avfilter/vf_pad: fix req_end

Fixes out of array accesses
Fixes Ticket3190

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavfilter/vf_pad.c

@@ -251,7 +251,7 @@ static int buffer_needs_copy(PadContext *s, AVFrame *frame, AVBufferRef *buf)
                               (s->y >> vsub) * frame->linesize[planes[i]];
         ptrdiff_t req_end   = ((s->w - s->x - frame->width) >> hsub) *
                               s->draw.pixelstep[planes[i]] +
-                              (s->y >> vsub) * frame->linesize[planes[i]];
+                              ((s->h - s->y - frame->height) >> vsub) * frame->linesize[planes[i]];
 
         if (frame->linesize[planes[i]] < (s->w >> hsub) * s->draw.pixelstep[planes[i]])
             return 1;