asfdec: Use the ASF stream count when iterating

The AVFormat stream count can be larger due external factors, such as
an id3 tag appended.

Avoid an out of bound read.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

libavformat/asfdec.c

@@ -1485,7 +1485,7 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
             asf->return_subpayload = 0;
             return 0;
         }
-        for (i = 0; i < s->nb_streams; i++) {
+        for (i = 0; i < asf->nb_streams; i++) {
             ASFPacket *asf_pkt = &asf->asf_st[i]->pkt;
             if (asf_pkt && !asf_pkt->size_left && asf_pkt->data_size) {
                 if (asf->asf_st[i]->span > 1 &&