Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jpegoptim: Initial Project Proposal #12919

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

capuanob
Copy link
Contributor

@capuanob capuanob commented Jan 8, 2025

I am requesting permission to integrate jpegoptim into OSS-Fuzz. I believe that this project is a good candidate for OSS-Fuzz integration as it serves as a preeminent JPEG compression library used by many prominent projects such as NextCloud Server, ImageOptim, and Nikola.

For the sake of highlighting the library's importance and the risks posed by potential vulnerabilities within it, it is beneficial to consider NextCloud's usage of the library to handle image size optimization for storing user's data. Some potential risks include image corruption and loss of customer data and, as a worst -case-scenario, the exploitation of the JPEG parsing to achieve RCE on a public-network-facing file store.

Please see upstream approval for integration here

Copy link

github-actions bot commented Jan 8, 2025

capuanob is integrating a new project:
- Main repo: https://github.com/tjko/jpegoptim.git
- Criticality score: 0.44567

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant