News for hackers. Stuff that matters.

A comment on Memory-Safe WebP Decoding.

Re:Memory-Safe WebP Decoding by jessa0 on Saturday October 03, 2026 @12:54PM (#49945864)
Related is Signal Messenger's webpsan crate, which validates webp container syntax before it is passed to libwebp. It stops just short of decoding actual pixel data, however, as the way webp works requires the entire canvas to be allocated in order to fully decode pixel data, which would have just made webpsan a full-on decoder anyway..

https://docs.rs/webpsan/latest/webpsan/

[ Parent | on HN ]
Re:Memory-Safe WebP Decoding by computerbuster on Saturday October 03, 2026 @01:29PM (#49946106)
Nice, I didn't know about this!
[ Parent | on HN ]
Re:Memory-Safe WebP Decoding by thereisno on Saturday October 03, 2026 @06:13PM (#49948295)
Validators separate from parsers have led to many vulnerabilities in the past. There's always something the validator didn't catch that crashed the parser anyway.
[ Parent | on HN ]
Re:Memory-Safe WebP Decoding by nine_k on Sunday October 04, 2026 @01:22AM (#49950899)
A validator before an unsafe parser is strictly better than just the unsafe parser, but worse than a safe parser.
[ Parent | on HN ]