CVE-2026-44638 libsixel空指针解引用拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-44638 * This code demonstrates the logic error in libsixel <= 1.8.7-r1. * To actually trigger this, one would need to call the vulnerable library function * in a low-memory environment. */ #include <stdio.h> #include <stdlib.h> #include <string.h> // Simulating the vulnerable logic void vulnerable_decode(char **output, size_t size) { // Allocation happens *output = (char *)malloc(size); // VULNERABLE CHECK: Checks the address of the pointer (output) rather than the value (*output) // In the real bug, it checked the output parameter address. if (&output == NULL) { // This condition is always false printf("Allocation failed detected (impossible path).\n"); return; } // If malloc returned NULL (low memory), this write causes a crash strcpy(*output, "SIXEL DATA"); } int main() { char *data = NULL; // In a real scenario, we would exhaust memory first or pass a huge size // to force malloc to return NULL, then call the library function. // Here we simulate the malloc failure by passing NULL directly to the write logic // for demonstration purposes, as forcing OOM is complex in a snippet. printf("Simulating conditions leading to NULL pointer dereference...\n"); // Forcing the crash scenario for demonstration: char *null_ptr = NULL; // The vulnerable code would do: strcpy(null_ptr, "DATA"); printf("Process would crash here attempting to write to NULL pointer.\n"); return 0; }