font: document (lack of) security hardening in font packages Malicious images are in our threat model, but at this time malicious fonts are not. Change-Id: I3edbf8ee83c946d2530ec71abb6db3a06a6a6964 Reviewed-on: https://go-review.googlesource.com/c/image/+/795381 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/font/opentype/opentype.go b/font/opentype/opentype.go
index 694ac47..72e83f0 100644
--- a/font/opentype/opentype.go
+++ b/font/opentype/opentype.go

@@ -9,6 +9,13 @@
 // implementing the golang.org/x/image/font.Face interface.
 //
 // The sibling golang.org/x/image/font/sfnt package provides a low-level API.
+//
+// # Security Considerations
+//
+// This package is not hardened against malicious inputs.
+// Crashes, excessive CPU or memory consumption, or similar misbehavior
+// caused by malicious or corrupt inputs will be handled as ordinary bugs,
+// not vulnerabilities.
 package opentype // import "golang.org/x/image/font/opentype"
 
 import (

diff --git a/font/plan9font/plan9font.go b/font/plan9font/plan9font.go
index 858b0f6..1822ab5 100644
--- a/font/plan9font/plan9font.go
+++ b/font/plan9font/plan9font.go

@@ -5,6 +5,13 @@
 // Package plan9font implements font faces for the Plan 9 font and subfont file
 // formats. These formats are described at
 // https://9p.io/magic/man2html/6/font
+//
+// # Security Considerations
+//
+// This package is not hardened against malicious inputs.
+// Crashes, excessive CPU or memory consumption, or similar misbehavior
+// caused by malicious or corrupt inputs will be handled as ordinary bugs,
+// not vulnerabilities.
 package plan9font // import "golang.org/x/image/font/plan9font"
 
 import (

diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go
index d1ef8a6..103aa43 100644
--- a/font/sfnt/sfnt.go
+++ b/font/sfnt/sfnt.go

@@ -28,6 +28,13 @@
 // another io.Writer, copying the underlying TTF file, but this package does
 // not provide an encoder. Specifically, there is no API to build a different
 // TTF file, whether 'from scratch' or by modifying an existing one.
+//
+// # Security Considerations
+//
+// This package is not hardened against malicious inputs.
+// Crashes, excessive CPU or memory consumption, or similar misbehavior
+// caused by malicious or corrupt inputs will be handled as ordinary bugs,
+// not vulnerabilities.
 package sfnt // import "golang.org/x/image/font/sfnt"
 
 // This implementation was written primarily to the