CVE-2026-71261: dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds

drlibs drwav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwavmetadataprocesschunk(), a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to sizet before dividing by DRWAVCUEPOINTBYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. The subsequent read in drwavreadcuetometadataobj() computes the actual cue point count and allocation size using the full-precision, attacker-controlled cuePointCount field without cross-checking it against the stage-1 capacity estimate, and the only bounds enforcement on the resulting memory region (drwavmetadatagetmemory()) is a DRWAVASSERT, which compiles to a no-op under -DNDEBUG (the default for release builds). A crafted W64 WAV file can therefore cause a heap buffer overflow in any 32-bit application parsing untrusted WAV metadata.