AIKIDO-2026-677824

TL;DR

Several decoder paths let exceptions escape that fall outside the library's documented InvalidArgumentException contract. Eight-byte length, count, and tag headers that exceed the PHP integer range reach BigInteger::toInt() and surface a Brick\Math overflow exception, while empty bignum payloads reach BigInteger::fromBase() because the guarding assert() is compiled out under the production default. Callers that guard decoding against the documented exception type therefore see unexpected exceptions and can crash on untrusted input. The fix translates these overflow and invalid-input failures into InvalidArgumentException.