Hacker News Reader

Yes, let us never forget how many exploits there are in trivial codecs like ICO and BMP, because they're written in C(++): https://bugzilla.mozilla.org/show_bug.cgi?id=775794#c0

BMP isn't so trivial, largely because it's been extended multiple times while never having a proper spec.

And .ico is just .bmp with some extras.