A crafted RIFF smpl chunk could put the stream read offset past the end
of the file. CalculateStreamInfo() and AddStreamData() then subtracted it
from the file size in unsigned arithmetic, the remaining size wrapped, and
the guest's data was copied to a guest-chosen distance past dataBuf_.
Check the offset before subtracting, and route every copy into dataBuf_
through a helper that clamps it to the file. SeekToSample() no longer
prefills from past the end, and dataBuf_'s slack covers a whole frame.
This is the old Atrac implementation, which is only used when chosen in
the config or when loading old savestates.
Discovered and reported by redthing1 (https://github.com/redthing1) of
V12 Security.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
