Update SkiaSharp to 2.88.6 to fix a critical security vulnerability

[spofdamon]

What does the pull request do?

Updates SkiaSharp from 2.88.3 to 2.88.6 to pull in the fix for a critical security vulnerability reported on September 11th.

What is the current behavior?

tl;dr A buffer overflow in libwebp, used by Skia, allows a maliciously crafted .webp file to execute arbitrary code in the rendering process.

From the vulnerability report:

Overview

Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.

Notes:

This is only exploitable if the color_cache_bits value defines which size to use.

This vulnerability was also published on libwebp CVE-2023-5129

What is the updated/expected behavior with this PR?

The security vulnerability will be closed.

How was the solution implemented (if it's not obvious)?

Just bumped the SkiaSharp version number to the first release with the fix.

Checklist

• Added unit tests (if possible)?
• Added XML documentation to any related classes?
• Consider submitting a PR to https://github.com/AvaloniaUI/avalonia-docs with user documentation

Breaking changes

Shouldn't be any. The Skia render tests succeed on my machine.

Obsoletions / Deprecations

N/A

Fixed issues

Fixes #13105

[spofdamon]

@dotnet-policy-service agree

[avaloniaui-team]

You can test this PR using the following package version. 11.0.999-cibuild0040396-beta. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

[avaloniaui-team]

You can test this PR using the following package version. 11.0.999-cibuild0040398-beta. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

[Mrxx99]

As this is a security fix it would make sense to backport to 11.0.x too