[C++] Reading a MapArray from invalid IPC stream/file can read memory out of bounds #54936

Describe the bug, including details regarding any error messages, version, and platform.

When loading a MapArray from IPC, we call MapArray::ValidateChildData to avoid a later crash in MapArray::SetData.

Unfortunately MapArray::ValidateChildData calls GetNullCount() which is unsafe if the advertised length is too large for the actual validity buffer size.

Found by OSS-Fuzz in https://issues.oss-fuzz.com/issues/556994537

Component(s)

C++