libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
aomedia libavif 0.8.0
aomedia libavif 0.8.1