NULL pointer dereference in the stb_image.h

[0xdd96]

I discovered a null pointer dereference vulnerability in the stb_image.h of libsixel, which also exists in this project.

Specifically, if the stbi__pic_load_core function returns 0 (line 6528), result will be released (line 6529) and set to 0 (line 6530). This null pointer will be dereferenced in stbi__convert_format, which would crash the application.

stb/stb_image.h

Lines 6523 to 6535 in 5736b15

	// intermediate buffer is RGBA
	result = (stbi_uc *) stbi__malloc_mad3(x, y, 4, 0);
	if (!result) return stbi__errpuc("outofmem", "Out of memory");
	memset(result, 0xff, x*y*4);
	if (!stbi__pic_load_core(s,x,y,comp, result)) {
	STBI_FREE(result);
	result=0;
	}
	*px = x;
	*py = y;
	if (req_comp == 0) req_comp = *comp;
	result=stbi__convert_format(result,4,req_comp,x,y);

[NBickford-NV]

Tracking CVE numbers: this is https://nvd.nist.gov/vuln/detail/CVE-2023-43898 ((#1521), and its equivalent in Servo's Rust port is https://rustsec.org/advisories/RUSTSEC-2023-0021.html.