rpm incorrect handling of negated offsets in headerVerifyInfo()

rpm insufficient validation of region tags

rpm improper validation of header contents total size in headerLoad()

rpm -V calls verifyscript twice