Use readOrThrow() to detect premature EOF

[kevinbackhouse]

Fixes an out-of-bounds read found by OSS-Fuzz. The bug looks pretty harmless to me, but I'll request a CVE and I think we should backport the fix to 0.28.x.

[kevinbackhouse]

https://github.com/Mergifyio backport 0.28.x

[mergify]

backport 0.28.x

✅ Backports have been created

• #3006 Use readOrThrow() to detect premature EOF (backport #3005) has been created for branch 0.28.x

[kevinbackhouse]

I've opened a draft advisory to request a CVE: https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh

[kevinbackhouse]

This is the poc file: issue-3005.asf.gz
It only causes a crash with specific sanitizer options enabled. My ASAN build wasn't able to detect the problem, but I verified the out-of-bounds read reported by OSS-Fuzz by manually stepping through the code in gdb.