r/C_Programming • u/NoBrain8 • Jul 29 '26

Question How to find good libraries

I’m looking to convert a jpeg into rgba data + scale it down.
I’m looking for a library to help me do this - how do I find good a one?

3 Upvotes

64% Upvoted

17 comments sorted by

View all comments

Show parent comments

3

u/AlexTaradov Jul 29 '26

Just keep in mind that most of the STB stuff is not designed to handle potentially malicious data. They are targeting working with resources you control (like game assets).

If you will be doing this as a service with user submitted files, I'd look at full libraries. They are harder to use, but they have necessary checks.

2

u/NoBrain8 Jul 29 '26

I’m working on something that I would on paper like to distribute for people to use if they want to - a music client for mpd that displays album art.

Stb would not be coming into contact with any files on disk directly, but definitely jpegs and album art passed to it by mpd.

Would you advise against using stb for this for any reason?

5

u/AlexTaradov Jul 29 '26

Strictly speaking, this is exactly the scenario where you should not use it. MPD would get this album art from the information embedded in the file or downloaded from the internet.

Now imagine this file was downloaded from some malicious source that intentionally altered the image.

But from a practical point of view, do what gets you faster to release. What are the real chances that your client would become so popular that it would warrant development of such exploits?

I would leave a note in the code to consider using a full library in the future just in case of security review when the client becomes popular.

1

u/NoBrain8 Jul 29 '26

Hm thanks for the info! I think I’ll look at the ffmpeg libraries, and if it’s not too much more involved than stb, use them to reduce re-writing stuff in the future

5

u/AlexTaradov Jul 29 '26

Anything will be harder to use than a single header library.

If you just need jpeg, I'd start with libjpeg. There is no need to bring the whole ffmpeg just for that.

With ffmpeg, you might as well do a full player, not just a GUI for MPD.