/usr/share/doc/libtiff-devel
Edit: /usr/share/doc/libtiff-devel/ChangeLog (292057B)
2017-11-18 Bob Friesenhahn
* configure.ac: libtiff 4.0.9 released.
* html/v4.0.9.html: Add HTML file to document changes in libtiff
v4.0.9.
2017-11-17 Even Rouault
* libtiff/tif_aux.c, tif_getimage.c, tif_read.c: typo fixes in
comments.
2017-11-02 Bob Friesenhahn
* test/Makefile.am: Add some tests for tiff2bw.
2017-11-01 Bob Friesenhahn
* tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
program. This is in response to the report associated with
CVE-2017-16232 but does not solve the extremely high memory usage
with the associated POC file.
2017-10-29 Bob Friesenhahn
* tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
arithmetic overflow in bounds checking code and eliminate
comparison between signed and unsigned type.
* tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as the
client data. This client data is not used at all at the moment,
but it makes the most sense. Issue that the value of
client_data.fd was passed where a pointer is expected was reported
via email by Gerald Schade on Sun, 29 Oct 2017.
2017-10-23 Even Rouault
* libtiff/tif_getimage.c: avoid floating point division by zero in
initCIELabConversion()
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
Credit to OSS Fuzz
2017-10-17 Even Rouault
* libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo 1.5.2 that
honours max_memory_to_use > 0.
Cf https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
2017-10-10 Even Rouault
* nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS and use
/MDd runtime in debug mode.
2017-10-01 Even Rouault
* tools/tiffset.c: fix setting a single value for the ExtraSamples tag
(and other tags with variable number of values).
So 'tiffset -s ExtraSamples 1 X'. This only worked
when setting 2 or more values, but not just one.
2017-09-29 Even Rouault
* libtiff/libtiff.def: add TIFFReadRGBAStripExt and TIFFReadRGBATileExt
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2735
2017-09-09 Even Rouault
* libtiff/tif_dirread.c: add NULL check to avoid likely false positive
null-pointer dereference warning by CLang Static Analyzer.
2017-09-07 Even Rouault
* libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a _TIFFSeekoK()
function that checks if the offset is not bigger than INT64_MAX, so as
to avoid a -1 error return code of TIFFSeekFile() to match a required
seek to UINT64_MAX/-1.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
Adapted from proposal by Nicolas Ruff.
2017-08-29 Even Rouault
* libtiff/tif_jpeg.c: accept reading the last strip of a JPEG compressed
file if the codestream height is larger than the truncated height of the
strip. Emit a warning in this situation since this is non compliant.
2017-08-28 Even Rouault
* test/Makefile.am: add missing reference to images/quad-lzw-compat.tiff
to fix "make distcheck". Patch by Roger Leigh
2017-08-23 Even Rouault
* libtiff/tif_dirwrite.c: replace assertion to tag value not fitting
on uint32 when selecting the value of SubIFD tag by runtime check
(in TIFFWriteDirectoryTagSubifd()).
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2728
Reported by team OWL337
2017-08-23 Even Rouault
* libtiff/tif_dirwrite.c: replace assertion related to not finding the
SubIFD tag by runtime check (in TIFFWriteDirectorySec())
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2727
Reported by team OWL337
2017-07-24 Even Rouault
* libtiff/tif_luv.c: further reduce memory requirements for temporary
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
LogL16InitState().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
Credit to OSS Fuzz
2017-07-24 Even Rouault
* libtiff/tif_getimage.c: fix fromskew computation when to-be-skipped
pixel number is not a multiple of the horizontal subsampling, and
also in some other cases. Impact putcontig8bitYCbCr44tile,
putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile,
putcontig8bitYCbCr21tile and putcontig8bitYCbCr12tile
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2637 (discovered
by Agostino Sarubbo)
and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691 (credit
to OSS Fuzz)
2017-07-24 Even Rouault
* libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
properly break from loops on error when stoponerr is set, instead
of going on iterating on row based loop.
2017-07-18 Even Rouault
* libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
allocation when RowsPerStrip tag is missing.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
Credit to OSS-Fuzz
2017-07-15 Even Rouault
* libtiff/tif_read.c: add protection against excessive memory
allocation attempts in TIFFReadDirEntryArray() on short files.
Effective for mmap'ed case. And non-mmap'ed case, but restricted
to 64bit builds.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2675
2017-07-15 Even Rouault
* libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
arrays that hold StripOffsets/StripByteCounts, when they are smaller
than the expected number of striles, up to 1 million striles, and
error out beyond. Can be tweaked by setting the environment variable
LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
This partially goes against a change added on 2002-12-17 to accept
those arrays of wrong sizes, but is needed to avoid denial of services.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
Credit to OSS Fuzz
2017-07-15 Even Rouault
* libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
Complementary fix for http://bugzilla.maptools.org/show_bug.cgi?id=2708
in the isMapped() case, so as to avoid excessive memory allocation
when we need a temporary buffer but the file is truncated.
2017-07-15 Even Rouault
* tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
mode on PlanarConfig=Contig input images.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2715
Reported by team OWL337
2017-07-11 Even Rouault
* libtiff/tif_dir.c: avoid potential null pointer dereference in
_TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag instance.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
2017-07-11 Even Rouault
* libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte LZW
strips. Crashing issue only on memory mapped files, where the strip
offset is the last byte of the file, and the file size is a multiple
of one page size on the CPU architecture (typically 4096). Credit
to myself :-)
2017-07-11 Even Rouault
* test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff: new files
to test old-style LZW decompression
* test/common.sh, Makefile.am, CMakeList.txt: updated with above
2017-07-11 Even Rouault
* refresh autoconf/make stuff with what is on Ubuntu 16.04 (minor changes)
2017-07-11 Even Rouault
* libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of old-style LZW
compressed files.
2017-07-10 Even Rouault
* libtiff/tif_pixarlog.c: avoid excessive memory allocation on decoding
when RowsPerStrip tag is not defined (and thus td_rowsperstrip == UINT_MAX)
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
Credit to OSS Fuzz
2017-07-04 Even Rouault
* libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedTileAndAllocBuffer()
and _TIFFReadTileAndAllocBuffer() variants of TIFFReadEncodedTile() and
TIFFReadTile() that allocates the decoded buffer only after a first
successful TIFFFillTile(). This avoids excessive memory allocation
on corrupted files.
* libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
Credit to OSS Fuzz.
2017-07-04 Even Rouault
* libtiff/tif_error.c, tif_warning.c: correctly use va_list when both
an old-style and new-style warning/error handlers are installed.
Patch by Paavo Helde (sent on the mailing list)
2017-07-02 Even Rouault
* libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
tif_rawdataloaded when it is set. Similarly to TIFFStartStrip().
This issue was revealed by the change of 2017-06-30 in TIFFFileTile(),
limiting the number of bytes read. But it could probably have been hit
too in CHUNKY_STRIP_READ_SUPPORT mode previously ?
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
Credit to OSS Fuzz
2017-06-30 Even Rouault
* man: update documentation regarding SubIFD tag and
TIFFSetSubDirectory() data type.
Patch by Eric Piel
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2671
2017-06-30 Even Rouault
* libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
functions associated with LONG8/SLONG8 data type, replace assertion that
the file is BigTIFF, by a non-fatal error.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
Reported by team OWL337
2017-06-30 Even Rouault
* libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedStripAndAllocBuffer()
function, variant of TIFFReadEncodedStrip() that allocates the
decoded buffer only after a first successful TIFFFillStrip(). This avoids
excessive memory allocation on corrupted files.
* libtiff/tif_getimage.c: use _TIFFReadEncodedStripAndAllocBuffer().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433 .
Credit to OSS Fuzz
2017-06-30 Even Rouault
* libtiff/tif_read.c: TIFFFillTile(): add limitation to the number
of bytes read in case td_stripbytecount[strip] is bigger than
reasonable, so as to avoid excessive memory allocation (similarly to
what was done for TIFFFileStrip() on 2017-05-10)
2017-06-29 Even Rouault
* libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
libtiff/tif_read.c: make TIFFReadScanline() works in
CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple scans.
Also make configurable through a LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER
environment variable the maximum number of scans allowed. Defaults to
100.
2017-06-27 Even Rouault
* libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that a
double value can fit in a float before casting. Patch by Nicolas RUFF
2017-06-26 Even Rouault
* libtiff/tif_jbig.c: fix memory leak in error code path of JBIGDecode()
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
Reported by team OWL337
2017-06-24 Even Rouault
* libtiff/tif_jpeg.c: error out at decoding time if anticipated libjpeg
memory allocation is above 100 MB. libjpeg in case of multiple scans,
which is allowed even in baseline JPEG, if components are spread over several
scans and not interleavedin a single one, needs to allocate memory (or
backing store) for the whole strip/tile.
