Heap out-of-bounds read via accessor wraparound

Integer overflow in cgltf through 1.15 allows remote attackers to read memory or crash applications via crafted .gltf or .glb files. In the non-sparse accessor path of cgltf_validate(), the req_size calculation adds accessor->offset to accessor->stride * (accessor->count - 1) and element_size without overflow checks, so a wrapped result can satisfy the buffer_view size test. Exploitation requires an application to parse attacker-supplied model data and later read the validated accessor, at which point cgltf_accessor_read_float() can perform a heap out-of-bounds read that discloses memory and can terminate the process.