mp3: fix buffer overflow when max_frames is too large

The function decodeFirstFrame() allocates memory based on data from
the mp3 header.  This can make the buffer size allocation overflow, or
lead to a DoS attack with a very large buffer.  Cap this buffer at 8
million frames, which should really be enough for reasonable files.

src/inputPlugins/mp3_plugin.c

@@ -776,6 +776,11 @@ static int decodeFirstFrame(mp3DecodeData * data,
 
 	if (!data->maxFrames) return -1;
 
+	if (data->maxFrames > 8 * 1024 * 1024) {
+		ERROR("mp3 file header indicates too many frames: %lu", data->maxFrames);
+		return -1;
+	}
+
 	data->frameOffset = xmalloc(sizeof(long) * data->maxFrames);
 	data->times = xmalloc(sizeof(mad_timer_t) * data->maxFrames);