Out-of-bounds write via signed tile-offset overflow

Integer overflow in VideoLAN dav1d before 1.4.0 allows attackers to write outside decoder memory through oversized AV1 frame dimensions. In dav1d_decode_frame_init, multithreaded tile offsets were accumulated in signed 32-bit fields and then used to derive writable pointers. The path requires multithreaded decoding on a 64-bit build without a restrictive frame-size limit; high-bit-depth input can place corrupted pointers within normal address ranges.