The WebP 0day
To me, this bug is most similar to the Timsort bug back in 2015 [1].<p>Timsort is an ingenious hybrid sorting algorithm originated from CPython and many implementations including OpenJDK adopted it mostly via a source-by-source translation. Timsort particularly maintains a stack of sorted runs, and due to the construction there is a small enough finite limit in the maximum possible stack size. However the original CPython implementation didn&#x27;t exactly match what was proven, so there were rare cases where stack overflow could happen. So this was a serious security bug in CPython, but wasn&#x27;t in OpenJDK because Java instead threw an exception in that case.<p>Similarly, this WebP bug occurred because the largest table size was formally proven but it didn&#x27;t match what was fed to the source code. This kind of bugs is not only hard to verify but also hard to review, because of course there is a proof and the source code seems to match the proof, so it should be okay! This bug suggests strong needs for approachable formal verification, including the use of memory-safe languages (type systems can be regarded as a weak form of formal verification), not human reviews.<p>[1] <a href="http:&#x2F;&#x2F;envisage-project.eu&#x2F;wp-content&#x2F;uploads&#x2F;2015&#x2F;02&#x2F;sorting.pdf" rel="nofollow noreferrer">http:&#x2F;&#x2F;envisage-project.eu&#x2F;wp-content&#x2F;uploads&#x2F;2015&#x2F;02&#x2F;sortin...</a>