qtdemux: Fix out of bounds read in tag parsing code