Variant parsing is vulnerable to memory-DoS and malformed-input crashes

> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.
>
> Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.

# Summary

Malformed variant buffers can force large allocations and raw JVM
exceptions before structural validation, turning small
attacker-controlled payloads into a read-time denial of service path.

# Affected Maven coordinates

* primary shipped client artifact: `org.apache.iceberg:iceberg-api`

# Attacker prerequisites

* Any consumer that parses variant values from untrusted or
semi-trusted Iceberg content is exposed.
* The easiest attack is a tiny payload that advertises a very large
element count or dictionary size.

# Impact

* A malicious variant payload can force large allocations before the
payload is structurally validated.
* The same code path can also fail with raw JVM exceptions such as
`NegativeArraySizeException`, `ArrayIndexOutOfBoundsException`, and
`IndexOutOfBoundsException` instead of a typed validation failure.
* In a service that reads attacker-controlled tables or records, this
is a straightforward availability issue.

# Proof status

Source review only. The issue is visible directly from source.

# Key source references

* org.apache.iceberg.variants.Variant
* org.apache.iceberg.variants.VariantValue
* org.apache.iceberg.variants.SerializedMetadata
* org.apache.iceberg.variants.SerializedArray
* org.apache.iceberg.variants.SerializedObject

Start by reviewing org.apache.iceberg.variants.Variant and VariantValue, then trace their use of SerializedMetadata, SerializedArray, and SerializedObject during parsing. Verify the reported allocation and malformed-input paths with focused tests; done means attacker-controlled malformed buffers are structurally validated without large premature allocations or the listed raw JVM exceptions.

Written by the indexing model from the issue text.