This is already fully covered in the answers to the following questions on this site:
How can I be protected from pictures vulnerabilities?How can I be protected from pictures vulnerabilities?
Is it safe to store and replay user-provided mime types?Is it safe to store and replay user-provided mime types?
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
Is it safe to serve any user uploaded file under only white-listed MIME content types?Is it safe to serve any user uploaded file under only white-listed MIME content types?
Does X-Content-Type-Options really prevent content sniffing attacks?Does X-Content-Type-Options really prevent content sniffing attacks?
What are the security risks of letting the users upload content to my site?What are the security risks of letting the users upload content to my site?
What steps should be taken to validate user uploaded images within an application?What steps should be taken to validate user uploaded images within an application?
Why should I restrict the content type of files be uploaded to my site?Why should I restrict the content type of files be uploaded to my site?
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
Is it possible to inject HTML into image to provoke XSS?Is it possible to inject HTML into image to provoke XSS?
Check them out -- you'll find a wealth of great information there!
