Reject truncated page headers in ogg_stream_pagein

[samuelgirmametaferia]

Summary

Reject truncated page headers in ogg_stream_pagein() before reading fixed header fields or the lacing table.

ogg_stream_pagein() currently calls helpers such as ogg_page_version(), ogg_page_granulepos(), and ogg_page_serialno(), and reads header[26], before checking og->header_len. A caller that passes a directly constructed or mutated ogg_page with a short header can therefore cause an out-of-bounds read before the function reaches its existing stream/page checks.

A one-byte header reproduces this under AddressSanitizer as a stack-buffer-overflow in ogg_page_version(), called from ogg_stream_pagein().

The change validates the 27-byte fixed header first, reads the segment count only after that check, and then verifies that the complete lacing table is present before parsing any page fields. The existing -1 error convention is used for malformed input.

Validation

• CMake build: PASS
• test_bitwise: PASS
• test_framing: PASS, including new short-fixed-header and truncated-lacing-table cases
• unpatched main: one-byte reproducer triggers AddressSanitizer stack-buffer-overflow in ogg_page_version()
• patched branch: the same sanitized reproducer is rejected with -1 without an ASan/UBSan finding
• git diff --check: PASS

I also checked the current open src/framing.c pull requests. #102 handles an inconsistent/negative body length, #105 handles sync byte counts, and #91/#94 touch unrelated code; none validates ogg_stream_pagein() header length before these reads.