|
Packit |
85355f |
<HTML>
|
|
Packit |
85355f |
<HEAD>
|
|
Packit |
85355f |
<TITLE>
|
|
Packit |
85355f |
Changes in TIFF v4.0.8
|
|
Packit |
85355f |
</TITLE>
|
|
Packit |
85355f |
</HEAD>
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<BODY BGCOLOR=white>
|
|
Packit |
85355f |
<FONT FACE="Helvetica, Arial, Sans">
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<BASEFONT SIZE=4>
|
|
Packit |
85355f |
<FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION
|
|
Packit |
85355f |
<BASEFONT SIZE=3>
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
Current Version: v4.0.8
|
|
Packit |
85355f |
Previous Version: v4.0.7
|
|
Packit |
85355f |
Master FTP Site:
|
|
Packit |
85355f |
download.osgeo.org, directory pub/libtiff
|
|
Packit |
85355f |
Master HTTP Site #1:
|
|
Packit |
85355f |
http://www.simplesystems.org/libtiff/
|
|
Packit |
85355f |
Master HTTP Site #2:
|
|
Packit |
85355f |
http://libtiff.maptools.org/
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
This document describes the changes made to the software between the
|
|
Packit |
85355f |
previous and current versions (see above). If you don't
|
|
Packit |
85355f |
find something listed here, then it was not done in this timeframe, or
|
|
Packit |
85355f |
it was not considered important enough to be mentioned. The following
|
|
Packit |
85355f |
information is located here:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
Major Changes
|
|
Packit |
85355f |
Changes in the software configuration
|
|
Packit |
85355f |
Changes in libtiff
|
|
Packit |
85355f |
Changes in the tools
|
|
Packit |
85355f |
Changes in the contrib area
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<FONT SIZE=+3>M</FONT>AJOR CHANGES:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
None
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
None
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis
|
|
Packit |
85355f |
to fix cppcheck clarifyCalculation warnings *
|
|
Packit |
85355f |
libtiff/tif_predict.c, libtiff/tif_print.c: fix printf
|
|
Packit |
85355f |
unsigned vs signed formatting (cppcheck
|
|
Packit |
85355f |
invalidPrintfArgType_uint warnings)
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
|
|
Packit |
85355f |
TIFFReadEncodedStrip() that caused an integer division by
|
|
Packit |
85355f |
zero. Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2596
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
|
|
Packit |
85355f |
buffer overflow on generation of PixarLog / LUV compressed
|
|
Packit |
85355f |
files, with ColorMap, TransferFunction attached and nasty
|
|
Packit |
85355f |
plays with bitspersample. The fix for LUV has not been
|
|
Packit |
85355f |
tested, but suffers from the same kind of issue of PixarLog.
|
|
Packit |
85355f |
Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2604
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_strip.c: revert the change in
|
|
Packit |
85355f |
TIFFNumberOfStrips() done for
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2587 /
|
|
Packit |
85355f |
CVE-2016-9273 since the above change is a better fix that
|
|
Packit |
85355f |
makes it unnecessary.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip()
|
|
Packit |
85355f |
to instanciate compute ntrips as
|
|
Packit |
85355f |
TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a
|
|
Packit |
85355f |
logic based on the total size of data. Which is faulty is the
|
|
Packit |
85355f |
total size of data is not sufficient to fill the whole image,
|
|
Packit |
85355f |
and thus results in reading outside of the
|
|
Packit |
85355f |
StripByCounts/StripOffsets arrays when using
|
|
Packit |
85355f |
TIFFReadScanline(). Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2608.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of
|
|
Packit |
85355f |
failure in OJPEGPreDecode(). This will avoid a divide by zero,
|
|
Packit |
85355f |
and potential other issues. Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_write.c: fix misleading indentation as warned by GCC.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_fax3.h: revert change done on 2016-01-09 that
|
|
Packit |
85355f |
made Param member of TIFFFaxTabEnt structure a uint16 to
|
|
Packit |
85355f |
reduce size of the binary. It happens that the Hylafax
|
|
Packit |
85355f |
software uses the tables that follow this typedef
|
|
Packit |
85355f |
(TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable),
|
|
Packit |
85355f |
although they are not in a public libtiff header. Raised by
|
|
Packit |
85355f |
Lee Howard. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2636
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tiffio.h, libtiff/tif_getimage.c: add
|
|
Packit |
85355f |
TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants of
|
|
Packit |
85355f |
the functions without ext, with an extra argument to control
|
|
Packit |
85355f |
the stop_on_error behaviour.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: fix potential memory leaks in error
|
|
Packit |
85355f |
code path of TIFFRGBAImageBegin(). Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2627
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_jpeg.c: increase libjpeg max memory usable to 10
|
|
Packit |
85355f |
MB instead of libjpeg 1MB default. This helps when creating
|
|
Packit |
85355f |
files with "big" tile, without using libjpeg temporary files.
