1898c42e6SBob Friesenhahn<HTML> 2898c42e6SBob Friesenhahn<HEAD> 3898c42e6SBob Friesenhahn<TITLE> 4898c42e6SBob Friesenhahn Changes in TIFF v3.9.5 5898c42e6SBob Friesenhahn</TITLE> 6898c42e6SBob Friesenhahn</HEAD> 7898c42e6SBob Friesenhahn 8898c42e6SBob Friesenhahn<BODY BGCOLOR=white> 9898c42e6SBob Friesenhahn<FONT FACE="Helvetica, Arial, Sans"> 10898c42e6SBob Friesenhahn<FONT FACE="Helvetica, Arial, Sans"> 11898c42e6SBob Friesenhahn 12898c42e6SBob Friesenhahn<BASEFONT SIZE=4> 13898c42e6SBob Friesenhahn<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B> 14898c42e6SBob Friesenhahn<BASEFONT SIZE=3> 15898c42e6SBob Friesenhahn 16898c42e6SBob Friesenhahn<UL> 17898c42e6SBob Friesenhahn<HR SIZE=4 WIDTH=65% ALIGN=left> 18898c42e6SBob Friesenhahn<B>Current Version</B>: v3.9.5<BR> 19898c42e6SBob Friesenhahn<B>Previous Version</B>: <A HREF=v3.9.4.html>v3.9.4</a><BR> 20*d4dd6cccSBob Friesenhahn<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff"> 21*d4dd6cccSBob Friesenhahndownload.osgeo.org</a>, directory pub/libtiff</A><BR> 22*d4dd6cccSBob Friesenhahn<B>Master HTTP Site</B>: <A HREF="http://www.simplesystems.org/libtiff/"> 23*d4dd6cccSBob Friesenhahnhttp://www.simplesystems.org/libtiff/</a> 24898c42e6SBob Friesenhahn<HR SIZE=4 WIDTH=65% ALIGN=left> 25898c42e6SBob Friesenhahn</UL> 26898c42e6SBob Friesenhahn 27898c42e6SBob Friesenhahn<P> 28898c42e6SBob FriesenhahnThis document describes the changes made to the software between the 29898c42e6SBob Friesenhahn<I>previous</I> and <I>current</I> versions (see above). If you don't 30898c42e6SBob Friesenhahnfind something listed here, then it was not done in this timeframe, or 31898c42e6SBob Friesenhahnit was not considered important enough to be mentioned. The following 32898c42e6SBob Friesenhahninformation is located here: 33898c42e6SBob Friesenhahn<UL> 34898c42e6SBob Friesenhahn<LI><A HREF="#hightlights">Major Changes</A> 35898c42e6SBob Friesenhahn<LI><A HREF="#configure">Changes in the software configuration</A> 36898c42e6SBob Friesenhahn<LI><A HREF="#libtiff">Changes in libtiff</A> 37898c42e6SBob Friesenhahn<LI><A HREF="#tools">Changes in the tools</A> 38898c42e6SBob Friesenhahn<LI><A HREF="#contrib">Changes in the contrib area</A> 39898c42e6SBob Friesenhahn</UL> 40898c42e6SBob Friesenhahn<p> 41898c42e6SBob Friesenhahn<P><HR WIDTH=65% ALIGN=left> 42898c42e6SBob Friesenhahn 43898c42e6SBob Friesenhahn<!---------------------------------------------------------------------------> 44898c42e6SBob Friesenhahn 45898c42e6SBob Friesenhahn<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A> 46898c42e6SBob Friesenhahn 47898c42e6SBob Friesenhahn<UL> 48898c42e6SBob Friesenhahn 49898c42e6SBob Friesenhahn <li> None 50898c42e6SBob Friesenhahn 51898c42e6SBob Friesenhahn</UL> 52898c42e6SBob Friesenhahn 53898c42e6SBob Friesenhahn 54898c42e6SBob Friesenhahn<P><HR WIDTH=65% ALIGN=left> 55898c42e6SBob Friesenhahn<!---------------------------------------------------------------------------> 56898c42e6SBob Friesenhahn 57898c42e6SBob Friesenhahn<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A> 58898c42e6SBob Friesenhahn 59898c42e6SBob Friesenhahn<UL> 60898c42e6SBob Friesenhahn 61898c42e6SBob Friesenhahn <li> configure.ac: Should use AC_CANONICAL_HOST since host specifies 62898c42e6SBob Friesenhahn the run-time target whereas target is used to specify the final 63898c42e6SBob Friesenhahn output target if the package is a build tool (like a compiler), 64898c42e6SBob Friesenhahn which libtiff is not. Resolves libtiff bug 2307 "Use 65898c42e6SBob Friesenhahn AC_CANONICAL_HOST macro". 