Hacker News new | past | comments | ask | show | jobs | submit login
Notes on fuzzing ImageMagick and GraphicsMagick (alexgaynor.net)
98 points by yodon on Feb 7, 2019 | hide | past | favorite | 10 comments



[libvips](https://jcupitt.github.io/libvips/) is a pretty amazing replacement for IM/GM -- for the overlapping functionality, IM/GM still do some things vips doesn't, and vips will depending on how it was compiled in some functional paths call out to IM/GM as a dependency, too.

But for some tasks I was doing, I found that vips could accomplish the tasks I was doing in IM in up to an _order of magnitude_ less RAM _and_ CPU time. (GM was getting me more like 10% improvement at best).

It would be sweet if they'd add vips as a fuzzing target too.


you linked to a fork of libvips the original is https://github.com/libvips/libvips


Oops, you're right. jcupitt is the creator and principal maintainer of libvips, but I guess I linked to his "personal copy" git repo (which comes up first on google!).

You linked to a git repo, I linked to docs, but here's docs with internal links to the 'official' repo.

https://libvips.github.io/libvips/


I saw a similar performance increase going from im to gm to libvips for the use case of tiling large (GB+) images.


btw, ClusterFuzz, the infrastructure behind OSS-Fuzz was open sourced today: https://news.ycombinator.com/item?id=19106771


Does anyone have any good resources for someone with reverse-engineering and security CTF experience looking to get into fuzzing?


"fuzzing intro", "fuzzing tutorial" will no doubt point you at suitable content.

I started with AFL, via this piece:

https://lwn.net/Articles/657959/


is there a good GUI to IM / GM ? I like cli typically, but not in this case. There parameters are just too verbose and obscure..


photoshop


Way overkill




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: