But the initial security issue was in libwebp, which is made by Google, and surely Google had already fuzzed it and run all the available static analyzers in the world.
Static analyzers are nice to have, but they can't warn of every issue out there.
Static analyzers are nice to have, but they can't warn of every issue out there.
I am skeptical inventing any kind of WebP was a good idea, but I know the inventor and he got mad at me last time I said that, so I won't.
The lesson I hope was learned is that nobody should be writing new parsers in an unsafe language. WebP is old enough that it was defensible at the time but everyone should have a “no new C/C++” policy for internet-facing code.
It's not better enough than JPEG to be worth existing.
Also HEIF actually has useful features, it supports HDR!
AVIF is certainly better though. I only feel positively about AVIF and JPEGXL.