Process crash via truncated codebook allocation

Heap buffer overflow in Nothings stb_vorbis 1.22 and earlier allows attackers to crash a decoding process with a crafted Ogg Vorbis file. In start_decoder(), a size_t codebook-multiplicands size is passed to the int-sized setup_malloc parameter, producing a tiny allocation before a larger expansion loop writes past its end. Exploitation requires a consuming application to decode the attacker-supplied file; the demonstrated result is a process crash with heap corruption.