An integer overflow flaw was discovered in the gst_vorbis_tag_add_coverart().  Large COVERART comment tag value can cause memory requirements computation to overflow, resulting in an insufficient memory to be allocated and the allocated buffer overflow when comment tag value is base64-decoded:

gst_vorbis_tag_add_coverart() in gst-libs/gst/tag/gstvorbistag.c:

319 
320   img_data = g_try_malloc0 (base64_len * 3 / 4);
321