Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...