stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Nothings |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-49965 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 13 Feb 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Nothings stb
|
|
| CPEs | cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Nothings stb
|
|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-02-13T17:14:07.600Z
Reserved: 2023-10-10T14:36:40.861Z
Link: CVE-2023-45675
Vulnrichment
Updated: 2024-08-02T20:21:16.836Z
NVD
Status : Modified
Published: 2023-10-21T00:15:09.207
Modified: 2024-11-21T08:27:11.510
Link: CVE-2023-45675
Redhat
No data.
OpenCVE Enrichment
No data.