diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -227,14 +227,15 @@ static int fixup_vorbis_headers(AVFormatContext *as,
                                 struct oggvorbis_private *priv,
                                 uint8_t **buf)
 {
-    int i, offset, len, err;
-    int buf_len;
+    int i, offset, err;
+    int64_t len, buf_len;
     unsigned char *ptr;

-    len = priv->len[0] + priv->len[1] + priv->len[2];
+    len = (int64_t)priv->len[0] + priv->len[1] + priv->len[2];
     buf_len = len + len / 255 + 64;

-    if (*buf)
+    /* Reject if the combined header size cannot fit in a signed int. */
+    if (*buf || buf_len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
         return AVERROR_INVALIDDATA;

     ptr = *buf = av_realloc(NULL, buf_len);