GStreamer RealMedia demuxer FILEINFO metadata OOB read. In gst_rmdemux_parse_mdpr(), the FILEINFO parsing loop (while element_nb) advances offset using re_skip_pascal_string() without bounds checking. re_skip_pascal_string() reads a length byte at the current offset and returns offset + 1 + length without validating the buffer boundary. element_nb is attacker-controlled and stored as signed int; value 0xFFFFFFFF causes infinite loop. No fix available; upstream recommends rmdemux rewrite. Reported via PSIRTSUPT-7239 by Tianshuo Han.