google/wuffs

I am not sure what's the current status of Wuffs-based WebP decoder, but that would be another implementation worth comparing since it shares the same goals of safety and speed. https://github.com/google/wuffs/tree/main/std/webp

Unsandboxed ImageMagick is known for being a security nightmare even back when PHP ruled the world (not saying sandboxing is a panacea either, it just requires a different and potentially harder exploit to develop a full chain). Difference is it's easier than ever to turn vulnerabilities into full compromises. At some point we'll have to replace all parsers with something at least as safe as https://github.com/google/wuffs right? Otherwise ImageMagick and co. will just keep giving.

> The thing I really want is a language or environment with no implicit access rights I don't think you'll find anything like that from a General Purpose Language, so you probably want something like WUFFS [Wrangling Untrusted File Formats Safely]. https://github.com/google/wuffs

For the implemented formats, wuffs is safer and also often faster: https://github.com/google/wuffs

> performant and memory safe decoder (in Rust?). Isn't this exactly the case that wuffs [1] is built for? I had the vague (and, looking into it now, probably incorrect) impression that Google was going to start building all their decoders with that. [1] https://github.com/google/wuffs

> Chromium: Parsers for PNG, JSON, and web fonts have been replaced with memory-safe implementations in Rust, making it easier for Chromium engineers to deal with data from the web I find this surprising, isn't Wuffs[1] (also made by Google) an even better fit for this particular use-case? (It has compile-time spatial memory safety, where Rust has compile-time temporal safety but runtime spatial safety, with bound checking). Obviously for general-purpose system programming, Rust is a no-brainer and I'm happy to see Google pursuing their rustification of Android. [1]: https://github.com/google/wuffs