_content/doc/security: decision: large images

Parsing a large image is not a vulnerability.

Change-Id: Ia066f2aa8bf5415dee6f5e4d069b3e396a6a6964
Reviewed-on: https://go-review.googlesource.com/c/website/+/786342
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

_content/doc/security/decisions.md

diff --git a/_content/doc/security/decisions.md b/_content/doc/security/decisions.md
index 1e6cdf1..84af168 100644
--- a/_content/doc/security/decisions.md
+++ b/_content/doc/security/decisions.md
@@ -33,3 +33,20 @@
   tests is not within our threat model.
 
 ## Non-Vulnerabilities
+
+### image, x/image: Large images
+
+Parsing a large image can allocate a large amount of memory.
+For example, a 65536x65536 32-bit color image requires 16MiB
+to store uncompressed.
+
+Many image compression formats can reduce a large, simple image
+to a very small file size. Decoding the small file may allocate
+a large amount of memory.
+
+Users parsing untrusted images should verify the image size prior
+to parsing, using a function such as
+[image.DecodeConfig](https://pkg.go.dev/image#DecodeConfig).
+
+We do not consider it to be a vulnerability for an image parsing
+function to decode a large, well-compressed image.