See http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
This limitation may be overriden by setting the
LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or recompiling
libtiff with a custom value of TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
2017-06-24 Even Rouault
* libtiff/tif_jpeg.c: add anti-denial of service measure to avoid excessive
CPU consumption on progressive JPEGs with a huge number of scans.
See http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
Note: only affects libtiff since 2014-12-29 where support of non-baseline JPEG
was added.
2017-06-18 Even Rouault
* libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW macro to
disable CLang warnings raised by -fsanitize=undefined,unsigned-integer-overflow
* libtiff/tif_predict.c: decorate legitimate functions where unsigned int
overflow occur with TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
* libtiff/tif_dirread.c: avoid unsigned int overflow in EstimateStripByteCounts()
and BYTECOUNTLOOKSBAD when file is too short.
* libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on tiled images.
* libtiff/tif_fax3.c: avoid unsigned int overflow in Fax3Encode2DRow(). Could
potentially be a bug with huge rows.
* libtiff/tif_getimage.c: avoid many (harmless) unsigned int overflows.
2017-06-12 Even Rouault
* libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the number of items
read in StripOffsets/StripByteCounts tags to the number of strips to avoid
excessive memory allocation.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
Credit to OSS Fuzz
2017-06-12 Even Rouault
* libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
ChopUpSingleUncompressedStrip() regarding update of newly single-strip
uncompressed files whose bytecount is 0. Before the change of 2016-12-03,
the condition bytecount==0 used to trigger an early exit/disabling of
strip chop. Re-introduce that in update mode. Otherwise this cause
later incorrect setting for the value of StripByCounts/StripOffsets.
( https://trac.osgeo.org/gdal/ticket/6924 )
2017-06-10 Even Rouault
* .appveyor.yml, .travis.yml, build/travis-ci: apply patches
0001-ci-Travis-script-improvements.patch and
0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
(sent to mailing list)
2017-06-08 Even Rouault
* .travis.yml, build/travis-ci: new files from
0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch by
Roger Leigh (sent to mailing list on 2017-06-08)
This patch adds support for the Travis-CI service.
* .appveyor.yml: new file from
0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to mailing
list on 2017-06-08)
This patch adds a .appveyor.yml file to the top-level. This allows
one to opt in to having a branch built on Windows with Cygwin,
MinGW and MSVC automatically when a branch is pushed to GitHub,
GitLab, BitBucket or any other supported git hosting service.
* CMakeLists.txt, test/CMakeLists.txt, test/TiffTestCommon.cmake: apply
patch 0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from Roger
Leigh (sent to mailing list on 2017-06-08)
This patch makes the CMake build system support running the tests
with MinGW or Cygwin.
2017-06-08 Even Rouault
* libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is defined, do not do
the #ifdef TIFFSwabXXX checks. Make it easier for GDAL to rename the symbols
of its internal libtiff copy.
2017-06-01 Even Rouault
* libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
to behave differently depending on whether the codec is enabled or not, and
thus can avoid stack based buffer overflows in a number of TIFF utilities
such as tiffsplit, tiffcmp, thumbnail, etc.
Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
(http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
Fixes:
http://bugzilla.maptools.org/show_bug.cgi?id=2580
http://bugzilla.maptools.org/show_bug.cgi?id=2693
http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
http://bugzilla.maptools.org/show_bug.cgi?id=2441
http://bugzilla.maptools.org/show_bug.cgi?id=2433
2017-05-29 Even Rouault
* libtiff/tif_getimage.c: initYCbCrConversion(): stricter validation for
refBlackWhite coefficients values. To avoid invalid float->int32 conversion
(when refBlackWhite[0] == 2147483648.f)
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
Credit to OSS Fuzz
2017-05-29 Even Rouault
* libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping to avoid
int32 overflow in TIFFYCbCrtoRGB().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
Credit to OSS Fuzz
2017-05-21 Bob Friesenhahn
* configure.ac: libtiff 4.0.8 released.
* html/v4.0.8.html: Add description of changes targeting the 4.0.8
release.
2017-05-20 Even Rouault
* libtiff/tif_getimage.c: initYCbCrConversion(): stricter validation for
refBlackWhite coefficients values. To avoid invalid float->int32 conversion.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718
Credit to OSS Fuzz
2017-05-18 Even Rouault
* libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1] is not zero
to avoid division by zero.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
Credit to OSS Fuzz
2017-05-17 Even Rouault
* libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast of double to
float.
Credit to Google Autofuzz project
2017-05-17 Even Rouault
* libtiff/tif_getimage.c: initYCbCrConversion(): add basic validation of
luma and refBlackWhite coefficients (just check they are not NaN for now),
to avoid potential float to int overflows.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663
Credit to OSS Fuzz
2017-05-17 Even Rouault
* libtiff/tif_pixarlog.c: PixarLogDecode(): resync tif_rawcp with
next_in and tif_rawcc with avail_in at beginning and end of function,
similarly to what is done in LZWDecode(). Likely needed so that it
works properly with latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT
mode. But untested...
2017-05-17 Even Rouault
* libtiff/tif_lzw.c: update dec_bitsleft at beginning of LZWDecode(),
and update tif_rawcc at end of LZWDecode(). This is needed to properly
work with the latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT
mode.
2017-05-14 Even Rouault
* libtiff/tif_luv.c: LogL16InitState(): avoid excessive memory
allocation when RowsPerStrip tag is missing.
Credit to OSS-Fuzz (locally run, on GDAL)
2017-05-14 Even Rouault
* libtiff/tif_packbits.c: fix out-of-buffer read in PackBitsDecode()
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
Credit to OSS-Fuzz
2017-05-13 Even Rouault
* libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32
overflows in multiply_ms() and add_ms().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558
Credit to OSS-Fuzz
2017-05-13 Even Rouault
* libtiff/tif_color.c: avoid potential int32 overflow in
TIFFYCbCrToRGBInit()
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533
Credit to OSS-Fuzz
2017-05-13 Even Rouault
* libtiff/tif_read.c: update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT
mode with tif_rawdataloaded when calling TIFFStartStrip() or
TIFFFillStripPartial(). This avoids reading beyond tif_rawdata
when bytecount > tif_rawdatasize.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.
Credit to OSS-Fuzz
2017-05-12 Even Rouault
* libtiff/tif_read.c: TIFFFillStripPartial():
avoid excessive memory allocation in case of shorten files.
Only effective on 64 bit builds.
Credit to OSS-Fuzz (locally run, on GDAL)
2017-05-12 Even Rouault
* libtiff/tif_read.c: TIFFFillStripPartial() / TIFFSeek(),
avoid potential integer overflows with read_ahead in
CHUNKY_STRIP_READ_SUPPORT mode. Should
especially occur on 32 bit platforms.
2017-05-10 Even Rouault
* libtiff/tif_read.c: TIFFFillStrip() and TIFFFillTile():
avoid excessive memory allocation in case of shorten files.
Only effective on 64 bit builds and non-mapped cases.
Credit to OSS-Fuzz (locally run, on GDAL)
2017-05-10 Even Rouault
* libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c: fix memory
leak when the underlying codec (ZIP, PixarLog) succeeds its
setupdecode() method, but PredictorSetup fails.
Credit to OSS-Fuzz (locally run, on GDAL)
2017-05-10 Even Rouault
* libtiff/tif_read.c: TIFFFillStrip(): add limitation to the number
of bytes read in case td_stripbytecount[strip] is bigger than
reasonable, so as to avoid excessive memory allocation.
2017-04-28 Even Rouault
* tools/tiff2bw.c: close TIFF handle in error code path.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2677
2017-04-27 Even Rouault
* litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.
Patch by Alan Coopersmith + complement by myself.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673
* tools/fax2tiff.c: emit appropriate message if the input file is
empty. Patch by Alan Coopersmith.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672
2017-04-27 Even Rouault
* libtiff/tif_ojpeg.c: fix potential memory leak in
OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable
and OJPEGReadHeaderInfoSecTablesAcTable
Patch by Nicolás Peña.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670
2017-04-27 Even Rouault
* libtiff/tif_dirread.c: fix memory leak in non DEFER_STRILE_LOAD
mode (ie default) when there is both a StripOffsets and
TileOffsets tag, or a StripByteCounts and TileByteCounts
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2689
* tools/tiff2ps.c: call TIFFClose() in error code paths.
