acl: fix the integer overflow bug in API message length validation logic