|
Packit |
7838c8 |
<HTML>
|
|
Packit |
7838c8 |
<HEAD>
|
|
Packit |
7838c8 |
<TITLE>
|
|
Packit |
7838c8 |
Changes in TIFF v4.0.9
|
|
Packit |
7838c8 |
</TITLE>
|
|
Packit |
7838c8 |
</HEAD>
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<BODY BGCOLOR=white>
|
|
Packit |
7838c8 |
<FONT FACE="Helvetica, Arial, Sans">
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<BASEFONT SIZE=4>
|
|
Packit |
7838c8 |
<FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION
|
|
Packit |
7838c8 |
<BASEFONT SIZE=3>
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
Current Version: v4.0.9
|
|
Packit |
7838c8 |
Previous Version: v4.0.8
|
|
Packit |
7838c8 |
Master FTP Site:
|
|
Packit |
7838c8 |
download.osgeo.org, directory pub/libtiff
|
|
Packit |
7838c8 |
Master HTTP Site #1:
|
|
Packit |
7838c8 |
http://www.simplesystems.org/libtiff/
|
|
Packit |
7838c8 |
Master HTTP Site #2:
|
|
Packit |
7838c8 |
http://libtiff.maptools.org/
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
This document describes the changes made to the software between the
|
|
Packit |
7838c8 |
previous and current versions (see above). If you don't
|
|
Packit |
7838c8 |
find something listed here, then it was not done in this timeframe, or
|
|
Packit |
7838c8 |
it was not considered important enough to be mentioned. The following
|
|
Packit |
7838c8 |
information is located here:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
Major Changes
|
|
Packit |
7838c8 |
Changes in the software configuration
|
|
Packit |
7838c8 |
Changes in libtiff
|
|
Packit |
7838c8 |
Changes in the tools
|
|
Packit |
7838c8 |
Changes in the contrib area
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<FONT SIZE=+3>M</FONT>AJOR CHANGES:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
None
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
test/Makefile.am: Add some tests for tiff2bw.
|
|
Packit |
7838c8 |
* .appveyor.yml, .travis.yml, build/travis-ci: apply patches
|
|
Packit |
7838c8 |
0001-ci-Travis-script-improvements.patch and
|
|
Packit |
7838c8 |
0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
|
|
Packit |
7838c8 |
(sent to mailing list)
|
|
Packit |
7838c8 |
.travis.yml, build/travis-ci: new files from
|
|
Packit |
7838c8 |
0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch by
|
|
Packit |
7838c8 |
Roger Leigh (sent to mailing list on 2017-06-08)
|
|
Packit |
7838c8 |
This patch adds support for the Travis-CI service.
|
|
Packit |
7838c8 |
.appveyor.yml: new file from
|
|
Packit |
7838c8 |
0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to mailing
|
|
Packit |
7838c8 |
list on 2017-06-08)
|
|
Packit |
7838c8 |
This patch adds a .appveyor.yml file to the top-level. This allows
|
|
Packit |
7838c8 |
one to opt in to having a branch built on Windows with Cygwin,
|
|
Packit |
7838c8 |
MinGW and MSVC automatically when a branch is pushed to GitHub,
|
|
Packit |
7838c8 |
GitLab, BitBucket or any other supported git hosting service.
|
|
Packit |
7838c8 |
CMakeLists.txt, test/CMakeLists.txt, test/TiffTestCommon.cmake: apply
|
|
Packit |
7838c8 |
patch 0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from Roger
|
|
Packit |
7838c8 |
Leigh (sent to mailing list on 2017-06-08)
|
|
Packit |
7838c8 |
This patch makes the CMake build system support running the tests
|
|
Packit |
7838c8 |
with MinGW or Cygwin.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff: new files
|
|
Packit |
7838c8 |
to test old-style LZW decompression
|
|
Packit |
7838c8 |
test/common.sh, Makefile.am, CMakeList.txt: updated with above
|
|
Packit |
7838c8 |
test/Makefile.am: add missing reference to images/quad-lzw-compat.tiff
|
|
Packit |
7838c8 |
to fix "make distcheck". Patch by Roger Leigh
|
|
Packit |
7838c8 |
nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS and use
|
|
Packit |
7838c8 |
/MDd runtime in debug mode.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping to avoid
|
|
Packit |
7838c8 |
int32 overflow in TIFFYCbCrtoRGB().
