mplayer -- multiple integer overflows

The oCERT team reports:

The MPlayer multimedia player suffers from a vulnerability which
could result in arbitrary code execution and at the least, in
unexpected process termination. Three integer underflows located
in the Real demuxer code can be used to exploit a heap overflow,
a specific video file can be crafted in order to make the
stream_read function reading or writing arbitrary amounts of
memory.