Chris Montgomery has informed us of a bug found in libvorbis.
The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis
(svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)

I'm calling this bug an "array boundary condition flaw".  It's the best
definition I could find that matched up with something MITRE uses.  The
issue in question is related to the usage of a function pointer table.
Here is an example:

_mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);

What happens is the value of 'ci->map_type[i]' can be an attacker
controlled 16 bit unsigned integer.  The amount of play with the that
function pointer is a bit suspect I admit, but I suspect it's still
exploitable (some peer review from someone better at this sort of thing
would be helpful).

The code in question is called when libvorbis starts to clean things up
after receiving bad data.