Data disclosure or crash via wrapped topology size

Integer overflow in ALSA Library 1.2.16.1 and earlier allows attackers to read process data or crash an application via a crafted topology file. The decoder in src/topology/ctl.c adds topology element sizes with 32-bit arithmetic, so a wrapped total passes its buffer bounds checks and leads to an out-of-bounds read. Exploitation requires an application to parse attacker-supplied topology data; the bounded outcomes are sensitive process-data disclosure or termination of that application.