Astra Linux – vulnerability in libstb

stbvorbis is a single-file MIT-licensed library for processing OGG Vorbis files. A specially crafted file may result in an out-of-bounds write via f-vendorlen = char'\0';. The root cause is that if len read from startdecoder is -1, then len + 1 becomes 0 when passed to setupmalloc. setupmalloc...