Make *_unserialize safe to use on buffers in-place