webp: avoid canvas overflow on 32-bit systems RFC 9649 permits canvases with a width*height of up to 2^32-1. Enforce a slightly smaller limit of 2^31-1 to avoid overflow on 32-bit platforms. This corrects the fix in CL 759860 to cover 32-bit platforms as well. For golang/go#78407 For CVE-2026-33813 Change-Id: Ib380c95234b59ed0074d00d0a18de9686a6a6964 Reviewed-on: https://go-review.googlesource.com/c/image/+/780860 Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This repository holds supplementary Go image packages.
The packages in this repository have the same security model as the standard library image package. Specifically, when operating on arbitrary images, DecodeConfig should be called before Decode, so that the program can decide whether the image, as defined in the returned header, can be safely decoded with the available resources. A call to Decode which produces an extremely large image, as defined in the header returned by DecodeConfig, is not considered a security issue, regardless of whether the image is itself malformed or not.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/image.
The main issue tracker for the image repository is located at https://go.dev/issues. Prefix your issue with “x/image:” in the subject line, so it is easy to find.