Fix potential heap buffer overflow in EntryParser::Fetch methods (#25)

* Fix heap buffer overflow in EntryParser::Fetch methods

Add buffer bounds validation to indexed Fetch methods that compute
offsets from attacker-controlled EXIF data via GetSubIFD().

Previously, Fetch(uint16_t, idx), Fetch(double), and Fetch(double, idx)
would read from buf at offsets derived from parsed EXIF fields without
checking against the actual buffer length. A crafted JPEG with a
malicious SubjectArea length (tag 0x9214) could trigger a heap buffer
overflow via parse16() reads past the end of the buffer.

Fixes #24

* Fix include directive and simplify Fetch method

TinyEXIF.cpp

@@ -205,7 +205,10 @@ public:
 	bool Fetch(uint16_t& val, uint32_t idx) const {
 		if (!IsShort() || length <= idx)
 			return false;
-		val = parse16(buf + GetSubIFD() + idx*2, alignIntel);
+		const uint32_t offset = GetSubIFD() + idx*2;
+		if (offset + 2 > len)
+			return false;
+		val = parse16(buf + offset, alignIntel);
 		return true;
 	}
 	bool Fetch(uint32_t& val) const {
@@ -229,7 +232,10 @@ public:
 	bool Fetch(double& val, uint32_t idx) const {
 		if (!IsRational() || length <= idx)
 			return false;
-		val = parseRational(buf + GetSubIFD() + idx*8, alignIntel, IsSRational());
+		const uint32_t offset = GetSubIFD() + idx*8;
+		if (offset + 8 > len)
+			return false;
+		val = parseRational(buf + offset, alignIntel, IsSRational());
 		return true;
 	}