There's no length check in this function, so it's possible for the parcel_r_int32 to read garbage.