Stack memory disclosure via negative blit index

Stack overflow in Telegram clients allows remote attackers to read stack memory via a malicious animated sticker. In rlottie's blit function, a negative spans->x bypasses a one-sided upper-bound check, so buffer + x points before the stack buffer and std::max dereferences it. An attacker must deliver an arbitrary sticker through a secret chat and the recipient must open that chat; ordinary chats filter uploaded stickers.