msgpackc is designed to unpack untrusted data (messages from a network, a radio, a serial line) on small devices. Bad data must only ever raise an exception: a crash, a hang, a read or write outside a buffer, or memory use far beyond the size of the data is a bug, and a security issue if it can be triggered remotely.

Please report such issues privately, through GitHub's private vulnerability reporting of this repository, rather than in a public issue. Include the data that triggers the problem (hex is fine), the MicroPython version and the board.

You should get an answer within a week. Once fixed, the issue is disclosed in the release notes, with credit to you unless you prefer otherwise.

Fixes are made on the latest release.