2017-02-25 Even Rouault
* libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7
-Wimplicit-fallthrough warnings.
2017-02-18 Even Rouault
* libtiff/tif_pixarlog.c: fix memory leak in error code path of
PixarLogSetupDecode(). Patch by Nicolás Peña.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2665
2017-02-18 Even Rouault
* libtiff/tif_lzw.c: in LZWPostEncode(), increase, if necessary, the
code bit-width after flushing the remaining code and before emitting
the EOI code.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=1982
2017-01-31 Even Rouault
* libtiff/tif_jpeg.c: only run JPEGFixupTagsSubsampling() if the
YCbCrSubsampling tag is not explicitly present. This helps a bit to reduce
the I/O amount when te tag is present (especially on cloud hosted files).
2017-01-14 Even Rouault
* tools/raw2tiff.c: avoid integer division by zero.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2631
2017-01-12 Even Rouault
* libtiff/tif_ojpeg.c: fix leak in OJPEGReadHeaderInfoSecTablesQTable,
OJPEGReadHeaderInfoSecTablesDcTable and OJPEGReadHeaderInfoSecTablesAcTable
when read fails.
Patch by Nicolás Peña.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659
2017-01-11 Even Rouault
* libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in Encode
functions instead of -1 when TIFFFlushData1() fails.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130
2017-01-11 Even Rouault
* tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow and
cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based overflow.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
http://bugzilla.maptools.org/show_bug.cgi?id=2657
2017-01-11 Even Rouault
* libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add _TIFFcalloc()
* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero
initialize tif_rawdata.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651
2017-01-11 Even Rouault
* libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to
avoid UndefinedBehaviorSanitizer warning.
Patch by Nicolás Peña.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658
2017-01-11 Even Rouault
* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer
addition in TIFFReadRawStrip1() in isMapped() case.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
2017-01-11 Even Rouault
* libtiff/tif_jpeg.c: validate BitsPerSample in JPEGSetupEncode() to avoid
undefined behaviour caused by invalid shift exponent.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648
2017-01-11 Even Rouault
* libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement various clampings
of double to other data types to avoid undefined behaviour if the output range
isn't big enough to hold the input value.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2643
http://bugzilla.maptools.org/show_bug.cgi?id=2642
http://bugzilla.maptools.org/show_bug.cgi?id=2646
http://bugzilla.maptools.org/show_bug.cgi?id=2647
2017-01-11 Even Rouault
* libtiff/tif_dirread.c: avoid division by floating point 0 in
TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
and return 0 in that case (instead of infinity as before presumably)
Apparently some sanitizers do not like those divisions by zero.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644
2017-01-11 Even Rouault
* libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedRational, replace
assertion by runtime check to error out if passed value is strictly
negative.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2535
* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that
caused double free.
Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535
2017-01-11 Even Rouault
* libtiff/tif_jpeg.c: avoid integer division by zero in
JPEGSetupEncode() when horizontal or vertical sampling is set to 0.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653
2017-01-03 Even Rouault
* libtiff/tif_jpeg.c: increase libjpeg max memory usable to
10 MB instead of libjpeg 1MB default. This helps when creating files
with "big" tile, without using libjpeg temporary files.
Related to https://trac.osgeo.org/gdal/ticket/6757
2016-12-20 Even Rouault
* tools/tiff2pdf.c: avoid potential heap-based overflow in
t2p_readwrite_pdf_image_tile().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640
2016-12-20 Even Rouault
* tools/tiff2pdf.c: avoid potential invalid memory read in
t2p_writeproc.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639
2016-12-20 Even Rouault
* tools/tiff2pdf.c: fix wrong usage of memcpy() that can trigger
unspecified behaviour.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2638
2016-12-18 Even Rouault
* libtiff/tif_getimage.c: fix potential memory leaks in error code
path of TIFFRGBAImageBegin().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2627
2016-12-18 Even Rouault
* tools/tiff2pdf.c: prevent heap-based buffer overflow in -j mode
on a paletted image. Note: this fix errors out before the overflow
happens. There could probably be a better fix.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2635
2016-12-17 Even Rouault
* libtiff/tiffio.h, libtiff/tif_getimage.c: add TIFFReadRGBAStripExt()
and TIFFReadRGBATileExt() variants of the functions without ext, with
an extra argument to control the stop_on_error behaviour.
2016-12-17 Even Rouault
* tools/tiff2ps.c: fix 2 heap-based buffer overflows (in PSDataBW
and PSDataColorContig). Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
http://bugzilla.maptools.org/show_bug.cgi?id=2634.
2016-12-13 Even Rouault
* libtiff/tif_fax3.h: revert change done on 2016-01-09 that made
Param member of TIFFFaxTabEnt structure a uint16 to reduce size of
the binary. It happens that the Hylafax software uses the tables that
follow this typedef (TIFFFaxMainTable, TIFFFaxWhiteTable,
TIFFFaxBlackTable), although they are not in a public libtiff header.
Raised by Lee Howard.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2636
2016-12-04 Even Rouault
* html/man/Makefile.am: remove thumbnail.1.html and rgb2ycbcr.1.html
from installed pages since the corresponding utilities are no longer
installed. Reported by Havard Eidnes
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2606
2016-12-03 Even Rouault
* libtiff/tif_write.c: fix misleading indentation as warned by GCC.
2016-12-03 Even Rouault
* tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non assert check.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2605
2016-12-03 Even Rouault
* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
2016-12-03 Even Rouault
* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
missing.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
2016-12-03 Even Rouault
* man/Makefile.am: remove thumbnail.1 and rgb2ycbcr.1 from installed man
pages since the corresponding utilities are no longer installed.
Reported by Havard Eidnes
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2606
2016-12-03 Even Rouault
* tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called,
limit the return number of inks to SamplesPerPixel, so that code that parses
ink names doesn't go past the end of the buffer.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599
2016-12-03 Even Rouault
* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
missing.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
2016-12-03 Even Rouault
* tools/tiffinfo.c: fix null pointer dereference in -r mode when the image has
no StripByteCount tag.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2594
2016-12-03 Even Rouault
* tools/tiffcrop.c: fix integer division by zero when BitsPerSample is missing.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
2016-12-03 Even Rouault
* tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in
readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2621
2016-12-03 Even Rouault
* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
that the output buffer is correctly incremented to avoid write outside bounds.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
2016-12-03 Even Rouault
* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
2016-12-03 Even Rouault
* libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
instead of a logic based on the total size of data. Which is faulty is
the total size of data is not sufficient to fill the whole image, and thus
results in reading outside of the StripByCounts/StripOffsets arrays when
using TIFFReadScanline().
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
the above change is a better fix that makes it unnecessary.
2016-12-03 Even Rouault
* libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based buffer
overflow on generation of PixarLog / LUV compressed files, with
ColorMap, TransferFunction attached and nasty plays with bitspersample.
The fix for LUV has not been tested, but suffers from the same kind
of issue of PixarLog.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2604
2016-12-02 Even Rouault
* tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that
can cause various issues, such as buffer overflows in the library.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598
2016-12-02 Even Rouault
* libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
TIFFReadEncodedStrip() that caused an integer division by zero.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
2016-11-20 Even Rouault
* libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis to
fix cppcheck clarifyCalculation warnings
* libtiff/tif_predict.c, libtiff/tif_print.c: fix printf unsigned
vs signed formatting (cppcheck invalidPrintfArgType_uint warnings)
2016-11-20 Bob Friesenhahn
* tools/fax2tiff.c (main): Applied patch by Jörg Ahrens to fix
passing client data for Win32 builds using tif_win32.c
(USE_WIN32_FILEIO defined) for file I/O. Patch was provided via
email on November 20, 2016.
2016-11-19 Bob Friesenhahn
* libtiff 4.0.7 released.
* configure.ac: Update for 4.0.7 release.
* tools/tiffdump.c (ReadDirectory): Remove uint32 cast to
_TIFFmalloc() argument which resulted in Coverity report. Added
more mutiplication overflow checks.
2016-11-18 Even Rouault
* tools/tiffcrop.c: Fix memory leak in (recent) error code path.
Fixes Coverity 1394415.
2016-11-17 Bob Friesenhahn
* libtiff/tif_getimage.c: Fix some benign warnings which appear in
64-bit compilation under Microsoft Visual Studio of the form
"Arithmetic overflow: 32-bit value is shifted, then cast to 64-bit
value. Results might not be an expected value.". Problem was
reported on November 16, 2016 on the tiff mailing list.
