Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Please be very careful when using less popular C/C++ image parsing libraries on anything that is user-controlled or that comes from the Internet.

Image, multimedia, and archive parsing are notoriously prone to security bugs. In fact, so are most other types of complex parsing. There are months of researcher work and decades of CPU time that went into auditing and fuzzing libraries such as libpng or libjpeg-turbo, identifying and fixing lots of vulnerabilities. The same isn't true for libraries with much smaller following, especially if their documentation doesn't contain any discussion of security risks and countermeasures taken.



And a quick glance shows that the code isn't written in a terribly obvious and defensive manner. For example, just by skimming you can spot loads and loads of unchecked arithmetic. How can you know none of that can be exploited? The code doesn't do a lot to assure you of that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: