`WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`

WaveFormat::parse is a safe function that takes a &WAVEFORMATEX, which is only valid for reads of sizeof:: 18 bytes. When the header has wFormatTag == WAVEFORMATEXTENSIBLE and cbSize = 22, the function reinterprets the reference as a WAVEFORMATEXTENSIBLE and reads 40 bytes. Nothing in the signatu...