fix: add file size validation and clarify Method 2 intent

- decrypt_images.c: validate aes_ct_size + xor_size fits within file
  before reading, preventing out-of-bounds reads on corrupt files
- decrypt_images.c: remove unused bytes2hex function
- find_image_key.c: add comment explaining Method 2 design intent —
  hex ASCII bytes used directly as AES key (not hex-decoded)

decrypt_images.c

@@ -55,11 +55,6 @@ static int hex2bytes(const char *hex, unsigned char *out, int maxlen) {
     return len;
 }
 
-static void bytes2hex(const unsigned char *d, int n, char *out) {
-    for (int i = 0; i < n; i++) sprintf(out + i*2, "%02x", d[i]);
-    out[n*2] = '\0';
-}
-
 /* Minimal JSON string extractor (for simple unescaped string values only). */
 static int json_get_string(const char *json, const char *key,
                            char *value, int maxlen) {
@@ -248,12 +243,17 @@ static int decrypt_v2_file(const char *input_path, const char *output_dir,
         ? (size_t)aes_size + 16
         : ((size_t)aes_size + 15) / 16 * 16;
 
-    /* Get total file size to calculate raw_data segment */
+    /* Get total file size and validate header claims fit within it */
     long cur_pos = ftell(fin);
     fseek(fin, 0, SEEK_END);
     long file_size = ftell(fin);
     fseek(fin, cur_pos, SEEK_SET);
 
+    if ((long)aes_ct_size + (long)xor_size > file_size - HEADER_SIZE) {
+        fclose(fin);
+        return -6;  /* header claims more data than file contains */
+    }
+
     unsigned char *aes_ct = malloc(aes_ct_size);
     if (!aes_ct) { fclose(fin); return -1; }
     size_t rd = fread(aes_ct, 1, aes_ct_size, fin);