If the last bytes in ziplist are corrupt and we decode from tail to head, we may reach slightly outside the ziplist. (cherry picked from commit a3a014294f)
a3a014294f