The WebP 0day

This page summarizes the projects mentioned and recommended in the original post on

Our great sponsors
  • InfluxDB - Collect and Analyze Billions of Data Points in Real Time
  • Onboard AI - Learn any GitHub repo in 59 seconds
  • SaaSHub - Software Alternatives and Reviews
  • libwebp

    Mirror only. Please do not send pull requests.

    Millions of people in the world are affected by this library. There is a call for libraries used by millions around the world to NOT use C. I love C. But this risk ratio is off the charts and they ought to not use C for such critical libraries.

    I think this is the fix

    "malloc fail"? :facepalm:

  • wuffs

    Wrangling Untrusted File Formats Safely

    Specifically, since performance is crucial for this type of work, it should be written in WUFFS. WUFFS doesn't emit bounds checks (as Java does and as Rust would where it's unclear why something should be in bounds at runtime) it just rejects programs where it can't see why the indexes are in-bounds.

    You can explicitly write the same checks and meet this requirement, but chances are since you believe you're producing a high performance piece of software which doesn't need checks you'll instead be pulled up by the fact the WUFFS tooling won't accept your code and discover you got it wrong.

    This is weaker than full blown formal verification, but not for the purpose we care about in program safety, thus a big improvement on humans writing LGTM.

  • InfluxDB

    Collect and Analyze Billions of Data Points in Real Time. Manage all types of time series data in a single, purpose-built database. Run at any scale in any environment in the cloud, on-premises, or at the edge.

  • safety-dance

    Auditing crates for unsafe code which can be safely replaced

  • image

    [mirror] Go supplementary image libraries (by golang)

    If you want some code to study, is a WebP-Lossless decoder in under 1200 lines of code.

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts