ape: check the tag size (fixes integer underflow)

The expression "tagLen - size > 0" may result in an integer underflow
and a buffer overflow, when "size" is larger than "tagLen".  "size" is
read from the input file, and must not be trusted.  This patch changes
the expression to "tagLen > size", which is a lot safer.

src/tag_ape.c

@@ -112,7 +112,7 @@ tag_ape_load(const char *file)
 
 		/* get the key */
 		key = p;
-		while (tagLen - size > 0 && *p != '\0') {
+		while (tagLen > size && *p != '\0') {
 			p++;
 			tagLen--;
 		}