• cd9660_rrip_slink() did not check that the lengths of individual entries do not exceed the length of the overall record.

• cd9660_rrip_altname() did not check that the length of the record was at least 5 before subtracting 5 from it.

Note that in both cases, a better solution would be to check the length
of the data before calling the handler, or immediately upon entry of
the handler, but this would require significant refactoring.

MFC after: 1 week
Reported by: Calif.io in collaboration with Claude and Anthropic Research
Reported by: Adam Crosser, Praetorian