stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.

stbimage is a single file MIT licensed library for processing images. When stbisetflipverticallyonload is set to TRUE and reqcomp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memcpy out-of-bounds read because bytesperpixel used to calculate bytesperrow doesn’t match the real image array dimensions.

stbimage is a single file MIT licensed library for processing images. The stbigetn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the stbihdrload function and in the stbitgaload function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.

stbimage is a single file MIT licensed library for processing images. A crafted image file can trigger stbiloadgifmainoutofmem attempt to double-free the out variable. This happens in stbiloadgifmain because when the layers stride value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to stbiloadgifmainoutofmem only frees possibly allocated memory in delays without resetting it to zero. Thus it would be fair to say the caller of stbiloadgifmain is responsible to free the allocated memory in delays only if stbiloadgifmain returns a non null value. However at the same time the function may return null value, but fail to free the memory in delays if internally stbiconvertformat is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free delays only when stbiloadgifmain didn’t fail or to a double-free if the delays is always freed

stbimage is a single file MIT licensed library for processing images.

If stbiloadgifmain in stbiloadgiffrommemory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbiverticalflipslices with the null pointer result value and the uninitialized z value. This may result in a program crash.