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: initYCbCrConversion(): stricter validation for
|
|
Packit |
7838c8 |
refBlackWhite coefficients values. To avoid invalid float->int32 conversion
|
|
Packit |
7838c8 |
(when refBlackWhite[0] == 2147483648.f)
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
|
|
Packit |
7838c8 |
and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
|
|
Packit |
7838c8 |
codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
|
|
Packit |
7838c8 |
to behave differently depending on whether the codec is enabled or not, and
|
|
Packit |
7838c8 |
thus can avoid stack based buffer overflows in a number of TIFF utilities
|
|
Packit |
7838c8 |
such as tiffsplit, tiffcmp, thumbnail, etc.
|
|
Packit |
7838c8 |
Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
|
|
Packit |
7838c8 |
(http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
|
|
Packit |
7838c8 |
Fixes:
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2580
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2693
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2441
|
|
Packit |
7838c8 |
http://bugzilla.maptools.org/show_bug.cgi?id=2433
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is defined, do not do
|
|
Packit |
7838c8 |
the #ifdef TIFFSwabXXX checks. Make it easier for GDAL to rename the symbols
|
|
Packit |
7838c8 |
of its internal libtiff copy.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
|
|
Packit |
7838c8 |
ChopUpSingleUncompressedStrip() regarding update of newly single-strip
|
|
Packit |
7838c8 |
uncompressed files whose bytecount is 0. Before the change of 2016-12-03,
|
|
Packit |
7838c8 |
the condition bytecount==0 used to trigger an early exit/disabling of
|
|
Packit |
7838c8 |
strip chop. Re-introduce that in update mode. Otherwise this cause
|
|
Packit |
7838c8 |
later incorrect setting for the value of StripByCounts/StripOffsets.
|
|
Packit |
7838c8 |
( https://trac.osgeo.org/gdal/ticket/6924 )
|
|
Packit |
7838c8 |
libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the number of items
|
|
Packit |
7838c8 |
read in StripOffsets/StripByteCounts tags to the number of strips to avoid
|
|
Packit |
7838c8 |
excessive memory allocation.
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: avoid many (harmless) unsigned int overflows.
|
|
Packit |
7838c8 |
libtiff/tif_fax3.c: avoid unsigned int overflow in Fax3Encode2DRow(). Could
|
|
Packit |
7838c8 |
potentially be a bug with huge rows.
|
|
Packit |
7838c8 |
libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on tiled images.
|
|
Packit |
7838c8 |
libtiff/tif_dirread.c: avoid unsigned int overflow in EstimateStripByteCounts()
|
|
Packit |
7838c8 |
and BYTECOUNTLOOKSBAD when file is too short.
|
|
Packit |
7838c8 |
libtiff/tif_predict.c: decorate legitimate functions where unsigned int
|
|
Packit |
7838c8 |
overflow occur with TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
|
|
Packit |
7838c8 |
* libtiff/tif_dirread.c: avoid unsigned int overflow in EstimateStripByteCounts()
|
|
Packit |
7838c8 |
libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW macro to
|
|
Packit |
7838c8 |
disable CLang warnings raised by -fsanitize=undefined,unsigned-integer-overflow
|
|
Packit |
7838c8 |
libtiff/tif_jpeg.c: add anti-denial of service measure to avoid excessive
|
|
Packit |
7838c8 |
CPU consumption on progressive JPEGs with a huge number of scans.
|
|
Packit |
7838c8 |
See http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
|
|
Packit |
7838c8 |
Note: only affects libtiff since 2014-12-29 where support of non-baseline JPEG
|
|
Packit |
7838c8 |
was added.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
libtiff/tif_jpeg.c: error out at decoding time if anticipated libjpeg
|
|
Packit |
7838c8 |
memory allocation is above 100 MB. libjpeg in case of multiple scans,
|
|
Packit |
7838c8 |
which is allowed even in baseline JPEG, if components are spread over several
|
|
Packit |
7838c8 |
scans and not interleavedin a single one, needs to allocate memory (or
|
|
Packit |
7838c8 |
backing store) for the whole strip/tile.
