Fix ArrayIndexOutOfBoundsException in Extended XMP processing (drewnoakes#712)

Add bounds validation before System.arraycopy in processExtendedXMPChunk()
to prevent crashes when processing malformed Extended XMP metadata.

The fix handles two edge cases:
- chunkOffset + copyLength exceeds buffer size
- chunkOffset is negative (from uint32 > Integer.MAX_VALUE cast to int)

Uses subtraction instead of addition to avoid integer overflow:
  if (chunkOffset < 0 || chunkOffset > buffer.length - copyLength)

Fixes drewnoakes#308

Author: alicanalbayrak

Source/com/drew/metadata/xmp/XmpReader.java

@@ -293,7 +293,17 @@ private static byte[] processExtendedXMPChunk(@NotNull Metadata metadata, @NotNu
                         extendedXMPBuffer = new byte[fullLength];
 
                     if (extendedXMPBuffer.length == fullLength) {
-                        System.arraycopy(segmentBytes, totalOffset, extendedXMPBuffer, chunkOffset, segmentLength - totalOffset);
+                        int copyLength = segmentLength - totalOffset;
+                        // Validate bounds before arraycopy to prevent ArrayIndexOutOfBoundsException.
+                        // Check for negative chunkOffset (from uint32 > Integer.MAX_VALUE) and use
+                        // subtraction instead of addition to avoid integer overflow.
+                        if (chunkOffset < 0 || chunkOffset > extendedXMPBuffer.length - copyLength) {
+                            XmpDirectory directory = new XmpDirectory();
+                            directory.addError(String.format("Extended XMP chunk would write beyond buffer bounds (offset=%d, length=%d, buffer size=%d)", chunkOffset, copyLength, extendedXMPBuffer.length));
+                            metadata.addDirectory(directory);
+                        } else {
+                            System.arraycopy(segmentBytes, totalOffset, extendedXMPBuffer, chunkOffset, copyLength);
+                        }
                     } else {
                         XmpDirectory directory = new XmpDirectory();
                         directory.addError(String.format("Inconsistent length for the Extended XMP buffer: %d instead of %d", fullLength, extendedXMPBuffer.length));