wuffs

It is C. It is just written with the aid of formal methods. It would be nice if all software were written that way. That said, if you want another language “resembling C”, there is always WUFFS: https://github.com/google/wuffs The output of the WUFFS compiler certainly resembles C because it is C.

Reminder that https://github.com/google/wuffs exists too.

Again, there are safe ways of doing this. For example, Wuffs exists: https://github.com/google/wuffs At the very least, big money security software companies should be parsing untrusted content with some kind of rigorouly safe approach, not just squirting it through a big pile of C/C++. And don't get me started on the whole concept of undefined behavior in those languages. To quote I. I. Rabi, "Who ordered that?"

> Rust was literally invented to solve the security and concurrency issues inherent in using C/C++ for a browser engine. Are most browser vulnerabilities not still found in engines like V8? Rust can help with something like last year's buffer overflow in libwebp (although that's overkill when a project like https://github.com/google/wuffs exists), but I'm unclear on how it gets you a better JIT.

I was confused about how one can write an emulator in the wuffs language. :-D https://github.com/google/wuffs/blob/main/doc/note/hermetici...

Wuffs is great. I use it in Substrata (https://substrata.info/) for loading PNGs. It is both faster and safer than LibPNG. It's something around 2x faster than LibPNG in my tests (depending on the PNG file), see timings here: https://github.com/google/wuffs/issues/13#issuecomment-17325... So generally Wuffs is great and you should use it to decode your PNGs. There are some downsides: not all of the obscure bit depths and formats that PNG supports are loaded as-is, some are converted to more standard formats. Also the Wuffs documentation is a bit hard to understand. It's a litle bit of a mission getting PNG decoding working. You can see my code for that here though: https://github.com/glaretechnologies/glare-core/blob/2c7174c...

It's certainly a conundrum isn't it. What programming language should we use for Wrangling Untrusted File Formats Safely ? https://github.com/google/wuffs

Yeah, it's just a coincidence (†), but I started working on Wuffs' LZMA and XZ decoders last December. It works well enough to decode the Linux source code tarball correctly (producing the same output as /usr/bin/xz). $ git clone --quiet --depth=1 https://github.com/google/wuffs.git $ gcc -O3 wuffs/example/mzcat/mzcat.c -o my-mzcat $ ./my-mzcat < linux-6.8.2.tar.xz | sha256sum d53c712611ea6cb5acaf6627a84d5226692ae90ce41ee599fcc3203e7f8aa359 - $ /usr/bin/xz -d < linux-6.8.2.tar.xz | sha256sum d53c712611ea6cb5acaf6627a84d5226692ae90ce41ee599fcc3203e7f8aa359 - (†) Also, I'm not "Jia Tan"! You're just going to have to trust me on both of those claims. :-/

It appears that XZ actually is in WUFFS! https://github.com/google/wuffs/tree/main/std/xz

I wonder if Google will make a JPEG library with https://github.com/google/wuffs at some point.

Why is it written in C++, when Google made Wuffs[1] for this exact purpose? [1]: https://github.com/google/wuffs

It takes some effort to implement, but Google has WUFFS for almost exactly this purpose: https://github.com/google/wuffs