`Unpacker.unpack()` segfaults after an incomplete `skip()`

[marinelay]

Summary

When Unpacker.skip() raises OutOfData for incomplete input, the remaining data can be supplied using feed().
Calling unpack() afterward causes a segmentation fault instead of returning the completed value or raising an exception.

Versions

msgpack 1.2.2, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.

Reproducer

import msgpack

unpacker = msgpack.Unpacker()
unpacker.feed(b"\x91")

try:
    unpacker.skip()
except msgpack.OutOfData:
    pass

unpacker.feed(b"\x00")
unpacker.unpack()

Running it produces:

$ python reproducer.py
Segmentation fault (core dumped)

For comparison, calling skip() again after an incomplete skip(), or calling unpack() again after an incomplete unpack(), completes normally:

import msgpack

# Incomplete skip() followed by skip()
skip_again = msgpack.Unpacker()
skip_again.feed(b"\x91")

try:
    skip_again.skip()
except msgpack.OutOfData:
    pass

skip_again.feed(b"\x00")
assert skip_again.skip() is None

# Incomplete unpack() followed by unpack()
unpack_again = msgpack.Unpacker()
unpack_again.feed(b"\x91")

try:
    unpack_again.unpack()
except msgpack.OutOfData:
    pass

unpack_again.feed(b"\x00")
assert unpack_again.unpack() == [0]

The crash occurs specifically when the operation changes from an incomplete skip() to unpack().

I found this while fuzzing Python C extension modules.
It looks like a bug to me, so I would appreciate confirmation.