Halide Compression has released wpd, an open-source WebP image decoder written primarily in Rust and intended to reduce the memory-safety risks associated with processing untrusted images. The project is available under the BSD 2-Clause licence.
Image decoders sit in browsers, operating systems, messaging applications and many other products. They routinely parse files received from outside a user’s device, making implementation flaws potentially valuable to attackers. Halide cited CVE-2023-4863, a libwebp vulnerability that affected widely used applications and was exploited in the wild, as an example of why decoder safety has broad consequences.
The new decoder uses Rust for its main implementation while retaining handwritten assembly for selected performance-sensitive operations. Halide says those SIMD routines are deliberately limited and checked for correctness. Organizations that place a higher priority on eliminating unsafe components can compile wpd without that assembly; in that configuration, the company says the remaining unsafe code is confined to the vetted zerocopy dependency.
Halide is also pitching speed as a reason to adopt the project. It reports better single-thread performance than libwebp on its test material and stronger scaling across multiple threads. Those measurements come from the developer’s own benchmark harness, using a particular libwebp revision and image-webp version, so independent testing across varied hardware and image collections will be needed to establish how broadly the gains apply.
The project is designed as a replacement for libwebp rather than a narrowly scoped experiment. Its feature set covers still images and animations, along with output transformations and partial-row processing in supported modes. Halide notes that some combinations have limits: subframe animation mode excludes crop, scale and flip operations, while partial-row decoding does not cover animations or transformed output.
Parallel handling can provide larger gains for workloads that mix animated and still files, according to the launch post. The company attributes its single-thread results to algorithmic improvements rather than parallel execution. Users evaluating a migration will need to weigh those performance claims alongside compatibility, maturity, platform support and the security implications of optional assembly.
The release adds wpd to Halide Compression’s open-source portfolio beside fcvvdp and fmetrics. The developer says achieving feature parity with libwebp remains a goal and is seeking feedback on obstacles that could prevent adoption. It is also exploring work with cybersecurity firms on deployments in critical software.
A safer implementation does not make image parsing risk-free. New code can contain logic errors, dependencies require review and assembly paths still demand careful auditing. Even so, moving the bulk of a decoder from C to a memory-safe language can remove classes of out-of-bounds access and lifetime bugs that have repeatedly affected media-processing libraries.
