Astra Linux - Vulnerability in libstb

stbvorbis is a single-file library licensed under the MIT License for processing Ogg Vorbis files. A specially crafted file may trigger an out-of-bounds write in f-vendorlen = char'\0';. The root cause is that if the len value read in startdecoder is -1, len + 1 becomes 0 when passed to...