lavfi/showspectrum: fix crash in case of negative linesize

Signed-off-by: Paul B Mahol <onemda@gmail.com>

libavfilter/avf_showspectrum.c

@@ -211,9 +211,11 @@ static int config_output(AVFilterLink *outlink)
         if (!outpicref)
             return AVERROR(ENOMEM);
         outlink->sample_aspect_ratio = (AVRational){1,1};
-        memset(outpicref->data[0],   0, outlink->h * outpicref->linesize[0]);
-        memset(outpicref->data[1], 128, outlink->h * outpicref->linesize[1]);
-        memset(outpicref->data[2], 128, outlink->h * outpicref->linesize[2]);
+        for (i = 0; i < outlink->h; i++) {
+            memset(outpicref->data[0] + i * outpicref->linesize[0],   0, outlink->w);
+            memset(outpicref->data[1] + i * outpicref->linesize[1], 128, outlink->w);
+            memset(outpicref->data[2] + i * outpicref->linesize[2], 128, outlink->w);
+        }
     }
 
     if (showspectrum->xpos >= outlink->w)