…25243)

Changes applied (3 files):

1. src/zipmap.c: Add sanity checks in zipmapValidateIntegrity() to reject
   entries where the decoded length < ZIPMAP_BIGLEN (254) but the encoding
   uses more than 1 byte. This prevents a pointer arithmetic mismatch
   between validation and zipmapNext() that leads to heap buffer over-reads.

2. src/rdb.c (hash zipmap conversion): Reorder the hashtableAdd()/lpSafeToAdd()
   checks so lpSafeToAdd() is evaluated before hashtableAdd() takes ownership
   of the field SDS. Add missing lpFree(lp) in the error path to fix a memory
   leak when the conversion fails.

3. src/rdb.c (stream consumer PEL): Remove erroneous streamFreeNACK(nack)
   in the "Duplicated consumer PEL entry" error path. The nack is a shared
   reference from the global PEL (obtained via raxFind), so freeing it here
   causes a double-free when the stream object is later destroyed.

Test: added a regression test in tests/unit/dump.tcl that crafts a
RESTORE payload with a 2-entry zipmap where the first field uses an
overlong 5-byte length encoding for value 3. Post-patch, this is
cleanly rejected by zipmapValidateIntegrity(). Pre-patch, the misaligned
zipmapNext() reads garbage (confirmed via server log: "Hash zipmap with
dup elements, or big length (0)") which also produces an error, so the
test serves as a defense-in-depth regression anchor rather than a strict
pass/fail differentiator. The actual heap over-read is detectable with
AddressSanitizer builds.

Signed-off-by: ikolomi <ikolomin@amazon.com>