decode_tiles(): validate buffer reads

Previous code indexed using the tile length coded in the bitstream
without checking that the read would be valid.

Change-Id: Ia5047762223a4f80d75016dd546dc2ef18b6887d