MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

Summary When MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small paylo...