There is a crash in snd_openal.c that exists when playing music.
It can be triggered when opening the sound file succeeded but the first read request to fill the openal buffer fails.
This will result in the opened sound stream being closed along with the codec structure which holds the functionpointers to the codec functions. The for loop will try to fill all buffers and uses the decoder functions every time for that, even if the stream is already closed. -> crash.

There is also a memory leak in the ogg decoder for sounds, not a big one though. When registering a sound, the engine tries to allocate space for the complete sound.
The function S_OGG_CodecLoad will take care of that. Normally the function returns a pointer to the allocated buffer, but if nothing is read due to an error, it will return a NULL pointer. Before returning NULL the allocated buffer won't get freed.

I fixed both bugs in my patch that is attached to this bug entry.