Sanitise jpgc box size before memory allocation

[lovell]

I think the work for #922 may have removed some existing security checks around memory allocation.

EDIT: The jpgC logic was introduced in commit 3e82d51 (and #922 moved it).

This PR adds sanity checking for jpgC box sizes and a 32 byte test file discovered via fuzz testing that will attempt to allocate ~9 exabytes and therefore segfault when parsed using v1.17.x. I've not checked other box types, but it's possible this sanity check may need to be applied in a more general manner to other parse functions.

[lovell]

It looks like this was fixed via commit 8ff8227

[farindk]

It looks like this was fixed via commit 8ff8227

Yes. Sorry for the double work. I also saw this is a fuzzer output.

[farindk]

it's possible this sanity check may need to be applied in a more general manner to other parse functions.

Right, this all started because of the changed handling of boxes with zero size field (undefined size). That should probably be handled in a more general way. I've opened #1021 for this.