Application crash via overflowing Node page allocation

Integer overflow in the MPack 1.1.1 Node API allows attackers to corrupt heap memory and crash 32-bit applications via crafted MessagePack data. The mpack_tree_parse_children() function multiplies an array32 or map32 element count into a size_t page-allocation size without preventing wraparound, then writes node records beyond the undersized heap allocation. Exploitation requires a 32-bit size_t build and an application that passes untrusted array32 or map32 input to the Node parser; the bounded demonstrated consequence is application denial of service.