3 ms·
here's my internet power user opinion: a malicious image, as in that opening it in a vulnerable program (browser or image viewer) would allow code execution?
by uwu 10y ago
here's my internet power user opinion:
a malicious image, as in that opening it in a vulnerable program (browser or image viewer) would allow code execution?
those exploits usually require specially crafted image files, so i think re-encoding and optimizing the image (like using `jpegtran -optimize -copy none` or `optipng`) would possibly do for "sanitizing" the file
a code execution flaw in jpegtran or optipng would be worse though, but sandboxing might work to protect against them (i don't know much about sandboxing though)
- nkkollaw 10y agoAttacks where the image isn't actually an image must be the minority, simply because an error would be thrown right away. Attacks most likely focus on vulnerabilities of image manipulation software: GD, imagemagick, Vips, Gifsicle, etc. It makes sense to use jpegtran.