CVE-2023-45680

What it actually does

A NULL pointer dereference occurs in vorbis_deinit after a memory allocation failure in start_decoder leaves comment_list as NULL without resetting comment_list_length.

Why it matters to the business

Applications using the stb_vorbis library may crash when processing specially crafted OGG Vorbis files, leading to denial of service and potential disruption of media handling workflows.

How an attack unfolds

An attacker crafts a malicious OGG Vorbis file that causes memory allocation to fail during decoder initialization. When the application later calls vorbis_deinit on the partially initialized structure, it attempts to dereference the NULL pointer, causing a crash.

How to fix it

Patch the library to reset f->comment_list_length to zero upon allocation failure in start_decoder before returning early from start_decoder.

How to confirm the fix worked

Test with a crafted file that triggers allocation failure in start_decoder and verify that vorbis_deinit completes without dereferencing NULL. Inspect source to confirm comment_list_length reset logic.

Typical attack path

1. Deliver crafted OGG Vorbis file to target application
2. Application parses the file using stb_vorbis
3. Memory allocation fails in start_decoder
4. vorbis_deinit dereferences NULL pointer causing crash

How to detect it

Monitor application logs and crash reports for segmentation faults or access violations occurring during vorbis_deinit calls after OGG Vorbis file parsing attempts.

What your security team should do

• Identify all applications and dependencies using stb_vorbis
• Apply code patch to reset comment_list_length on allocation failure
• Sandbox or restrict processing of untrusted OGG Vorbis files until fixed