Executing Image.save_webp_to_buffer function crashes Godot

[qarmin]

Godot version

4.2.beta.custom_build. 2b987d1

System information

Ubuntu 22.04 CI

Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)

extends Node
func _process(delta):
	for i in get_children():
		i.queue_free()
	var temp_variable4230 = Image.new()
	temp_variable4230.crop(70, 75)
	temp_variable4230.compress_from_channels(1, -60, -88)
	temp_variable4230.save_webp_to_buffer(false, -2.51768231391907)

Godot crashes:

Godot Engine v4.2.beta.custom_build.2b987d1c5 - https://godotengine.org
Time set to: 0 seconds.
Loaded settings:
ERROR: Cannot convert to <-> from compressed formats. Use compress() and decompress() instead.
   at: convert (core/io/image.cpp:524)
=================================================================
==18481==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6210001c3110 at pc 0x55fd84218099 bp 0x7ffd494fad90 sp 0x7ffd494fad80
READ of size 16 at 0x6210001c3110 thread T0
    #0 0x55fd84218098 in _mm_loadu_si128 /usr/lib/gcc/x86_64-linux-gnu/11/include/emmintrin.h:703
    #1 0x55fd84218098 in ConvertBGRAToRGBA_SSE2 thirdparty/libwebp/src/dsp/lossless_sse2.c:535
    #2 0x55fd841267f1 in Import thirdparty/libwebp/src/enc/picture_csp_enc.c:777
    #3 0x55fd84126dba in WebPPictureImportRGBA thirdparty/libwebp/src/enc/picture_csp_enc.c:835
    #4 0x55fd8410f74c in WebPCommon::_webp_packer(Ref<Image> const&, float, bool) modules/webp/webp_common.cpp:99
    #5 0x55fd8410e50d in WebPCommon::_webp_lossless_pack(Ref<Image> const&) modules/webp/webp_common.cpp:54
    #6 0x55fd8410d028 in ResourceSaverWebP::save_image_to_buffer(Ref<Image> const&, bool, float) modules/webp/resource_saver_webp.cpp:73
    #7 0x55fd96e21aed in Image::save_webp_to_buffer(bool, float) const core/io/image.cpp:2578
    #8 0x55fd96f10fd2 in void call_with_variant_args_retc_helper<__UnexistingClass, Vector<unsigned char>, bool, float, 0ul, 1ul>(__UnexistingClass*, Vector<unsigned char> (__UnexistingClass::*)(bool, float) const, Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul, 1ul>) core/variant/binder_common.h:806
    #9 0x55fd96ef6ca3 in void call_with_variant_args_retc_dv<__UnexistingClass, Vector<unsigned char>, bool, float>(__UnexistingClass*, Vector<unsigned char> (__UnexistingClass::*)(bool, float) const, Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:567
    #10 0x55fd96ee236b in MethodBindTRC<Vector<unsigned char>, bool, float>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:583
    #11 0x55fd98257e26 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:775
    #12 0x55fd9760c12e in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1168
    #13 0x55fd7ef55ac9 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1704
    #14 0x55fd7e84f4f4 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1896
    #15 0x55fd8c016a40 in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:318
    #16 0x55fd8bf55230 in Node::_notification(int) scene/main/node.cpp:57
    #17 0x55fd7e35fca3 in Node::_notificationv(int, bool) scene/main/node.h:49
    #18 0x55fd982599b0 in Object::notification(int, bool) core/object/object.cpp:837
    #19 0x55fd8c114c02 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:951
    #20 0x55fd8c117ea6 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1028
    #21 0x55fd8c105f9c in SceneTree::process(double) scene/main/scene_tree.cpp:508
    #22 0x55fd7d99d731 in Main::iteration() main/main.cpp:3636
    #23 0x55fd7d6b5665 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:933
    #24 0x55fd7d693b97 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #25 0x7f6ab6829d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #26 0x7f6ab6829e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #27 0x55fd7d693544 in _start (/home/runner/work/Qarminer/Qarminer/godot.linuxbsd.editor.dev.x86_64.san+0x3a274544)
0x6210001c3110 is located 0 bytes to the right of 4112-byte region [0x6210001c2100,0x6210001c3110)