2016-11-16 Even Rouault
* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not dereference
NULL pointer when values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are 0-byte arrays.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression introduced
by previous fix done on 2016-11-11 for CVE-2016-9297).
Reported by Henri Salo. Assigned as CVE-2016-9448
2016-11-12 Bob Friesenhahn
* tools/tiffinfo.c (TIFFReadContigTileData): Fix signed/unsigned
comparison warning.
(TIFFReadSeparateTileData): Fix signed/unsigned comparison
warning.
* tools/tiffcrop.c (readContigTilesIntoBuffer): Fix
signed/unsigned comparison warning.
* html/v4.0.7.html: Add a file to document the pending 4.0.7
release.
2016-11-11 Even Rouault
* tools/tiff2pdf.c: avoid undefined behaviour related to overlapping
of source and destination buffer in memcpy() call in
t2p_sample_rgbaa_to_rgb()
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2577
2016-11-11 Even Rouault
* tools/tiff2pdf.c: fix potential integer overflows on 32 bit builds
in t2p_read_tiff_size()
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2576
2016-11-11 Even Rouault
* libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted()
when requesting Predictor tag and that the zip/lzw codec is not
configured.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591
2016-11-11 Even Rouault
* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that
values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are null terminated, to avoid potential read outside buffer
in _TIFFPrintField().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590 (CVE-2016-9297)
2016-11-11 Even Rouault
* libtiff/tif_dirread.c: reject images with OJPEG compression that
have no TileOffsets/StripOffsets tag, when OJPEG compression is
disabled. Prevent null pointer dereference in TIFFReadRawStrip1()
and other functions that expect td_stripbytecount to be non NULL.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585
2016-11-11 Even Rouault
* tools/tiffcrop.c: fix multiple uint32 overflows in
writeBufferToSeparateStrips(), writeBufferToContigTiles() and
writeBufferToSeparateTiles() that could cause heap buffer overflows.
Reported by Henri Salo from Nixu Corporation.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592 (CVE-2016-9532)
2016-11-10 Even Rouault
* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstrips
value when it is non-zero, instead of recomputing it. This is needed in
TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of
array in tiffsplit (or other utilities using TIFFNumberOfStrips()).
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 (CVE-2016-9273)
2016-11-04 Even Rouault
* libtiff/tif_predic.c: fix memory leaks in error code paths added in
previous commit (fix for MSVR 35105)
2016-10-31 Even Rouault
* libtiff/tif_predict.h, libtiff/tif_predict.c:
Replace assertions by runtime checks to avoid assertions in debug mode,
or buffer overflows in release mode. Can happen when dealing with
unusual tile size like YCbCr with subsampling. Reported as MSVR 35105
by Axel Souchet & Vishal Chauhan from the MSRC Vulnerabilities & Mitigations
team.
2016-10-26 Even Rouault
* tools/fax2tiff.c: fix segfault when specifying -r without
argument. Patch by Yuriy M. Kaminskiy.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2572
2016-10-25 Even Rouault
* libtiff/tif_dir.c: discard values of SMinSampleValue and
SMaxSampleValue when they have been read and the value of
SamplesPerPixel is changed afterwards (like when reading a
OJPEG compressed image with a missing SamplesPerPixel tag,
and whose photometric is RGB or YCbCr, forcing SamplesPerPixel
being 3). Otherwise when rewriting the directory (for example
with tiffset, we will expect 3 values whereas the array had been
allocated with just one), thus causing a out of bound read access.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500
(CVE-2014-8127, duplicate: CVE-2016-3658)
* libtiff/tif_dirwrite.c: avoid null pointer dereference on td_stripoffset
when writing directory, if FIELD_STRIPOFFSETS was artificially set
for a hack case in OJPEG case.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500
(CVE-2014-8127, duplicate: CVE-2016-3658)
2016-10-25 Even Rouault
* tools/tiffinfo.c: fix out-of-bound read on some tiled images.
(http://bugzilla.maptools.org/show_bug.cgi?id=2517)
* libtiff/tif_compress.c: make TIFFNoDecode() return 0 to indicate an
error and make upper level read routines treat it accordingly.
(linked to the test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)
2016-10-14 Even Rouault
* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.
2016-10-09 Even Rouault
* tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on JPEG
compressed images. Reported by Tyler Bohan of Cisco Talos as
TALOS-CAN-0187 / CVE-2016-5652.
Also prevents writing 2 extra uninitialized bytes to the file stream.
2016-10-08 Even Rouault
* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
tile width vs image width. Reported as MSVR 35103
by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
Mitigations team.
2016-10-08 Even Rouault
* tools/tiff2pdf.c: fix read -largely- outsize of buffer in
t2p_readwrite_pdf_image_tile(), causing crash, when reading a
JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
Reported as MSVR 35101 by Axel Souchet and Vishal Chauhan from
the MSRC Vulnerabilities & Mitigations team. CVE-2016-9453
2016-10-08 Even Rouault
* tools/tiffcp.c: fix read of undefined variable in case of missing
required tags. Found on test case of MSVR 35100.
* tools/tiffcrop.c: fix read of undefined buffer in
readContigStripsIntoBuffer() due to uint16 overflow. Probably not a
security issue but I can be wrong. Reported as MSVR 35100 by Axel
Souchet from the MSRC Vulnerabilities & Mitigations team.
2016-09-25 Bob Friesenhahn
* html: Change as many remotesensing.org broken links to a working
URL as possible.
2016-09-24 Bob Friesenhahn
* libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to
read floating point images.
* libtiff/tif_predict.c (PredictorSetup): Enforce bits-per-sample
requirements of floating point predictor (3). Fixes CVE-2016-3622
"Divide By Zero in the tiff2rgba tool."
2016-09-23 Even Rouault
* tools/tiffcrop.c: fix various out-of-bounds write vulnerabilities
in heap or stack allocated buffers. Reported as MSVR 35093,
MSVR 35096 and MSVR 35097. Discovered by Axel Souchet and Vishal
Chauhan from the MSRC Vulnerabilities & Mitigations team.
* tools/tiff2pdf.c: fix out-of-bounds write vulnerabilities in
heap allocate buffer in t2p_process_jpeg_strip(). Reported as MSVR
35098. Discovered by Axel Souchet and Vishal Chauhan from the MSRC
Vulnerabilities & Mitigations team.
* libtiff/tif_pixarlog.c: fix out-of-bounds write vulnerabilities
in heap allocated buffers. Reported as MSVR 35094. Discovered by
Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
Mitigations team.
* libtiff/tif_write.c: fix issue in error code path of TIFFFlushData1()
that didn't reset the tif_rawcc and tif_rawcp members. I'm not
completely sure if that could happen in practice outside of the odd
behaviour of t2p_seekproc() of tiff2pdf). The report points that a
better fix could be to check the return value of TIFFFlushData1() in
places where it isn't done currently, but it seems this patch is enough.
Reported as MSVR 35095. Discovered by Axel Souchet & Vishal Chauhan &
Suha Can from the MSRC Vulnerabilities & Mitigations team.
2016-09-20 Bob Friesenhahn
* html/man/index.html: Comment out links to documentation for
abandoned utilities.
2016-09-17 Even Rouault
* libtiff/tif_lzma.c: typo fix in comment
2016-09-04 Even Rouault
* libtiff/*.c: fix warnings raised by clang 3.9 -Wcomma
2016-09-03 Even Rouault
* libtiff/tif_dirwrite.c, libtiff/tif_color.c: fix warnings raised
by GCC 5 / clang -Wfloat-conversion
2016-08-16 Even Rouault
* tools/tiffcrop.c: fix C99'ism.
2016-08-15 Even Rouault
* tools/tiff2bw.c: fix weight computation that could result of color
value overflow (no security implication). Fix bugzilla #2550.
Patch by Frank Freudenberg.
2016-08-15 Even Rouault
* tools/rgb2ycbcr.c: validate values of -v and -h parameters to
avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)
2016-08-15 Even Rouault
* tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
From patch libtiff-CVE-2016-3991.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
2016-08-15 Even Rouault
* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
if more input samples are provided than expected by PixarLogSetupEncode.
Idea based on libtiff-CVE-2016-3990.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
simpler check. (bugzilla #2544)
2016-08-15 Even Rouault
* tools/tiff2rgba.c: Fix integer overflow in size of allocated
buffer, when -b mode is enabled, that could result in out-of-bounds
write. Based initially on patch tiff-CVE-2016-3945.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
invalid tests that rejected valid files. (bugzilla #2545)
2016-07-11 Even Rouault
* tools/tiffcrop.c: Avoid access outside of stack allocated array
on a tiled separate TIFF with more than 8 samples per pixel.
Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360
(CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)
2016-07-10 Even Rouault
* libtiff/tif_read.c: Fix out-of-bounds read on
memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1()
when stripoffset is beyond tmsize_t max value (reported by
Mathias Svensson)
2016-07-10 Even Rouault
* tools/tiffdump.c: fix a few misaligned 64-bit reads warned
by -fsanitize
2016-07-03 Even Rouault
* libtiff/tif_read.c: make TIFFReadEncodedStrip() and
TIFFReadEncodedTile() directly use user provided buffer when
no compression (and other conditions) to save a memcpy().
* libtiff/tif_write.c: make TIFFWriteEncodedStrip() and
TIFFWriteEncodedTile() directly use user provided buffer when
no compression to save a memcpy().
2016-07-01 Even Rouault
* libtiff/tif_luv.c: validate that for COMPRESSION_SGILOG and
PHOTOMETRIC_LOGL, there is only one sample per pixel. Avoid
potential invalid memory write on corrupted/unexpected images when
using the TIFFRGBAImageBegin() interface (reported by
Clay Wood)
2016-06-28 Even Rouault
* libtiff/tif_pixarlog.c: fix potential buffer write overrun in
PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
(CVE-2016-5875)
2016-06-15 Bob Friesenhahn
* libtiff/libtiff.def: Added _TIFFMultiply32 and _TIFFMultiply64
to libtiff.def
2016-06-05 Bob Friesenhahn
* tools/Makefile.am: The libtiff tools bmp2tiff, gif2tiff,
ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed from
the distribution. The libtiff tools rgb2ycbcr and thumbnail are
only built in the build tree for testing. Old files are put in
new 'archive' subdirectory of the source repository, but not in
distribution archives. These changes are made in order to lessen
the maintenance burden.
2016-05-10 Bob Friesenhahn
* libtiff/tif_config.vc.h (HAVE_SNPRINTF): Add a '1' to the
HAVE_SNPRINTF definition.'
2016-05-09 Bob Friesenhahn
* libtiff/tif_config.vc.h (HAVE_SNPRINTF): Applied patch by Edward
Lam to define HAVE_SNPRINTF for Visual Studio 2015.
2016-04-27 Even Rouault
* libtiff/tif_dirread.c: when compiled with DEFER_STRILE_LOAD,
fix regression, introduced on 2014-12-23, when reading a one-strip
file without a StripByteCounts tag. GDAL #6490
2016-04-07 Bob Friesenhahn
* html/bugs.html: Replace Andrey Kiselev with Bob Friesenhahn for
purposes of security issue reporting.
2016-01-23 Even Rouault
* libtiff/*: upstream typo fixes (mostly contributed by Kurt Schwehr)
coming from GDAL internal libtiff
2016-01-09 Even Rouault
* libtiff/tif_fax3.h: make Param member of TIFFFaxTabEnt structure
a uint16 to reduce size of the binary.
2016-01-03 Even Rouault
* libtiff/tif_read.c, tif_dirread.c: fix indentation issues raised
by GCC 6 -Wmisleading-indentation
2015-12-27 Even Rouault
* libtiff/tif_pixarlog.c: avoid zlib error messages to pass a NULL
string to %s formatter, which is undefined behaviour in sprintf().
2015-12-27 Even Rouault
* libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
(bugzilla #2508)
2015-12-27 Even Rouault
* libtiff/tif_luv.c: fix potential out-of-bound writes in decode
functions in non debug builds by replacing assert()s by regular if
checks (bugzilla #2522).
Fix potential out-of-bound reads in case of short input data.
2015-12-26 Even Rouault
* libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage
interface in case of unsupported values of SamplesPerPixel/ExtraSamples
for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in
TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and
CVE-2015-8683 reported by zzf of Alibaba.
2015-12-21 Even Rouault
* libtiff/tif_dirread.c: workaround false positive warning of Clang Static
Analyzer about null pointer dereference in TIFFCheckDirOffset().
2015-12-19 Even Rouault
* libtiff/tif_fax3.c: remove dead assignment in Fax3PutEOLgdal(). Found
by Clang Static Analyzer
2015-12-18 Even Rouault
* libtiff/tif_dirwrite.c: fix truncation to 32 bit of file offsets in
TIFFLinkDirectory() and TIFFWriteDirectorySec() when aligning directory
offsets on a even offset (affects BigTIFF). This was a regression of the
changeset of 2015-10-19.
2015-12-12 Even Rouault
* libtiff/tif_write.c: TIFFWriteEncodedStrip() and TIFFWriteEncodedTile()
should return -1 in case of failure of tif_encodestrip() as documented
* libtiff/tif_dumpmode.c: DumpModeEncode() should return 0 in case of
failure so that the above mentionned functions detect the error.
2015-12-06 Even Rouault
* libtiff/uvcode.h: const'ify uv_code array
2015-12-06 Even Rouault
* libtiff/tif_dirinfo.c: const'ify tiffFields, exifFields,
tiffFieldArray and exifFieldArray arrays
2015-12-06 Even Rouault
* libtiff/tif_print.c: constify photoNames and orientNames arrays
2015-12-06 Even Rouault
* libtiff/tif_close.c, libtiff/tif_extension.c : rename link
variable to avoid -Wshadow warnings
2015-11-22 Even Rouault
* libtiff/*.c: fix typos in comments (patch by Kurt Schwehr)
2015-11-22 Even Rouault
* libtiff/*.c: fix MSVC warnings related to cast shortening and
assignment within conditional expression
2015-11-18 Even Rouault
* libtiff/*.c: fix clang -Wshorten-64-to-32 warnings
2015-11-18 Even Rouault
* libtiff/tif_dirread.c: initialize double* data at line 3693 to NULL
to please MSVC 2013
2015-11-17 Even Rouault
* libtiff/tif_dirread.c: prevent reading ColorMap or TransferFunction
if BitsPerPixel > 24, so as to avoid huge memory allocation and file
read attempts
2015-11-02 Even Rouault
* libtiff/tif_dirread.c: remove duplicated assignment (reported by
Clang static analyzer)
2015-10-28 Even Rouault
* libtiff/tif_dir.c, libtiff/tif_dirinfo.c, libtiff/tif_compress.c,
libtiff/tif_jpeg_12.c: suppress warnings about 'no previous
declaration/prototype'
2015-10-19 Even Rouault
* libtiff/tiffiop.h, libtiff/tif_dirwrite.c: suffix constants by U to fix
'warning: negative integer implicitly converted to unsigned type' warning
(part of -Wconversion)
2015-10-17 Even Rouault
* libtiff/tif_dir.c, libtiff/tif_dirread.c, libtiff/tif_getimage.c,
libtiff/tif_print.c: fix -Wshadow warnings (only in libtiff/)
2015-09-12 Bob Friesenhahn
* libtiff 4.0.6 released.
* html/v4.0.6.html: Added release notes for 4.0.6.
2015-09-06 Bob Friesenhahn
* tools/tiffgt.c: Silence glut API deprecation warnings on MacOS
X. Patch by Roger Leigh.
* Makefile.am: Added a 'coverity' rule to assist with Coverity
submissions.
* tools/tiff2pdf.c: Fix compiler warning about unused function
when JPEG is not available.
* tools/fax2ps.c (main): Detect failure to write to temporary
file.
2015-09-05 Bob Friesenhahn
* libtiff/tif_dirread.c (TIFFReadDirEntryCheckRangeSlongSlong8):
Change implementation so that it does not sometimes overflow the
range of a 32-bit int and to avoid a signed vs unsigned compare
compiler warning.
(TIFF_INT64_MAX): Avoid use of platform-specific large constants.
(TIFF_UINT32_MAX): Avoid use of platform-specific large constants.
2015-09-01 Bob Friesenhahn
* Makefile.am (distcheck-hook), configure.ac: Applied patches by
Roger Leigh (via tiff mailing list on 2015-09-01) to fix issue
with BSD make and to make use of cmake in 'distcheck' target
conditional on if cmake is available.
* CMakeLists.txt, Makefile.am, configure.ac: Applied patches by
Roger Leigh (via tiff mailing list on 2015-09-01).
CMake build is now included in 'distcheck' target.
Builds with CMake 2.8.9 and newer.
Tar is now resquested to use POSIX PAX format.
2015-08-31 Bob Friesenhahn
* CMakeLists.txt, libtiff/test/Makefile.am: Applied patches by
Roger Leigh (via tiff mailing list on 2015-08-31.
