Submeter #944868: nothings stb (stb_image_write.h) 31c1ad3 (latest at time of discovery) CWE-190: Integer Overflow; CWE-787: Out-of-bounds Write; CWE-125

Integer overflow in stb_image_write.h causes heap buffer overflow in PNG encoding and out-of-bounds reads in JPEG/TGA encoding (nothings stb).

Several size calculations in stb_image_write.h use 32-bit int arithmetic that overflows when processing large caller-supplied image dimensions. PNG: filt allocation (x*n+1)*y wraps to 68,603 bytes for x=50000, n=1, y=85899; the encoder then performs a 50,000-byte memmove write past the end of the undersized buffer (stb_image_write.h:1173). JPEG: base_p row offset width*comp*height wraps negative, causing an out-of-bounds read and SIGSEGV (stb_image_write.h:1582). TGA: row pointer j*x*comp wraps negative, causing an out-of-bounds read in memcmp and SIGSEGV (stb_image_write.h:570). The write-side encoders have no dimension limit checks.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (Base 8.2, High)

Confirmed via ASAN on Linux x86_64 (gcc 15.2.0):

PNG: ==227906==ERROR: AddressSanitizer: unknown-crash; WRITE of size 50000 (allocated 68603 bytes at stb_image_write.h:1144)
JPEG: ==227910==ERROR: AddressSanitizer: SEGV on unknown address at stbi_write_jpg_core stb_image_write.h:1582
TGA: ==227917==ERROR: AddressSanitizer: SEGV in __memcmp_avx2_movbe at stbi_write_tga_core stb_image_write.h:570

Reported to the maintainer via public GitHub issue #1964. No response received from the maintainer as of 2026-08-24. This is not a duplicate of CVE-2018-19759: that CVE is a 1-byte out-of-bounds READ in libsixel's call path (Red Hat bug 1649202, closed NOTABUG), while this report covers integer-overflow-driven out-of-bounds WRITES inside stb_image_write.h itself (PNG filt allocation, JPEG/TGA row offsets). Distinct mechanism, distinct root cause. No CVE assigned yet. Fixed by none (not fixed upstream).

• Fonte: ⚠️ https://github.com/nothings/stb/issues/1964
• Utilizador: JerryGW (UID 99144)
• Submissão: 24/08/2026 15h47 (há 1 mês)
• Moderação: 29/09/2026 19h08 (1 month later)
• Estado: Aceite
• Entrada VulDB: 411497 [Nothings stb até 1.16 Image Encoding stb_image_write.h Excesso de tampão]
• Pontos: 20