Heap overflow via unchecked reservation sizing

Heap buffer overflow in MessagePack msgpack-c 7.0.1 and earlier allows attackers to corrupt memory via oversized reserve requests. The msgpack_unpacker_expand_buffer function adds the requested size to the used count without an overflow check, so wraparound can satisfy the growth-loop condition early, reallocate a too-small buffer, and return success through msgpack_unpacker_reserve_buffer. Reachability depends on an integration that passes an attacker-influenced length into that public reservation API and then writes the requested length, matching the shipped reserve-then-write example whose capacity assert is removed under NDEBUG.