Index: demux_ogg.c
===================================================================
--- demux_ogg.c (revision 20509)
+++ demux_ogg.c (working copy)
@@ -230,6 +230,9 @@
   int line_pos = 0;
   int ignoring = 0;
   char *packet = pack->packet;
+  if (pack->bytes < 4)
+    return;
+  packet[pack->bytes - 1] = 0;
 
   mp_msg(MSGT_DEMUX,MSGL_DBG2,"\ndemux_ogg_add_sub %02X %02X %02X '%s'\n",
       (unsigned char)packet[0],
@@ -244,6 +247,8 @@
     int16_t hdrlen = (*packet & PACKET_LEN_BITS01)>>6, i;
     hdrlen |= (*packet & PACKET_LEN_BITS2) <<1;
     lcv = 1 + hdrlen;
+    if (pack->bytes <= lcv)
+      return;
     for (i = hdrlen; i > 0; i--) {
       duration <<= 8;
       duration |= (unsigned char)packet[i];