pulseaudio: fix CVE-2014-3970 by upstream patch