CKck45·Dec 22, 2022
That sounds a bit like what WUFFS is doing
WUFFS: https://github.com/google/wuffs
In Checked Cgoogle
wuffs
C2017–2026
google / wuffs
wuffs
Wrangling Untrusted File Formats Safely
76Distinct people
121Mentions
0Explicit recommenders
4.9KGitHub stars
What to know before exploring
What it is
Wrangling Untrusted File Formats Safely
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 7:24:48 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year121 dated mentions
Observed mentions: 2017-11-16 05:54:56 UTC to 2026-10-29 00:33:25 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 11 | 4 | 7 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 2 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 28 | 5 | 23 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 20 | 0 | 20 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 16 | 2 | 14 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 11 | 0 | 11 |
What Hacker News says
20 sources> A cooler feature would be requiring the compiler to prove the addition wouldn’t overflow.
Wuffs is specialized enough to do exactly that (https://github.com/google/wuffs).
In Fast midpoint between two integers without overflowThat's how WUFFS (Wrangling Untrusted File Formats Safely) works:
https://github.com/google/wuffs#what-does-compile-time-check...
In How much does Rust's bounds checking cost?I can think of a few others…
Sawzall, a language focused around processing logs. Rob Pike led on this but use has pretty much all been replaced by Go. https://en.m.wikipedia.org/wiki/Sawzall_(programming_languag...
Dex, a language focused around array processing from the team behind the Jax machine learning library. Early stage research project.
https://github.com/google-research/dex-lang
Rune, a language focused on security, early stage research project. https://github.com/google/rune
Wuffs, a language focused on writing safe file format handlers (parsing, encoding, decoding)
https://github.com/google/wuffs
In Mangle, a programming language for deductive database programming> Consider a program in which an array was accessed based on the index provided by some user input -- how could this ever be proven to never go out of bounds?
It's a type constraint on the index. In most programming languages we're used to the index value is some machine type, like a 32-bit unsigned integer, but that's arbitrary, the language can say OK, this is an index into an array of sixteen things, so, the index must be between 0 and 15 inclusive.
Now, depending on the software you might just have to write bounds checks yourself to satisfy this constraint, so you just made more work for yourself, but if your software actually deals in types that can and perhaps should be constrained properly elsewhere this approach means you get a compiler error not a runtime failure.
Suppose we've got code that does foo[k] where foo is an array of e
Read the rest
ight things and k is an unsigned variable with the bottom four bits of a value from an image file that's supposed to be the CGA medium resolution colour palette ID (0, 1, or 2). Alas the file might be corrupt or malicious and those bottom bits could be, for example 10.
In C and C++ foo[k] compiles, and when the corrupt file is used there is Undefined Behaviour
In Rust foo[k] compiles, and when the corrupt file is used the program panics on this line
In WUFFS foo[k] doesn't compile, variable k is the wrong type for indexing foo.
https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang...
Now, WUFFS is not a general purpose programming language. You should not write an operating system, a web server, a compiler in WUFFS. But, you should write your thumbnail making routine, your PDF validation code, your audio compressor in WUFFS, because in choosing not to be a general purpose language WUFFS is freed to simply always be safe. That WUFFS thumbnail code might make the RCE attempt from Leet Hacker into a blue rectangle, or crop all the executives photos to just their nose, but it simply cannot accidentally create a reverse shell, or spew passwords into the thumbnails, or a billion other things which Rust would make difficult to do by mistake but never impossible.
There might be a few others. https://github.com/google/wuffs for example isn't general purpose or mainstream, but it's meant to solve practical problems, so I don't think I'd call it a research language. Opinions may vary.
In Two years of fiddling with RustHere's another SIMD implementation, with commentary:
https://github.com/google/wuffs/blob/main/std/adler32/common...
Like the fpng implementation, it's SSE (128-bit registers), but the inner loop eats 32 bytes at a time, not 16.
"Wuffs’ Adler-32 implementation is around 6.4x faster (11.3GB/s vs 1.76GB/s) than the one from zlib-the-library", which IIUC is roughly comparable to the article's defer32.
https://nigeltao.github.io/blog/2021/fastest-safest-png-deco...
In Computing Adler32 Checksums at 41 GB/s> Programing languages require precedence rules
WUFFS doesn't have operator precedence. https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang...
