Possible double-free or memory leak in stbi__load_gif_main in stb_image

CVE-2023-45666

What is CVE-2023-45666?

The stb_image library, widely used for image processing, contains a vulnerability that can result in memory leaks or double-free errors. When the function stbi__load_gif_main encounters an unrecognized GIF image, it fails to reset the memory output variable *delays to zero. While the initial state sets *delays to zero, erroneous conditions prevent this from happening if an internal memory allocation fails. This places the caller in a precarious position where they must decide when to free allocated memory, risking memory leaks or double-free scenarios. Developers using the stb_image library should carefully consider their error handling strategies to mitigate potential exploitation risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References