|
|
Packit |
7838c8 |
See http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
|
|
Packit |
7838c8 |
This limitation may be overriden by setting the
|
|
Packit |
7838c8 |
LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or recompiling
|
|
Packit |
7838c8 |
libtiff with a custom value of TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
|
|
Packit |
7838c8 |
libtiff/tif_jbig.c: fix memory leak in error code path of JBIGDecode()
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that a
|
|
Packit |
7838c8 |
double value can fit in a float before casting. Patch by Nicolas RUFF
|
|
Packit |
7838c8 |
libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
|
|
Packit |
7838c8 |
libtiff/tif_read.c: make TIFFReadScanline() works in
|
|
Packit |
7838c8 |
CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple scans.
|
|
Packit |
7838c8 |
Also make configurable through a LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER
|
|
Packit |
7838c8 |
environment variable the maximum number of scans allowed. Defaults to
|
|
Packit |
7838c8 |
100.
|
|
Packit |
7838c8 |
libtiff/tif_read.c: TIFFFillTile(): add limitation to the number
|
|
Packit |
7838c8 |
of bytes read in case td_stripbytecount[strip] is bigger than
|
|
Packit |
7838c8 |
reasonable, so as to avoid excessive memory allocation (similarly to
|
|
Packit |
7838c8 |
what was done for TIFFFileStrip() on 2017-05-10)
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: use _TIFFReadEncodedStripAndAllocBuffer().
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
|
|
Packit |
7838c8 |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433 .
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedStripAndAllocBuffer()
|
|
Packit |
7838c8 |
function, variant of TIFFReadEncodedStrip() that allocates the
|
|
Packit |
7838c8 |
decoded buffer only after a first successful TIFFFillStrip(). This avoids
|
|
Packit |
7838c8 |
excessive memory allocation on corrupted files.
|
|
Packit |
7838c8 |
libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
|
|
Packit |
7838c8 |
functions associated with LONG8/SLONG8 data type, replace assertion that
|
|
Packit |
7838c8 |
the file is BigTIFF, by a non-fatal error.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
|
|
Packit |
7838c8 |
tif_rawdataloaded when it is set. Similarly to TIFFStartStrip().
|
|
Packit |
7838c8 |
This issue was revealed by the change of 2017-06-30 in TIFFFileTile(),
|
|
Packit |
7838c8 |
limiting the number of bytes read. But it could probably have been hit
|
|
Packit |
7838c8 |
too in CHUNKY_STRIP_READ_SUPPORT mode previously ?
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_error.c, tif_warning.c: correctly use va_list when both
|
|
Packit |
7838c8 |
an old-style and new-style warning/error handlers are installed.
|
|
Packit |
7838c8 |
Patch by Paavo Helde (sent on the mailing list)
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
|
|
Packit |
7838c8 |
Credit to OSS Fuzz.
|
|
Packit |
7838c8 |
libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedTileAndAllocBuffer()
|
|
Packit |
7838c8 |
and _TIFFReadTileAndAllocBuffer() variants of TIFFReadEncodedTile() and
|
|
Packit |
7838c8 |
TIFFReadTile() that allocates the decoded buffer only after a first
|
|
Packit |
7838c8 |
successful TIFFFillTile(). This avoids excessive memory allocation
|
|
Packit |
7838c8 |
on corrupted files.
|
|
Packit |
7838c8 |
libtiff/tif_pixarlog.c: avoid excessive memory allocation on decoding
|
|
Packit |
7838c8 |
when RowsPerStrip tag is not defined (and thus td_rowsperstrip == UINT_MAX)
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of old-style LZW
|
|
Packit |
7838c8 |
compressed files.
|
|
Packit |
7838c8 |
libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte LZW
|
|
Packit |
7838c8 |
strips. Crashing issue only on memory mapped files, where the strip
|
|
Packit |
7838c8 |
offset is the last byte of the file, and the file size is a multiple
|
|
Packit |
7838c8 |
of one page size on the CPU architecture (typically 4096). Credit
|
|
Packit |
7838c8 |
to myself :-)
|
|
Packit |
7838c8 |
libtiff/tif_dir.c: avoid potential null pointer dereference in
|
|
Packit |
7838c8 |
_TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag instance.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
|
|
Packit |
7838c8 |
tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
|
|
Packit |
7838c8 |
mode on PlanarConfig=Contig input images.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2715
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
|
|
Packit |
7838c8 |
Complementary fix for http://bugzilla.maptools.org/show_bug.cgi?id=2708
|
|
Packit |
7838c8 |
in the isMapped() case, so as to avoid excessive memory allocation
|
|
Packit |
7838c8 |
when we need a temporary buffer but the file is truncated.
|
|
Packit |
7838c8 |
libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
|
|
Packit |
7838c8 |
Complementary fix for http://bugzilla.maptools.org/show_bug.cgi?id=2708
|
|
Packit |
7838c8 |
in the isMapped() case, so as to avoid excessive memory allocation
|
|
Packit |
7838c8 |
when we need a temporary buffer but the file is truncated.
|
|
Packit |
7838c8 |
libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
|
|
Packit |
7838c8 |
arrays that hold StripOffsets/StripByteCounts, when they are smaller
|
|
Packit |
7838c8 |
than the expected number of striles, up to 1 million striles, and
|
|
Packit |
7838c8 |
error out beyond. Can be tweaked by setting the environment variable
|
|
Packit |
7838c8 |
LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
|
|
Packit |
7838c8 |
This partially goes against a change added on 2002-12-17 to accept
|
|
Packit |
7838c8 |
those arrays of wrong sizes, but is needed to avoid denial of services.
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
|
|
Packit |
7838c8 |
arrays that hold StripOffsets/StripByteCounts, when they are smaller
|
|
Packit |
7838c8 |
than the expected number of striles, up to 1 million striles, and
|
|
Packit |
7838c8 |
error out beyond. Can be tweaked by setting the environment variable
|
|
Packit |
7838c8 |
LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
|
|
Packit |
7838c8 |
This partially goes against a change added on 2002-12-17 to accept
|
|
Packit |
7838c8 |
those arrays of wrong sizes, but is needed to avoid denial of services.
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_read.c: add protection against excessive memory
|
|
Packit |
7838c8 |
allocation attempts in TIFFReadDirEntryArray() on short files.
|
|
Packit |
7838c8 |
Effective for mmap'ed case. And non-mmap'ed case, but restricted
|
|
Packit |
7838c8 |
to 64bit builds.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2675
|
|
Packit |
7838c8 |
libtiff/tif_read.c: add protection against excessive memory
|
|
Packit |
7838c8 |
allocation attempts in TIFFReadDirEntryArray() on short files.
|
|
Packit |
7838c8 |
Effective for mmap'ed case. And non-mmap'ed case, but restricted
|
|
Packit |
7838c8 |
to 64bit builds.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2675
|
|
Packit |
7838c8 |
libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
|
|
Packit |
7838c8 |
allocation when RowsPerStrip tag is missing.
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
|
|
Packit |
7838c8 |
Credit to OSS-Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
|
|
Packit |
7838c8 |
properly break from loops on error when stoponerr is set, instead
|
|
Packit |
7838c8 |
of going on iterating on row based loop.
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: fix fromskew computation when to-be-skipped
|
|
Packit |
7838c8 |
pixel number is not a multiple of the horizontal subsampling, and
|
|
Packit |
7838c8 |
also in some other cases. Impact putcontig8bitYCbCr44tile,
|
|
Packit |
7838c8 |
putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile,
|
|
Packit |
7838c8 |
putcontig8bitYCbCr21tile and putcontig8bitYCbCr12tile
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2637 (discovered
|
|
Packit |
7838c8 |
by Agostino Sarubbo)
|
|
Packit |
7838c8 |
and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691 (credit
|
|
Packit |
7838c8 |
to OSS Fuzz)
|
|
Packit |
7838c8 |
libtiff/tif_luv.c: further reduce memory requirements for temporary
|
|
Packit |
7838c8 |
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
|
|
Packit |
7838c8 |
LogL16InitState().
