source-git / mingw-libtiff

Clone
Source Code
GIT

Blame html/v4.0.8.html

c8 master
  1.   7838c85e25d4f12136e729d9f49350990bb8202d
  2.   html
  3.   v4.0.8.html
Blob History Raw
Packit 7838c8 
<HTML>
Packit 7838c8 
<HEAD>
Packit 7838c8 
<TITLE>
Packit 7838c8 
	Changes in TIFF v4.0.8
Packit 7838c8 
</TITLE>
Packit 7838c8 
</HEAD>
Packit 7838c8
Packit 7838c8 
<BODY BGCOLOR=white>
Packit 7838c8 
<FONT FACE="Helvetica, Arial, Sans">
Packit 7838c8
Packit 7838c8 
<BASEFONT SIZE=4>
Packit 7838c8 
<FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION
Packit 7838c8 
<BASEFONT SIZE=3>
Packit 7838c8
Packit 7838c8
    Packit 7838c8
    Packit 7838c8 
    Current Version: v4.0.8
    Packit 7838c8 
    Previous Version: v4.0.7
    Packit 7838c8 
    Master FTP Site:
    Packit 7838c8 
    download.osgeo.org, directory pub/libtiff
    Packit 7838c8 
    Master HTTP Site #1:
    Packit 7838c8 
    http://www.simplesystems.org/libtiff/
    Packit 7838c8 
    Master HTTP Site #2:
    Packit 7838c8 
    http://libtiff.maptools.org/
    Packit 7838c8
    Packit 7838c8
    Packit 7838c8
    Packit 7838c8
    Packit 7838c8 
    This document describes the changes made to the software between the
    Packit 7838c8 
    previous and current versions (see above).  If you don't
    Packit 7838c8 
    find something listed here, then it was not done in this timeframe, or
    Packit 7838c8 
    it was not considered important enough to be mentioned.  The following
    Packit 7838c8 
    information is located here:
    Packit 7838c8
      Packit 7838c8 
    • Major Changes
      		•
      Packit 7838c8 
    • Changes in the software configuration
      		•
      Packit 7838c8 
    • Changes in libtiff
      		•
      Packit 7838c8 
    • Changes in the tools
      		•
      Packit 7838c8 
    • Changes in the contrib area
      		•
      Packit 7838c8
      Packit 7838c8
      Packit 7838c8
      Packit 7838c8
      Packit 7838c8
      Packit 7838c8
      Packit 7838c8 
      <FONT SIZE=+3>M</FONT>AJOR CHANGES:
      Packit 7838c8
      Packit 7838c8
        Packit 7838c8
        Packit 7838c8 
        	
      •  None
        		•
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8
        Packit 7838c8 
        <FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:
        Packit 7838c8
        Packit 7838c8
          Packit 7838c8
          Packit 7838c8 
            
