avformat/librist: honor the caller buffer size in librist_read

librist_read() ignored its size argument and copied the full payload_len,
overflowing a smaller destination (e.g. via the async: wrapper). Clamp the
copy to the caller-provided buffer size.

Fixes: out of array access
(cherry picked from commit 1c10bcc2e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/librist.c

@@ -226,7 +226,7 @@ static int librist_read(URLContext *h, uint8_t *buf, int size)
         }
     }
 
-    size = data_block->payload_len;
+    size = FFMIN(data_block->payload_len, size);
     memcpy(buf, data_block->payload, size);
 out_free:
     rist_receiver_data_block_free2(&data_block);