Better handling of truncated data when reading strings

Summary:
Currently we read string size and blindly pre-allocate it. This allows malicious attacker to send a few bytes message and cause server to allocate huge amount of memory (>1GB).

This diff changes the logic to check if we have enough data in the buffer before allocating the string.

This is a second part of a fix for CVE-2019-3553.

Reviewed By: vitaut

Differential Revision: D14393393

fbshipit-source-id: e2046d2f5b087d3abc9a9d2c6c107cf088673057