How to Extract JPEG Dimensions Without Decoding

Network parsers determine the width and height of a JPEG image by inspecting its structured binary metadata rather than decompressing pixel data. By stepping through the image's marker segments and targeting the Start of Frame (SOF) marker, a parser can extract the exact pixel dimensions from just a few bytes of header information. This targeted approach allows firewalls, proxies, and content inspection engines to retrieve image dimensions within the first few network packets, bypassing the computationally expensive processes of Huffman decoding and inverse discrete cosine transforms.

The Structure of a JPEG Stream

A JPEG file consists of a sequence of chunks called "marker segments." Every marker begins with a byte value of 0xFF followed by a single-byte marker code that defines the segment type.

Except for standalone markers like the Start of Image (0xFFD8) and End of Image (0xFFD9), every marker is immediately followed by a two-byte big-endian integer. This integer defines the length of the segment payload, including the two length bytes themselves. This explicit length field is what enables non-decoding parsers to quickly leapfrog through the file: a parser reads the marker, reads the payload size, and immediately seeks forward by that exact offset to find the next marker.

Identifying the Start of Frame (SOF)

The dimensions of an image are stored exclusively within the Start of Frame (SOF) segment. Different JPEG compression algorithms use different SOF markers, but all share the same internal header layout:

(Note: Markers 0xFFC4, 0xFFC8, and 0xFFCC represent Huffman tables and arithmetic coding definitions and do not contain frame dimensions).

The Parsing Algorithm

To extract the dimensions from a network stream, the parser executes the following steps:

  1. Verify the Stream Header: The parser verifies that the first two bytes are 0xFFD8 (SOI). If they do not match, the payload is rejected as non-JPEG data.
  2. Iterate Marker Segments: The parser reads the next two bytes to detect the marker.
    • If the marker indicates metadata that does not contain frame dimensions (such as 0xFFE0 for JFIF, 0xFFE1 for Exif, 0xFFDB for Quantization Tables, or 0xFFC4 for Huffman Tables), the parser reads the subsequent two-byte length field \(L\).
    • The parser skips forward by \(L - 2\) bytes to position the read pointer directly at the next marker.
  3. Extract SOF Data: Once an SOF marker (0xFFC0 through 0xFFC3) is encountered, the parser skips the two-byte segment length and the single-byte sample precision field. The subsequent four bytes contain the dimensions:
    • Height: Bytes 4 and 5 of the SOF payload (16-bit big-endian unsigned integer).
    • Width: Bytes 6 and 7 of the SOF payload (16-bit big-endian unsigned integer).
  4. Halt Execution: The parser terminates the operation immediately after extracting the width and height.

Why Entropy Decoding Is Avoided

The bulk of a JPEG’s file size resides in the entropy-coded scan data, which begins after the Start of Scan (SOS, 0xFFDA) marker. This data consists of variable-length Huffman codes representing high-frequency image coefficients.

Decoding this section requires substantial memory allocation, bit-shifting routines, and mathematical transformation (IDCT). Because the SOF segment invariably precedes the SOS segment, a network parser can locate the dimensions within the first 1 to 4 kilobytes of the stream. It drops or forwards the remaining megabytes of image payload without ever initializing a decompression pipeline.