66898c42e6SBob Friesenhahn 67898c42e6SBob Friesenhahn</UL> 68898c42e6SBob Friesenhahn 69898c42e6SBob Friesenhahn<P><HR WIDTH=65% ALIGN=left> 70898c42e6SBob Friesenhahn 71898c42e6SBob Friesenhahn<!---------------------------------------------------------------------------> 72898c42e6SBob Friesenhahn 73898c42e6SBob Friesenhahn<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A> 74898c42e6SBob Friesenhahn 75898c42e6SBob Friesenhahn<UL> 76898c42e6SBob Friesenhahn <li> libtiff/tif_getimage.c: Check the number of samples per pixel when 77898c42e6SBob Friesenhahn working with YCbCr image in PickContigCase(). As per bug 78898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2216 79898c42e6SBob Friesenhahn 80898c42e6SBob Friesenhahn <li> libtiff/tif_dir.c: Set the bogus post-decoding hook when processing 81898c42e6SBob Friesenhahn TIFFTAG_BITSPERSAMPLE in _TIFFVSetField() for the case of 8 bit when 82898c42e6SBob Friesenhahn we don't need any post-processing. That helps to reset the hook if we 83898c42e6SBob Friesenhahn previously set this field to some other value and the hook was 84898c42e6SBob Friesenhahn initialized accordingly. As per bug 85898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2035 86898c42e6SBob Friesenhahn 87898c42e6SBob Friesenhahn <li> libtiff/tif_getimage.c: Avoid wrong math du to the signed/unsigned 88898c42e6SBob Friesenhahn integer type conversions. As per bug 89898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2207 90898c42e6SBob Friesenhahn 91898c42e6SBob Friesenhahn <li> libtiff/tif_dirinfo.c: Don't use assertions in _TIFFFieldWithTag() 92898c42e6SBob Friesenhahn and _TIFFFieldWithName() if the tag is not found in the tag table. 93898c42e6SBob Friesenhahn This should be normal situation and returned NULL value should be 94898c42e6SBob Friesenhahn properly handled by the caller. 95898c42e6SBob Friesenhahn 96898c42e6SBob Friesenhahn <li> libtiff/{tif_dirwrite.c, tif_print.c}: Properly handle "DotRange" 97898c42e6SBob Friesenhahn tag as it can be either byte or short size and should be set and read 98898c42e6SBob Friesenhahn by value, not as an array. As per bug 99898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2116 100898c42e6SBob Friesenhahn 101898c42e6SBob Friesenhahn <li> libtiff/tif_dirread.c: Really reset the tag count in CheckDirCount() 102898c42e6SBob Friesenhahn to expected value as the warning message suggests. As per bug 103898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=1963 104898c42e6SBob Friesenhahn 105898c42e6SBob Friesenhahn <li> libtiff/tif_open.c: Fix mode check before opening a file. 106898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=1906 107898c42e6SBob Friesenhahn 108898c42e6SBob Friesenhahn <li> libtiff/tif_jpeg.c, libtiff/tif_strip.c: apply patch for 109898c42e6SBob Friesenhahn CVE-2010-3087 per bug 110898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2140 111898c42e6SBob Friesenhahn 112898c42e6SBob Friesenhahn <li> libtiff/tif_dirread.c: fix crash when reading a badly-constructed 113898c42e6SBob Friesenhahn TIFF per http://bugzilla.maptools.org/show_bug.cgi?id=1994 114898c42e6SBob Friesenhahn 115898c42e6SBob Friesenhahn <li> libtiff/tif_ojpeg.c: fix buffer