Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • A possible solution might be to process/view the image in a sandboxed environment. Commented Mar 20, 2019 at 9:08
  • Or use a lossless codec to change its format to another one, and back again. Commented Mar 21, 2019 at 18:55
  • @ThoriumBR That would open up the decoder/encoder to exploitation. If you want to convert an image as PNG->BMP->PNG because you're afraid of a vulnerability in your viewer's copy of libpng, you'll be screwing yourself by passing the same exploit through a conversion program that uses the exact same libpng. It could be possible to do this securely if you convert PNG->PPM->PNG where the conversion process uses a tight syscall sandbox and sets resource limits, and only passes data over shared memory or pipes... Commented Mar 21, 2019 at 19:02
  • Run the converter on an obscure OS, like BeOS, QNX or something like that. Commented Mar 21, 2019 at 19:04
  • @ThoriumBR Huh? First of all, that's security through obscurity and is a bad thing (and QNX isn't obscure anyway). Second of all, even the most obscure OS uses the same vulnerable image decoder libraries as everyone else. If you are using an image viewer on BeOS, it's going to be using libpng for PNG files. Commented Mar 21, 2019 at 20:20