Repository navigation
x/image/vp8l: excessive memory allocation from unused Huffman tree groups #80069
Description
VP8L images include a number of Huffman tree groups. Tiles in the image reference groups by index. An image file can contain tree groups which are not referenced by any tile.
x/image/vp8l decodes unused Huffman tree groups. A small malicious image can cause the decoder to allocate a ~175MiB slice to hold tree groups. If the image includes the group data it can cause up to ~1.4GiB of allocations.
We should avoid excessive allocations when processing images with unused Huffman tree groups.
For reference, libwebp parses and discards unused groups when the number of groups is large (for some definition of large):
https://chromium.googlesource.com/webm/libwebp/+/refs/tags/v1.6.0/src/dec/vp8l_dec.c#410
This is a PUBLIC track vulnerability and CVE-2026-46603.
Activity
gabyhelp commentedon Jun 19, 2026
Related Issues
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
neild commentedon Jun 23, 2026
Thanks to sorte for reporting this issue.
gopherbot commentedon Jun 23, 2026
Change https://go.dev/cl/793460 mentions this issue:
vp8l: vp8l: avoid allocating many unused Huffman tree groupsvp8l: avoid allocating many unused Huffman tree groups