overflow on problem data 116898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=1999 117898c42e6SBob Friesenhahn 118898c42e6SBob Friesenhahn <li> libtiff/tif_dirread.c: modify warnings 119898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2016 120898c42e6SBob Friesenhahn 121898c42e6SBob Friesenhahn <li> libtiff/tif_jpeg.c: fix use of clumplines calculation 122898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2149 123898c42e6SBob Friesenhahn 124898c42e6SBob Friesenhahn <li> libtiff/tif_color.c: prevent crash in handling bad TIFFs 125898c42e6SBob Friesenhahn resolves CVE-2010-2595 126898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2208 127898c42e6SBob Friesenhahn 128898c42e6SBob Friesenhahn <li> libtiff/tif_dirread.c: fix needless tag ordering warning 129898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2210 130898c42e6SBob Friesenhahn 131898c42e6SBob Friesenhahn <li> libtiff/tif_jpeg.c: reduce usage of JCS_UNKNOWN in order 132898c42e6SBob Friesenhahn to improve compatibility with various viewers 133898c42e6SBob Friesenhahn submitted by e-mail from Dwight Kelly <[email protected]> 134898c42e6SBob Friesenhahn 135898c42e6SBob Friesenhahn <li> libtiff/tif_strip.c: use TIFFGetFieldDefaulted instead 136898c42e6SBob Friesenhahn of TIFFGetField when we assume that it will succeed 137898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2215 138898c42e6SBob Friesenhahn 139898c42e6SBob Friesenhahn <li> libtiff/tif_dirread.c: tolerate some cases where 140898c42e6SBob Friesenhahn FIELD_COLORMAP is missing 141898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2189 142898c42e6SBob Friesenhahn 143898c42e6SBob Friesenhahn <li> libtiff/tif_jpeg.c: Fix regressions with 2 and 3 band images 144898c42e6SBob Friesenhahn caused by commit on 2010-12-14. Submitted by e-mail from 145898c42e6SBob Friesenhahn Even Rouault <[email protected]> 146898c42e6SBob Friesenhahn 147898c42e6SBob Friesenhahn <li> libtiff/tif_dirwrite.c: Avoid undefined behaviour when casting from 148898c42e6SBob Friesenhahn float to unsigned integer in TIFFWriteRationalArray() as reported by 149898c42e6SBob Friesenhahn Kareem Shehata. 150898c42e6SBob Friesenhahn 151898c42e6SBob Friesenhahn <li> libtiff/tif_fax3.h: Protect against a fax VL(n) codeword commanding 152898c42e6SBob Friesenhahn a move left. Without this, a malicious input file can generate an 153898c42e6SBob Friesenhahn indefinitely large series of runs without a0 ever reaching the right 154898c42e6SBob Friesenhahn margin, thus overrunning our buffer of run lengths. Per CVE-2011-0192. 155898c42e6SBob Friesenhahn This is a modified version of a patch proposed by Drew Yao of Apple 156898c42e6SBob Friesenhahn Product Security. It adds an unexpected() report, and disallows the 157898c42e6SBob Friesenhahn equality case, since emitting a run without increasing a0 still allows 158898c42e6SBob Friesenhahn buffer overrun. 159898c42e6SBob Friesenhahn 160898c42e6SBob Friesenhahn <li> libtiff/tif_fax3.h: Fix to last change allowing zero length 161898c42e6SBob Friesenhahn runs at the start of a scanline - needed for legal cases. 162898c42e6SBob Friesenhahn 163898c42e6SBob Friesenhahn <li> libtiff/tif_thunder.c: Correct potential buffer overflow with 164898c42e6SBob Friesenhahn thunder encoded files with wrong bitspersample set. The libtiff 165898c42e6SBob Friesenhahn development team would like to thank Marin Barbella and TippingPoint's 166898c42e6SBob Friesenhahn Zero Day Initiative for reporting this vulnerability (ZDI-CAN-1004, 167898c42e6SBob Friesenhahn CVE-2011-1167). 