CVE-2023-45678 — Off-by-one heap buffer write in start_decoder in stb_vorbis
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submap…
Published: 2023-10-20 · CVSS: 6.5 · CVSS 3.1
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7