w and h are both read as uint16 + 1 so this can not happen. A similar
change was introduced in 97962b27 / 72ca830f, with the
av_log()+AVERROR_INVALIDDATA form, suggesting it could be triggerable
somehow.

Change suggested by Ronald S. Bultje.