allocated by thread T0 here:
    #0 0x7f6ab74b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55fd96907167 in Memory::alloc_static(unsigned long, bool) core/os/memory.cpp:75
    #2 0x55fd7d83a402 in Error CowData<unsigned char>::resize<false>(int) core/templates/cowdata.h:291
    #3 0x55fd7d8175a5 in Vector<unsigned char>::resize(int) core/templates/vector.h:94
    #4 0x55fd7e7b07de in _compress_etcpak(EtcpakType, Image*) modules/etcpak/image_compress_etcpak.cpp:176
    #5 0x55fd7e7af1b5 in _compress_etc1(Image*) modules/etcpak/image_compress_etcpak.cpp:78
    #6 0x55fd96e23928 in Image::compress_from_channels(Image::CompressMode, Image::UsedChannels, Image::ASTCFormat) core/io/image.cpp:2654
    #7 0x55fd96f0d10c in void call_with_variant_args_ret_helper<__UnexistingClass, Error, Image::CompressMode, Image::UsedChannels, Image::ASTCFormat, 0ul, 1ul, 2ul>(__UnexistingClass*, Error (__UnexistingClass::*)(Image::CompressMode, Image::UsedChannels, Image::ASTCFormat), Variant const**, Variant&, Callable::CallError&, IndexSequence<0ul, 1ul, 2ul>) core/variant/binder_common.h:755
    #8 0x55fd96ef36d9 in void call_with_variant_args_ret_dv<__UnexistingClass, Error, Image::CompressMode, Image::UsedChannels, Image::ASTCFormat>(__UnexistingClass*, Error (__UnexistingClass::*)(Image::CompressMode, Image::UsedChannels, Image::ASTCFormat), Variant const**, int, Variant&, Callable::CallError&, Vector<Variant> const&) core/variant/binder_common.h:534
    #9 0x55fd96edffb3 in MethodBindTR<Error, Image::CompressMode, Image::UsedChannels, Image::ASTCFormat>::call(Object*, Variant const**, int, Callable::CallError&) const core/object/method_bind.h:496
    #10 0x55fd98257e26 in Object::callp(StringName const&, Variant const**, int, Callable::CallError&) core/object/object.cpp:775
    #11 0x55fd9760c12e in Variant::callp(StringName const&, Variant const**, int, Variant&, Callable::CallError&) core/variant/variant_call.cpp:1168
    #12 0x55fd7ef55ac9 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_vm.cpp:1704
    #13 0x55fd7e84f4f4 in GDScriptInstance::callp(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1896
    #14 0x55fd8c016a40 in bool Node::_gdvirtual__process_call<false>(double) scene/main/node.h:318
    #15 0x55fd8bf55230 in Node::_notification(int) scene/main/node.cpp:57
    #16 0x55fd7e35fca3 in Node::_notificationv(int, bool) scene/main/node.h:49
    #17 0x55fd982599b0 in Object::notification(int, bool) core/object/object.cpp:837
    #18 0x55fd8c114c02 in SceneTree::_process_group(SceneTree::ProcessGroup*, bool) scene/main/scene_tree.cpp:951
    #19 0x55fd8c117ea6 in SceneTree::_process(bool) scene/main/scene_tree.cpp:1028
    #20 0x55fd8c105f9c in SceneTree::process(double) scene/main/scene_tree.cpp:508
    #21 0x55fd7d99d731 in Main::iteration() main/main.cpp:3636
    #22 0x55fd7d6b5665 in OS_LinuxBSD::run() platform/linuxbsd/os_linuxbsd.cpp:933
    #23 0x55fd7d693b97 in main platform/linuxbsd/godot_linuxbsd.cpp:74
    #24 0x7f6ab6829d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/lib/gcc/x86_64-linux-gnu/11/include/emmintrin.h:703 in _mm_loadu_si128
Shadow bytes around the buggy address:
  0x0c42800305d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c42800305e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c42800305f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280030600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280030610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4280030620: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280030630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280030640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280030650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280030660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280030670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==18481==ABORTING

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project

Above