plug-ins: Add bounds check for SFW plug-in

Resolves #16075
As noted by chamal, it is possible to cause a buffer overflow
in a crafted SFW file. This patch adds bounds checks to prevent
this from occurring.

plug-ins/common/file-seattle-filmworks.c

@@ -287,6 +287,16 @@ load_image (GFile        *file,
 
       while (index < file_size && data[index])
         {
+          if (index          >= (file_size - 0xE0) ||
+              metadata_index >= 2)
+            {
+              g_set_error (error, G_FILE_ERROR,
+                           g_file_error_from_errno (errno),
+                           _("Invalid file."));
+              fclose (fp);
+              return NULL;
+            }
+
           if (data[index] == 0x20)
             metadata_len[metadata_index++] = index;