fix: handle negative node read size in ubifs walk

[urknall]

In ubi_reader ≤0.8.13 (master as of 2026-03), _index() computes

read_size = chdr.len - UBIFS_COMMON_HDR_SZ
node_buf  = ubifs.file.read(read_size)

without first checking that read_size >= 0. A zero-filled erase block (factory bad block, or any block whose first bytes are all 0x00) causes the common-node header to be read as all-zeros, so chdr.len == 0 and read_size == -24 (== -UBIFS_COMMON_HDR_SZ). Python's io.BufferedReader raises

ValueError: read length must be non-negative or -1

which propagates through walk.index() and is caught by extract_files as:

extract_files Error: read length must be non-negative or -1

This aborts the entire UBIFS extraction even though only one LEB is affected and the rest of the filesystem is intact.

Fix: add a bounds check for read_size < 0 immediately after the subtraction, matching the style of the adjacent len(buf) guard that already handles the case where the common header itself is short:

• With -w / --warn-only-block-read-errors the corrupted node is skipped with an 'Error'-level message and _index() returns.
• Without -w the existing 'Fatal' path is taken, preserving the pre-fix behaviour for strict mode.