I'm confused about security notice

[CycloneRing]

Hi, I can't understand what kind of security issue this library has? How can someone perform attacks when using stb headers when they are compiled in machine code in final program? Can I get some examples?

[nothings]

If you try to use stb_image to load an image provided by an attacker, bad things could potentially happen. If you only use it to load your own choice of images, generally things are fine.

[CycloneRing]

Thank you for quick reply! Gladly I only need to use it to encode images.

[CycloneRing]

Does this apply to PNG or JPG as well or more complicated formats like HDR EXR TGA?
I only need JPG and PNG

[nothings]

If you're just using it to encode images it doesn't matter, but it applies to all formats (jpg and png are also complicated internally).