        •  None
          		•
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8
          Packit 7838c8 
          <FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:
          Packit 7838c8
          Packit 7838c8
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis
            		•
            Packit 7838c8 
                    to fix cppcheck clarifyCalculation warnings *
            Packit 7838c8 
                    libtiff/tif_predict.c, libtiff/tif_print.c: fix printf
            Packit 7838c8 
                    unsigned vs signed formatting (cppcheck
            Packit 7838c8 
                    invalidPrintfArgType_uint warnings)
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
            		•
            Packit 7838c8 
                    TIFFReadEncodedStrip() that caused an integer division by
            Packit 7838c8 
                    zero.  Reported by Agostino Sarubbo.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2596
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
            		•
            Packit 7838c8 
                    buffer overflow on generation of PixarLog / LUV compressed
            Packit 7838c8 
                    files, with ColorMap, TransferFunction attached and nasty
            Packit 7838c8 
                    plays with bitspersample.  The fix for LUV has not been
            Packit 7838c8 
                    tested, but suffers from the same kind of issue of PixarLog.
            Packit 7838c8 
                    Reported by Agostino Sarubbo.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2604
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_strip.c: revert the change in
            		•
            Packit 7838c8 
                    TIFFNumberOfStrips() done for
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2587 /
            Packit 7838c8 
                    CVE-2016-9273 since the above change is a better fix that
            Packit 7838c8 
                    makes it unnecessary.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip()
            		•
            Packit 7838c8 
                    to instanciate compute ntrips as
            Packit 7838c8 
                    TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a
            Packit 7838c8 
                    logic based on the total size of data. Which is faulty is the
            Packit 7838c8 
                    total size of data is not sufficient to fill the whole image,
            Packit 7838c8 
                    and thus results in reading outside of the
            Packit 7838c8 
                    StripByCounts/StripOffsets arrays when using
            Packit 7838c8 
                    TIFFReadScanline().  Reported by Agostino Sarubbo.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2608.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of
            		•
            Packit 7838c8 
                    failure in OJPEGPreDecode(). This will avoid a divide by zero,
            Packit 7838c8 
                    and potential other issues.  Reported by Agostino Sarubbo.
            Packit 7838c8 
                    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_write.c: fix misleading indentation as warned by GCC.
            		•
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_fax3.h: revert change done on 2016-01-09 that
            		•
            Packit 7838c8 
                    made Param member of TIFFFaxTabEnt structure a uint16 to
            Packit 7838c8 
                    reduce size of the binary. It happens that the Hylafax
            Packit 7838c8 
                    software uses the tables that follow this typedef
            Packit 7838c8 
                    (TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable),
            Packit 7838c8 
                    although they are not in a public libtiff header.  Raised by
            Packit 7838c8 
                    Lee Howard.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2636
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tiffio.h, libtiff/tif_getimage.c: add
            		•
            Packit 7838c8 
                    TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants of
            Packit 7838c8 
                    the functions without ext, with an extra argument to control
            Packit 7838c8 
                    the stop_on_error behaviour.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: fix potential memory leaks in error
            		•
            Packit 7838c8 
                    code path of TIFFRGBAImageBegin().  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2627
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_jpeg.c: increase libjpeg max memory usable to 10
            		•
            Packit 7838c8 
                    MB instead of libjpeg 1MB default. This helps when creating
            Packit 7838c8 
                    files with "big" tile, without using libjpeg temporary files.
            Packit 7838c8 
                    Related to https://trac.osgeo.org/gdal/ticket/6757
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_jpeg.c: avoid integer division by zero in
            		•
            Packit 7838c8 
                    JPEGSetupEncode() when horizontal or vertical sampling is set
            Packit 7838c8 
                    to 0.  Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_dirwrite.c: in
            		•
            Packit 7838c8 
                    TIFFWriteDirectoryTagCheckedRational, replace assertion by
            Packit 7838c8 
                    runtime check to error out if passed value is strictly
            Packit 7838c8 