|
|
Packit |
85355f |
Related to https://trac.osgeo.org/gdal/ticket/6757
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_jpeg.c: avoid integer division by zero in
|
|
Packit |
85355f |
JPEGSetupEncode() when horizontal or vertical sampling is set
|
|
Packit |
85355f |
to 0. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_dirwrite.c: in
|
|
Packit |
85355f |
TIFFWriteDirectoryTagCheckedRational, replace assertion by
|
|
Packit |
85355f |
runtime check to error out if passed value is strictly
|
|
Packit |
85355f |
negative. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2535
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_dirread.c: avoid division by floating point 0 in
|
|
Packit |
85355f |
TIFFReadDirEntryCheckedRational() and
|
|
Packit |
85355f |
TIFFReadDirEntryCheckedSrational(), and return 0 in that case
|
|
Packit |
85355f |
(instead of infinity as before presumably) Apparently some
|
|
Packit |
85355f |
sanitizers do not like those divisions by zero. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2644
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement
|
|
Packit |
85355f |
various clampings of double to other data types to avoid
|
|
Packit |
85355f |
undefined behaviour if the output range isn't big enough to
|
|
Packit |
85355f |
hold the input value. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2643
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2642
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2646
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2647
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_jpeg.c: validate BitsPerSample in
|
|
Packit |
85355f |
JPEGSetupEncode() to avoid undefined behaviour caused by
|
|
Packit |
85355f |
invalid shift exponent. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2648
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: avoid potential undefined behaviour on
|
|
Packit |
85355f |
signed integer addition in TIFFReadRawStrip1() in isMapped()
|
|
Packit |
85355f |
case. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: add explicit uint32 cast in
|
|
Packit |
85355f |
putagreytile to avoid UndefinedBehaviorSanitizer warning.
|
|
Packit |
85355f |
Patch by Nicolás Peña. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2658
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc()
|
|
Packit |
85355f |
to zero initialize tif_rawdata. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2651
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add
|
|
Packit |
85355f |
_TIFFcalloc()
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in
|
|
Packit |
85355f |
Encode functions instead of -1 when TIFFFlushData1() fails.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_ojpeg.c: fix leak in
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesQTable,
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesDcTable and
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesAcTable when read fails. Patch by
|
|
Packit |
85355f |
Nicolás Peña. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2659
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_jpeg.c: only run JPEGFixupTagsSubsampling() if
|
|
Packit |
85355f |
the YCbCrSubsampling tag is not explicitly present. This helps
|
|
Packit |
85355f |
a bit to reduce the I/O amount when the tag is present
|
|
Packit |
85355f |
(especially on cloud hosted files).
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_lzw.c: in LZWPostEncode(), increase, if
|
|
Packit |
85355f |
necessary, the code bit-width after flushing the remaining
|
|
Packit |
85355f |
code and before emitting the EOI code. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=1982
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_pixarlog.c: fix memory leak in error code path of
|
|
Packit |
85355f |
PixarLogSetupDecode(). Patch by Nicolás Peña. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2665
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7
|
|
Packit |
85355f |
-Wimplicit-fallthrough warnings.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_dirread.c: fix memory leak in non
|
|
Packit |
85355f |
DEFER_STRILE_LOAD mode (ie default) when there is both a
|
|
Packit |
85355f |
StripOffsets and TileOffsets tag, or a StripByteCounts and
|
|
Packit |
85355f |
TileByteCounts Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2689
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_ojpeg.c: fix potential memory leak in
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesQTable,
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesDcTable and
|
|
Packit |
85355f |
OJPEGReadHeaderInfoSecTablesAcTable Patch by Nicolás Peña.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.
|
|
Packit |
85355f |
Patch by Alan Coopersmith + complement by myself. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2673
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: TIFFFillStrip(): add limitation to the
|
|
Packit |
85355f |
number of bytes read in case td_stripbytecount[strip] is
|
|
Packit |
85355f |
bigger than reasonable, so as to avoid excessive memory
|
|
Packit |
85355f |
allocation.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c: fix memory
|
|
Packit |
85355f |
leak when the underlying codec (ZIP, PixarLog) succeeds its
|
|
Packit |
85355f |
setupdecode() method, but PredictorSetup fails. Credit to
|
|
Packit |
85355f |
OSS-Fuzz (locally run, on GDAL)
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: TIFFFillStrip() and TIFFFillTile(): avoid
|
|
Packit |
85355f |
excessive memory allocation in case of shorten files. Only
|
|
Packit |
85355f |
effective on 64 bit builds and non-mapped cases. Credit to
|
|
Packit |
85355f |
OSS-Fuzz (locally run, on GDAL)
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: TIFFFillStripPartial() / TIFFSeek(),
|
|
Packit |
85355f |
avoid potential integer overflows with read_ahead in
|
|
Packit |
85355f |
CHUNKY_STRIP_READ_SUPPORT mode. Should
|
|
Packit |
85355f |
especially occur on 32 bit platforms.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: TIFFFillStripPartial(): avoid excessive
|
|
Packit |
85355f |
memory allocation in case of shorten files. Only effective on
|
|
Packit |
85355f |
64 bit builds. Credit to OSS-Fuzz (locally run, on GDAL)
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: update tif_rawcc in
|
|
Packit |
85355f |
CHUNKY_STRIP_READ_SUPPORT mode with tif_rawdataloaded when
|
|
Packit |
85355f |
calling TIFFStartStrip() or TIFFFillStripPartial(). This
|
|
Packit |
85355f |
avoids reading beyond tif_rawdata when bytecount >
|
|
Packit |
85355f |
tif_rawdatasize. Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.
|
|
Packit |
85355f |
Credit to OSS-Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_color.c: avoid potential int32 overflow in
|
|
Packit |
85355f |
TIFFYCbCrToRGBInit() Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533
|
|
Packit |
85355f |
Credit to OSS-Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32
|
|
Packit |
85355f |
overflows in multiply_ms() and add_ms(). Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558
|
|
Packit |
85355f |
Credit to OSS-Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_packbits.c: fix out-of-buffer read in
|
|
Packit |
85355f |
PackBitsDecode() Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
|
|
Packit |
85355f |
Credit to OSS-Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_luv.c: LogL16InitState(): avoid excessive memory
|
|
Packit |
85355f |
allocation when RowsPerStrip tag is missing.
|
|
Packit |
85355f |
Credit to OSS-Fuzz (locally run, on GDAL)
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_lzw.c: update dec_bitsleft at beginning of
|
|
Packit |
85355f |
LZWDecode(), and update tif_rawcc at end of LZWDecode(). This
|
|
Packit |
85355f |
is needed to properly work with the latest chnges in
|
|
Packit |
85355f |
tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_pixarlog.c: PixarLogDecode(): resync tif_rawcp
|
|
Packit |
85355f |
with next_in and tif_rawcc with avail_in at beginning and end
|
|
Packit |
85355f |
of function, similarly to what is done in LZWDecode(). Likely
|
|
Packit |
85355f |
needed so that it works properly with latest chnges in
|
|
Packit |
85355f |
tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode. But untested...
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: initYCbCrConversion(): add basic
|
|
Packit |
85355f |
validation of luma and refBlackWhite coefficients (just check
|
|
Packit |
85355f |
they are not NaN for now), to avoid potential float to int
|
|
Packit |
85355f |
overflows. Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663
|
|
Packit |
85355f |
Credit to OSS Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
|
|
Packit |
85355f |
of double to float. Credit to Google Autofuzz project
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
|
|
Packit |
85355f |
is not zero to avoid division by zero. Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
|
|
Packit |
85355f |
Credit to OSS Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
|
|
Packit |
85355f |
of double to float. Credit to Google Autofuzz project
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
|
|
Packit |
85355f |
is not zero to avoid division by zero. Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
|
|
Packit |
85355f |
Credit to OSS Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
libtiff/tif_getimage.c: initYCbCrConversion(): stricter
|
|
Packit |
85355f |
validation for refBlackWhite coefficients values. To avoid
|
|
Packit |
85355f |
invalid float->int32 conversion. Fixes
|
|
Packit |
85355f |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718
|
|
Packit |
85355f |
Credit to OSS Fuzz
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/fax2tiff.c (main): Applied patch by Jörg Ahrens to fix
|
|
Packit |
85355f |
passing client data for Win32 builds using tif_win32.c
|
|
Packit |
85355f |
(USE_WIN32_FILEIO defined) for file I/O. Patch was provided
|
|
Packit |
85355f |
via email on November 20, 2016.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips
|
|
Packit |
85355f |
that can cause various issues, such as buffer overflows in the
|
|
Packit |
85355f |
library. Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2598
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i
|
|
Packit |
85355f |
(ignore) mode so that the output buffer is correctly
|
|
Packit |
85355f |
incremented to avoid write outside bounds. Reported by
|
|
Packit |
85355f |
Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2620
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in
|
|
Packit |
85355f |
readSeparateStripsIntoBuffer() to avoid read outside of heap
|
|
Packit |
85355f |
allocated buffer. Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2621
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcrop.c: fix integer division by zero when
|
|
Packit |
85355f |
BitsPerSample is missing. Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffinfo.c: fix null pointer dereference in -r mode
|
|
Packit |
85355f |
when the image has no StripByteCount tag. Reported by
|
|
Packit |
85355f |
Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2594
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: avoid potential division by zero is
|
|
Packit |
85355f |
BitsPerSamples tag is missing. Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, )
|
|
Packit |
85355f |
is called, limit the return number of inks to SamplesPerPixel,
|
|
Packit |
85355f |
so that code that parses ink names doesn't go past the end of
|
|
Packit |
85355f |
the buffer. Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2599
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: avoid potential division by zero is
|
|
Packit |
85355f |
BitsPerSamples tag is missing. Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: fix uint32 underflow/overflow that can cause
|
|
Packit |
85355f |
heap-based buffer overflow. Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non
|
|
Packit |
85355f |
assert check. Reported by Agostino Sarubbo. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2605
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2ps.c: fix 2 heap-based buffer overflows (in
|
|
Packit |
85355f |
PSDataBW and PSDataColorContig). Reported by Agostino Sarubbo.
|
|
Packit |
85355f |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2634.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2pdf.c: prevent heap-based buffer overflow in -j
|
|
Packit |
85355f |
mode on a paletted image. Note: this fix errors out before the
|
|
Packit |
85355f |
overflow happens. There could probably be a better fix. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2635
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2pdf.c: fix wrong usage of memcpy() that can
|
|
Packit |
85355f |
trigger unspecified behaviour. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2638
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2pdf.c: avoid potential invalid memory read in
|
|
Packit |
85355f |
t2p_writeproc. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2639
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2pdf.c: avoid potential heap-based overflow in
|
|
Packit |
85355f |
t2p_readwrite_pdf_image_tile(). Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2640
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcrop.c: remove extraneous TIFFClose() in error code
|
|
Packit |
85355f |
path, that caused double free. Related to
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2535
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
|
|
Packit |
85355f |
and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap
|
|
Packit |
85355f |
based overflow. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2657
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/raw2tiff.c: avoid integer division by zero. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2631
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2ps.c: call TIFFClose() in error code paths.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/fax2tiff.c: emit appropriate message if the input file
|
|
Packit |
85355f |
is empty. Patch by Alan Coopersmith. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2672
|
|
Packit |
85355f |
|
|
Packit |
85355f |
tools/tiff2bw.c: close TIFF handle in error code path. Fixes
|
|
Packit |
85355f |
http://bugzilla.maptools.org/show_bug.cgi?id=2677
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
<FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
None
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
|
|
Packit |
85355f |
Last updated $Date: 2017-05-21 17:47:46 $.
|
|
Packit |
85355f |
|
|
Packit |
85355f |
</BODY>
|
|
Packit |
85355f |
</HTML>
|