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
libtiff/tif_dirwrite.c: replace assertion related to not finding the
|
|
Packit |
7838c8 |
SubIFD tag by runtime check (in TIFFWriteDirectorySec())
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2727
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
libtiff/tif_dirwrite.c: replace assertion to tag value not fitting
|
|
Packit |
7838c8 |
on uint32 when selecting the value of SubIFD tag by runtime check
|
|
Packit |
7838c8 |
(in TIFFWriteDirectoryTagSubifd()).
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2728
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
libtiff/tif_jpeg.c: accept reading the last strip of a JPEG compressed
|
|
Packit |
7838c8 |
file if the codestream height is larger than the truncated height of the
|
|
Packit |
7838c8 |
strip. Emit a warning in this situation since this is non compliant.
|
|
Packit |
7838c8 |
libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a _TIFFSeekoK()
|
|
Packit |
7838c8 |
function that checks if the offset is not bigger than INT64_MAX, so as
|
|
Packit |
7838c8 |
to avoid a -1 error return code of TIFFSeekFile() to match a required
|
|
Packit |
7838c8 |
seek to UINT64_MAX/-1.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
|
|
Packit |
7838c8 |
Adapted from proposal by Nicolas Ruff.
|
|
Packit |
7838c8 |
libtiff/tif_dirread.c: add NULL check to avoid likely false positive
|
|
Packit |
7838c8 |
null-pointer dereference warning by CLang Static Analyzer.
|
|
Packit |
7838c8 |
libtiff/libtiff.def: add TIFFReadRGBAStripExt and TIFFReadRGBATileExt
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2735
|
|
Packit |
7838c8 |
libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo 1.5.2 that
|
|
Packit |
7838c8 |
honours max_memory_to_use > 0.
|
|
Packit |
7838c8 |
Cf https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
|
|
Packit |
7838c8 |
libtiff/tif_getimage.c: avoid floating point division by zero in
|
|
Packit |
7838c8 |
initCIELabConversion()
|
|
Packit |
7838c8 |
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
|
|
Packit |
7838c8 |
Credit to OSS Fuzz
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
|
|
Packit |
7838c8 |
mode on PlanarConfig=Contig input images.
|
|
Packit |
7838c8 |
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2715
|
|
Packit |
7838c8 |
Reported by team OWL337
|
|
Packit |
7838c8 |
tools/tiffset.c: fix setting a single value for the ExtraSamples tag
|
|
Packit |
7838c8 |
(and other tags with variable number of values).
|
|
Packit |
7838c8 |
So 'tiffset -s ExtraSamples 1 X'. This only worked
|
|
Packit |
7838c8 |
when setting 2 or more values, but not just one.
|
|
Packit |
7838c8 |
tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as the
|
|
Packit |
7838c8 |
client data. This client data is not used at all at the moment,
|
|
Packit |
7838c8 |
but it makes the most sense. Issue that the value of
|
|
Packit |
7838c8 |
client_data.fd was passed where a pointer is expected was reported
|
|
Packit |
7838c8 |
via email by Gerald Schade on Sun, 29 Oct 2017.
|
|
Packit |
7838c8 |
tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
|
|
Packit |
7838c8 |
arithmetic overflow in bounds checking code and eliminate
|
|
Packit |
7838c8 |
comparison between signed and unsigned type.
|
|
Packit |
7838c8 |
tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
|
|
Packit |
7838c8 |
program. This is in response to the report associated with
|
|
Packit |
7838c8 |
CVE-2017-16232 but does not solve the extremely high memory usage
|
|
Packit |
7838c8 |
with the associated POC file.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
<FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
None
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
Last updated $Date: 2017-11-18 19:38:06 $.
|
|
Packit |
7838c8 |
|
|
Packit |
7838c8 |
</BODY>
|
|
Packit |
7838c8 |
</HTML>
|