Buffer under-read in String#unpack

String#unpack receives format specifiers as its parameter, and can be
specified the position of parsing the data by the specifier @. If a big
number is passed with @, the number is treated as the negative value, and
out-of-buffer read is occurred. So, if a script accepts an external input as
the argument of String#unpack, the attacker can read data on heaps.

All users running an affected release should upgrade immediately.