NULL pointer derefence in PIC loading (CVE-2023-43898)

[mmuehlenhoff]

This appeared in the CVE feed updates, apparently someone requested a CVE ID (https://www.cve.org/CVERecord?id=CVE-2023-43898) for https://github.com/peccc/null-stb, but failed to actually report it to you...

[NBickford-NV]

I'm going to link this issue with the original report in #1452 and the patch in #1454 - thanks!

[tom-seddon]

Googling suggests the PIC support's main current purpose is to allow automated fuzzers to find new ways to make stb_image crash. I can't imagine anybody still needs to do anything with the early-2000s-era Maya assets from Sega that prompted me to cobble this stuff together in the first place - so maybe it's time to take this code out back and send it to a farm upstate?

--Tom

[tom-seddon]

If nobody is using this code, it needs to be removed.

If anybody is using it, let's remove it anyway - they can switch to using PNG instead.

I can do a PR if there is any interest.

--Tom