ogg_stream_pagein: validate page segment table against body length

[XananasX7]

Problem

ogg_stream_pagein() is a public entry point and may be handed pages that were parsed or constructed by the caller (custom demuxers, remuxers, seek/index layers, or sync builds with DISABLE_CRC). Pages produced by ogg_sync_pageout() are length- and checksum-verified, but callers using their own page parsing can supply an ogg_page whose segment table claims more body data than body_len contains.

In that case bodysize goes negative while the segment table is walked: the continued-packet skip loop (or a final short body) then reaches memcpy with a negative length (huge size_t), or leaves body_fill negative for subsequent packet assembly — a heap-corruption / out-of-bounds condition reachable from malformed media. ASan reports negative-size-param at framing.c:862.

Minimal reproducer against current master:

ogg_stream_init(&os, 0x1234);
unsigned char hdr[28], body[16];
memcpy(hdr, "OggS", 4);
hdr[5] = 0x01;            /* continued packet */
hdr[14] = 0x34; hdr[15] = 0x12; /* serial */
hdr[26] = 1;              /* segments */
hdr[27] = 250;            /* lacing value > body_len */
ogg_page og = { hdr, sizeof(hdr), body, 10 };
ogg_stream_pagein(&os, &og);   /* -> negative-size-param memcpy */

Fix

Reject any page whose lacing values overshoot its body (or whose header_len can't contain the segment table) before trusting the table, returning -1 as with other invalid pages. The check is O(segments) with an early exit, and validates pages produced by ogg_sync_pageout() (which satisfy it by construction).

Testing

• Malformed page now returns -1 (previously: ASan negative-size-param in memcpy).
• A full encode/decode round trip — including packets spanning multiple 255-lacing segments and BOS/EOS flags — decodes byte-identically to before the change.