Skip to content

[pull] master from golang:master#34

Merged
pull[bot] merged 3 commits into
trailofbits:masterfrom
golang:master
May 15, 2026
Merged

[pull] master from golang:master#34
pull[bot] merged 3 commits into
trailofbits:masterfrom
golang:master

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 15, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

adavila0703 and others added 3 commits May 14, 2026 14:41
…nput

Document that image.Decode may allocate memory proportional to width and
height from the image header before all pixel data is consumed or validated,
and that image.DecodeConfig reads only headers without allocating a full
pixel buffer.

Add package-level and function-level notes on gif.Decode, gif.DecodeAll,
and gif.DecodeConfig pointing to the same guidance and the Security
Considerations section in package image.

Add ExampleDecode_untrusted in package image: call DecodeConfig, reject
oversized dimensions using an int64 pixel product, then Decode.

Updates #79063

Change-Id: I491fa036dab49f4d413e04df161da5f430f3cf97
GitHub-Last-Rev: 8effaee
GitHub-Pull-Request: #79221
Reviewed-on: https://go-review.googlesource.com/c/go/+/774640
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Alan Donovan <adonovan@google.com>
Reviewed-by: Alan Donovan <adonovan@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
386 and AMD64's splitload could silently change
a pointer type to an int type. Fix that.
Add type preservation to the narrower widths for symmetry,
even though it doesn't matter in the same way there.

Change-Id: I155d136dd43989900d26f2a7f014d7300fdbb7cb
Reviewed-on: https://go-review.googlesource.com/c/go/+/777820
Reviewed-by: Keith Randall <khr@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Keith Randall <khr@google.com>
Auto-Submit: Keith Randall <khr@golang.org>
For #78737

Change-Id: Ie8468fcdf6f7fa8e89522eaa0e7ba2636a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777921
Auto-Submit: Nicholas Husin <husin@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
@pull pull Bot locked and limited conversation to collaborators May 15, 2026
@pull pull Bot added the ⤵️ pull label May 15, 2026
@pull pull Bot merged commit fade3d0 into trailofbits:master May 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants