fix: address third-round review findings

- OtlpReceiver: enforce body size limit during read (handles chunked
  transfer where ContentLength64 is -1); pass CancellationToken to
  stream reads; fix class doc to clarify /v1/traces is forwarded only
- ProtobufReader: add varint overflow guard (shift >= 64); add bounds
  checks for Fixed64/Fixed32 in Skip; reuse ReadLengthDelimited in
  Skip for LengthDelimited case; remove dead ReadBytes method
- OtlpLogParser: remove unused System.Buffers.Binary import
- TUnitBaggagePropagationHandler: guard against duplicate baggage header
  when OTel SDK's BaggagePropagator has already injected one

TUnit.Aspire/Http/TUnitBaggagePropagationHandler.cs

@@ -32,31 +32,36 @@ protected override Task<HttpResponseMessage> SendAsync(
                     }
                 });
 
-            // Inject baggage header (not handled by the default propagator)
-            var first = true;
-            var sb = new System.Text.StringBuilder();
-
-            foreach (var (key, value) in activity.Baggage)
+            // Inject baggage header if the propagator hasn't already done so.
+            // When OTel SDK is configured with BaggagePropagator, the Inject call
+            // above may have already added a baggage header — avoid duplicates.
+            if (!request.Headers.Contains("baggage"))
             {
-                if (key is null)
+                var first = true;
+                var sb = new System.Text.StringBuilder();
+
+                foreach (var (key, value) in activity.Baggage)
                 {
-                    continue;
+                    if (key is null)
+                    {
+                        continue;
+                    }
+
+                    if (!first)
+                    {
+                        sb.Append(',');
+                    }
+
+                    sb.Append(Uri.EscapeDataString(key));
+                    sb.Append('=');
+                    sb.Append(Uri.EscapeDataString(value ?? string.Empty));
+                    first = false;
                 }
 
                 if (!first)
                 {
-                    sb.Append(',');
+                    request.Headers.TryAddWithoutValidation("baggage", sb.ToString());
                 }
-
-                sb.Append(Uri.EscapeDataString(key));
-                sb.Append('=');
-                sb.Append(Uri.EscapeDataString(value ?? string.Empty));
-                first = false;
-            }
-
-            if (!first)
-            {
-                request.Headers.TryAddWithoutValidation("baggage", sb.ToString());
             }
         }
 

TUnit.Aspire/Telemetry/OtlpLogParser.cs

@@ -1,4 +1,3 @@
-using System.Buffers.Binary;
 using System.Text;
 
 namespace TUnit.Aspire.Telemetry;
@@ -270,6 +269,11 @@ public ulong ReadVarint()
 
         while (!_data.IsEmpty)
         {
+            if (shift >= 64)
+            {
+                throw new InvalidOperationException("Malformed varint: exceeds 64 bits.");
+            }
+
             var b = _data[0];
             _data = _data[1..];
             result |= (ulong)(b & 0x7F) << shift;
@@ -290,11 +294,6 @@ public ReadOnlySpan<byte> ReadBytesAsSpan()
         return ReadLengthDelimited();
     }
 
-    public byte[] ReadBytes()
-    {
-        return ReadLengthDelimited().ToArray();
-    }
-
     public string ReadString()
     {
         return Encoding.UTF8.GetString(ReadLengthDelimited());
@@ -328,13 +327,24 @@ public void Skip(WireType wireType)
                 ReadVarint();
                 break;
             case WireType.Fixed64:
+                if (_data.Length < 8)
+                {
+                    throw new InvalidOperationException(
+                        $"Truncated fixed64 field: need 8 bytes but only {_data.Length} remain.");
+                }
+
                 _data = _data[8..];
                 break;
             case WireType.LengthDelimited:
-                var length = (int)ReadVarint();
-                _data = _data[length..];
+                ReadLengthDelimited();
                 break;
             case WireType.Fixed32:
+                if (_data.Length < 4)
+                {
+                    throw new InvalidOperationException(
+                        $"Truncated fixed32 field: need 4 bytes but only {_data.Length} remain.");
+                }
+
                 _data = _data[4..];
                 break;
             default:

TUnit.Aspire/Telemetry/OtlpReceiver.cs

@@ -13,9 +13,10 @@ namespace TUnit.Aspire.Telemetry;
 /// <remarks>
 /// <para>
 /// The receiver listens on a dynamic localhost port and accepts OTLP/HTTP protobuf
-/// exports at <c>/v1/logs</c> and <c>/v1/traces</c>. It extracts TraceId from
-/// incoming log records and looks up the corresponding test in
-/// <see cref="TraceRegistry"/> to route logs to the correct test output.
+/// exports at <c>/v1/logs</c> (parsed for correlation) and <c>/v1/traces</c>
+/// (accepted but only forwarded, not parsed). It extracts TraceId from incoming
+/// log records and looks up the corresponding test in <see cref="TraceRegistry"/>
+/// to route logs to the correct test output.
 /// </para>
 /// <para>
 /// Optionally forwards received telemetry to an upstream OTLP endpoint (e.g., the
@@ -124,11 +125,26 @@ private async Task ProcessRequestAsync(HttpListenerContext context)
                 return;
             }
 
-            // Read the request body
+            // Read the request body with size enforcement (ContentLength64 is -1 for chunked)
             byte[] body;
             using (var ms = new MemoryStream())
             {
-                await request.InputStream.CopyToAsync(ms).ConfigureAwait(false);
+                var buffer = new byte[8192];
+                long totalRead = 0;
+                int bytesRead;
+                while ((bytesRead = await request.InputStream.ReadAsync(buffer, _cts.Token).ConfigureAwait(false)) > 0)
+                {
+                    totalRead += bytesRead;
+                    if (totalRead > MaxBodyBytes)
+                    {
+                        response.StatusCode = 413;
+                        response.Close();
+                        return;
+                    }
+
+                    ms.Write(buffer, 0, bytesRead);
+                }
+
                 body = ms.ToArray();
             }