demux: wav: stay within riff chunk boundaries (fix #10323)