buffer overflow in QuickTimeVideo::userDataDecoder

[kevinbackhouse]

Reported by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52053

There is an out-of-bounds write here:

exiv2/src/quicktimevideo.cpp

Line 832 in a2cb06a

io_->readOrThrow(buf.data(), size - 8);

The problem is that buf might be smaller than size - 8.

quicktimevideo.cpp is a new file, so this bug doesn't affect any released versions of exiv2.

poc: https://user-images.githubusercontent.com/4358136/194719660-df2e62c2-1c91-4c12-a330-6988785a1a72.mp4

To reproduce:

exiv2 poc.mp4

(Causes exiv2 to crash.)