From bb9fda892dbafc6f51b1795a5b0f157f4895ee87 Mon Sep 17 00:00:00 2001
From: wangyangdi <wangyangdi@kylinos.cn>
Date: Tue, 1 Sep 2026 10:43:48 +0800
Subject: [PATCH] fix:CVE-2026-5186

---
 stb_image.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/stb_image.h b/stb_image.h
index 9eedabedc4..7d47e5bd1a 100644
--- a/stb_image.h
+++ b/stb_image.h
@@ -7060,8 +7060,10 @@ static void *stbi__gif_load(stbi__context *s, int *x, int *y, int *comp, int req
 
       // moved conversion to after successful load so that the same
       // can be done for multiple frames.
-      if (req_comp && req_comp != 4)
+      if (req_comp && req_comp != 4) {
          u = stbi__convert_format(u, 4, req_comp, g.w, g.h);
+         g.out = NULL;
+      }
    } else if (g.out) {
       // if there was an error and we allocated an image buffer, free it!
       STBI_FREE(g.out);