msgpack5: Reserved byte can cause unbounded stream buffering

Impact

The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.

Patches

The decoder now rejects 0xc1 as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.

Workarounds

Reject 0xc1 before streaming input to msgpack5, and enforce stream byte and time limits.