Code execution via overflowing comment-pointer allocation

Heap-based buffer overflow in STB stb_vorbis 1.22 allows attackers to execute arbitrary code by supplying a crafted Ogg Vorbis file. The start_decoder function multiplies an attacker-controlled comment count by the pointer size without checking for integer overflow, underallocating comment_list before writing pointers past its heap buffer. Exploitation requires a host application to decode the malicious file; successful heap grooming permits arbitrary code execution in that application's context.