demuxer: fixed possible buffer overrun in nal_unescape