GeezerVison

Fixes gh-158648.

Python/marshal.c reads stacksize from untrusted marshal data with only a >= 0 check. When the code object is constructed, co_framesize = nlocalsplus + stacksize + FRAME_SPECIALS_SIZE is computed as a C int; a stacksize near INT_MAX overflows this, producing a negative co_framesize. That value defeats the stack-space check in _PyThreadState_HasStackSpace _PyThreadState_PushFrame and can move the interpreter's data-stack pointer backwards, corrupting memory rather than failing cleanly.

This adds a bounds check to _PyCode_Validate() — the single validation path shared by marshal, types.CodeType(), and code.replace() — that rejects a stacksize large enough to overflow co_framesize, raising OverflowError instead.

Verified against the PoC in the issue (now raises OverflowError instead of corrupting frame state), plus full test_marshal, test_code, test_sys_settrace, and test_frame runs (all passing).