Heap Buffer Overflow leading to Core Dump via vulnerable `libwebp` dependency (CVE-2023-4863)

[dywzju09-blip]

Error Description:
dssim version 3.4.0 transitively depends on an outdated version of libwebp that is vulnerable to CVE-2023-4863. When dssim parses a maliciously crafted .webp image for similarity comparison, the underlying C library suffers a heap buffer overflow in the lossless Huffman decoder. This corrupts heap metadata and causes an immediate crash (core dump).

Reproduction Steps:

1. Obtain a standard WebP image (test.webp) and a malicious WebP image crafted to trigger CVE-2023-4863 (bad.webp).
2. Run the dssim tool to compare them: dssim test.webp bad.webp.
3. Observe the program output and exit status.

Observable Evidence / Impact:
The glibc memory allocator detects the heap metadata corruption and aborts the process, resulting in a core dump.

Running `dssim test.webp bad.webp`
corrupted size vs. prev_size
timeout: the monitored command dumped core

Suggested Mitigation:
Update dependencies (load_image / webp-static / libwebp-sys2) to versions that statically or dynamically link against a patched libwebp (>= 1.3.2).