demux: ogg: check packets header size (fix #13875)

diff --git a/modules/demux/ogg.c b/modules/demux/ogg.c
index 6e0a500806caa782847fb018270f53a5d494e5ad..8326b4e0ef35fdbbf59332ff1730990f2c4bd894 100644 (file)
--- a/modules/demux/ogg.c
+++ b/modules/demux/ogg.c
@@ -1408,6 +1408,13 @@ static void Ogg_DecodePacket( demux_t *p_demux,
         i_header_len = (*p_oggpacket->packet & PACKET_LEN_BITS01) >> 6;
         i_header_len |= (*p_oggpacket->packet & PACKET_LEN_BITS2) << 1;
 
+        if( i_header_len >= p_oggpacket->bytes )
+        {
+            msg_Dbg( p_demux, "discarding invalid packet" );
+            block_Release( p_block );
+            return;
+        }
+
         if( p_stream->fmt.i_codec == VLC_CODEC_SUBT)
         {
             /* But with subtitles we need to retrieve the duration first */