Possible double-free or memory leak in stbi__load_gif_main in stb_image

CVE-2023-45666

What is CVE-2023-45666?

The stb_image library, widely used for image processing, contains a vulnerability that can result in memory leaks or double-free errors. When the function stbi__load_gif_main encounters an unrecognized GIF image, it fails to reset the memory output variable *delays to zero. While the initial state sets *delays to zero, erroneous conditions prevent this from happening if an internal memory allocation fails. This places the caller in a precarious position where they must decide when to free allocated memory, risking memory leaks or double-free scenarios. Developers using the stb_image library should carefully consider their error handling strategies to mitigate potential exploitation risks.

References