1.00.810: Crash playing ogm-files

[the_doctor]

Playing ogm-files crashes build 810 reproducibly while the same file can be played by Windows Media Player correctly.
The crash occures, depending on the file, not immediately. For example
Rurouni_Kenshin_-_Reminiscence_-_1_-_Act_1._The_Man_of_the_Slashing_Sword_-_[zx](cdd642de)(dub.sub_jap.eng.eng)[AniDB].ogm
crashed after playing about 30 seconds while
Shin_seiki_Evangelion_Gekijo_-_Death_&_Rebirth_-_[zx].ogm crashes the player immediately.

System: Asus A7V266-E with Athlon 1800+; Geforce2mx/400; Windows 2000 Sp4
Player: BSplayer 1.0 b 810
Codecs && Filters: DivX 5.1.1.1031; Gabest OGG Splitter 1.0.0.11; AC3 filter 1.0.1.0; DirectVobSub 1.0.0.9

WinDBG crash analysis:

Microsoft (R) Windows Debugger  Version 6.0.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\app.dmp]
User Dump File: Only application data is available

Windows 2000 Version 2195 UP Free x86 compatible
Product: WinNt
System Uptime: not available
Process Uptime: not available
Symbol search path is: srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\winnt
.......................................................................
(5f8.6e0): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=00000000 edx=0af1fe48 esi=00000000 edi=01354720
eip=004d97f6 esp=0af1fe48 ebp=0af1fea4 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
*** WARNING: Unable to verify timestamp for bsplayer.exe
*** ERROR: Module load completed but symbols could not be loaded for bsplayer.exe
bsplayer+d97f6:
004d97f6 807cd81800     cmp byte ptr [eax+ebx*8+0x18],0x0 ds:0023:00000018=??
0:016> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***                                                                   ***
*************************************************************************
*** WARNING: Unable to verify checksum for bsrendv2.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for bsrendv2.dll - 

FAULTING_IP: 
bsplayer+d97f6
004d97f6 807cd81800       cmp     byte ptr [eax+ebx*8+0x18],0x0

EXCEPTION_RECORD:  ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 004d97f6 (bsplayer+0x000d97f6)
   ExceptionCode: c0000005
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000018
Attempt to read from address 00000018

DEFAULT_BUCKET_ID:  APPLICATION_FAULT

PROCESS_NAME:  bsplayer.exe

READ_ADDRESS:  00000018 

BUGCHECK_STR:  ACCESS_VIOLATION

LAST_CONTROL_TRANSFER:  from 004e688e to 004d97f6

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0af1fea4 004e688e 00000000 00000036 0b130054 bsplayer+0xd97f6
0af1fecc 09b9b146 01345dc8 00000001 0af1ff08 bsplayer+0xe688e
02a41408 02b1f114 48000100 50000000 00000030 bsrendv2+0xb146
09bbeb50 09ba1870 09ba1880 09ba4fb0 09ba5040 0x2b1f114
09ba1860 0000008c fef933e9 ccccccff 04246c81 bsrendv2!DllUnregisterServer+0x7c0


FOLLOWUP_IP: 
bsplayer+d97f6
004d97f6 807cd81800       cmp     byte ptr [eax+ebx*8+0x18],0x0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  bsplayer+d97f6

MODULE_NAME:  bsplayer

IMAGE_NAME:  bsplayer.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  2a425e19

STACK_COMMAND:  .ecxr ; kb

BUCKET_ID:  ACCESS_VIOLATION_bsplayer+d97f6

Followup: MachineOwner

The dumpfile(104MB; 14MB rar'ed) is availabe on request.

-td