                    negative.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2535
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_dirread.c: avoid division by floating point 0 in
            		•
            Packit 7838c8 
                    TIFFReadDirEntryCheckedRational() and
            Packit 7838c8 
                    TIFFReadDirEntryCheckedSrational(), and return 0 in that case
            Packit 7838c8 
                    (instead of infinity as before presumably) Apparently some
            Packit 7838c8 
                    sanitizers do not like those divisions by zero.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2644
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement
            		•
            Packit 7838c8 
                    various clampings of double to other data types to avoid
            Packit 7838c8 
                    undefined behaviour if the output range isn't big enough to
            Packit 7838c8 
                    hold the input value.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2643
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2642
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2646
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2647
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_jpeg.c: validate BitsPerSample in
            		•
            Packit 7838c8 
                    JPEGSetupEncode() to avoid undefined behaviour caused by
            Packit 7838c8 
                    invalid shift exponent.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2648
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: avoid potential undefined behaviour on
            		•
            Packit 7838c8 
                    signed integer addition in TIFFReadRawStrip1() in isMapped()
            Packit 7838c8 
                    case.  Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: add explicit uint32 cast in
            		•
            Packit 7838c8 
                    putagreytile to avoid UndefinedBehaviorSanitizer warning.
            Packit 7838c8 
                    Patch by Nicolás Peña.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2658
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc()
            		•
            Packit 7838c8 
                    to zero initialize tif_rawdata.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2651
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add
            		•
            Packit 7838c8 
                _TIFFcalloc()
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in
            		•
            Packit 7838c8 
                    Encode functions instead of -1 when TIFFFlushData1() fails.
            Packit 7838c8 
                    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_ojpeg.c: fix leak in
            		•
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesQTable,
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesDcTable and
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesAcTable when read fails.  Patch by
            Packit 7838c8 
                    Nicolás Peña.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2659
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_jpeg.c: only run JPEGFixupTagsSubsampling() if
            		•
            Packit 7838c8 
                    the YCbCrSubsampling tag is not explicitly present. This helps
            Packit 7838c8 
                    a bit to reduce the I/O amount when the tag is present
            Packit 7838c8 
                    (especially on cloud hosted files).
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_lzw.c: in LZWPostEncode(), increase, if
            		•
            Packit 7838c8 
                    necessary, the code bit-width after flushing the remaining
            Packit 7838c8 
                    code and before emitting the EOI code.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=1982
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_pixarlog.c: fix memory leak in error code path of
            		•
            Packit 7838c8 
                    PixarLogSetupDecode(). Patch by Nicolás Peña.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2665
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7
            		•
            Packit 7838c8 
                    -Wimplicit-fallthrough warnings.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_dirread.c: fix memory leak in non
            		•
            Packit 7838c8 
                    DEFER_STRILE_LOAD mode (ie default) when there is both a
            Packit 7838c8 
                    StripOffsets and TileOffsets tag, or a StripByteCounts and
            Packit 7838c8 
                    TileByteCounts Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2689
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_ojpeg.c: fix potential memory leak in
            		•
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesQTable,
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesDcTable and
            Packit 7838c8 
                    OJPEGReadHeaderInfoSecTablesAcTable Patch by Nicolás Peña.
            Packit 7838c8 
                    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.
            		•
            Packit 7838c8 
                    Patch by Alan Coopersmith + complement by myself.  Fixes
            Packit 7838c8 
                    http://bugzilla.maptools.org/show_bug.cgi?id=2673
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: TIFFFillStrip(): add limitation to the
            		•
            Packit 7838c8 
                    number of bytes read in case td_stripbytecount[strip] is
            Packit 7838c8 
                    bigger than reasonable, so as to avoid excessive memory
            Packit 7838c8 
                    allocation.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c: fix memory
            		•
            Packit 7838c8 
                    leak when the underlying codec (ZIP, PixarLog) succeeds its
            Packit 7838c8 
                    setupdecode() method, but PredictorSetup fails.  Credit to
            Packit 7838c8 
                    OSS-Fuzz (locally run, on GDAL)
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: TIFFFillStrip() and TIFFFillTile(): avoid
            		•
            Packit 7838c8 
                    excessive memory allocation in case of shorten files.  Only
            Packit 7838c8 
                    effective on 64 bit builds and non-mapped cases.  Credit to
            Packit 7838c8 
                    OSS-Fuzz (locally run, on GDAL)
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: TIFFFillStripPartial() / TIFFSeek(),
            		•
            Packit 7838c8 
                    avoid potential integer overflows with read_ahead in
            Packit 7838c8 
                    CHUNKY_STRIP_READ_SUPPORT mode. Should
            Packit 7838c8 
                    especially occur on 32 bit platforms.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: TIFFFillStripPartial(): avoid excessive
            		•
            Packit 7838c8 
                    memory allocation in case of shorten files.  Only effective on
            Packit 7838c8 
                    64 bit builds.  Credit to OSS-Fuzz (locally run, on GDAL)
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: update tif_rawcc in
            		•
            Packit 7838c8 
                    CHUNKY_STRIP_READ_SUPPORT mode with tif_rawdataloaded when
            Packit 7838c8 
                    calling TIFFStartStrip() or TIFFFillStripPartial(). This
            Packit 7838c8 
                    avoids reading beyond tif_rawdata when bytecount >
            Packit 7838c8 
                    tif_rawdatasize.  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.
            Packit 7838c8 
                    Credit to OSS-Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_color.c: avoid potential int32 overflow in
            		•
            Packit 7838c8 
                    TIFFYCbCrToRGBInit() Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533
            Packit 7838c8 
                    Credit to OSS-Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32
            		•
            Packit 7838c8 
                    overflows in multiply_ms() and add_ms().  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558
            Packit 7838c8 
                    Credit to OSS-Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_packbits.c: fix out-of-buffer read in
            		•
            Packit 7838c8 
                    PackBitsDecode() Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
            Packit 7838c8 
                    Credit to OSS-Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_luv.c: LogL16InitState(): avoid excessive memory
            		•
            Packit 7838c8 
                    allocation when RowsPerStrip tag is missing.
            Packit 7838c8 
                    Credit to OSS-Fuzz (locally run, on GDAL)
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_lzw.c: update dec_bitsleft at beginning of
            		•
            Packit 7838c8 
                    LZWDecode(), and update tif_rawcc at end of LZWDecode(). This
            Packit 7838c8 
                    is needed to properly work with the latest chnges in
            Packit 7838c8 
                    tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_pixarlog.c: PixarLogDecode(): resync tif_rawcp
            		•
            Packit 7838c8 
                    with next_in and tif_rawcc with avail_in at beginning and end
            Packit 7838c8 
                    of function, similarly to what is done in LZWDecode(). Likely
            Packit 7838c8 
                    needed so that it works properly with latest chnges in
            Packit 7838c8 
                    tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode. But untested...
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: initYCbCrConversion(): add basic
            		•
            Packit 7838c8 
                    validation of luma and refBlackWhite coefficients (just check
            Packit 7838c8 
                    they are not NaN for now), to avoid potential float to int
            Packit 7838c8 
                    overflows.  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663
            Packit 7838c8 
                    Credit to OSS Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
            		•
            Packit 7838c8 
                    of double to float.  Credit to Google Autofuzz project
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
            		•
            Packit 7838c8 
                    is not zero to avoid division by zero.  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
            Packit 7838c8 
                    Credit to OSS Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
            		•
            Packit 7838c8 
                    of double to float.  Credit to Google Autofuzz project
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
            		•
            Packit 7838c8 
                    is not zero to avoid division by zero.  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
            Packit 7838c8 
                    Credit to OSS Fuzz
            Packit 7838c8
            Packit 7838c8 
                
          •  libtiff/tif_getimage.c: initYCbCrConversion(): stricter
            		•
            Packit 7838c8 
                    validation for refBlackWhite coefficients values. To avoid
            Packit 7838c8 
                    invalid float->int32 conversion.  Fixes
            Packit 7838c8 
                    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718
            Packit 7838c8 
                    Credit to OSS Fuzz
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8
            Packit 7838c8 
            <FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:
            Packit 7838c8
            Packit 7838c8
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/fax2tiff.c (main): Applied patch by Jörg Ahrens to fix
              		•
              Packit 7838c8 
                      passing client data for Win32 builds using tif_win32.c
              Packit 7838c8 
                      (USE_WIN32_FILEIO defined) for file I/O.  Patch was provided
              Packit 7838c8 
                      via email on November 20, 2016.
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips
              		•
              Packit 7838c8 
                      that can cause various issues, such as buffer overflows in the
              Packit 7838c8 
                      library.  Reported by Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2598
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i
              		•
              Packit 7838c8 
                      (ignore) mode so that the output buffer is correctly
              Packit 7838c8 
                      incremented to avoid write outside bounds.  Reported by
              Packit 7838c8 
                      Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2620
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in
              		•
              Packit 7838c8 
                      readSeparateStripsIntoBuffer() to avoid read outside of heap
              Packit 7838c8 
                      allocated buffer.  Reported by Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2621
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcrop.c: fix integer division by zero when
              		•
              Packit 7838c8 
                      BitsPerSample is missing.  Reported by Agostino Sarubbo.
              Packit 7838c8 
                      Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffinfo.c: fix null pointer dereference in -r mode
              		•
              Packit 7838c8 
                      when the image has no StripByteCount tag.  Reported by
              Packit 7838c8 
                      Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2594
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: avoid potential division by zero is
              		•
              Packit 7838c8 
                      BitsPerSamples tag is missing.  Reported by Agostino Sarubbo.
              Packit 7838c8 
                      Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, )
              		•
              Packit 7838c8 
                      is called, limit the return number of inks to SamplesPerPixel,
              Packit 7838c8 
                      so that code that parses ink names doesn't go past the end of
              Packit 7838c8 
                      the buffer.  Reported by Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2599
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: avoid potential division by zero is
              		•
              Packit 7838c8 
                      BitsPerSamples tag is missing.  Reported by Agostino Sarubbo.
              Packit 7838c8 
                      Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: fix uint32 underflow/overflow that can cause
              		•
              Packit 7838c8 
                      heap-based buffer overflow.  Reported by Agostino Sarubbo.
              Packit 7838c8 
                      Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non
              		•
              Packit 7838c8 
                      assert check.  Reported by Agostino Sarubbo.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2605
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2ps.c: fix 2 heap-based buffer overflows (in
              		•
              Packit 7838c8 
                      PSDataBW and PSDataColorContig). Reported by Agostino Sarubbo.
              Packit 7838c8 
                      Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2634.
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2pdf.c: prevent heap-based buffer overflow in -j
              		•
              Packit 7838c8 
                      mode on a paletted image. Note: this fix errors out before the
              Packit 7838c8 
                      overflow happens. There could probably be a better fix.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2635
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2pdf.c: fix wrong usage of memcpy() that can
              		•
              Packit 7838c8 
                      trigger unspecified behaviour.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2638
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2pdf.c: avoid potential invalid memory read in
              		•
              Packit 7838c8 
                      t2p_writeproc.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2639
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2pdf.c: avoid potential heap-based overflow in
              		•
              Packit 7838c8 
                      t2p_readwrite_pdf_image_tile().  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2640
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcrop.c: remove extraneous TIFFClose() in error code
              		•
              Packit 7838c8 
                      path, that caused double free.  Related to
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2535
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
              		•
              Packit 7838c8 
                      and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap
              Packit 7838c8 
                      based overflow.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2657
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/raw2tiff.c: avoid integer division by zero.  Fixes
              		•
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2631
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2ps.c: call TIFFClose() in error code paths.
              		•
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/fax2tiff.c: emit appropriate message if the input file
              		•
              Packit 7838c8 
                      is empty. Patch by Alan Coopersmith.  Fixes
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2672
              Packit 7838c8
              Packit 7838c8 
                  
            •  tools/tiff2bw.c: close TIFF handle in error code path.  Fixes
              		•
              Packit 7838c8 
                      http://bugzilla.maptools.org/show_bug.cgi?id=2677
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8 
              <FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8 
                
            •  None
              		•
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8
              Packit 7838c8 
              Last updated $Date: 2017-05-21 17:47:46 $.
              Packit 7838c8
              Packit 7838c8 
              </BODY>
              Packit 7838c8 
              </HTML>

              Powered by Pagure 5.13.3

              SSH Hostkey/Fingerprint | Documentation