Bump imagesize from 0.8.1 to 0.9.0

[dependabot-preview]

Bumps imagesize from 0.8.1 to 0.9.0.

Release notes

Sourced from imagesize's releases.

JXL Support

This release has two changes. The main one is #13 which adds support for JXL images. This isn't a format I was aware of but @​oscar-rc1 was kind enough to create a PR to add it.

Behind the scenes there was also some minor refactoring which may be expanded later. The interface should stay the same but I may work on restructuring things further in the future. I doubt there will be any forward facing interface changes though.

Support for lossless WEBP images

Recently I've been pointed to a great project that also deals with image size. I was curious as to how the support for some of the formats I don't include works, and while looking at that I noticed there was a type of webp I had never encountered before in the wild. In order to be thorough, I've patched up this missing hole which means lossless webp images are now supported.

As for the other missing formats, out of the ones they have that this library doesn't the only reasonable candidate for inclusion would be j2c, jp2, jcx, and mng, but I have personally never seen these formats and I don't want to include something unless it's actually used.

Internally there was also some cleanup regarding the interfaces and organization of tests.

Rework JPEG parsing to handle markers properly

The previous implementation of JPEG parsing relied on tags being the first thing encountered in an image, and having metadata not get in the way. This was a poor implementation and led to issues where JPEG files with EXIF data could show up as corrupted or report an improper size.

As of 0.8.7 the JPEG parsing has been reworked to instead read each JPEG marker, determine whether it is the dimension tag, and if not skip the entire length of the tag. This prevents the library from getting stuck inside metadata sections and reading unrelated data as invalid markers.

Clean up SOF check

After publishing 0.8.5 I was made aware that not all SOF markers are dimensions. In particular FF C4, FF C8, and FF CC do not contain valid dimension data. Instead of leaving this bug hidden inside, I've decided to push an update again.

I've also included a bunch of clippy fixes, but this is just to make me feel better about myself.

Accept all JPEG SOF variants

Previously I've only encountered JPG images using SOF0 or SOF2 (FF C0 or FF C2). However, #10 brought to my attention an SOF1 image. I looked up the SOF marker definition and it looks like C0 to CF are all valid SOF markers, so I've changed the check to accept them all.

I am missing tests for C3 to CF so I can't guarantee they are all the same, but if something breaks please open an issue. As of right now all JPG test images in the repo are working.

Fix HEIC image parsing

This release fixes an issue with HEIC image parsing where the dimensions returned would be a sub-image or thumbnail and not the larger image. In order to fix this, the library will now read all spacial tags and pick the largest one as the size to return. On top of this, it now also looks for a rotation tag and will swap the width and height if the image should be rotated 90 or 270 degrees.

Fix multiplication overflow crash

I've been meaning to try out fuzzing for a while, but unfortunately I only tried it after v0.8.2 was released. Running cargo fuzz found a multiplication crash in under 10 seconds, which was very impressive and also kind of frustrating due to the recent release. This crash should not be an issue in release mode, but this does make it so debug mode does not crash anymore.

The crash involved a crafted or corrupted TIFF payload where a tag's count entry was set to a very large number. This number was eventually multiplied and converted to a usize, but since the multiplication happened as a u32, it was possible to overflow by setting the count to something like 0xFFFFFFFF. The variable is now converted to a usize after being read, so this type of overflow should not be possible anymore.

Fix JPEG parsing issues

This release fixes two major issues with JPEG parsing which would cause a valid JPEG to return an error.

Issue one (#9) was that JPEGs that happened to have their image dimension marker be preceded by FF would be skipped (e.g., FF FF C0).

Issue two was that JPEGs where the image dimension tag was directly preceded by another tag would be skipped. (e.g., FF E1 FF C0)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)