4 ms·

Notes on fuzzing ImageMagick and GraphicsMagick

98 points by yodon 8y ago

jrochkind1 8y ago
[libvips](https://jcupitt.github.io/libvips/ https://jcupitt.github.io/libvips/) is a pretty amazing replacement for IM/GM -- for the overlapping functionality, IM/GM still do some things vips doesn't, and vips will depending on how it was compiled in some functional paths call out to IM/GM as a dependency, too. But for some tasks I was doing, I found that vips could accomplish the tasks I was doing in IM in up to an _order of magnitude_ less RAM _and_ CPU time. (GM was getting me more like 10% improvement at best). It would be sweet if they'd add vips as a fuzzing target too.
- nslocum 8y ago
  you linked to a fork of libvips the original is https://github.com/libvips/libvips https://github.com/libvips/libvips
  - jrochkind1 8y ago
    Oops, you're right. jcupitt is the creator and principal maintainer of libvips, but I guess I linked to his "personal copy" git repo (which comes up first on google!). You linked to a git repo, I linked to docs, but here's docs with internal links to the 'official' repo. https://libvips.github.io/libvips/ https://libvips.github.io/libvips/
- eunoia 8y ago
  I saw a similar performance increase going from im to gm to libvips for the use case of tiling large (GB+) images.
metzmanj 8y ago
btw, ClusterFuzz, the infrastructure behind OSS-Fuzz was open sourced today: https://news.ycombinator.com/item?id=19106771 https://news.ycombinator.com/item?id=19106771
s3krit 8y ago
Does anyone have any good resources for someone with reverse-engineering and security CTF experience looking to get into fuzzing?
- stevekemp 8y ago
  "fuzzing intro", "fuzzing tutorial" will no doubt point you at suitable content. I started with AFL, via this piece: https://lwn.net/Articles/657959/ https://lwn.net/Articles/657959/
jordache 8y ago
is there a good GUI to IM / GM ? I like cli typically, but not in this case. There parameters are just too verbose and obscure..
- nothanksmydude 8y ago
  photoshop
  - h1d 8y ago
    Way overkill

98 points by yodon 8y ago

[libvips](https://jcupitt.github.io/libvips/ https://jcupitt.github.io/libvips/) is a pretty amazing replacement for IM/GM -- for the overlapping functionality, IM/GM still do some things vips doesn't, and vips will depending on how it was compiled in some functional paths call out to IM/GM as a dependency, too. But for some tasks I was doing, I found that vips could accomplish the tasks I was doing in IM in up to an _order of magnitude_ less RAM _and_ CPU time. (GM was getting me more like 10% improvement at best). It would be sweet if they'd add vips as a fuzzing target too.

nslocum 8y ago
you linked to a fork of libvips the original is https://github.com/libvips/libvips https://github.com/libvips/libvips
- jrochkind1 8y ago
  Oops, you're right. jcupitt is the creator and principal maintainer of libvips, but I guess I linked to his "personal copy" git repo (which comes up first on google!). You linked to a git repo, I linked to docs, but here's docs with internal links to the 'official' repo. https://libvips.github.io/libvips/ https://libvips.github.io/libvips/
eunoia 8y ago
I saw a similar performance increase going from im to gm to libvips for the use case of tiling large (GB+) images.

metzmanj 8y ago

btw, ClusterFuzz, the infrastructure behind OSS-Fuzz was open sourced today: https://news.ycombinator.com/item?id=19106771 https://news.ycombinator.com/item?id=19106771

s3krit 8y ago

Does anyone have any good resources for someone with reverse-engineering and security CTF experience looking to get into fuzzing?

stevekemp 8y ago
"fuzzing intro", "fuzzing tutorial" will no doubt point you at suitable content. I started with AFL, via this piece: https://lwn.net/Articles/657959/ https://lwn.net/Articles/657959/

jordache 8y ago

is there a good GUI to IM / GM ? I like cli typically, but not in this case. There parameters are just too verbose and obscure..

nothanksmydude 8y ago
photoshop
- h1d 8y ago
  Way overkill