Code execution via unchecked RIFF palette size multiplication

Integer overflow in GStreamer gst-plugins-base before 1.28.1 allows context-dependent attackers to execute code via crafted AVI palette data. In gst_riff_create_video_caps, num_colors was multiplied by four without checked arithmetic before the result was compared with the palette buffer size, allowing the size calculation to wrap and subsequent heap reads and writes to exceed the buffer. A consuming application must process the malicious file; successful exploitation runs code in that application's process, while the upstream project confirms crashes and out-of-bounds heap access.