From 06a7d1fd04e10f52f6c18d6e868e2185c9a56b13 Mon Sep 17 00:00:00 2001 From: Matt Brubeck Date: Sun, 19 Mar 2023 08:52:01 -0700 Subject: [PATCH] NULL pointer dereference in stb_image (#1647) --- crates/stb_image/RUSTSEC-0000-0000.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 crates/stb_image/RUSTSEC-0000-0000.md diff --git a/crates/stb_image/RUSTSEC-0000-0000.md b/crates/stb_image/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..7442293 --- /dev/null +++ b/crates/stb_image/RUSTSEC-0000-0000.md @@ -0,0 +1,18 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "stb_image" +date = "2023-03-19" +url = "https://github.com/servo/rust-stb-image/pull/102" +categories = ["memory-corruption"] +keywords = ["NULL-pointer-dereference"] + +[versions] +patched = [">= 0.2.5"] +``` + +# NULL pointer derefernce in `stb_image` + +A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file. This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers. + +Thank you to GitHub user 0xdd96 for finding and fixing this vulnerability.