w and h are both read as uint16 + 1 so this can not happen. A similar
change was introduced in 97962b2
/ 72ca830, with the
av_log()+AVERROR_INVALIDDATA form, suggesting it could be triggerable
somehow.
Change suggested by Ronald S. Bultje.
tags/n2.2-rc1