avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)

try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.

libavfilter/af_join.c

@@ -469,7 +469,7 @@ static int try_push_frame(AVFilterContext *ctx)
         for (j = 0; j < nb_buffers; j++)
             if (s->buffers[j]->buffer == buf->buffer)
                 break;
-        if (j == i)
+        if (j == nb_buffers)
             s->buffers[nb_buffers++] = buf;
     }