Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dimension limit for alpha chunks #12

Open
jessa0 opened this issue Oct 29, 2023 · 0 comments
Open

Add dimension limit for alpha chunks #12

jessa0 opened this issue Oct 29, 2023 · 0 comments

Comments

@jessa0
Copy link
Contributor

jessa0 commented Oct 29, 2023

The VP8X chunk allows specifying ridiculously large canvas dimensions up to 2^24 x 2^24, which end up being used for ALPH chunk bitstreams. This can be a DoS vector. It's unclear whether there's a valid WebP with such large dimensions, as both the VP8 and VP8L bitstreams only allow dimensions up to 2^12 x 2^12. In other words, a larger ALPH would be rejected later anyway in parsing for mismatching dimensions with the VP8/VP8L appearing later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant