Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).

Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:

https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960

Test files do not crash libvobis revision 2960 or later.