Will Drewry of the Google Security Team reported an issue in OGG Vorbis library, that can cause crash of the application using vorbis library, trigger an infinite loop, or cause an integer overflow leading to possible heap overflow.

Problem is caused by codebooks with codebook.dim == 0.

Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.