The Small WebP Header That Asked the JVM for Gigabytes
A profile-length check had to run before ImageIO read dimensions, with independent upload and ingestion guards and explicit remaining PDF limits.
Reviewed by Dmytro Nasyrov on October 27, 2026.
A file can be small enough to pass an upload limit and still make a decoder allocate gigabytes before it reports the image's width. We found that path while adding scanned pages and standalone images to our document pipeline.
A WebP color-profile header could declare an allocation larger than the bytes actually present. The dangerous field was in that header, rather than an ordinary image's giant pixel array. Reading dimensions therefore needed its own precondition; postponing every check until after decoding was already too late.
Three different sizes
We separated transferred bytes, declared pixel dimensions and decoder-controlled auxiliary data. An upload-byte cap constrains the first. A megapixel check constrains a width-height product. Neither automatically bounds an allocation requested while a plugin reads a color profile.
The historical ImageIO helper recognized formats from their bytes, accepted only PNG, JPEG and WebP, then asked for dimensions without decoding pixels. That is useful protection against large declared images. The implementation review found that a plugin could allocate profile memory while answering the dimension query itself.
| Boundary | What it can miss |
|---|---|
| Maximum uploaded bytes | Large allocations derived from a small header |
| Width multiplied by height | A profile allocation before dimensions are returned |
| File extension | Bytes recognized as another format |
| Successful upload validation | A later pipeline path that decodes without repeating the guard |
Validate the container before consulting the plugin
The repair walked the WebP RIFF chunks before reading its header through ImageIO. An ICCP chunk could not extend beyond the remaining file, and the embedded profile could not declare more bytes than its chunk contained. A malformed profile failed this preflight.
The helper restored the stream position and byte order afterward. That small contract matters: a validator which leaves a downstream parser at an arbitrary offset can turn safe files into confusing failures. The guard needed to reject impossible lengths while allowing the decoder to begin where it expected.
recognize container
check chunk length against remaining file
check profile-declared length against its chunk
restore stream position and byte order
only then ask the image reader for dimensionsThe recorded regression used a thread-allocation bound. Without protection the crafted input drove about 2.13 GB of allocation. With the guard, the upload path used about 35 KB and the pipeline path about 770 KB in that test. These are measurements of a specific malformed-input regression, not a benchmark for arbitrary valid images.
The pipeline did not inherit trust from the upload
Both entry points checked the container. The upload could reject unsupported or unreadable bytes before storing a new source. The ingestion path independently rechecked accepted formats and profile bounds before decoding. Stored bytes are not a reason to skip a decoder precondition. The accepted set was deliberate. GIF, BMP and TIFF remained unsupported even if an image reader could recognize them. A PNG named with a JPEG extension was still a PNG for this decision. This made the supported-format rule inspectable rather than dependent on whatever plugins happened to be installed.
Packaging introduced another boundary. ImageIO's plugin registry is process-wide and depends on class loading. The application scanned for plugins at context startup and retained a check for the WebP reader. An image that works in a test classpath does not by itself prove that the packaged application can read it.
A PDF adds another allocation path
For scanned PDF pages, the implementation inspected embedded image dimensions before rendering. A separate scan setting controlled when very large images could be subsampled. Reusing the standalone upload limit would let one configuration change silently alter another pipeline stage's behavior.
A Flate stream that the PDF library fully expands was not stopped by the megapixel ceiling.
EXIF orientation and some additional PDF image decoders also remained separate work. The successful WebP repair was not a declaration that every compressed-image resource-exhaustion path had been closed.
The test needs to reach the early allocation
A regression with an ordinary large photograph would exercise the pixel path and could miss this defect. The crafted small container reached the profile reader before width and height were returned. That made it possible to test the failing boundary without needing a legitimate gigabyte-scale image.
For another ingestion system, preserve the distinction between a file you can store, a header you can safely inspect and pixels you can afford to decode. The recorded code and tests support this bounded repair in the pinned implementation. A current vulnerability assessment of other library versions would require separate work.
FAQ
Quick answers to common questions about custom software development, pricing, process and technology.
