bplist: Prevent crash in plist_from_bin() when parsing unusually structured binary plist