fix BigValueRoute sscanf over-read on non-NUL-terminated reply

Summary: Root cause: BigValueRoute::ChunksInfo(folly::StringPiece replyValue) parsed the chunks-info header by calling sscanf(replyValue.data(), “%u-%u-%lu%n”, …). The StringPiece is a (ptr, len) view over a coalesced IOBuf reply payload and is NOT NUL-terminated. glibc sscanf computes the input C-string length up front by scanning for a NUL with rawmemchr (via _IO_str_init_static_internal called with size=-1), BEFORE any parsing happens. When the byte after the payload is not a NUL, that scan reads past the buffer; if the payload abuts an unmapped page the read SIGSEGVs. The existing charsRead == replyValue.size() guard cannot prevent it because it runs only after the faulting sscanf call returns.

Evidence: confirmed in two production CachiusServer coredumps on mcrpxy-web* threads. In the non-marker core the rawmemchr fault register was rdi=0x7f8744dfffe0, exactly 0x20 below the page boundary 0x7f8744e00000, with rsi=0 (scanning for NUL) - i.e. a length-scan running off the end of a mapped page. Both cores had a valid v1 ChunksInfo input (“1-2-7419256”, “1-2-3745222203”) followed by adjacent garbage, so the crash requires no malformed or attacker-controlled data. This accounts for 480 SIGSEGV/week (19% of CachiusServer crashes); it is steady and version-independent. (It is distinct from the larger CachiusCPUPool SIGABRT population, which is unrelated to mcrouter.)

Fix: parse strictly within the StringPiece bounds. Extracted a bounded detail::parseChunksInfo() helper using folly::split(‘-‘, …) (exact 3 fields) + folly::tryTo<uint32_t/uint32_t/uint64_t>, which never reads past replyValue. Semantics are preserved (and slightly stricter on malformed input: leading ‘+’, overflow, and negative fields are now rejected - none reachable from the toStringType() producer, which emits pure “{}-{}-{}” digits). numChunks_/suffix_ are now zero-initialized.

Bumps ClientVersion 182 -> 183.

Reviewed By: disylh

Differential Revision: D107896217

fbshipit-source-id: 77e80ddc660d66e46b0f0bbc66ec2028aec261cc