webp: require that VP8/VP8L dimensions match canvas dimensions VP8 and VP8L chunks contain a width and height. RFC 9649 indicates that this width/height is supposed to match the width/height of the canvas. Verify that they do. Fixes a potential crash when processing a file where an alpha-channel chunk does not match the canvas dimensions. Fixes CVE-2026-46601 Fixes golang/go#79869 Change-Id: I26d13a523870b7cbf4bbd7f5f2383cfc6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/image/+/787681 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Neal Patel <neal@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com>
This repository holds supplementary Go image packages.
The packages in this repository have the same security model as the standard library image package. Specifically, when operating on arbitrary images, DecodeConfig should be called before Decode, so that the program can decide whether the image, as defined in the returned header, can be safely decoded with the available resources. A call to Decode which produces an extremely large image, as defined in the header returned by DecodeConfig, is not considered a security issue, regardless of whether the image is itself malformed or not.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/image.
The main issue tracker for the image repository is located at https://go.dev/issues. Prefix your issue with “x/image:” in the subject line, so it is easy to find.