Description
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service.
Published: 2023-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-49970 stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service.
History

No history.

Subscriptions

Nothings Stb Vorbis.c
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-09-11T20:22:52.057Z

Reserved: 2023-10-10T14:36:40.862Z

Link: CVE-2023-45680

cve-icon Vulnrichment

Updated: 2024-08-02T20:29:31.640Z

cve-icon NVD

Status : Modified

Published: 2023-10-21T00:15:09.540

Modified: 2024-11-21T08:27:12.257

Link: CVE-2023-45680

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses