libwebp
image
Our great sponsors
libwebp | image | |
---|---|---|
13 | 37 | |
1,908 | 4,505 | |
1.9% | 2.7% | |
8.7 | 9.1 | |
7 days ago | 7 days ago | |
C | Rust | |
BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
libwebp
-
Google assigns a CVE for libwebp and gives it a 10.0 score
The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to verify. I suspect the cost would be relatively small. Small enough that I personally would be happy to pay it.
https://github.com/webmproject/libwebp/commit/902bc919033134...
This is also a great reminded that fuzzing isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code, a couple too many branches away from being likely to be found by fuzzing.
-
The WebP 0day
There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c87044...
[0]: https://security-tracker.debian.org/tracker/CVE-2023-4863
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
The breakage [0] was introduced by the creator [1] of the project. If you want to audit 1674 commits over the past 12 years, it'd be easier to just audit the full project.
[0] https://github.com/webmproject/libwebp/commit/21735e06f7c1cb...
[1] https://github.com/webmproject/libwebp/commit/c3f41cb47e5f32...
- Convenient CPU feature detection and dispatch in the Magnum Engine
-
Whats going on with .webp and why are more and more internet images being converted to it?
If you like the command line, then you can use ffmpeg and ImageMagick, or use libwebp directly
-
What's up with people hating WebP?
The webp parser code is open source. Which means that even if Google decides to hide/obscure the code for webp, they'd legally not be allowed to prevent you from using older versions of the webp parser library. The only thing they could do is patent it, and then companies in the US (which has software patents, unfortunately) would have to pay royalties to decode it anyway; but here comes the next point
image
-
Transitioning From PyTorch to Burn
With the help of the image crate, loading an image from disk is fairly straightforward.
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
FTR there is a WebP decoder implementation in safe Rust in the image crate: https://github.com/image-rs/image
It used to be quite incomplete for a long time, but work last year has implemented many webp features. Chromium now has a policy of allowing the use of Rust dependencies, so maybe Chromium could start adopting it?
-
Porting a local app to Web
Hello! So I have a local app that I am currently running on desktop (windows). I'm using egui for the UI, and the program basically opens a folder, gets all the images in the folder, and then uses the image-rs library to resize and create a grid of images / some other operations.
- Setting the DPI of an image before saving it
-
png crate gets an ultrafast compression mode, up to 4x faster decompression
png is the de-facto standard Rust crate for reading and writing PNG images, used e.g. by the image crate.
-
What's everyone working on this week (12/2023)?
There's also a CLI to convert between formats. It uses the crate image.
-
The `exr` crate got up to 3x faster, even better performance coming soon
exr is a is a 100% Rust and 100% safe code library for reading and writing OpenEXR images. It is used by the popular image crate to read and write OpenEXR.
-
Announcing zune-jpeg: Rust's fastest JPEG decoder
We're currently looking for contributors to add support for zune-jpeg to the image crate. The image maintainers are open to it, but don't have the capacity to do it themselves. You can find more details here.
-
Does the rust image crate support paletted png?
It would be helpful to contribute to the general change towards an untyped buffer with runtime representations for color space information and fallible conversions. (https://github.com/image-rs/image/pull/1718). It's currently stalling on having too few eyeballs to judge the impact and need for that complexity.
-
picst - a CLI tool to resize clipboard images on the fly
It uses https://github.com/1Password/arboard and https://github.com/image-rs/image under the hood. I haven't tested deeply but I assume it should handle many formats out of the box.
What are some alternatives?
libjpeg-turbo - Main libjpeg-turbo repository
opencv-rust - Rust bindings for OpenCV 3 & 4
Save-webP-as-extension - Firefox extension to overlay format and JPEG quality buttons on inline or stand-alone images for quickly saving a converted version of the image.
photon - ⚡ Rust/WebAssembly image processing library
BrowserBoxPro - :cyclone: BrowserBox is Web application virtualization via zero trust remote browser isolation and secure document gateway technology. Embed secure unrestricted webviews on any device in a regular webpage. Multiplayer embeddable browsers, open source! [Moved to: https://github.com/BrowserBox/BrowserBox]
imageproc - An advanced image processing library for Rust.
image - [mirror] Go supplementary image libraries
imageproc (PistonDevelopers) - Image processing operations
libavif - libavif - Library for encoding and decoding .avif files
rust-ndarray - ndarray: an N-dimensional array with array views, multidimensional slicing, and efficient operations
Electron - :electron: Build cross-platform desktop apps with JavaScript, HTML, and CSS
oxipng - Multithreaded PNG optimizer written in Rust