[rajath201]

as<std::array<T, N>> (include/msgpack/v1/adaptor/cpp11/array.hpp) only rejects wire arrays longer than N. as_impl always reads N elements, so a well-formed array with fewer than N, the empty array included, walks o.via.array.ptr[0..N-1] past the end of the real array, or dereferences a null pointer when the array is empty. Decoding an untrusted msgpack array through object::as<std::array<T, N>>() with an element type that has an as adaptor reads out of bounds (ASan SEGV, UBSan non-zero offset to null pointer).

Reject any array whose size is not exactly N, the same guard the tuple and fusion readers already carry. The check stays in as rather than the recursive as_impl so the bound is stated once at the entry point, and the convert path is left alone since it only iterates array.size. A5 in security_fixes_cpp11.cpp sits next to the existing short-array cases; it faults on the current tree and passes with the fix.

[redboltz]

@rajath201, thank you for sending the PR. It looks good to me. appveyor looks still processing but I've comfirmed it successfully finished from the appveyor site.