The version of libwebp used by ImageSharp is not recognized by the BDBA

[manupstairs]

Hi, I have a project that indirectly references ImageSharp.
When I use BDBA(Black Duck Binary Analysis) to scan project, then I find BDBA can't reconginzed the version of libwebp (ImageSharp use it).
For components of unknown versions, the BDBA displays all historical vulnerabilities.

My question is that, is there any way to confirm libwebp verison in ImageSharp? Any document, link, comment can indicate the version?
Thank you very much!

[tocsoft]

ImageSharp does not use libwebp... imagesharp is completly managed code so we have our own custom implementations of webp encodes/decoders.

[manupstairs]

Thanks @tocsoft !
That means this is a false positive report by BDBA.
Since imagesharp has own custom implementations of webp encodes/decoders.
So I think there is no vulnerability just like above image second line show.

[Myster]

Does this mean the CVE-2023-4863 vulnerability or similar does not exist?
Is it possible when translating the original into managed code that the vulnerability was included?
Since the vulnerability relates to buffer overflow I assume this would only be possible if 'unsafe' keyword was used in the c# version.

[JimBobSquarePants]

There's no unsafe code in that area so the worst thing that would happen is an argument out of range exception.

However.... I would like to see the diff from the relevant patch applied so that was avoided.

webmproject/libwebp@902bc91#diff-048cd0744572f0f96c1fd0a2115c8f6b4019473409d3584a348fce0f9e522b6c