Hachoir limitations:

  • Speed: Hachoir is written in Python and so is slower than a program in C
  • Unable to limit memory or CPU usage
    • An evil file may crash Hachoir using special values
    • Hachoir has many arbitrary limits and file validation to limit this problem
    • Example: very long loop (more than 10.000 iterations) or deep recursion (more than 100 recursive function calls) (changeset:2326, changeset:2299)
    • Example: Loop in a chain (eg. FAT block chain) (changeset:2323)
  • Hachoir design disallow random access (use of seek() function) in a file
    • SeekableFieldSet is an experimental class allowing to seek() anywhere in a class (but it also has limitations :-))

"Fault tolerant" feature limits:

  • Some error types are not catched (eg. AssertionError)