Binary-patch size validation can be bypassed because it checks the encoded input rather than the inflated result, potentially causing an out-of-bounds read and crash.