From 022bfda52a15c8d615e8ee298a19efe1250f9ab3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Jan 2024 10:40:59 +0100 Subject: [chore]: Bump golang.org/x/image from 0.14.0 to 0.15.0 (#2506) Bumps [golang.org/x/image](https://github.com/golang/image) from 0.14.0 to 0.15.0. - [Commits](https://github.com/golang/image/compare/v0.14.0...v0.15.0) --- updated-dependencies: - dependency-name: golang.org/x/image dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- vendor/golang.org/x/image/webp/decode.go | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'vendor/golang.org/x/image/webp/decode.go') diff --git a/vendor/golang.org/x/image/webp/decode.go b/vendor/golang.org/x/image/webp/decode.go index d6eefd596..e211c7d57 100644 --- a/vendor/golang.org/x/image/webp/decode.go +++ b/vendor/golang.org/x/image/webp/decode.go @@ -39,6 +39,7 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) { alpha []byte alphaStride int wantAlpha bool + seenVP8X bool widthMinusOne uint32 heightMinusOne uint32 buf [10]byte @@ -113,6 +114,10 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) { return m, image.Config{}, err case fccVP8X: + if seenVP8X { + return nil, image.Config{}, errInvalidFormat + } + seenVP8X = true if chunkLen != 10 { return nil, image.Config{}, errInvalidFormat } -- cgit v1.2.3