Avoiding Malicious Images

sys4dm1n

I run an image sharing website. I have been trying to come up with a way to check if an image file (jpg/jpeg, bmp, gif, png) is in fact a valid image file. This means no malicious bytes.

I have read about splitting the heads of the files after they have been uploaded but is that really a fail-safe method? Is there a way to do this so it will work 99% of the time?

Thanks in advance!

jeremyphphaven

I noticed no one has address yet, so I'll jump in here.

I don't know of any, other than using all of GDI and PHP's built in functions combined hoping they all weed stuff out.

Also try sourceforge... someone may have created a class in PHP that does just this.

Let us know if you find something, great question and I'd love to know the answer.

sys4dm1n

jeremyphphaven wrote:
I noticed no one has address yet, so I'll jump in here.

I don't know of any, other than using all of GDI and PHP's built in functions combined hoping they all weed stuff out.

Also try sourceforge... someone may have created a class in PHP that does just this.

Let us know if you find something, great question and I'd love to know the answer.

Thanks for the response, Jeremy. I will continue to research this -- hopefully I can find something 🙂.

Weedpacket

http://www.phpbuilder.com/board/showthread.php?t=10346677&highlight=valid+image+file
http://www.phpbuilder.com/board/showthread.php?t=10345852&highlight=valid+image+file
http://www.phpbuilder.com/board/showthread.php?t=10339980&highlight=valid+image+file
Etc.
etc.
etc.

jeremyphphaven

From my understanding... I don't think the question is how to check if the type is an image or not ( and I may of miss understood so I apologize if that's the case ).

I think the question is... in lamens(sp) terms... can php get inside the file itself and determine if it's malicious or not. It's easy to scan the type, I've never seen how to really validate the file thought.

Weedpacket

jeremyphphaven wrote:
can php get inside the file itself

How do you think the function determines the image's dimensions?

jeremyphphaven

I see your point, I don't think you're understanding/validating mine.

If you're going to hide malicious code in an image... the underlying image header should still show as valid if you're coding the malicious image right, thus what you are suggesting above would not work... but again, the questions goes back to sys4dm1n if I'm in line with his original thinking.

Weedpacket

If you're going to be like that it's possible to have a perfectly legitimate image file that just happens to break some implementation of some software that attempts to read it. Whether it makes a difference or not depends on what is going to happen to the image.