4 ms·
I don't see any documentation around libvps that claims it's safe to run on untrusted inputs, so you might want to run this thing in gVisor or a dedicated VM if
by jrockway 5y ago
I don't see any documentation around libvps that claims it's safe to run on untrusted inputs, so you might want to run this thing in gVisor or a dedicated VM if that's your plan.
(I also looked for fuzz tests up the chain; libvips -> govips -> imagor, and didn't find any.)
- fragmede 5y agoquite. inside docker, on a VPS with only other instances of that container running, uploading to an S3 bucket using IAM write-only privs, and the instance gets automatically cycled every hour.
- thebruce87m 5y agoOnly every hour? I see you like to take risks.
- ldoughty 5y agoLoad it up as an ECR lambda ? Write file, return data to caller.. lambda terminates... Put the lambda on a reasonably short max execution time
- clon 5y agoFor what it's worth, libvips is part of OSS fuzz https://github.com/google/oss-fuzz/tree/a21768ce6a5056d27f82b2f412c86261ad2dc8d0/projects/libvips https://github.com/google/oss-fuzz/tree/a21768ce6a5056d27f82... I thought they mostly fuzz the loaders, which are the most critical, apparently the found bugs present a picture of a pretty wide coverage: https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Libvips https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Lib... As of June 2021, OSS-Fuzz has found over 30,000 bugs in 500 open source projects.
- jrockway 5y agoAh, very nice! I should have checked there.