Wuffs is a memory-safe programming language designed for parsing, decoding, and encoding untrusted file formats such as images, audio, video, fonts, and compressed archives.
The problem Wuffs solves is the need to handle untrusted data safely without sacrificing performance. Traditional approaches either accept memory safety risks inherent in hand-written C or incur runtime overhead from safety checks. Wuffs takes a different approach: it performs all safety checks at compile time rather than runtime. The language enforces explicit proofs of safety through annotations, catching buffer overflows, integer arithmetic overflows, and null pointer dereferences before code executes. This means that if a Wuffs program compiles, it is guaranteed safe with respect to those three bug classes. The language achieves performance comparable to C by eliminating runtime checks entirely, while maintaining the safety guarantees of languages like Go or Rust.
Wuffs is suited for projects that need to process untrusted file formats with both safety and speed. It is not a general-purpose language but specifically designed for writing libraries. The tool is available as transpiled C code, allowing existing C and C++ projects to use Wuffs libraries without requiring the Wuffs language toolchain or compiler. This makes it practical for integration into large projects like web browsers and operating systems. The trade-off is that writing Wuffs code requires more effort than hand-written C, since programmers must explicitly annotate their code with safety proofs. Benchmarks show the tool decodes bzip2 significantly faster than standard utilities, deflate faster than zlib, and GIF and PNG formats substantially faster than popular libraries in C, Go, and Rust.
The project maintains active development with regular updates to its codec implementations and language features. The codebase demonstrates careful attention to performance optimization, with documented benchmarks comparing against established alternatives. Development includes ongoing refinement of the compiler's proof system to reduce the annotation burden on programmers while maintaining compile-time safety guarantees.
