Code: vips_malloc( VipsObject *object, size_t size )
 {
 	void *buf;
 
	buf = g_malloc( size );
 
         if( object ) {
 		g_signal_connect( object, "postclose", 
			G_CALLBACK( vips_malloc_cb ), buf );
		object->local_memory += size;
	}

	return( buf );
}

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
Commit Message: zero memory on malloc

to prevent write of uninit memory under some error conditions

thanks Balint