GStreamer RealMedia demuxer FILEINFO metadata OOB read. In gstrmdemuxparsemdpr(), the FILEINFO parsing loop (while elementnb) advances offset using reskippascalstring() without bounds checking. reskippascalstring() reads a length byte at the current offset and returns offset + 1 + length without validating the buffer boundary. elementnb is attacker-controlled and stored as signed int; value 0xFFFFFFFF causes infinite loop. No fix available; upstream recommends rmdemux rewrite. Reported via PSIRTSUPT-7239 by Tianshuo Han.