faxcompr: Dont read ref when the end has been reached in pass mode

Fixes reading over the end

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/faxcompr.c

@@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
             return -1;
         }
         if(!cmode){//pass mode
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             run = run_off - offs;
             offs= run_off;
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             if(offs > width){
                 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
                 return -1;