CVE-2023-45666

Name
CVE-2023-45666
Description
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L6962-L7045
MISC https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/
MISC https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L6957
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nothings:stb_image.h:2.28:*:*:*:*:*:*:* stb_image.h == None == 2.28

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
stb edge-community 0_git20231012-r0 Simon Zeni <simon@bl4ckb0ne.ca> fixed
stb 3.19-community 0_git20231012-r0 Simon Zeni <simon@bl4ckb0ne.ca> fixed
stb 3.20-community 0_git20231012-r0 Simon Zeni <simon@bl4ckb0ne.ca> fixed