Service interrupt via signed length truncation

Integer overflow in Libevent before 2.1.13 and 2.2.2-alpha allows remote attackers to interrupt service via crafted tag lengths. In event_tagging.c, evtag_unmarshal_header() decodes an attacker-controlled uint32 payload length with evtag_decode_int() and returns it as int, so values above INT_MAX become negative or truncated before evtag_unmarshal_string() uses them in allocation sizing. Reachability requires an application to accept attacker-supplied evtag or evrpc messages; the published proof of concept shows oversized lengths triggering a wrapped allocation request and memory-exhaustion failure rather than code execution.