Fix incorrect boundary check in CVE-2020-0499 patch for FLAC bitreader

[Copilot]

PR #179 attempts to fix CVE-2020-0499 in FLAC's bitreader but uses br->capacity (allocated buffer size) instead of br->words (actual valid data). This still allows reading uninitialized memory between valid data and buffer end.

Changes

• cores/genesis/core/cd_hw/libchdr/deps/libFLAC/bitreader.c: Change boundary check from capacity to words
• cores/pce/deps/flac-1.3.2/src/libFLAC/bitreader.c: Change boundary check from capacity to words

// PR #179 (incorrect - checks allocated size)
b = cwords < br->capacity ? br->buffer[cwords] << br->consumed_bits : 0;

// This PR (correct - checks actual data)
b = cwords < words ? br->buffer[cwords] << br->consumed_bits : 0;

The words variable is set to br->words two lines above and represents completed words in buffer. This matches the boundary check pattern used elsewhere in the same function (line 866) and the original xiph/flac security fix.

Original prompt

#179

This PR doesn't introduce any bugs right?

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.