vp8l: avoid allocating many unused Huffman tree groups A VP8L image contains a number of Huffman tree groups. The number of groups is derived from the largest group index observed in the file. The largest possible index is 2^16-1. A VP8L file may included unused groups. Decoding and storing all unused groups can cause excessive memory allocation from a small input file. Use the same approach to unused groups as libwebp: When there are many groups (for some definition of "many"), store the groups as a compacted array with unreferenced groups removed, and rewrite all references to index into the new array. In addition, limit the total number of groups to 2600. The libwebp encoder never produces more than this number of groups, and there don't seem to be any other encoders in common use. Fixes golang/go#80069 Fixes CVE-2026-46603 Change-Id: I8738d53b67510a8c12b99fd4df55f4126a6a6964 Reviewed-on: https://go-review.googlesource.com/c/image/+/793460 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com> Reviewed-by: Nigel Tao <nigeltao@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-by: Nigel Tao <nigeltao@google.com>
This repository holds supplementary Go image packages.
The packages in this repository have the same security model as the standard library image package. Specifically, when operating on arbitrary images, DecodeConfig should be called before Decode, so that the program can decide whether the image, as defined in the returned header, can be safely decoded with the available resources. A call to Decode which produces an extremely large image, as defined in the header returned by DecodeConfig, is not considered a security issue, regardless of whether the image is itself malformed or not.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/image.
The main issue tracker for the image repository is located at https://go.dev/issues. Prefix your issue with “x/image:” in the subject line, so it is easy to find.
