Wondermagick

A memory-safe drop-in replacement for imagemagick. It's also really fast!

Vulnerabilities in image processing are devastating, because image processing is everywhere. The share of memory safety vulnerabilities across all software is 70%, and in image manipulation it is even higher: binary format parsing is notorious for these kinds of vulnerabilities.

It is not a theoretical concern. Every C image parsing library has a history of serious memory safety vulnerabilities. Imagemagick itself has had many more. And they are being exploited in the wild.

Trying to secure massive memory-unsafe codebases is untenable, but migrating to memory safe languages works.

Thanks to Rust, we can now eradicate these vulnerabilities once and for all, without sacrificing performance!

The underlying image format decoders and encoders are very mature. The Rust community has been developing them and using them in production for years. They have been tested on millions of real-world images.

wondermagick itself is still young. We are currently focusing on the convert binary for converting and resizing images, which is the most common workload for imagemagick.

See the [features] section in Cargo.toml for the list of supported image formats, and wm-convert --help for the list of supported operations.

Supporting the libmagick C API is not planned.

You can help by:

1. Funding this project, so that we could advance both wondermagick and the Rust image library.
2. Contributing to the libraries wondermagick relies on.
3. Implementing more imagemagick commands in wondermagick. See CONTRIBUTING.md for details on code contributions.
4. Making bindings to Rust image for your favourite language. Making drop-in replacements for other memory-unsafe systems. Not the whole world runs on imagemagick.

• oxipng: Memory-safe PNG optimizer. Like pngcrush, but much faster thanks to multi-threading.
• gifski: create efficient GIF animations with thousands of colors per frame
• cavif-rs: converts images to AVIF. Can read PNG and JPEG.

• image-rs: does all the heavy lifting for wondermagick.
• WUFFS: memory-safe image decoders that compile to C. No support for encoding images or operations like resize. If you cannot adopt Rust, at least use these.

This project has benefited from an investment by the Sovereign Tech Agency. 91% of the funds were allocated to image-rs and its image format implementations, enabling its adoption GNOME and Chromium, while 9% of the funds were allocated to wondermagick and the image-rs features it was missing.