CVE-2023-45667 Information

Description

stb_image is a single file MIT licensed library for processing images.

If stbi__load_gif_main in stbi_load_gif_from_memory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag it continues and calls stbi__vertical_flip_slices with the null pointer result value and the uninitialized z value. This may result in a program crash.

Reference

https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1442-L1454 https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1448 https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/