Type to filter questions and answers. Use Topic to narrow the list.
Showing all 14
No matches
Try a different keyword, change the topic or clear filters
-
How long have you been in business?
Pharos Production has been in business since 2013, with over 13 years of experience in custom software development. During this time, we have delivered over 110 applications for 200+ clients across 28 industries, including FinTech, healthcare, crypto and e-commerce. We are rated 5/5 on Clutch based on 107 verified reviews (2026).
-
What services do you provide?
Pharos Production provides six core service categories: AI Development (LLM applications, AI agents, machine learning and computer vision), Blockchain and Web3 (smart contracts, DeFi, tokenization on Ethereum, Solana, TON and other chains), FinTech Development (payment platforms, digital banking, KYC and AML integration), Software Development (mobile apps, web platforms, database design, UI/UX), Security and QA (code audits, penetration testing, smart contract audits, manual and automated testing) and Consulting (architecture design, MVP validation, startup consulting).
-
Where is Pharos Production located?
Pharos Production is headquartered in Las Vegas, Nevada, USA (5348 Vegas Dr, Las Vegas, NV 89108), with an engineering office in Kyiv, Ukraine (44-B Eugene Konovalets Str. Suite 201, Kyiv 01133). We work with clients worldwide and provide remote collaboration across all time zones. Visit our contact page for directions and scheduling options.
-
How big is your team?
Pharos Production has a team of 90+ engineers, including software developers, blockchain specialists, QA engineers, DevOps experts, UI/UX designers, project managers and solution architects. Our founder, Dr. Dmytro Nasyrov, holds a PhD in Artificial Intelligence and leads the technical direction of all projects.
-
What types of customers do you serve?
We serve a wide range of clients, from startups and product companies to mid-sized enterprises and large institutions. Our clients include crypto exchanges, FinTech providers (like Pleenk), healthcare organizations, sportsbook operators (like Pro Gambling), e-commerce platforms and SaaS companies. Pharos Production has worked with 200+ clients across 28 industries since 2013, adapting engagement models to match each client's stage, whether it is MVP validation for a startup or enterprise-scale development for an established business.
-
How is a custom software development company different from an agency?
A custom software development company like Pharos Production assigns one dedicated engineering team that owns your product across multiple release cycles, instead of handing it off once a contract ends. Agencies more often rotate staff between clients and optimize for fast delivery over long-term product ownership.
Pharos Production keeps the same team on your codebase through 2-week sprints, so there is no re-onboarding cost each time you request a new feature.
-
How much does custom software development cost?
Custom software development costs vary based on project scope and complexity. At Pharos Production, typical project ranges are: MVP development ($10,000-$25,000), suitable for startups validating a product idea; full-fledged production ($25,000-$50,000), for established businesses scaling a proven concept; and full-cycle development ($50,000-$80,000+), for complex enterprise-grade systems. These ranges include architecture design, development, QA testing and deployment. Hourly rates range from $50 to $99 depending on role and seniority. Final pricing depends on technology stack, number of integrations and engagement model (staff augmentation, dedicated team or project outsourcing).
-
How long does it take to develop a custom software application?
Development timelines depend on scope and complexity. At Pharos Production, a typical MVP takes 2-4 months, a production-ready application takes 4-8 months and a complex enterprise system can take 8-12+ months. We use an agile methodology with 2-week sprints, delivering working increments after each sprint. Every sprint includes a retrospective, progress report and planning session for the next iteration. This approach ensures transparency and allows businesses to launch faster by prioritizing high-impact features first. Get a timeline estimate for your project.
-
What industries does Pharos Production serve?
Pharos Production serves 28 industries: FinTech, MiCA Compliance, Banking, Insurance, Crypto, Healthcare, Fitness, E-Commerce, Food & Restaurant, On-Demand, Manufacturing, Automotive, Energy, Oil & Gas, Supply Chain, Construction, Real Estate, Gaming, Streaming, Media, Telecom, Education, Aviation, Travel, Logistics, Marketing, Agriculture and Recommender Systems. Our deepest expertise is in FinTech, blockchain and healthcare, where we have delivered compliance-ready platforms (HIPAA, PCI DSS, GDPR) and high-load systems handling thousands of concurrent users. For the latest industry insights, read our guides on FinTech trends in 2026 and the Web3 technology stack.
