triggerable libwebp animation decode heap-buffer-overflow in nannou_webp_animation 0.2.2 (CVE-2023-4863)

[dywzju09-blip]

Summary

I confirmed a triggerable libwebp vulnerability path in nannou_webp_animation 0.2.2.
Malformed animated WebP input reaches the public animation decode API and causes a real AddressSanitizer heap-buffer-overflow.

Trigger Point

• nannou_webp_animation::decoder::WebpDecoder::decode(path)

Trigger Reason

• Malformed animated WebP input reaches libwebp's vulnerable animation decode path
• The project-owned decode method directly drives WebPAnimDecoderGetNext on attacker-controlled input

Trigger Evidence

• Input: malformed bad.webp
• Observed signal: AddressSanitizer: heap-buffer-overflow
• Native stack: ReplicateValue -> VP8LBuildHuffmanTable -> WebPAnimDecoderGetNext
• Project stack: WebpDecoder::decode at src/decoder.rs:122

Suggested Remediation

1. Upgrade libwebp to 1.3.2 or another fixed release.
2. Add a regression test for WebpDecoder::decode(path) using malformed animated WebP input.
3. If untrusted animated WebP input is supported, consider temporary validation or feature gating until the dependency upgrade is released.