Fix Wuffs metadata loading

Apparently the algorithm needs to be able to look behind.

fiv-io.c

@@ -326,13 +326,24 @@ static GBytes *
 pull_metadata(wuffs_base__image_decoder *dec, wuffs_base__io_buffer *src,
 	wuffs_base__more_information *minfo, GError **error)
 {
-	uint8_t buf[8192] = {};
 	GByteArray *array = g_byte_array_new();
 	while (true) {
+		if (array->len > G_MAXUINT - 8192) {
+			set_error(error, "metadata is too large");
+			goto fail;
+		}
+
+		guint offset = array->len;
+		g_byte_array_set_size(array, offset + 8192);
+		wuffs_base__io_buffer dst =
+			wuffs_base__ptr_u8__writer(array->data, array->len);
+		dst.meta.wi = offset;
+
 		*minfo = wuffs_base__empty_more_information();
-		wuffs_base__io_buffer dst = wuffs_base__ptr_u8__writer(buf, sizeof buf);
 		wuffs_base__status status =
 			wuffs_base__image_decoder__tell_me_more(dec, &dst, minfo, src);
+		g_byte_array_set_size(array, dst.meta.wi);
+
 		switch (minfo->flavor) {
 		case 0:
 			// Most likely as a result of an error, we'll handle that below.
@@ -350,10 +361,16 @@ pull_metadata(wuffs_base__image_decoder *dec, wuffs_base__io_buffer *src,
 			// and it can say "even more information". See decode_gif.wuffs.
 			if (!pull_passthrough(minfo, src, &dst, error))
 				goto fail;
+
+			size_t length = wuffs_base__io_buffer__reader_length(&dst);
+			if (length > G_MAXUINT - array->len) {
+				set_error(error, "metadata is too large");
+				goto fail;
+			}
+			g_byte_array_append(array,
+				wuffs_base__io_buffer__reader_pointer(&dst), (guint) length);
 		}
 
-		g_byte_array_append(array, wuffs_base__io_buffer__reader_pointer(&dst),
-			wuffs_base__io_buffer__reader_length(&dst));
 		if (wuffs_base__status__is_ok(&status))
 			return g_byte_array_free_to_bytes(array);