search

lvandeve / lodepng

PNG encoder and decoder in C and C++.
zlib License
2.04k stars 420 forks source link

Is lodepng safe to use with arbitrary files? #127

Closed randy408 closed 4 years ago

randy408 commented 4 years ago

Given reasonable image width- and height limits, is it capable of decoding arbitrary files without crashing, running out of memory or taking forever?

lvandeve commented 4 years ago

Fuzzing helps find such security bugs. LodePNG is being fuzzed with oss-fuzz here:

https://github.com/google/oss-fuzz/tree/master/projects/lodepng

Bugs found by fuzzing have been fixed in the past, and the fuzzer has not found new bugs for months, as of typing this.

You can judge based on this information and the above oss-fuzz link.

lvandeve commented 4 years ago

To answer the running out of memory question:

lodepng will handle out of memory errors, it'll return an error code.

by default, lodepng will try to allocate whatever is needed without limits, if an image is 1 billion by 1 billion pixels it would try to allocate that (but not on a 32-bit machine since this would overflow there). You could use lodepng_inspect beforehand to get the width and height of the image and reject too large images.

randy408 commented 4 years ago

Thanks for the answers.