Possible buffer overflow in CURVE mechanism handshake

[sigiesec]

E.g., the function zmq::curve_client_t::produce_initiate contains the following lines:

    //  Assume here that metadata is limited to 256 bytes
    uint8_t initiate_plaintext [crypto_box_ZEROBYTES + 128 + 256];

One part of the metadata is the socket identity, which alone may be 255 bytes, so this is definitely too small.

The other mechanisms suffer from similar risks, but use larger buffers (512 bytes). Still, they do not check for overruns.