Code execution via dangling bit-writer buffer

Buffer overflow in the FLAC encoder before 1.4.0 allows context-dependent attackers to execute code through crafted encoder input. When bitwriter_grow_ cannot enlarge its allocation, safe_realloc_mul_2op_ frees the old buffer but leaves bw->buffer pointing to it, and later encoder writes use that dangling address. Reachability requires an application to encode attacker-controlled data and trigger allocation failure; the resulting memory corruption causes a process crash or code execution.