Wondermagick

A memory-safe replacement for imagemagick. It's also really fast!

Why?

Vulnerabilities in image processing are devastating, because image processing is everywhere. The share of memory safety vulnerabilities across all software is 70%, and in image manipulation it is even higher: binary format parsing is notorious for these kinds of vulnerabilities.

It is not a theoretical concern. Every C image parsing library has a history of serious memory safety vulnerabilities. Imagemagick itself has had many more. And they are being exploited in the wild.

Trying to secure massive memory-unsafe codebases is untenable, but migrating to memory safe languages works.

Thanks to Rust, we can now eradicate these vulnerabilities once and for all, without sacrificing performance!

Current status

The underlying image format decoders and encoders are very mature. The Rust community has been developing them and using them in production for years. They have been tested on millions of real-world images.

wondermagick itself is in the early stages of development. We are currently focusing on converting and resizing images, which is the most common workload for imagemagick.

Contributing

You can help by:

1. Funding this project, so that we could advance both wondermagick and the Rust image library.
2. Donating to https://www.memorysafety.org/, a registered non-profit, so they could complete rav1d which will enable us to decode AVIF images. (encoding already works)
3. Contributing to the libraries wondermagick relies on. We publish a list of such issues affecting us.
4. Implementing more imagemagick commands in wondermagick. See CONTRIBUTING.md for details on code contributions.
5. Making bindings to Rust image for your favourite language. Making drop-in replacements for other memory-unsafe systems. Not the whole world runs on imagemagick.

Related work

Tools

• oxipng: Memory-safe PNG optimizer. Like pngcrush, but much faster thanks to multi-threading.
• gifski: create efficient GIF animations with thousands of colors per frame
• cavif-rs: converts images to AVIF. Can read PNG and JPEG.

Libraries

• image-rs: does all the heavy lifting for wondermagick.
• WUFFS: memory-safe image decoders that compile to C. No support for encoding images or operations like resize. If you cannot adopt Rust, at least use these.