GHSA-ppjr-267j-5p9x: NULL pointer derefernce in `stb_image`

March 20, 2023 (updated July 19, 2023)

A bug in error handling in the stb_image C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file. This is fixed in version 0.2.5 and later of the stb_image Rust crate, by patching the C code to correctly handle NULL pointers.

References

github.com/advisories/GHSA-ppjr-267j-5p9x
github.com/servo/rust-stb-imag
github.com/servo/rust-stb-image/pull/102
rustsec.org/advisories/RUSTSEC-2023-0021.html

Code Behaviors & Features

Detect and mitigate GHSA-ppjr-267j-5p9x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →