2

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there is no special validation that this image is of valid type. Then this resized image is put into directory at web server. When user requests certain url, this image is presented to him.

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

  • 2
    Devil's advocate: How would you verify without loading it into GD in the first place? – Polynomial Sep 26 '12 at 15:11
1

It is better to validate the input as much as you can before trying to process it; this stackoverflow post lists several methods, of which the finfo method appears to address @Polynomial's legitimate advocacy for the devil.

That being said, there are various format attacks against image processing libraries, but they mostly start with a valid image file. Libraries like GD will generally open up the file and bail out of it doesn't look like a valid image file, so in order to break them, you need a file that's legitimate right up until it violates spec in a way that the parser breaks instead of rejecting it. So validating input helps avoid accidental and stupidity-based bad inputs, but don't overestimate it's effectiveness against the malicious attacker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.