Access violation at TheoraVideoClip_Theora::load

[d1ke]

Hello,
I have access violation at ogg_page_serialno called from code below. It happens because case when ret == -1 not handled. Sometimes mInfo.OggPage stays unitialized after calling ogg_sync_buffer. And if mInfo.OggPage.header points to protected memory - we get crash.

void TheoraVideoClip_Theora::load(TheoraDataSource* source)
{
    ...
    char *buffer = ogg_sync_buffer(&mInfo.OggSyncState, 4096 * i);
    int bytes_read = mStream->read(buffer, 4096 * i);
    ogg_sync_wrote(&mInfo.OggSyncState, bytes_read);
    ogg_sync_pageseek(&mInfo.OggSyncState, &mInfo.OggPage);

    for (;;)
    {
        int ret = ogg_sync_pageout(&mInfo.OggSyncState, &mInfo.OggPage);
        if (ret == 0)
        {
            break;
        }
        // if page is not a theora page, skip it
        if (ogg_page_serialno(&mInfo.OggPage) != mInfo.TheoraStreamState.serialno) // <--- HERE!
        {
            continue;
        }
        ...
    }
    ...
}

I have 100% reproducibility using GFlags (gflags /p /enable C:\myapp.exe /full) and this video: http://s000.tinyupload.com/?file_id=66466629115262039545

Adding check ret == -1 fixes this bug for me.

if (ret == -1 || ogg_page_serialno(&mInfo.OggPage) != mInfo.TheoraStreamState.serialno) 

[kspes]

Good catch! Commited your fix, thanks :)