-
Why hire a software development company instead of building in-house?
Hiring a software development company offers faster time-to-market, lower upfront costs and access to specialized expertise without long-term employment commitments. According to Deloitte's 2024 Global Outsourcing Survey, 57% of companies outsource software development to access skills they cannot hire internally.
Factor In-house team Software development company Time to assemble 3-6 months (recruiting + onboarding) 1-2 weeks Upfront cost High (salaries, benefits, equipment) Lower (project-based pricing) Specialized expertise Limited to who you can hire locally Access to 90+ engineers across blockchain, AI, FinTech Scalability Slow (each new hire takes months) Fast (scale up or down per sprint) Long-term commitment Full-time employment contracts Flexible engagement models Risk High if key engineers leave Company ensures continuity and knowledge transfer For businesses that need blockchain, AI or high-load architecture expertise, outsourcing to a specialized firm like Pharos Production reduces risk and accelerates delivery.
-
What projects does Pharos Production not take on?
Pharos Production focuses on mid-to-large custom software projects with budgets starting at $10,000. We do not take on template-based websites, WordPress theme customization or short-term contracts under one month. We also do not provide non-technical staffing (marketing, sales or design-only roles). Our strongest fit is blockchain, FinTech and healthcare projects where security, compliance and high-load architecture are critical. For smaller projects or MVPs under $10,000, we recommend exploring freelance platforms or no-code tools as a more cost-effective starting point.
-
Why does Pharos Production use agile methodology?
We use agile with 2-week sprints because it reduces the risk of building features that miss the mark. Each sprint ends with a working demo, a retrospective and a plan for the next iteration.
This means clients see progress every 14 days and can adjust priorities based on real results, not assumptions. We chose this approach after years of experience showing that rigid, fixed-scope contracts lead to scope creep, missed deadlines and products that do not match market needs by launch day.
-
When should you NOT hire a custom software development company?
Custom development is not the right choice in every situation. You should not hire a custom software company if: your problem is fully solved by an existing SaaS product (e.g. Shopify for e-commerce, Salesforce for CRM); your budget is under $10,000 and timeline is under 4 weeks; you need a simple landing page or marketing website (WordPress or Webflow is faster and cheaper); or you are still validating the idea and have not spoken to potential users yet.
In these cases, off-the-shelf tools or no-code platforms offer better ROI. Custom development makes sense when you need unique workflows, regulatory compliance, high-load architecture or competitive differentiation that packaged software cannot provide.
-
What kind of projects has Pharos Production delivered?
Here are three anonymized examples from our recent delivery history:
FinTech startup - payment platform (MVP)
Scope: mobile app + backend API with bank-grade encryption. Team: 4 engineers, 1 QA. Timeline: 10 weeks. Budget: $38,000. Result: launched on schedule, processed $2M+ in transactions within the first quarter.Healthcare provider - patient portal (Full product)
Scope: HIPAA-aligned web platform with EHR integration, appointment scheduling and telemedicine. Team: 6 engineers, 1 DevOps, 2 QA. Timeline: 6 months. Budget: $120,000. Result: 15,000+ active patients, zero compliance violations in two annual audits.Crypto exchange - trading engine (Complex)
Scope: high-load matching engine handling 50,000+ orders per second, multi-chain wallet infrastructure on Ethereum and Solana. Team: 8 engineers, 2 QA, 1 security auditor. Timeline: 11 months. Budget: $340,000. Result: 99.97% uptime, passed three independent security audits.See more projects: NoMoreBets, Pulse, Sagas, Gambit Stream and Pleenk. For the full portfolio, visit our case studies. Learn more about the technology behind these projects in our guide to stablecoins and crypto infrastructure.
Dmytro Ihnatov is the Lead Backend Developer at Pharos Production. He documents backend architecture and research experiments from the team's work on a professional learning platform for aesthetic medicine.
