GStreamer WavPack decoder heap buffer overflow via integer overflow. In gstwavpackdechandleframe() (gstwavpackdec.c), the allocation gmalloc(4 wph.blocksamples dec->channels) uses unchecked 32-bit arithmetic. With blocksamples=0x20000001 and stereo, the multiplication wraps to 8 bytes; WavpackUnpackSamples() then writes ~4 GiB past the allocation. Affects 64-bit RHEL (arithmetic is 32-bit before sizet promotion). Fix pending in GStreamer 1.28.4. Reported via PSIRTSUPT-8879 by Seung Min Shin.