CVE-2023-45675

CVE-2023-45675 affects stb_vorbis library; a crafted Ogg Vorbis file may trigger an out-of-bounds write in f->vendor[len] via start_decoder length handling. Root cause: when len is -1, len+1 becomes 0 for setup_malloc, which behaves differently if f->alloc.alloc_buffer is pre-allocated, ret...