This is one of the reasons I'm a big fan of wuffs[0] - it specifically targets dealing with formats like pictures, safely, and the result drops in to a C codebase to make the compat/migration story easy.
> API. After limiting it to deal only with approximately screen sized
> inputs, it fuzzed for 25 hours CPU time without a single hang or
> crash. This is a notable improvement over running the test with our
> old decoder which crashes within a minute.
Cooool.