Heap overflow via mismatched restoration worker count

Heap-based buffer overflow in Alliance for Open Media libaom before 3.7.1 allows attackers to corrupt memory via frame resizing. av1_loop_restoration_dealloc() uses the current worker count instead of the count stored with the allocated loop-restoration worker array, so its cleanup loop can walk beyond that allocation. The condition requires a multithreaded encode that increases frame resolution; the overflow reads adjacent memory or terminates the encoding process.