WARNING: This is EXPERIMENTAL software written by ChatGPT Astra, until it's undergone adversarial review you should assume there is at least one critical exploit in here. Use at your own risk.

This is an attempt at a formally verified replacement library for libtiff written in Rust and Verus. It is currently about 5x slower than the C libtiff, but can presumably be brought up to parity with further optimization of either the library itself or Verus. I have minimal experience with Rust and zero experience with Verus, so I'm left in the strange position of having this artifact but not really knowing if it's any good or not. I guess I'll find out.

Right now it implements most of the reader/decoder side of libtiff, but doesn't implement writing tiff files at all. I do plan to add this in a future update, but since my motivation was to mitigate the further discovery of zero days in libtiff and these are of most consequence in e.g. zero click phone exploits it seemed more important to complete a somewhat performant version of the reader API than spend tokens on writing right away.

I have limited tokens and this project requires quite a few of them, so I am interested in patches from others. I am particularly interested in performance improvements, hardening, bug fixes and test coverage (especially in the C shim, which is currently the weak point of the whole library), and implementing more of the libtiff API. My goal is to eventually reach full parity with the C libtiff.

The library is about 5x slower overall, but it's uneven and some parts of it are slower than others, you can consult the benchmark numbers below to get a sense of whether you'd like to try this or not:

(AI text follows)

Measurements used nine randomized serial batches of at least 200 ms per implementation/workload, pinned to one AMD EPYC 9V74 CPU, with fresh handles and warm memory input. 114 outputs matched exactly; two JPEG outputs differed by at most one channel value. The reference preserves the previous suite’s JPEG SIMD-disabled configuration; WebP SIMD is enabled.

Below, times are median milliseconds per operation. Ratio means ours ÷ libtiff, so above 1 favors libtiff. native reads all samples, scan reads every scanline, rgba converts the full image, and crop reads a centered 128×128 RGBA region. This matrix does not time OJPEG or SGILog/LogLuv.

Main suite — all 102 results

RGB Deflate strip-layout diagnostics

Large-strip reads with default strip-chopping behavior

(End AI Text)

Astra wrote a README of weird mumbly AI text that you probably don't want to read, but I have included it for the sake of completeness.