[Vorbis-dev] Crash when reading OGG/Vorbis file

[Stevo Brock]

I'm seeing a crash when reading an OGG/Vorbis file.  I'm using OGG 1.0 
/ Vorbis 1.0.

The crash occurs in _vds_shared_init because the passed in vorbis_info 
*vi points to a structure containing all 0s (and thus crashes on the 
line

b->modebits = ilog2(ci->modes);

as ci is NULL.

Following the stack, I see that _vds_shared_init is called by 
vorbis_synthesis_init which is called by _make_decode_ready by the line

vorbis_syntesis_init(&vf->vd, vf->vi + vf->current_link);

At this point in the vf structure, links = 7.  Looking at the vb->vi 
array I see that elements 0 and 5 are initialized structures, but 1, 2, 
3, 4, and 6 are all 0.

My company provides a tool that reads and writes OGG/Vorbis files and 
the file that is causing this crash is from one of our customers.  At 
this point, I don't know where the file came from or how it was 
created.  I suppose it could be a corrupted or malformed file.

Any help would be greatly appreciated.

-Stevo Brock
  Skyward Studios
  www.monkey-tools.com