demuxer: fixed buffer-overrun in nal_unescape