stb_image & stb_vorbis memory safety bugs & PoC

Vulnerability Summary: Memory Safety Defects in stb_image and stb_vorbis (Issue #1928) Vulnerability Overview Multiple memory safety defects were identified in v2.30 and v1.2.2, including: Integer overflows Out-of-bounds accesses Logic errors Affected Scope stb_image.h: 1. lacks an overflow check (line 1820) 2. / (lines 1193, 1209) 3. pointer underflow in animated GIFs (line 7023) 4. overflow in animated GIFs (lines 6991–7021) 5. PNG palette index out-of-bounds access (line 4988) 6. Invalid PNG color type + bit depth accepted (line 5112) 7. Double overflow due to PNG IDAT data limit (line 5188) 8. Incorrect return value on JPEG marker processing failure (line 3440) 9. Uninitialized heap leak in progressive JPEGs (lines 3346, 3085) 10. Uninitialized palette read in BMPs (line 5601) 11. Overflow in (line 1250) stb_vorbis.c: 12. Sign error in boundary clamping (line 1891) 13. Codebook entry dimension overflow (line 3860) 14. Multiplier allocation overflow (lines 3878, 3880) 15. Unchecked (line 3660) Fix Status A PR has been submitted to fix some of these defects (bugs 1, 2, 3, 5, 8, 12), with PR number #1927. The remaining defects (bugs 4, 6, 7, 9, 10, 11, 13, 14, 15) remain unfixed and require further handling. PoC / Exploit Code 1. stbi__convert_format16 overflow (line 1820) > For large images (e.g., 32768x32768 RGBA), may overflow to 0, causing a zero-size buffer allocation, while subsequent code writes 8 GB into that buffer. 3. Animated GIF two_back pointer underflow (line 7023) > When points to the start of a heap-allocated buffer, points before the heap allocation. If dispose method 3 is used, the read at line 6818 using this pointer can cause a crash. 4. Animated GIF layers->stride overflow (lines 6991–7021) > is incremented per frame for realloc and memory offset calculations, with no overflow check. A 400x400 RGBA GIF will overflow after approximately 3356 frames. 5. PNG palette index out-of-bounds (line 4988) > accepts the palette length but explicitly ignores it. Pixel values 0–255 do not depend on palette size; the array has only 1024 bytes of stack space and is only partially initialized. Pixel indices exceeding the actual palette size cause reads of uninitialized stack memory. 6. Invalid PNG color type + bit depth (line 5112) > The PNG specification restricts color types to 2, 4, and 6 with bit depths of 8 and 16 bits, but also accepts 1, 2, and 4. The unpacking code is designed for single-channel images, so or leads to errors. 7. Double overflow from PNG IDAT data limit (line 5188) > After collecting many IDAT chunks, may overflow to 32. When is 0, allocates 0 bytes, and writes up to 1 GB into that zero-size buffer. 8. JPEG marker failure returns success (line 3440) > When returns 0 (failure), the function returns 1 (success). It should return 0 upon encountering the 8-bit marker. 9. Uninitialized heap leak in progressive JPEG (lines 3346, 3085) > The coefficient buffers are allocated with (not ). processes all components regardless of whether they appear in the SOSC scan. A progressive JPEG defining 3 components but scanning only 2 causes 2 leaked heap blocks. 10. Uninitialized BMP palette read (line 5601) > Similar to the PNG palette issue. Small-palette BMPs allow pixel indices to exceed the palette size, causing reads from the uninitialized stack array. 11. stbi__vertical_flip_slices overflow (line 1250) > No overflow check is performed. This value is used in pointer arithmetic for the flip path of animated GIFs. 12. Boundary clamping sign error (line 1891) > The code should use instead of ; otherwise, samples may be clamped beyond the end of the buffer. 13. Codebook entry dimension overflow (line 3860) > In the loop, lacks an overflow check. Since entries can be up to 2^15-1 and dimensions can be up to 2^15-1, the product may overflow to an undefined value. 14. Multiplier allocation overflow (lines 3878, 3880) > The product overflows, resulting in a small allocation followed by a large write. 15. Unchecked comment_list_length (line 3660) > A 32-bit value is read from the stream and multiplied by for allocation. This may overflow on 32-bit platforms.

Goal Reached Thanks to every supporter — we hit 100%!

stb_image & stb_vorbis memory safety bugs & PoC

More from this source