Core/Housing: fix unsupported BoundedSize packet reads

src/server/game/Server/Packets/HousingRoomPackets.cpp

@@ -13,6 +13,13 @@
 
 namespace WorldPackets::Housing
 {
+    namespace
+    {
+        // Allocation-safety cap only; this is not used as a retail protocol semantic limit.
+        // Oversized client counts are rejected before vector allocation/iteration.
+        constexpr uint32 MaxRoomComponentOptionIds = 1024;
+    }
+
     void HousingRoomSetLayoutEditMode::Read()
     {
         _worldPacket >> Bits<1>(Active);
@@ -58,7 +65,12 @@ namespace WorldPackets::Housing
     void HousingRoomSetComponentTheme::Read()
     {
         _worldPacket >> RoomGuid;
-        _worldPacket >> BoundedSize<uint32>(OptionIDs);
+
+        uint32 const optionCount = _worldPacket.read<uint32>();
+        if (optionCount > MaxRoomComponentOptionIds)
+            WorldPackets::OnInvalidArraySize(optionCount, MaxRoomComponentOptionIds);
+
+        OptionIDs.resize(optionCount);
         _worldPacket >> HouseThemeID;
         for (uint32& optionID : OptionIDs)
             _worldPacket >> optionID;
@@ -73,7 +85,12 @@ namespace WorldPackets::Housing
         // component slot byte + option IDs. Keeping the slot before the array is
         // critical; treating it as a trailing bit shifts the first option by one byte.
         _worldPacket >> RoomGuid;
-        _worldPacket >> BoundedSize<uint32>(OptionIDs);
+
+        uint32 const optionCount = _worldPacket.read<uint32>();
+        if (optionCount > MaxRoomComponentOptionIds)
+            WorldPackets::OnInvalidArraySize(optionCount, MaxRoomComponentOptionIds);
+
+        OptionIDs.resize(optionCount);
         _worldPacket >> ColorOverride;
         _worldPacket >> RoomComponentTextureID;
         _worldPacket >> ComponentSlot;