x/image/webp: lack of maximum size checks can create invalid images on 32-bit platforms

[neild]

On 32-bit platforms, decoding a WebP image with a canvas size that overflows an int32 returns a corrupt Image that will panic when accessed.

WebP VP8X headers may not specify a canvas size (width * height) more than 2^32-1 pixels:
https://www.rfc-editor.org/rfc/rfc9649.html#section-2.7-12

We should not return corrupt images, and we should reject canvases that overflow the defined limit.

Thanks to Tristan Madani for reporting this issue.

This has been designated a PUBLIC track vulnerability and CVE-2026-33813.

[gabyhelp]

Related Issues

• image/png: integer overflows lead to panic in PNG decoder on 32-bit architectures #38435 (closed)
• image/png: Integer underflow bug on 32-bit systems #12687 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/759860 mentions this issue: webp: reject VP8X headers with too-large canvases

[gopherbot]

Change https://go.dev/cl/780860 mentions this issue: webp: avoid canvas overflow on 32-bit systems