stb · Issues· 430 open

stb_truetype.h: heap-use-after-free in ttUSHORT via stbtt__GetGlyphShapeTT

stb_image GIF: missing aggregate bounds check on background+history buffers allows ~2.4GB allocation from 64-byte input

stb_image: integer overflow in animated GIF multi-frame allocation (layers * stride)

Support `valueFormat1 == (X_ADVANCE | X_ADVANCE_DEVICE)` case in `stbtt__GetGlyphGPOSInfoAdvance`. Support GPOS table V1.1

stb_truetype: Support lookupType 9 table in `stbtt__GetGlyphGPOSInfoAdvance`

stb_image.h: 18-byte TGA header forces ~2.1 GB allocation (per-axis STBI_MAX_DIMENSIONS doesn't bound area)

GIF: unbounded frame count grows memory with no cap

[SECURITY] Integer overflow in stb_image_write.h leads to heap buffer overflow in PNG encoding and out-of-bounds reads in JPEG/TGA encoding

[SECURITY] stbsp_snprintf with count=0 writes null terminator before buffer

[SECURITY] Off-curve point at contour end causes OOB read in stbtt__GetGlyphShapeTT

[SECURITY] Integer overflow in hexwave_init() causes heap/stack buffer overflow in stb_hexwave.h

Two potential problems (or possibly hallucinations) from Gemini

stb_truetype.h Transform vertices

`stb_image_resize2` unaligned memory

Horrible performance for GIF with many frames