Notes on fuzzing ImageMagick and GraphicsMagick

alexgaynor.net

98 points·yodon··10 comments

[libvips](https://jcupitt.github.io/libvips/) is a pretty amazing replacement for IM/GM -- for the overlapping functionality, IM/GM still do some things vips doesn't, and vips will depending on how it was compiled in some functional paths call out to IM/GM as a dependency, too.

But for some tasks I was doing, I found that vips could accomplish the tasks I was doing in IM in up to an _order of magnitude_ less RAM _and_ CPU time. (GM was getting me more like 10% improvement at best).

It would be sweet if they'd add vips as a fuzzing target too.

you linked to a fork of libvips the original is https://github.com/libvips/libvips

Oops, you're right. jcupitt is the creator and principal maintainer of libvips, but I guess I linked to his "personal copy" git repo (which comes up first on google!).

You linked to a git repo, I linked to docs, but here's docs with internal links to the 'official' repo.

https://libvips.github.io/libvips/

I saw a similar performance increase going from im to gm to libvips for the use case of tiling large (GB+) images.

btw, ClusterFuzz, the infrastructure behind OSS-Fuzz was open sourced today: https://news.ycombinator.com/item?id=19106771

Does anyone have any good resources for someone with reverse-engineering and security CTF experience looking to get into fuzzing?

"fuzzing intro", "fuzzing tutorial" will no doubt point you at suitable content.

I started with AFL, via this piece:

https://lwn.net/Articles/657959/

is there a good GUI to IM / GM ? I like cli typically, but not in this case. There parameters are just too verbose and obscure..

photoshop

Way overkill

Reply on news.ycombinator.com