Divide By Zero Vulnerability in dlib TGA File Handling
A divide-by-zero vulnerability in dlib's Targa file handling function was patched after being identified as a copy of code from libjpeg-turbo that had not received an upstream security fix. The fix was merged in late February 2025.
What happened
A security vulnerability in dlib's start_input_tga() function was identified. The function was cloned from libjpeg-turbo but did not receive a security patch that had been applied to the original code.
The vulnerability involved a potential divide by zero or integer overflow issue related to image dimension validation when reading Targa files. A fix was submitted via pull request #3058 on February 24, 2025, and merged on February 27, 2025, which adds validation to throw an error when image width or height is 0.
Index analysis
The original upstream vulnerability was reported in libjpeg-turbo under CVE-2018-11212. The same vulnerability existed in dlib's cloned code until the patch was applied.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.