Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there is no special validation that this image is of valid type. Then this resized image is put into directory at web server. When user requests certain url, this image is presented to him.

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

share|improve this question
Devil's advocate: How would you verify without loading it into GD in the first place? – Polynomial Sep 26 '12 at 15:11

It is better to validate the input as much as you can before trying to process it; this stackoverflow post lists several methods, of which the finfo method appears to address @Polynomial's legitimate advocacy for the devil.

That being said, there are various format attacks against image processing libraries, but they mostly start with a valid image file. Libraries like GD will generally open up the file and bail out of it doesn't look like a valid image file, so in order to break them, you need a file that's legitimate right up until it violates spec in a way that the parser breaks instead of rejecting it. So validating input helps avoid accidental and stupidity-based bad inputs, but don't overestimate it's effectiveness against the malicious attacker.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.