Repository navigation
x/image/webp: VP8L chunk dimension validation comes too late #80063
Description
Consider a WEBP image containing a VP8X chunk giving one set of dimensions, followed by a VP8L chunk with a different set of dimensions.
DecodeConfig reports the dimensions from the VP8X chunk.
Decoding will decode the VP8L chunk, detect the mismatch, and return an error. However, this error is only reported after allocating memory for the VP8L chunk. At the maximum VP8L chunk size (16384x16384), that's a 1GiB transient allocation.
Credit to herdiyana256 for noticing this in https://go.dev/cl/774460.
1GiB is a lot, but this is a transient allocation. We've tentatively decided to call this a hardening measure rather than a vulnerability.
Activity
gopherbot commentedon Jun 18, 2026
Change https://go.dev/cl/792240 mentions this issue:
webp: check for VP8L dimension mismatch before allocationgabyhelp commentedon Jun 18, 2026
Related Issues
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
webp: check for VP8L dimension mismatch before allocation