go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

The Go project reports:

Certain invalid inputs to ReadUvarint or ReadVarint could cause
those functions to read an unlimited number of bytes from the
ByteReader argument before returning an error. This could lead to
processing more input than expected when the caller is reading
directly from the network and depends on ReadUvarint and ReadVarint
only consuming a small, bounded number of bytes, even from invalid
inputs.