[LOW] Reject definite maps whose item count overflows

[OskarEichler]

Summary

A definite map length greater than SIZE_MAX / 2 overflows the decoder's internal key/value item count. On 64-bit builds, a header declaring 2^63+1 pairs wraps to an item count of two, so cbor 0.5.10.3 accepts a one-pair map that is incomplete according to its own header.

This saturates the internal count on overflow, allowing the existing incomplete-input path to reject the payload. The change closes a malformed-input validation gap that can create parser differentials when another component enforces the declared CBOR structure.

Reproduction

require "cbor"

data = "\xbb\x80\x00\x00\x00\x00\x00\x00\x01\x01\x02".b
unpacker = CBOR::Unpacker.new
unpacker.feed(data)
p unpacker.read

0.5.10.3 returns {1 => 2} despite the header declaring 9,223,372,036,854,775,809 pairs. This branch raises EOFError because the declared map is incomplete.

Verification

• Focused oversized-map model confirms release acceptance and candidate rejection.
• Existing suite: 170 examples, 0 failures.
• Native extension compiles on Ruby 4.0.6.

No tests were changed because this repository asks contributors not to add or modify tests.

Scope and limitations

The malformed payload does not allocate or iterate 2^63 entries. The concrete issue is incorrect structural acceptance and the resulting parser differential; no standalone authorization bypass was demonstrated.

The overflow requires a 64-bit explicit map length on the reviewed 64-bit build.

Breaking changes

Malformed CBOR maps whose declared lengths overflow the internal key/value item count are rejected instead of being accepted after a wrapped number of pairs. Valid CBOR behavior is unchanged.