The Piston image library is now pure Rust

Re:The Piston image library is now pure Rust by Ar-Curunir on Sunday January 08, 2017 @01:28PM (#13351130)

C image libraries likr imagemagick are full of dangerous bugs. Using a performant memory safe language for image parsing and manipulation is a big win for security (and stability).

If this image handling can be extracted into its own library ( maybe it already has), then it can be used by other projects, and maybe even by C and C++ projects.

[ Parent | on HN ]

Re:The Piston image library is now pure Rust by Agathos on Sunday January 08, 2017 @01:44PM (#13351202)

For example, https://imagetragick.com/

"One of the vulnerabilities can lead to remote code execution (RCE) if you process user submitted images."

[ Parent | on HN ]

Re:The Piston image library is now pure Rust by dbaupp on Sunday January 08, 2017 @01:58PM (#13351279)

(FWIW, I don't think any of those bugs are directly addressed by Rust's memory safety guarantee, since they mostly seem to be string injection problems. The strong abstraction power of Rust versus C may help people create APIs that are more resistant, but people can always write bad code. And of course, those are unlikely to be the only bugs in that C code.)

[ Parent | on HN ]

Re:The Piston image library is now pure Rust by tinus_hn on Sunday January 08, 2017 @05:49PM (#13352550)

Unfortunately, these bugs will not be prevented by using rust as they are not memory related bugs.

If you code a command that reads and then deletes a file on the command line and people allow remote users to invoke that command remotely, the programming language is not going to help you.

ImageMagick doesn't have the design that is necessary to be exposed to remote users. So it shouldn't be.

[ Parent | on HN ]