Hacker News Reader

I don't see any documentation around libvps that claims it's safe to run on untrusted inputs, so you might want to run this thing in gVisor or a dedicated VM if that's your plan.

(I also looked for fuzz tests up the chain; libvips -> govips -> imagor, and didn't find any.)

View on HN

For what it's worth, libvips is part of OSS fuzz

https://github.com/google/oss-fuzz/tree/a21768ce6a5056d27f82...

I thought they mostly fuzz the loaders, which are the most critical, apparently the found bugs present a picture of a pretty wide coverage:

https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Lib...

As of June 2021, OSS-Fuzz has found over 30,000 bugs in 500 open source projects.

Ah, very nice! I should have checked there.

quite. inside docker, on a VPS with only other instances of that container running, uploading to an S3 bucket using IAM write-only privs, and the instance gets automatically cycled every hour.

Only every hour? I see you like to take risks.

Load it up as an ECR lambda ? Write file, return data to caller.. lambda terminates... Put the lambda on a reasonably short max execution time

Reply on news.ycombinator.com