libwebp
jxl.js
libwebp | jxl.js | |
---|---|---|
13 | 25 | |
1,913 | 296 | |
0.9% | - | |
8.8 | 0.0 | |
5 days ago | about 1 year ago | |
C | JavaScript | |
BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
libwebp
-
Google assigns a CVE for libwebp and gives it a 10.0 score
The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to verify. I suspect the cost would be relatively small. Small enough that I personally would be happy to pay it.
https://github.com/webmproject/libwebp/commit/902bc919033134...
This is also a great reminded that fuzzing isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code, a couple too many branches away from being likely to be found by fuzzing.
-
The WebP 0day
There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c87044...
[0]: https://security-tracker.debian.org/tracker/CVE-2023-4863
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
The breakage [0] was introduced by the creator [1] of the project. If you want to audit 1674 commits over the past 12 years, it'd be easier to just audit the full project.
[0] https://github.com/webmproject/libwebp/commit/21735e06f7c1cb...
[1] https://github.com/webmproject/libwebp/commit/c3f41cb47e5f32...
- Convenient CPU feature detection and dispatch in the Magnum Engine
-
Whats going on with .webp and why are more and more internet images being converted to it?
If you like the command line, then you can use ffmpeg and ImageMagick, or use libwebp directly
-
What's up with people hating WebP?
The webp parser code is open source. Which means that even if Google decides to hide/obscure the code for webp, they'd legally not be allowed to prevent you from using older versions of the webp parser library. The only thing they could do is patent it, and then companies in the US (which has software patents, unfortunately) would have to pay royalties to decode it anyway; but here comes the next point
jxl.js
-
JPEG XL and the Pareto Front
> It's so frustrating how the chromium team is ending up as a gatekeeper of the Internet by pick and choosing what gets developed or not.
https://github.com/niutech/jxl.js is based on Chromium tech (Squoosh from GoogleChromeLabs) and provides an opportunity to use JXL with no practical way for Chromium folks to intervene.
Even if that's a suboptimal solution, JXL's benefits supposedly should outweight the cost of integrating that, and yet I haven't seen actual JXL users running to that in droves.
So JXL might not be a good support for your theory: where people could do they still don't. Maybe the format isn't actually that important, it's just a popular meme to rehash.
-
Still no love for JPEG XL: Browser maker love-in snubs next-gen image format
https://github.com/niutech/jxl.js a javascript polyfill taken from the main page https://jpegxl.info/
There are other decoders [0] written in a "safe language" (rust) listed as well. So no there are many "safe" implementations
[0] https://github.com/tirr-c/jxl-oxide
- CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
-
Apple Safari 17 beta release notes: JPEG XL support added
> If you care about JXL, and only want to support JXL, and you put a JXL in your picture tag, then the browser still won't render it, even if you use a picture tag.
Is this true if you provide a polyfill? Have you tried it and it failed? (Serious question.)
https://github.com/niutech/jxl.js
-
FSF Slams Google over Dropping JPEG-XL in Chrome
All of the people here who are so passionate about JPEG-XL will be happy to learn that there's nothing preventing them from using it on their sites right now:
https://github.com/niutech/jxl.js
If you want Chrome to ship with JPEG-XL support, use it. At some point, browser makers will decide it's worth the cost to them and all users to add it.
-
Nvenc vs. QSV: Who Has the Best Hardware AV1 Encoder?
> Please be aware that some images may not load on this page unless your browser supports JPEG-XL
The site could provide a WebAssembly decoder to make the JPEG-XL images work for everyone.
For example, here's a WebAssembly decoder: https://github.com/niutech/jxl.js
Demo: https://niutech.github.io/jxl.js/
-
Question: Is there a list anywhere of which browsers support JPG-XL by default?
at this point, I'd consider just using a polyfill library to decode jpegxl data client-side, like JXL https://github.com/niutech/jxl.js
-
Efficient and performance-portable vector software
:) There are some wasm vs native benchmarks in the context of JPEG XL (for example https://github.com/niutech/jxl.js#benchmark)
-
Adding JPEG XL & QOI Support to my Website OS
For adding JPEG XL support I went with jxl.js which I modified for my use case. After looking through the main file, which is also called jxl.js, I decided I only needed 2 relevant code blocks. The one to decode the image and the one to turn the ImageData into something I could display in my existing codebase (which I already partially had implemented for another use case).
-
JXL.js decoder now features multithreading and SIMD
It's easy - you'll get ReferenceError: SharedArrayBuffer is not defined when the COOP and COEP headers are not set. Multithreading is enabled by default if you use the scripts from multithread folder. If only SIMD is supported, it is being used. Oh, and progressive decoding is also enabled by default.
What are some alternatives?
libjpeg-turbo - Main libjpeg-turbo repository
jxl-wasm - WebAssembly-compiled JPEG XL command line tool for Node.js
Save-webP-as-extension - Firefox extension to overlay format and JPEG quality buttons on inline or stand-alone images for quickly saving a converted version of the image.
ImageMagick - 🧙♂️ ImageMagick 7
BrowserBoxPro - :cyclone: BrowserBox is Web application virtualization via zero trust remote browser isolation and secure document gateway technology. Embed secure unrestricted webviews on any device in a regular webpage. Multiplayer embeddable browsers, open source! [Moved to: https://github.com/BrowserBox/BrowserBox]
jpeg-xl - jpeg-xl for the Windows build of ImageMagick
image - [mirror] Go supplementary image libraries
squoosh - Make images smaller using best-in-class codecs, right in the browser.
libavif - libavif - Library for encoding and decoding .avif files
libiamf - Reference Software for IAMF
Electron - :electron: Build cross-platform desktop apps with JavaScript, HTML, and CSS
node-unblocker - Web proxy for evading internet censorship, and general-purpose Node.js library for proxying and rewriting remote webpages