@fweimer I disagree, it doesn't make any sense to check lengths between wire data and in memory ones. The check above is too restrictive as sizeof(LICENSE_BLOB) is bigger than 4, and in theory we could have a serie of 0 length blobs and in that case each blob would be 4 bytes in the stream.
The best fix would probably be to put a limit of the acceptable number of blobs as obviously it will never be 2^32.