Heap overflow via null-terminator size wraparound

Integer overflow in MPack 1.1.1 allows context-dependent attackers to corrupt heap memory via a maximum-length MessagePack string. In mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc(), the 32-bit node length is incremented before conversion to size_t, so UINT32_MAX wraps to zero and produces an undersized allocation before the full string is copied and terminated. Exploitation requires a 64-bit build, a parsed untrusted string declaring the maximum 32-bit length, and a caller-supplied limit that permits it; the resulting out-of-bounds writes can crash the consuming process or corrupt its heap.