Unrated severityNVD Advisory· Published Oct 20, 2023· Updated Sep 11, 2024
Null pointer dereference in vorbis_deinit in stb_vorbis
CVE-2023-45680
Description
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, the f->comment_list is set to NULL, but f->comment_list_length is not reset. Later in vorbis_deinit it tries to dereference the NULL pointer. This issue may lead to denial of service.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.cmitrex_refsource_MISC
- github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.cmitrex_refsource_MISC
- securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.