Vulnerability

Two additional sites in sdk/src/jumbf/boxes.rs compute size - HEADER_SIZE (or similar) on attacker-controlled size values without first validating the minimum size. Both follow the same underflow pattern addressed in #2200 but were not in the original report.

Sites

• read_uuid_box — size - HEADER_SIZE - 16 (UUID box's payload subtraction)
• read_desc_box SaltHash private-box branch — header.size - HEADER_SIZE

Fix

Same checked_sub(...).ok_or(InvalidBoxHeader)? pattern as #2200

• read_uuid_box: size.checked_sub(HEADER_SIZE + 16).ok_or(...)?
• read_desc_box SaltHash branch: header.size.checked_sub(HEADER_SIZE).ok_or(...)?

Tests

Added 2 regression tests covering both sites.

Checklist

• This PR represents a single feature, fix, or change.
• All applicable changes have been documented.
• Any TO DO items have been entered as GitHub issues and the link has been included in a comment.