MessageUnpacker#unpackValue can cause NegativeArraySizeException for large maps #1042

Version

org.msgpack:msgpack-core:0.9.12

Description

Related to #657

The MessageUnpacker methods unpackValue() and unpackValue(Variable) can throw NegativeArraySizeException for large maps because they try to create an array with length size * 2, but that expression can overflow causing the length to become negative.

Expected behavior:

• Either performing the allocation gradually, and therefore not immediately causing a numeric overflow (see also Consuming a large amount of memory when unpacking huge Array and Map unexpectedly #657)
  (most likely the message is malformed / maliciously crafted and gradual construction fails because the map ends prematurely)
• Or a MessagePackException to be thrown