[Bug]: integer overflow in JumpTable.SubStr

[nan01ab]

Describe the bug
In JumpTable.SubStr, if count is set to a large int(for example, Int32.MaxValue), index + count may less than 0, and index + count > x.Length will be false, so new Buffer may allocate a large buffer(max is 2GiB)

        public virtual void SubStr(ExecutionEngine engine, Instruction instruction)
        {
            int count = (int)engine.Pop().GetInteger();
            if (count < 0)
                throw new InvalidOperationException($"The value {count} is out of range.");
            int index = (int)engine.Pop().GetInteger();
            if (index < 0)
                throw new InvalidOperationException($"The value {index} is out of range.");
            var x = engine.Pop().GetSpan();
            if (index + count > x.Length)
                throw new InvalidOperationException($"The value {count} is out of range.");
            Types.Buffer result = new(count, false);
            x.Slice(index, count).CopyTo(result.InnerBuffer.Span);
            engine.Push(result);
        }

To Reproduce
like this:

PUSHDATA1 0x00010203040506070809
PUSH2
PUSHINT32
0x7FFFFFFF
SUBSTR