Refuse a PDU whose optional parameters do not end on command_length (#87)

* Regression tests for a truncated TLV tail refused rather than accepted

* Refuse a PDU whose optional parameters do not end on command_length

* Assert the bare TLV header refusal against jsmpp instead of recording it as a defect

* Note the truncated TLV tail defect as fixed in the java-client findings

* Derive the padding position, share the bare TLV fixture and trim the decision record

* Regression tests for a PDU whose trailing C-Octet String a peer left out

* An absent trailing C-Octet String consumes no octet, so a bodyless PDU still parses

* Bound the TLV loop by the buffer it was given rather than a second spelling of its length

* Answer the stability review's questions in the record and pin the array contract

test/types.test.ts

@@ -108,8 +108,9 @@ describe('cstring (C-Octet String)', () => {
 		assert.ok(types.cstring.read(encoded, encoded.length + 1).err instanceof Error);
 		assert.ok(types.cstring.read(encoded, -1).err instanceof Error);
 
-		// At the end exactly the field is absent, not corrupt: peers truncate a NULL-only body.
-		assert.deepEqual(types.cstring.read(encoded, encoded.length), { bytesRead: 1, value: '' });
+		// At the end exactly the field is absent, not corrupt, and consumes no octet: counting one
+		// puts every later offset past the declared end.
+		assert.deepEqual(types.cstring.read(encoded, encoded.length), { bytesRead: 0, value: '' });
 	});
 });
 
@@ -187,6 +188,12 @@ describe('dest_address_array', () => {
 			bytesRead: 13,
 			value: expected,
 		});
+
+		// A structure that ran out counts the octets that were there, never the terminator that was not.
+		assert.deepEqual(types.dest_address_array.read(Buffer.from([0x01, 0x01, 0x00, 0x00]), 0), {
+			bytesRead: 4,
+			value: [{ dest_addr_npi: 0, dest_addr_ton: 0, destination_addr: '' }],
+		});
 	});
 
 	test('sizes every dest_address structure', () => {