libwebp
Skia
Our great sponsors
libwebp | Skia | |
---|---|---|
13 | 55 | |
1,908 | 8,641 | |
1.9% | 2.5% | |
8.7 | 9.9 | |
2 days ago | about 18 hours ago | |
C | C++ | |
BSD 3-clause "New" or "Revised" License | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
libwebp
-
Google assigns a CVE for libwebp and gives it a 10.0 score
The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to verify. I suspect the cost would be relatively small. Small enough that I personally would be happy to pay it.
https://github.com/webmproject/libwebp/commit/902bc919033134...
This is also a great reminded that fuzzing isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code, a couple too many branches away from being likely to be found by fuzzing.
-
The WebP 0day
There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c87044...
[0]: https://security-tracker.debian.org/tracker/CVE-2023-4863
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
The breakage [0] was introduced by the creator [1] of the project. If you want to audit 1674 commits over the past 12 years, it'd be easier to just audit the full project.
[0] https://github.com/webmproject/libwebp/commit/21735e06f7c1cb...
[1] https://github.com/webmproject/libwebp/commit/c3f41cb47e5f32...
- Convenient CPU feature detection and dispatch in the Magnum Engine
-
Whats going on with .webp and why are more and more internet images being converted to it?
If you like the command line, then you can use ffmpeg and ImageMagick, or use libwebp directly
-
What's up with people hating WebP?
The webp parser code is open source. Which means that even if Google decides to hide/obscure the code for webp, they'd legally not be allowed to prevent you from using older versions of the webp parser library. The only thing they could do is patent it, and then companies in the US (which has software patents, unfortunately) would have to pay royalties to decode it anyway; but here comes the next point
Skia
-
Skia VS nitro-gl - a user suggested alternative
2 projects | 21 Aug 2023
- The Future of the Web Is VNC
- Cairo – Open-Source 2D Graphics Layer/API with Fonts and Many Back-Ends
-
Lottie under the hood
Actually, that's not entirely accurate. The lottie-web library itself doesn't support rendering to WebGL. However, there is a package called canvaskit-wasm that wraps Skia (a graphics engine) with WebAssembly (wasm). This package includes a module called skottie which supports rendering animations into a WebGL surface. However, there is a drawback with this approach: using wasm requires loading a relatively large package, and it's uncertain whether all features are supported correctly, as the official compatibility table that tracks lottie support on different platforms does not include skottie.
-
Widely-used graphics library
Skia is pretty great if you can get it running.
- Vivaldi 6.0 Web Browser Introduces Tab Workspaces and Custom Icons
-
Due to popular demand, here’s part 2
The imgs are mainly used by Tencent QQ and Baidu Tieba users. QQ and Tieba compress imgs by default, so the popular imgs (in China we call them "屌图" or "表情包") would be compressed million of times during the spreading, causing the super low quality. These APPs on Android are using Skia for image processing, which suffering from a legendary bug: result would be more green. The bug was fixed in 2016: https://github.com/google/skia/commit/c7d01d3e1d3621907c27b283fb7f8b6e177c629d
- Leveraging Rust and the GPU to render user interfaces at 120 FPS
- How important is avoiding Blink/Chromium to you? And if not at all, why?
-
Graphic Library for C
There’s also Skia by Google. Used by Android and Google Chrome.
What are some alternatives?
libjpeg-turbo - Main libjpeg-turbo repository
bgfx - Cross-platform, graphics API agnostic, "Bring Your Own Engine/Framework" style rendering library.
Save-webP-as-extension - Firefox extension to overlay format and JPEG quality buttons on inline or stand-alone images for quickly saving a converted version of the image.
nanovg - Antialiased 2D vector drawing library on top of OpenGL for UI and visualizations.
BrowserBoxPro - :cyclone: BrowserBox is Web application virtualization via zero trust remote browser isolation and secure document gateway technology. Embed secure unrestricted webviews on any device in a regular webpage. Multiplayer embeddable browsers, open source! [Moved to: https://github.com/BrowserBox/BrowserBox]
GLFW - A multi-platform library for OpenGL, OpenGL ES, Vulkan, window and input
libavif - libavif - Library for encoding and decoding .avif files
Atomic Game Engine - The Atomic Game Engine is a multi-platform 2D and 3D engine with a consistent API in C++, C#, JavaScript, and TypeScript
image - [mirror] Go supplementary image libraries
Ogre 3D - scene-oriented, flexible 3D engine (C++, Python, C#, Java)
Electron - :electron: Build cross-platform desktop apps with JavaScript, HTML, and CSS
imgui - Dear ImGui: Bloat-free Graphical User interface for C++ with minimal dependencies