controlled buffer under-read in pack_unpack_internal()

Brief ----- There is a signedness error in the pack_unpack_internal(), allowing the '@' type to trigger a buffer under-read when unpacking with a controlled format (similar to format string implementation vulnerabilities).

        long len;