libsixel Memory Leak Vulnerability

A memory leak vulnerability has been identified in libsixel versions prior to 1.8.7. The issue arises in the malloc_stub.c component, where allocated memory is not properly reused or freed, leading to a direct leak of approximately 4500 bytes. This leak was detected using AddressSanitizer while processing certain image files with the 'img2sixel' converter.

Impact

Exploitation of this vulnerability causes a memory leak, where allocated memory is not released, potentially leading to increased memory usage and degradation of performance over time.

Reproduction

The vulnerability can be reproduced by using the 'img2sixel' command-line tool with specific options that trigger the memory leak. The PoC file demonstrating this issue is available as part of the vulnerability report.

Remediation

The memory leak has been fixed in the 'develop' branch of the libsixel repository, and will be included in the next release.