util/rbsp: Fill bits twice if reading more than 16 bits

vl_rbsp_fillbits may fill less than 32 bits if it removes emulation
prevention bytes, but will fill at least 16 bits. We need to call it
twice when reading more than 16 bits.

This fixes parsing H264 SPS packed header in va frontend when emulation
prevention bytes are at position where 32 bit values are read.

Cc: mesa-stable

Reviewed-by: Leo Liu <leo.liu@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/26276>

src/util/vl_rbsp.h

@@ -138,6 +138,8 @@ static inline unsigned vl_rbsp_u(struct vl_rbsp *rbsp, unsigned n)
       return 0;
 
    vl_rbsp_fillbits(rbsp);
+   if (n > 16)
+      vl_rbsp_fillbits(rbsp);
    return vl_vlc_get_uimsbf(&rbsp->nal, n);
 }