avformat/ogg: Fix overflow and stale oggvorbis_private values

- Prevent integer overflow when summing header lengths; add bounds check.
- Re-initialize priv->vp with the new stream's extradata once all chained
  stream headers are collected.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
(cherry picked from commit 6e0e13b0bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/oggparsevorbis.c

@@ -608,6 +608,13 @@ static int vorbis_packet(AVFormatContext *s, int idx)
         priv->comment_size = 0;
         av_freep(&priv->setup);
         priv->setup_size = 0;
+
+        av_vorbis_parse_free(&priv->vp);
+        priv->vp = av_vorbis_parse_init(os->new_extradata, os->new_extradata_size);
+        if (!priv->vp) {
+            av_log(s, AV_LOG_ERROR, "Failed to re-initialize Vorbis parser\n");
+            return AVERROR_INVALIDDATA;
+        }
     }
 
     return skip_packet;