Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure the image is valid?
In my case the upload is handled by PHP and then passed to GD or ImageMagick both of which suffer from vulnerabilities that can result in denial of service and possibly the execution of arbitrary code.
I would be interested in any suggestions people could offer to improve the validation process both specifically to PHP and also to any web or non-web application in general.