wavdec: check size before reading the data, not after.