CVE-2026-5315 Nothings stb 越界读取漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> // Simulating the vulnerable function stbtt__buf_get8 typedef struct { unsigned char *data; int cursor; int size; } stbtt__buf; // Vulnerable implementation unsigned char stbtt__buf_get8(stbtt__buf *b) { // Missing bounds check here allows out-of-bounds read if (b->cursor >= b->size) { printf("Error: Out of bounds read attempted!\n"); return 0; } return b->data[b->cursor++]; } int main() { // Create a small buffer to simulate a truncated TTF file int buffer_size = 10; unsigned char *data = (unsigned char *)malloc(buffer_size); memset(data, 0, buffer_size); stbtt__buf buf; buf.data = data; buf.size = buffer_size; buf.cursor = 0; printf("Attempting to read buffer normally...\n"); for(int i=0; i<buffer_size; i++) { stbtt__buf_get8(&buf); } printf("Attempting to trigger out-of-bounds read...\n"); // This call should trigger the vulnerability logic (reading beyond size) unsigned char val = stbtt__buf_get8(&buf); free(data); return 0; }