| 제목 | nothings stb (stb_hexwave.h) 31c1ad3 (latest at time of discovery) CWE-190: Integer Overflow; CWE-120: Buffer Overflow |
|---|
| 설명 | Integer overflow in hexwave_init() causes heap/stack buffer overflow in stb_hexwave.h (nothings stb).
In hexwave_init(), the product oversample * halfwidth overflows a 32-bit int when caller-supplied width and oversample values are large (e.g. 65536 and 65536). The internal buffers are then undersized, while the deinterleave loop runs with a post-clamp width, performing 4,194,368 out-of-bounds writes per buffer. Depending on the buffer type, the overflow manifests as either a heap-buffer-overflow (user_buffer == NULL, malloc path) or a stack-buffer-overflow (user_buffer points to a small local array). width and oversample have no upper bound check.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (Base 8.2, High)
Confirmed via ASAN on Linux x86_64 (gcc 15.2.0):
==227894==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x700e0cff0040
WRITE of size 4 at 0x700e0cff0040
#0 hexwave_init ../stb_hexwave.h:611
#1 main poc_hexwave.c:5
SUMMARY: AddressSanitizer: stack-buffer-overflow ../stb_hexwave.h:611 in hexwave_init
Reported to the maintainer via public GitHub issue #1961. No response received from the maintainer as of 2026-08-24. No CVE assigned yet. Fixed by none (not fixed upstream).
|
|---|
| 원천 | ⚠️ https://github.com/nothings/stb/issues/1961 |
|---|
| 사용자 | JerryGW (UID 99144) |
|---|
| 제출 | 2026. 08. 24. PM 03:26 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 29. PM 07:08 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 411496 [Nothings stb 까지 2c980bb59875b0d32144a71867fbdebb2f77cd20 stb_hexwave.h hexwave_init width/oversample 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|