cater for array size marked with -1

Signed-off-by: Ceki Gulcu <ceki@qos.ch>

Author: ceki

logback-classic/src/main/java/ch/qos/logback/classic/spi/LoggingEventVO.java

@@ -208,7 +208,7 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE
         int argArrayLen = in.readInt();
 
         // Prevent DOS attacks via large or negative arrays
-        if (argArrayLen < 0 || argArrayLen > ARGUMENT_ARRAY_DESERIALIZATION_LIMIT) {
+        if (argArrayLen < NULL_ARGUMENT_ARRAY || argArrayLen > ARGUMENT_ARRAY_DESERIALIZATION_LIMIT) {
             throw new InvalidObjectException("Argument array length is invalid: " + argArrayLen);
         }