Vorbis comments integer overflows

I do not currently have a test sample, but from looking at the code, vorbis_ParseComment() suffers from a very similar bug as #17592 (closed)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information