dav1d Integer Overflow / Out-Of-Bounds Write

There is an integer overflow in dav1d when decoding an AV1 video with large width/height. The integer overflow may result in an out-of-bounds write.