The specification doesn't say how to handle negative values in lengths. I propose that it should be handeled as an error, but this needs to be specified, otherwise parsers will disagree on how to handle this case.
I checked a couple of C/C++ libraries, and they seem to silently cast the value to a size_t and allocating memory, resulting in either crashes or errors. The missing specification seems to have resulted in unsafe implementations.