stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder
. In that case the function returns early, the f->comment_list
is set to NULL
, but f->comment_list_length
is not reset. Later in vorbis_deinit
it tries to dereference the NULL
pointer. This issue may lead to denial of service.