NULL pointer derefence in PIC loading (CVE-2023-43898)

nothings / stb

stb single-file public domain libraries for C/C++

https://twitter.com/nothings

Other

25.99k stars 7.67k forks source link

NULL pointer derefence in PIC loading (CVE-2023-43898) #1521

Open mmuehlenhoff opened 10 months ago

mmuehlenhoff commented 10 months ago

This appeared in the CVE feed updates, apparently someone requested a CVE ID (https://www.cve.org/CVERecord?id=CVE-2023-43898) for https://github.com/peccc/null-stb, but failed to actually report it to you...

NBickford-NV commented 10 months ago

I'm going to link this issue with the original report in #1452 and the patch in #1454 - thanks!

tom-seddon commented 9 months ago

Googling suggests the PIC support's main current purpose is to allow automated fuzzers to find new ways to make stb_image crash. I can't imagine anybody still needs to do anything with the early-2000s-era Maya assets from Sega that prompted me to cobble this stuff together in the first place - so maybe it's time to take this code out back and send it to a farm upstate?

--Tom

tom-seddon commented 9 months ago

If nobody is using this code, it needs to be removed.

If anybody is using it, let's remove it anyway - they can switch to using PNG instead.

I can do a PR if there is any interest.

--Tom