Fix SEGV on stack depth underflow in recursive extension unpacking

[Watson1978]

A recursive extension proc that rescues an inner read error, or that calls Unpacker#skip, can leave stack.depth at 0 before read_raw_body_begin pops the barrier it pushed. The unconditional pop then underflowed the depth to SIZE_MAX and read/wrote out-of-bounds stack entries, crashing the VM (SIGSEGV). This restores the depth to just below the pushed barrier instead of decrementing unconditionally.

Reproduction

require "msgpack"

klass = Class.new
factory = MessagePack::Factory.new
factory.register_type(0x01, klass,
  packer: ->(_obj, packer) { packer.write(nil) },
  # A recursive proc that skips its extension body.
  unpacker: ->(u) { u.skip },
  recursive: true)

# fixext1 (type = 0x01), then fixarray(1) and an integer as the body.
factory.unpack("\xd4\x01\x91\x2a".b)
puts "no crash"

Before this change the script crashes with a SIGSEGV; after it, it prints no crash.

🤖 Generated with Claude Code