openjpeg

I'm not sure if it's going to persuade you but here is an example: https://github.com/uclouvain/openjpeg Basically the only library for reading jp2k data (complicated specs, ask your AI to one shot an implementation, mine said "it's 3000 lines of fiddly spec, too complicated"). Issues full of buffer-overflows. Recently unmaintained. Used in tons of projects, now all possibly vulnerable.

> The whole file is effectively a write-what-where primitive2. In addition to that, the Count Info Table is not bounds checked either... File formats like that, with many offsets in the file, are troublesome. There used to be more formats like that. Microsoft Word .doc is the classic example. OpenJPEG 2000 has a similar problem. I just hit that yesterday.[1] Valgrind is finding references to un-initialized data which affect control flow, and running the JPEG decoder on valid but truncated files (which is allowed) is causing bad memory reference crashes and errors. New formats like this are rare. People have learned. A modern exception is Unreal Engine 5's Nanite has much offset data, and there may be an attack surface there for hostile game content. Nanite is a way to store a graphics mesh with both multiple levels of detail and common su

It certainly was a risk in 2013, when the open source libraries were slow and riddled with bugs. Today, there are two stable, well maintained and fast open source libraries available: https://github.com/uclouvain/openjpeg and https://github.com/GrokImageCompression/grok JPEG 2000 is a niche codec, but in the niches that it occupies it is the gold standard, even after 20 years: 1. digital cinema (part of the digital cinema standard) and broadcast 2. medical imaging 3. satellite imagery For memory institutions, it still vies with Tiff as the top preservation codec.

There seems to be a functional and open reference implementation for JPEG 2000. https://github.com/uclouvain/openjpeg

> or even 20 years ago, remember JPEG2000? Open Source JPEG2000 libraries: - Grok, last commit 9 hours ago: https://github.com/GrokImageCompression/grok - JasPer, last commit 5 days ago: https://github.com/jasper-software/jasper - OpenJPEG, last commit 8 days ago: https://github.com/uclouvain/openjpeg I didn't try them, but I think you can probably still read your 20 year old JPEG2000 files today without too much problems.

That was a little of it but the patents expired years ago. The big blockers I saw were basically that it was a very complex format with a specification behind a paywall and no good open-source implementation or test suite. Interoperability was bad until a couple of years ago and it took significant amounts of complex code to make it fast enough to use. They've subsequently improved that — OpenJPEG is quite good now https://github.com/uclouvain/openjpeg — but probably missed the window for adoption barring a major upset, which is a shame because it's a very powerful codec and has some neat tricks like progressive decoding (imagine if you could have one file in storage and your responsive design simplify specified the HTTP range requests to get for successively large resolution images?). You could ship it in a browser using WASM but I think