[Security] Candid deserialization vulnerabilities

[crusso]

Tracking JIRA issue(s):

https://dfinity.atlassian.net/browse/FOLLOW-303

• [x] uint overflow
• [ ] recursion limit
• [x] binread allocation
• [ ] space bomb (vec null)
• [ ] skip vec null faster
• [ ] branching on uninitialized value?

[chenyan-dfinity]

Yeah, nothing surprising here. The remaining ones are:

• Reading deeply nested value can cause stack overflow
• A binary parser we use (binread) doesn't do defensive read, so it can allocate large memory
• Space bomb for vec null. Maybe setting a size limit just for vec null/reserved?