libao: backport fix for CVE-2017-11548