Code execution via unchecked Marshal buffer length

Buffer over-read in OCaml Marshal deserialization before 4.14.3 and in 5.0.0 through 5.4.0 allows local users to execute arbitrary code. The runtime/intern.c readblock() function passes an attacker-controlled length to memcpy() without first verifying that the requested bytes remain inside the Marshal input buffer. Exploitation requires an application to deserialize untrusted data through Marshal.from_channel, Marshal.from_bytes, Marshal.from_string, or input_value, and resulting code runs with that application's privileges.