Are PPM or BMP images safer than JPEGs or PNGs?

Question

I was reading this question ( How to check if an image file is clean? ) and forest's answer suggested converting the image to a "trivial pixelmap format, such as PPM". Such a format was considered "simple enough that it would be infeasible to exploit".

The question is: what makes a PPM file safer? Is it because there's no room to hide a payload, without becoming too noticeable at first sight? Or is it because the format is so simple to parse, that we can suppose our software will be less likely to be vulnerable, when opening such files? And most importantly, is it even true that we can consider PPM files (and maybe also BMP) to be safer than, say, more complex formats like JPEG or PNG?

Answer 1

The question is: what makes a PPM file safer? Is it because there's no room to hide a payload, without becoming too noticeable at first sight?

No. You might argue that for plain text files (not strictly true, but that would allow to vet most of them).

However, for most images, you wouldn't be able to discern the payload from the image data.

Or is it because the format is so simple to parse, that we can suppose our software will be less likely to be vulnerable, when opening such files? And most importantly, is it even true that we can consider PPM files (and maybe also BMP) to be safer than, say, more complex formats like JPEG or PNG?

Exactly. Decompression routines are complex. Code rendering formats like JPEG or PNG have an higher chance of having a vulnerability on there. Still very unlikely, albeit there were a few of them (e.g. JPEG 2000 one years back), but it is higher than for a dumber format.

Answer 2

While you might be able to argue that the complexity of some file formats are simpler than others and would lead to the programmer making fewer mistakes is flawed thinking.

The vulnerabilities are in the parsing software and developers frequently make mistakes such as assuming buffer sizes when reading file content from disk, regardless of the file type.

A better argument would be that you should use PPM with $program because they use fuzz testing and secure code analysis/review as part of their development process.