As its designers explain: A bare a * b + c is an invalid expression. You must explicitly write either (a * b) + c or a * (b + c).
Why doesn't WUFFS have precedence? Because it's focused intensely on solving its specific problem, Wrangling Untrusted File Formats Safely. Having solved the buffer problem (you can't write buffer[oops_too_big] type mistakes in WUFFS, they will not compile) and the integer overflow problem (likewise, it doesn't compile) they wanted to also solve that problem where the programmer thought there were making one calculation, but due to precedence rules they were actually making a different calculation.
In Ivy – An interpreter for an APL-like language[WUFFS](https://github.com/google/wuffs) is made for stuff like this, and it has a library available as transpiled C code.
In New Ghostscript PDF interpreterProgram and data aren't really different, philosophically. On some level this even applies to people. When someone teaches you French is that program or data? Is it just data? Why can you now understand French then? Or if it's program, how does that work, who taught the teacher how to program you?
So, our best effort is to constrain what certain data can do when we process it, in the hope that this prevents surprising negative consequences like a PDF that steals privileged information and sends it elsewhere.
Notice that, in some sense, a PDF which just contains a photograph of your wife tied to a chair and holding today's newspaper, plus human readable text like, "We have your wife Sarah and all three kids Beth, Jim and Amanda. We are watching. Do not try to call for help. Email the privileged information to crooks@example.com or we will
Read the rest
kill your family" is also potentially effective at doing this, but we would not usually consider that an exploit in this context.
One irritation in this space is that programmers love General Purpose Programming Languages. The idea of the general purpose language is that it can do anything. But the problem in this sort of situation is that we don't want programs which can do anything, in fact doing anything is our worst case scenario. We actually want Special Purpose Programming Languages. We want to write our PDF data processing software in a language that even if we were trying can't do the things that should never happen as a result of processing a PDF.
This is the purpose of languages like WUFFS: https://github.com/google/wuffs
You can't write a WUFFS program to, for example, email anything to crooks@example.com even if you desperately needed to, which means you definitely won't accidentally write a program which can email the privileged information to the crooks when fed a PDF. Of course the PDF mentioned earlier with the kidnap note inside it could still work. And also of course making a PDF renderer out of WUFFS would be a really big ask. WUFFS-the-library today can render PNG, GIF, BMP but notably not yet JPEG. But it's clearly possible for something like PDF rendering to happen under these constraints. Nobody ordinarily viewing a PDF wants it to do arbitrary stuff.
This sort of stuff is where Iterate Loops are good:
https://github.com/google/wuffs/blob/main/doc/note/iterate-l...
WUFFS wants this because it demands all the checking at compile time (WUFFS code with a potential buffer overflow just won't compile), so if you need bounds checks you'll be writing them out by hand and the iterate loop often allows you to express a correct solution with no actual checks.
In tolower() in bulk at speedIdk, but there's an interesting project, wuffs: a programming language specifically aimed at efficiently and safely parsing document structure. There is a PNG decoder [2].
1. https://github.com/google/wuffs
2. https://news.ycombinator.com/item?id=26714831
In Pure: A static analysis file format checkerEven though it'd be a while before this really affects the Chrome codebase, it's a real testament to how well Rust nails the safe-but-low-level niche. Google does not lack resources to tool (or staff!) a C++ codebase correctly, nor does it lack resources to build languages[1] targeting these specific problems; that they'd consider Rust isn't just because "it's there".
[1] https://github.com/google/wuffs
In Experimenting with Rust in ChromiumTom Duff's device was doing that because he's doing MMIO, you should not [I know you're not suggesting it, but just in case anybody reading thinks it's clever] do this today when you don't want MMIO, your compiler is very capable of just doing an actual copy quickly, so tell it that's what you want, don't write gymnastics like Duff's device.
However, expressing these partially unrolled loops nicely is a nice performance-not-safety feature of WUFFS called "Iterate loops":
https://github.com/google/wuffs/blob/main/doc/note/iterate-l...
Well, I say performance not safety, as always they want both, but you could safely just write the never unrolled case, while the existence of Iterate loops allows you to express a much faster special case but know the compiler will fix things up properly no matter what.
In How fast can a 6502 transfer memory?For anyone curious: https://github.com/google/wuffs
In Data Race Patterns in GoShowing the 15 most recent of 20 sources. Enable JavaScript to search and browse every indexed mention.