Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.

...

3 commits
5 files changed
2 contributors

Commits on Mar 30, 2026

webp: reject VP8X headers with too-large canvases

RFC 9649 states that the canvas width * height must be
at most 2^32-1. Enforce this.

This avoids creating an invalid image (which will panic
when manipulated) when decoding a too-large image on
32-bit platforms.

https://www.rfc-editor.org/rfc/rfc9649.html#section-2.7-12

Fixes golang/go#78407
Fixes CVE-2026-33813

Change-Id: I7e2b68374681da4f72ee51ebfd8833006a6a6964
Reviewed-on: https://go-review.googlesource.com/c/image/+/759860
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Damien Neil <[email protected]>
Reviewed-by: Neal Patel <[email protected]>

neild authored and gopherbot committed Mar 30, 2026

Commits on Apr 1, 2026

font/sfnt: apply bounds checks before allocating read buffer

When using ReadAt to read more than 1MiB of data from a font file,
verify that the file contains the data before allocating the
read buffer. Avoids excessive memory allocation when parsing corrupt
or malicious font files.

Thanks to Andy Gill, ZephrSec Ltd for reporting this issue.

Fixes golang/go#78382
Fixes CVE-2026-33812

Change-Id: Icd5e7388661a76a6af800f0ba0b728c46a6a6964
Reviewed-on: https://go-review.googlesource.com/c/image/+/761180
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Damien Neil <[email protected]>
Reviewed-by: Neal Patel <[email protected]>

neild authored and gopherbot committed Apr 1, 2026

Commits on Apr 9, 2026

go.mod: update golang.org/x dependencies

Update golang.org/x dependencies to their latest tagged versions.

Change-Id: Ibbf25c50cf9f700e7a8fca7ce751350e7629ca2c
Reviewed-on: https://go-review.googlesource.com/c/image/+/764500
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Gopher Robot <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>
Reviewed-by: David Chase <[email protected]>

gopherbot committed Apr 9, 2026