CMake reads all version information directly from configure.ac to
avoid duplication of values. This basically greps over the file
for the LIBTIFF_* variables, then translates them to the form
needed for cmake. This includes the release version and libtool
shared library version information.
Make shared/static library building configurable. Currently it
always builds shared libraries, with static libs having a _static
suffix (copying zlib, but it means it's got a non-standard name).
CMake has a -DBUILD_SHARED_LIBS=ON|OFF option to select one or the
other, which is now used instead. There's now a single "tiff"
target to build either shared or static as required, and all the
tests and tools are linked with this. Note: the Windows tests fail
when linked with a static libtiff (says: libtiff.dll not found).
Not really a regression since this was not tested up to this
point, and it's likely the unit tests haven't (ever?) been run on
Windows with a static libtiff, so there's some additional
portability issue here to address. Works fine on UNIX systems,
and fine on Windows with the default to build a DLL.
Add a missing file which wasn't being distributed, causing unit
tests to fail. Note that "find . -name '*.cmake'" lists all the
CMake files which need distributing in addition to all the
CMakeLists.txt files (which now are distributed).
2015-08-31 Even Rouault
* libtiff/tif_predict.c: pedantic change to add explicit masking
with 0xff before casting to uchar in floating-point horizontal
differencing and accumulation routines.
2015-08-31 Even Rouault
* libtiff/tif_predict.c: fix generation of output with 16 bit
or 32 bit integer, when byte swapping is needed, in
horizontal predictor (#2521). Also fixes decoding when there is
a single pixel to code (unlikely case...) and byte swapping is
involved.
2015-08-30 Even Rouault
* libtiff/tif_lzw.c: make nextdata a unsigned type to avoid
undefined behaviour with shifts (gcc -fsanitize=shift)
2015-08-30 Even Rouault
* libtiff/tif_fax3.c, libtiff/tif_lzw.c, libtiff/tif_predict.c:
add explicit masking with 0xff before casting
to unsigned char (make icc -check=conversions happy)
* libtiff/tif_predict.c: operate on unsigned datatypes when
computing/applying differences to avoid undefined behaviour of
signed types (C standard compliance)
2015-08-30 Bob Friesenhahn
* configure.ac: libtiff 4.0.5 released.
2015-08-29 Bob Friesenhahn
* CMakeLists.txt: Applied patch by Roger Leigh (via tiff mailing
list on 2015-08-29) to add ld-version-script option to cmake build
to match autoconf. Note: defaults to 'on' to be ABI-compatible by
default with common Linux distribution builds. Note that the
autoconf configure script defaults to 'off'.
* html/build.html: Applied patch by Roger Leigh (via tiff mailing
list on 2015-08-29) to describe how to use CMake to build libtiff.
2015-08-28 Bob Friesenhahn
* html/v4.0.5.html: Added HTML file describing the changes which
will appear in the 4.0.5 release.
2015-08-23 Bob Friesenhahn
* libtiff/tiffiop.h: For MinGW comiles, make sure that build
supports necessary __MSVCRT_VERSION__ (at least at least 0x800).
Otherwise large files can not be supported for POSIX-style I/O.
* tools/fax2tiff.c (main): Eliminate a compiler warning in 64-bit
builds about cast to thandle_t.
* test/rewrite_tag.c (main): Does not require any arguments.
2015-08-20 Bob Friesenhahn
* tools/CMakeLists.txt, port/snprintf.c: Patch by Roger Leigh to
fix build issues when using Cmake due to Windows large file
changes.
2015-08-18 Bob Friesenhahn
* libtiff/tiffiop.h: First cut at supporting large files under
Microsoft Windows using tif_unix.c and the libtiff tools. This
only works if the Windows CDK is new enough to support the APIs
used (Visual C++ 2005 or later). Support for large files is not
actually tested yet.
2015-08-15 Bob Friesenhahn
* libtiff/tif_jpeg.c: Applied patch by Räisä Olli to assure that
client_data is initialized to a known value, and to report an
error on two memory allocation failures.
2015-08-13 Bob Friesenhahn
* CMakeLists.txt: Applied patch by Roger Leigh to fix libtiffxx
symbol versioning. Patch was mailed to libtiff list on Thu, 13
Aug 2015.
2015-07-04 Bob Friesenhahn
* cmake: Add d suffix to debug libraries with MSVC. Patch #3 of 3
by Roger Leigh posted to tiff list on Wed, 1 Jul 2015 15:58:20
+0100.
* cmake: Add extra warning flags. Patch #2 of 3 by Roger Leigh
posted to tiff list on Wed, 1 Jul 2015 15:58:20 +0100.
* cmake: Correct snprintf fallback for VS2015. Patch #1 of 3 by
Roger Leigh posted to tiff list on Wed, 1 Jul 2015 15:58:20 +0100.
2015-06-24 Bob Friesenhahn
* CMakeLists.txt: Add CMake patchset by Roger Leigh as posted to
libtiff mailing list on Mon, 22 Jun 2015 21:21:01 +0100. Several
corrections to ensure that the autotools build still works were
added by me. I have not yet tested the build using 'cmake' or
MSVC with 'nmake'.
2015-06-21 Bob Friesenhahn
* test/Makefile.am: tiff2rgba-quad-tile.jpg.sh depends on the JPEG
library so only execute if JPEG is available.
* libtiff 4.0.4 released.
* configure.ac: Add a HAVE_FOO Automake conditional for each
add-on library.
* test/Makefile.am (JPEG_DEPENDENT_CHECK_PROG): raw_decode
requires JPEG support to compile. Use Automake conditional to
only include it when JPEG support is available.
* html/build.html: Try to improve the nmake-based VC++ build
description.
* libtiff/tiffconf.vc.h: Build fixes based on testing.
* libtiff/tif_config.vc.h: Build fixes based on testing.
* libtiff/libtiff.def: TIFFRasterScanline does not exist so remove
export for it.
2015-06-20 Bob Friesenhahn
* libtiff/tif_config.vc.h: Make adjustments to match the new
definitions that configure produces, including for WIN64. Still
needs to be tested.
* configure.ac: For 64-bit MinGW, fix SSIZE_FORMAT formatting
specifier. 64-bit MinGW supports 'long long' but support for
'lld' is not assured by the run-time DLLs and so GCC warns.
Add TIFF_SIZE_T and TIFF_SIZE_FORMAT to provide a type definition
and printf format specifier to deal with printing values of
'size_t' type. In particular, this was necessary for WIN64.
Added a configure test for if the system headers provide 'optarg'
(normal case) and block out the many explicit 'extern' statements
in the utilities. This was found to be necessary under Windows
when getopt is in a DLL and the symbols are already imported with
dllimport via standard header files.
* test/raw_decode.c (XMD_H): Avoid conflicting typedefs for INT32
and boolean in MinGW build due to including jpeglib.h.
* test/rewrite_tag.c (main): Fix problem with location of variable
declaration.
* libtiff/libtiff.def: Added exports for TIFFGetConfiguredCODECs,
TIFFReadRGBAImageOriented, TIFFSetCompressionScheme,
TIFFSwabArrayOfTriples, TIFFVGetFieldDefaulted, _TIFFCheckRealloc,
TIFFRasterScanline, TIFFSetErrorHandlerExt,
TIFFSetWarningHandlerExt, TIFFNumberOfDirectories,
TIFFCreateCustomDirectory, TIFFCreateEXIFDirectory,
TIFFWriteCustomDirectory, _TIFFRewriteField as recommended by
Roger Leigh and justified by use in libtiff tests, documentation,
and changelog notes. Also sorted symbol list and removed
duplicate entries.
2015-06-16 Bob Friesenhahn
* libtiff/tif_getimage.c: Fix four Coverity issues related to
unintended sign extension.
2015-06-16 Even Rouault
* libtiff/tif_unix.c: fix compilation with MSVC (fix by Jeff McKenna)
2015-06-14 Lee Howard
* libtiff/tif_unix.c: contribution from Vadim Zeitlin on
Bugzilla Bug #2510 fixes several harmless but still annoying
warnings
* configure: contribution from Ludolf Holzheid on Bugzilla
Bug #2498. Adds an option to select the file I/O style on
Windows hosts.
* libtiff/tif_getimage.c: contribution from Gary Cramblitt
on Bugzilla Bug #2409. Correct reading of certain tiled TIFFs.
* configure, configure.ac: contribution from Marcos H. Woehrmann
on Bugzilla Bug #2405. Correct shell equality operator.
* tools/tiffgt.c (raster_draw): contribution from Jay Berkenbilt
on Bugzilla Bug #2401. Appropriately call glFlush().
