avformat/hxvs: Do not allow backward steps in hxvs_probe()

Fixes: infinite loop
Fixes: 487632033/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-4565877872984064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/hxvs.c

@@ -118,6 +118,10 @@ static int hxvs_probe(const AVProbeData *p)
         i += 4;
         if (tag == HXVF || tag == HXAF) {
             bytes = AV_RL32(&p->buf[i]);
+
+            if (12 + bytes > INT_MAX - i)
+                return 0;
+
             i += 12 + bytes;
             flag |= (tag == HXVF) ? 2 : 4;
             continue;