| Title | nothings stb (stb_hexwave.h) 31c1ad3 (latest at time of discovery) CWE-190: Integer Overflow; CWE-120: Buffer Overflow |
|---|
| Description | Integer overflow in hexwave_init() causes heap/stack buffer overflow in stb_hexwave.h (nothings stb).
In hexwave_init(), the product oversample * halfwidth overflows a 32-bit int when caller-supplied width and oversample values are large (e.g. 65536 and 65536). The internal buffers are then undersized, while the deinterleave loop runs with a post-clamp width, performing 4,194,368 out-of-bounds writes per buffer. Depending on the buffer type, the overflow manifests as either a heap-buffer-overflow (user_buffer == NULL, malloc path) or a stack-buffer-overflow (user_buffer points to a small local array). width and oversample have no upper bound check.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (Base 8.2, High)
Confirmed via ASAN on Linux x86_64 (gcc 15.2.0):
==227894==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x700e0cff0040
WRITE of size 4 at 0x700e0cff0040
#0 hexwave_init ../stb_hexwave.h:611
#1 main poc_hexwave.c:5
SUMMARY: AddressSanitizer: stack-buffer-overflow ../stb_hexwave.h:611 in hexwave_init
Reported to the maintainer via public GitHub issue #1961. No response received from the maintainer as of 2026-08-24. No CVE assigned yet. Fixed by none (not fixed upstream).
|
|---|
| Source | ⚠️ https://github.com/nothings/stb/issues/1961 |
|---|
| User | JerryGW (UID 99144) |
|---|
| Submission | 08/24/2026 15:26 (2 months ago) |
|---|
| Moderation | 09/29/2026 19:08 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 411496 [Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20 stb_hexwave.h hexwave_init width/oversample integer overflow] |
|---|
| Points | 20 |
|---|