* tools/tiff2pdf.c: change ColorTransform from "0" to "1"
following Bugzilla Bug #2150.
2015-06-13 Lee Howard
* libtiff/tif_lzw.c: contribution from Andy Cave - decode
files that contain consecutive CODE_CLEAR codes.
* tools/tiff2pdf.c: contribution from Antti S. Lankila on
Bugzilla Bug #2078. Suppress initial output of the header.
* tools/tiff2pdf.c: contribution from Yuriy M. Kaminskiy -
Take care in using the return value from snprintf().
* tools/tiffcrop.c: contribution from Eduardo Robles Elvira -
correctly copy the compression tag from the source TIFF.
* tools/tiff2ps.c: contribution from Eduardo Robles Elvira -
correct sizing and scaling problems with output document.
2015-06-10 Bob Friesenhahn
* libtiff/tif_jpeg.c (JPEGDecode): Split JPEGDecode() into two
clean implementations in order to avoid pre-processor hell. Only
one of the implementations is used in a given build.
2015-06-08 Even Rouault
* libtiff/tif_jpeg.c: Fix compilation in BITS_IN_JSAMPLE == 12
case
2015-06-07 Bob Friesenhahn
* libtiff/tif_write.c (TIFFWriteEncodedStrip): Fix Coverity 715975
"Division or modulo by zero".
(TIFFWriteEncodedTile): Fix Coverity 715976 and 715977 "Division
or modulo by zero".
(TIFFWriteRawStrip): Fix Coverity 715978 "Division or modulo by
zero".
(TIFFWriteScanline): Fix Coverity 715979 "Division or modulo by
zero".
* libtiff/tif_read.c (TIFFStartTile): Fix Coverity 715973 and
715974 "Division or modulo by zero".
2015-05-31 Bob Friesenhahn
* libtiff/tif_dir.c (TIFFNumberOfDirectories): Quiet Coverity
1134470 "Logically dead code" by making the roll-over check
explicit.
* libtiff/tif_luv.c (LogLuvDecodeTile): Fix Coverity 991227
"Division or modulo by zero".
(LogLuvDecodeStrip): Fix Coverity 991239 "Division or modulo by
zero".
(LogLuvEncodeStrip): Fix Coverity 991240 "Division or modulo by
zero".
(LogLuvEncodeTile): Fix Coverity 991241 "Division or modulo by
zero".
* libtiff/tif_dirread.c (TIFFReadDirEntryDoubleArray): Fix
Coverity 298626 "Logically dead code".
(TIFFReadDirEntryFloatArray): Fix Coverity 298627 "Logically dead
code".
(TIFFReadDirEntryIfd8Array): Fix Coverity 298628 "Logically dead
code".
(TIFFReadDirEntrySlong8Array): Fix Coverity 298629 "Logically dead
code"
* libtiff/tif_dir.c (TIFFNumberOfDirectories): Don't depend on ++
operator precedenc in evaluation. Might quench Coverity 1134470
"Logically dead code".
* libtiff/tif_jpeg.c (JPEGDecode): Fix Coverity 602597 "Operands
don't affect result". This change uses ifdefs to include
applicable code based on properties of libjpeg. Still needs to be
re-tested with 12-bit "6b" and "MK1".
2015-05-30 Bob Friesenhahn
* libtiff/tif_dirwrite.c (_TIFFRewriteField): Fix Coverity 1024310
"Resource leak".
* libtiff/tif_ojpeg.c (OJPEGReadHeaderInfoSecStreamDht): Fix
Coverity 601720 "Resource leak".
* libtiff/tif_jpeg.c (JPEGCleanup): Fix Coverity 298624
"Dereference before null check".
* libtiff/tif_ojpeg.c (OJPEGReadBufferFill): Fix Coverity 603400
"Missing break in switch".
* contrib/addtiffo/tif_overview.c (TIFF_DownSample): Check buffer
size calculation for overflow.
* contrib/addtiffo/addtiffo.c (main): Possibly address Coverity
1024226 "Untrusted value as argument".
* tools/gif2tiff.c (readgifimage): Fix Coverity 1024222 "Untrusted
value as argument".
(checksignature): Fix Coverity 1024894 "Ignoring number of bytes
read".
(readextension): Fix Coverity 1024893 "Ignoring number of bytes
read".
(readgifimage): Fix Coverity 1024890 "Ignoring number of bytes
read".
(readraster): Fix Coverity 1024891 "Ignoring number of bytes
read".
(readgifimage): Fix Coverity 1024892 "Ignoring number of bytes
read".
* tools/tiff2pdf.c (t2p_readwrite_pdf_image): Fix Coverity 1024181
"Structurally dead code".
* tools/raw2tiff.c (main): Fix Coverity 1024887 "Unchecked return
value from library".
(guessSize): Fix Coverity 1024888 "Unchecked return value from
library".
(guessSize): Fix Coverity 1214162 "Ignoring number of bytes read".
(guessSize): Fix Coverity 1024889 "Unchecked return value from
library".
* tools/tiff2pdf.c (t2p_readwrite_pdf_image): Fix Coverity 298621
"Resource leak".
(t2p_readwrite_pdf_image): Fix Coverity 1024181 "Structurally dead
code".
(t2p_write_pdf): Fix Coverity 1227690 "Unused value".
2015-05-29 Bob Friesenhahn
* contrib/iptcutil/iptcutil.c (formatIPTC): Fix Coverity 1024468
"Infinite loop".
(formatIPTC): Fix Coverity 1024727 "Truncated stdio return value".
(formatIPTC): Fix Coverity 1214240 "Untrusted loop bound".
2015-05-28 Bob Friesenhahn
* contrib/addtiffo/tif_ovrcache.c (TIFFCreateOvrCache): Fix
Coverity 298615 "Resource leak".
(TIFFGetOvrBlock): Fix Coverity 1024649 "Unintended sign
extension".
* tools/bmp2tiff.c (main): Fix Coverity 1024225 "Untrusted value
as argument".
(main): Fix Coverity 1024678 "Unchecked return value from
library".
(main): Fix Coverity 1024679 "Unchecked return value from
library".
(main): Fix Coverity 1214160 "Ignoring number of bytes read".
* contrib/addtiffo/tif_ovrcache.c (TIFFCreateOvrCache): Fix
Coverity 298615 "Resource leak".
* tools/tiffcp.c: Fix Coverity 1024306, 1024307, 1024308, 1024309
"Resource leak".
* tools/tiffsplit.c (cpTiles): Fix Coverity 1024304 "Resource
leak".
(cpStrips): Fix Coverity 1024305 "Resource leak".
2015-05-27 Bob Friesenhahn
* tools/ras2tiff.c: Fix Sun Raster header definition to be safe
for 64-bit systems. Add some header validations. Should fix many
Coverity issues.
(main): Fix Coverity 1301206: "Integer handling issues (BAD_SHIFT)".
(main): Quiet Coverity 1024223 "Untrusted value as argument".
* tools/tiffmedian.c (GetInputLine): Fix Coverity 1024795 "Nesting
level does not match indentation".
(get_histogram): Quiet Coverity 1024386 "Out-of-bounds read".
This was a benign mis-diagnosis but added code to enforce against
buffer overflow.
* tools/tiffcrop.c (ROTATE_ANY): Fix Coverity 1294542 "Logical
vs. bitwise operator".
(readContigStripsIntoBuffer): Fix Coverity 1024545 "Division or
modulo by zero".
(readContigTilesIntoBuffer): Fix Coverity 1024586 "Logically dead
code".
(writeSingleSection): Fix Coverity 1024796 "Nesting level does not
match indentation".
(writeCroppedImage): Fix Coverity 1024797 "Nesting level does not
match indentation".
(loadImage): Fix Coverity 1299741 "Dereference before null check".
(loadImage): Fix Coverity 1299740 "Out-of-bounds write".
2015-03-02 Even Rouault
* tools/tiffdither.c: check memory allocations to avoid writing to
NULL pointer. Also check multiplication overflow. Fixes #2501,
CVE-2014-8128. Derived from patch by Petr Gajdos.
2015-01-26 Even Rouault
* add html/v4.0.4beta.html under version control
* HOWTO-RELEASE: write that cvs add html/vX.X.html must be used
2015-01-26 Even Rouault
* libtiff 4.0.4beta released
2015-01-26 Even Rouault
* automake: updated to 1.15
* libtool: updated to 2.4.5
2015-01-22 Even Rouault
* tools/tiff2pdf.c: Fix two crashes (oCERT-2014-013)
2015-01-05 Frank Warmerdam
* html/bugs.html: remove note about needing to email the tiff mailing
list administrator about being approved for membership, this appears
not to be true.
