CVE-2023-45666: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis

stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to stbiloadgifmainoutofmem only frees possibly allocated memory in delays without resetting it to zero. Thus it would be fair to say the caller of stbiloadgifmain is responsible to free the allocated memory in delays only if stbiloadgifmain returns a non null value. However at the same time the function may return null value, but fail to free the memory in delays if internally stbiconvertformat is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free delays only when stbiloadgifmain didn’t fail or to a double-free if the delays is always freed