framing: validate page lengths before checksum

[mcc0nnell]

Summary

Validate public ogg_page lengths before ogg_page_checksum_set() zeros the checksum field or passes them into the internal CRC loop.

Details

ogg_page stores header_len and body_len as long, while _os_update_crc() takes an int size. Current main does not validate either length before the conversion.

Two standalone sanitizer repros demonstrate the failure on current main (06a5e026):

• header_len = -1 enters _os_update_crc() with a negative size; the while(size--) loop walks past the supplied header and ASan reports a stack-buffer-overflow read.
• on 64-bit builds, header_len = INT_MAX + 1 narrows to INT_MIN; UBSan reports signed overflow in the decrement and ASan then reports the same out-of-bounds read.

The fix rejects null/short headers, negative lengths, lengths that cannot be represented by the CRC helper, and nonzero body lengths with a null body pointer before mutating the checksum bytes.

Validation

• test_framing under Clang ASan + UBSan: pass
• standalone negative-length and narrowing repros fail on the base revision and return cleanly with this patch
• strict C89 compile with -Wall -Wextra -Werror: pass
• git diff --check: pass

Boundary note: normal pages produced by libogg framing have bounded lengths. This patch hardens the public checksum API for caller-constructed or mutated ogg_page values; it is not presented as malformed-wire reachability.

Signed-off-by: Robert McConnell robert@mcc0nnell.org