2015-01-05 Olivier Paquet
* tools/tiff2pdf.c: Fixed unsigned integer addition overflow detection.
2015-01-03 Even Rouault
* libtiff/tif_dirread.c: in TIFFCheckDirOffset(), avoid uint16 overflow
when reading more than 65535 directories, and effectively error out when
reaching that limit.
2014-12-29 Even Rouault
* libtiff/tif_jpeg.c: in JPEGFixupTags(), recognize SOF2, SOF9 and SOF10
markers to avoid emitting a warning (even if, according to the TechNote,
there are admitedly unusual/not recommended or even forbidden variants, but
they do work well with libjpeg for SOF2, and with libjpeg-turbo for SOF2,
SOF9 and SOF10).
Define in_color_space and input_components to the right values in
JPEGSetupEncode(), before calling jpeg_set_defaults(), as specified by
libjpeg API documentation, so as to be compatible with mozjpeg library.
Note: the default settings of mozjpeg will produce progressive scans, which
is forbidden by the TechNote.
2014-12-29 Even Rouault
* libtiff/tif_getimage.c: move test on vertical value of YCbCr subsampling.
to avoid buffer leak (fix previous fix, found by Coverity scan)
2014-12-29 Even Rouault
* libtiff/tif_next.c: add new tests to check that we don't read outside of
the compressed input stream buffer.
* libtiff/tif_getimage.c: in OJPEG case, fix checks on strile width/height
in the putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile and
putcontig8bitYCbCr21tile cases.
2014-12-27 Even Rouault
* libtiff/tif_dir.c: in TIFFDefaultDirectory(), reset any already existing
extented tags installed by user code through the extender mechaninm before
calling the extender callback (GDAL #5054)
2014-12-26 Bob Friesenhahn
* tools/tiffcrop.c: Fix warnings about variables set but not used.
* contrib/iptcutil/iptcutil.c: Fix warnings about variables set
but not used.
* tools/tiffgt.c: Fix warnings about unused parameters.
* libtiff/tif_stream.cxx: Fix warnings about unused parameters.
2014-12-25 Even Rouault
* libtiff/tif_getimage.c, libtiff/tif_ojpeg.c, libtiff/tif_zip.c: fix
various typos found by Debian lintian tool (GDAL #5756)
2014-12-24 Even Rouault
* libtiff/tif_getimage.c: avoid divide by zero on invalid YCbCr subsampling.
http://bugzilla.maptools.org/show_bug.cgi?id=2235
2014-12-24 Even Rouault
* tools/tiff2pdf.c: fix buffer overflow on some YCbCr JPEG compressed images.
http://bugzilla.maptools.org/show_bug.cgi?id=2445
2014-12-24 Even Rouault
* tools/tiff2pdf.c: fix buffer overflow on YCbCr JPEG compressed image.
Derived from patch by Petr Gajdos,
http://bugzilla.maptools.org/show_bug.cgi?id=2443
2014-12-23 Even Rouault
* libtiff/tif_dirread.c: In EstimateStripByteCounts(), check return code
of _TIFFFillStriles(). This solves crashing bug on corrupted
images generated by afl.
2014-12-23 Even Rouault
* libtiff/tif_read.c: fix several invalid comparisons of a uint64 value with
<= 0 by casting it to int64 first. This solves crashing bug on corrupted
images generated by afl.
2014-12-21 Bob Friesenhahn
* tools/tiffdump.c: Guard against arithmetic overflow when
calculating allocation buffer sizes.
2014-12-21 Even Rouault
* tools/tiff2bw.c: when Photometric=RGB, the utility only works if
SamplesPerPixel = 3. Enforce that
http://bugzilla.maptools.org/show_bug.cgi?id=2485 (CVE-2014-8127)
2014-12-21 Even Rouault
* tools/pal2rgb.c, tools/thumbnail.c: fix crash by disabling TIFFTAG_INKNAMES
copying. The right fix would be to properly copy it, but not worth the burden
for those esoteric utilities.
http://bugzilla.maptools.org/show_bug.cgi?id=2484 (CVE-2014-8127)
2014-12-21 Even Rouault
* tools/thumbnail.c: fix out-of-buffer write
http://bugzilla.maptools.org/show_bug.cgi?id=2489 (CVE-2014-8128)
2014-12-21 Even Rouault
* tools/thumbnail.c, tools/tiffcmp.c: only read/write TIFFTAG_GROUP3OPTIONS
or TIFFTAG_GROUP4OPTIONS if compression is COMPRESSION_CCITTFAX3 or
COMPRESSION_CCITTFAX4
http://bugzilla.maptools.org/show_bug.cgi?id=2493 (CVE-2014-8128)
2014-12-21 Even Rouault
* libtiff/tif_next.c: check that BitsPerSample = 2. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2487 (CVE-2014-8129)
2014-12-21 Even Rouault
* tools/tiff2pdf.c: check return code of TIFFGetField() when reading
TIFFTAG_SAMPLESPERPIXEL
2014-12-21 Even Rouault
* tools/tiffcp.c: fix crash when converting YCbCr JPEG-compressed to none.
Based on patch by Tomasz Buchert (http://bugzilla.maptools.org/show_bug.cgi?id=2480)
Description: fix for Debian bug #741451
tiffcp crashes when converting JPEG-encoded TIFF to a different
encoding (like none or lzw). For example this will probably fail:
tiffcp -c none jpeg_encoded_file.tif output.tif
The reason is that when the input file contains JPEG data,
the tiffcp code forces conversion to RGB space. However,
the output normally inherits YCbCr subsampling parameters
from the input, which leads to a smaller working buffer
than necessary. The buffer is subsequently overrun inside
cpStripToTile() (called from writeBufferToContigTiles).
Note that the resulting TIFF file would be scrambled even
if tiffcp wouldn't crash, since the output file would contain
RGB data intepreted as subsampled YCbCr values.
This patch fixes the problem by forcing RGB space on the output
TIF if the input is JPEG-encoded and output is *not* JPEG-encoded.
Author: Tomasz Buchert
2014-12-21 Even Rouault
Fix various crasher bugs on fuzzed images.
* libtiff/tif_dir.c: TIFFSetField(): refuse to set negative values for
TIFFTAG_XRESOLUTION and TIFFTAG_YRESOLUTION that cause asserts when writing
the directory
* libtiff/tif_dirread.c: TIFFReadDirectory(): refuse to read ColorMap or
TransferFunction if BitsPerSample has not yet been read, otherwise reading
it later will cause user code to crash if BitsPerSample > 1
* libtiff/tif_getimage.c: TIFFRGBAImageOK(): return FALSE if LOGLUV with
SamplesPerPixel != 3, or if CIELAB with SamplesPerPixel != 3 or BitsPerSample != 8
* libtiff/tif_next.c: in the "run mode", use tilewidth for tiled images
instead of imagewidth to avoid crash
* tools/bmp2tiff.c: fix crash due to int overflow related to input BMP dimensions
* tools/tiff2pdf.c: fix crash due to invalid tile count (should likely be checked by
libtiff too). Detect invalid settings of BitsPerSample/SamplesPerPixel for CIELAB / ITULAB
* tools/tiffcrop.c: fix crash due to invalid TileWidth/TileHeight
* tools/tiffdump.c: fix crash due to overflow of entry count.
2014-12-15 Even Rouault
* libtiff/tif_jpeg.c: Fix regression introduced on 2010-05-07 that caused
all tiles/strips to include quantization tables even when the jpegtablesmode
had the JPEGTABLESMODE_QUANT bit set.
Also add explicit removal of Huffman tables when jpegtablesmode has the
JPEGTABLESMODE_HUFF bit set, which avoids Huffman tables to be emitted in the
first tile/strip (only useful in update scenarios. create-only was
fine)
2014-12-09 Bob Friesenhahn
* tools/tiff2pdf.c: Assure that memory size calculations for
_TIFFmalloc() do not overflow the range of tmsize_t.
2014-12-07 Even Rouault
* tools/thumbnail.c, tools/tiffcrop.c: "fix" heap read over-run found with
Valgrind and Address Sanitizer on test suite
2014-12-07 Bob Friesenhahn
* tools/tiff2pdf.c (t2p_read_tiff_init): TIFFTAG_TRANSFERFUNCTION
tag can return one channel, with the other two channels set to
NULL. The tiff2pdf code was expecting that other two channels
were duplicate pointers in the case where there is only one
channel. Detect this condition in order to avoid a crash, and
presumably perform correctly with just one channel.
2014-12-06 Bob Friesenhahn