bug2: an interger overflow of swfmill swf2xml

[ghost]

poc:
https://drive.google.com/open?id=1o3DyrB2cT_yHOMqYWOUXxHKqgHKQ3Oad
asan:
https://drive.google.com/open?id=1FfVhfhB_lJc6bAYOWyoOkjz-Udmn0l9J

r->position() + len caused a interger overflow at line 6857 of file gSWFParser.cpp

if( r->getPosition() != file_offset + len ) {
     fprintf( stderr, "WARNING: end of tag %s is @%i, should be @%i\n",
             "DefineSprite",
             r->getPosition(),
             file_offset+len );
     r->seekTo( file_offset + len );
 }

it will make cur pos to a negative number
then in the function getword, the pos will be a really big number, then it will cause an oob access.

uint16_t Reader::getWord() {
     if (pos+2 > length) {
         err = Reader::eof;
         pos = length+1;
         return 0;
     }
     printf("%d\n", pos);
     int r = data[pos++];
     r += data[pos++]<<8;
     return r;
 }