libwebp-1.2.3

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

- 6/30/2022: version 1.2.3
  This is a binary compatible release.
  * security fix for lossless encoder
  * improved progress granularity in WebPReportProgress() when using lossless
  * improved precision in Sharp YUV (-sharp_yuv) conversion
  * many corrections to webp-lossless-bitstream-spec.txt
  * crash/leak fixes on error/OOM and other bug fixes

[Douglas R. Reno]

There were no details on WebP's bug tracker, nor on Chromium's bug tracker.

However, I found the commits that bug 565 (the security fix) was resolved in:

​https://github.com/webmproject/libwebp/commit/fe153fae98a3fe4626ff537ec8d5f4477cec5739

​https://github.com/webmproject/libwebp/commit/a828a59b49d2e3fbc40dc42a6ee6426cd0f2c9dc

​https://github.com/webmproject/libwebp/commit/e3cfafaf719c2e163d3548d7a415da96fdff714f

This looks to be a denial of service (memory leak and segmentation fault due to being out of memory) issue when processing JPG images to convert them to WebP images

No CVE number yet, but this should be enough to file an advisory.

[Douglas R. Reno]

I'll file an advisory once more information about this one is available (a CVE number in particular). It doesn't make much sense to refer to bug reports instead since they're currently locked to the public.

[Douglas R. Reno]

Fixed at 7d5d3d4bf5bff53b39c6df7b8b67b469bed785f1