Make the dependency on FreeImage optional

[mahiuchun]

Desired behavior

gz-common could be built without using FreeImage.

Alternatives considered

N/A

Implementation suggestion

Use https://github.com/nothings/stb/blob/master/stb_image.h for image loading.

Additional context

• By not supporting less commonly used image formats, the attack surface of image loading is reduced.
• FreeImage has an active SVN but they have not made a release since 2018.

[wentasah]

This might be a good idea, as freeimage is known to contain many security vulnerabilities.

[mjcarroll]

Yes, there has been a little bit of work attempting to replace the dependency with something like stb (#590) but I haven't had bandwidth to continue on it.

[oysstu]

Archlinux has now followed NixOS and removed freeimage
https://gitlab.archlinux.org/archlinux/packaging/packages/freeimage/-/issues/1

[oysstu]

Is QImageReader a possible alternative? A downside is that it pulls not only qt core but also qt gui.

[mjcarroll]

Is QImageReader a possible alternative? A downside is that it pulls not only qt core but also qt gui.

We don't have Qt as a dependency this low in the stack. I would think something like stb or an equivalent lightweight loader. I also saw that someone created https://github.com/agruzdev/FreeImageRe

I think it's binary compatible and fixes the CVEs.

[oysstu]

Is QImageReader a possible alternative? A downside is that it pulls not only qt core but also qt gui.

We don't have Qt as a dependency this low in the stack. I would think something like stb or an equivalent lightweight loader. I also saw that someone created https://github.com/agruzdev/FreeImageRe

I think it's binary compatible and fixes the CVEs.

Figured that would be the case. Looks like FreeImageRe has been under fairly active development by two devs for the past three years. Stb looks decent also, if the supported formats are sufficient. ImageMagick is also an alternative with good format support. Perhaps not lightweight though.