3 ms·
This would significantly increases browser attack surface area. Coders are usually much more complicated than decoders.
by onedognight 5y ago
This would significantly increases browser attack surface area. Coders are usually much more complicated than decoders.
- nine_k 5y agoThe browser has to decompress the image into raw pixels to display it anyway. Dumping these raw pixels into a trivial intermediate format, like uncompressed PNG or BMP, should not increase the attack surface in any noticeable way.
- jonsneyers 5y agoBrowsers already have to include an encoder for JPEG and PNG. They need that anyway for things like toDataURL(), see https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/toDataURL https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasE...
- astrange 5y agoThe input data to an encoder is very simple since it's just pixels. It's possible to find a crash but it would be surprising to find an exploitable one.