Issue #770: Be more careful about extra_length

Issue #770:  Be more careful about extra_length

Hanno Böck pointed out that the loop here computes
extra_length - 4 without first checking for possible underflow.

In addition to fixing this, I also added a bunch of error
checks so Zip parsing will fail if any Zip extra field
is malformed.  Among other things, this uncovered an
old bug that would skip a trailing extra field with
zero-sized data.

Note that we still simply ignore well-formed
extra fields that we don't understand.