168898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2300 169898c42e6SBob Friesenhahn 170898c42e6SBob Friesenhahn <li> libtiff/tiffiop.h: avoid declaring int64/uint64 on AIX with XLC 171898c42e6SBob Friesenhahn where they are already available. (#2301) 172898c42e6SBob Friesenhahn</UL> 173898c42e6SBob Friesenhahn 174898c42e6SBob Friesenhahn<P><HR WIDTH=65% ALIGN=left> 175898c42e6SBob Friesenhahn 176898c42e6SBob Friesenhahn<!--------------------------------------------------------------------------> 177898c42e6SBob Friesenhahn 178898c42e6SBob Friesenhahn<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A> 179898c42e6SBob Friesenhahn 180898c42e6SBob Friesenhahn<UL> 181898c42e6SBob Friesenhahn 182898c42e6SBob Friesenhahn <li> tools/tiffcrop.c: Patch from Richard Nolde. Reject YCbCr 183898c42e6SBob Friesenhahn subsampled data since tiffcrop currently doesn't support it. Fix 184898c42e6SBob Friesenhahn JPEG support. 185898c42e6SBob Friesenhahn 186898c42e6SBob Friesenhahn <li> tools/tiffcp.c: Initialize buffer arrays with zero to avoid 187898c42e6SBob Friesenhahn referencing to uninitialized memory in some cases (e.g. when tile size 188898c42e6SBob Friesenhahn set bigger than the image size). 189898c42e6SBob Friesenhahn 190898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: Better generation of ID field in 191898c42e6SBob Friesenhahn t2p_write_pdf_trailer(). Get rid of GCC aliasing warnings. 192898c42e6SBob Friesenhahn 193898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: Fixed computation of the tile buffer size when 194898c42e6SBob Friesenhahn converting JPEG encoded tiles. 195898c42e6SBob Friesenhahn 196898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: Better handling of string fields, use static 197898c42e6SBob Friesenhahn string buffers instead of dynamically allocated, use strncpy() instead 198898c42e6SBob Friesenhahn of strcpy(), control the string lengths. 199898c42e6SBob Friesenhahn 200898c42e6SBob Friesenhahn <li> tools/{tiff2bw.c, thumbnail.c, pal2rgb.c}: Fix the count for 201898c42e6SBob Friesenhahn WhitePoint tag as per bug 202898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2042 203898c42e6SBob Friesenhahn 204898c42e6SBob Friesenhahn <li> tools/tiffdump.c: Use PrintData() function instead of 205898c42e6SBob Friesenhahn PrintByte/Short/Long(). Should fix an issue reported at 206898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2116 207898c42e6SBob Friesenhahn 208898c42e6SBob Friesenhahn <li> tools/tiffset.c: Properly handle TIFFTAG_PAGENUMBER, 209898c42e6SBob Friesenhahn TIFFTAG_HALFTONEHINTS, TIFFTAG_YCBCRSUBSAMPLING, TIFFTAG_DOTRANGE 210898c42e6SBob Friesenhahn which should be set by value. 211898c42e6SBob Friesenhahn 212898c42e6SBob Friesenhahn <li> tools/tiffdump.c: Avoid integer overflows computing the buffer size 213898c42e6SBob Friesenhahn for large directories. As per bug 214898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2218 215898c42e6SBob Friesenhahn 216898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: Fixed ID buffer filling in 217898c42e6SBob Friesenhahn t2p_write_pdf_trailer(), thanks to Dmitry V. Levin. 218898c42e6SBob Friesenhahn 219898c42e6SBob Friesenhahn <li> tools/tiffcrop.c: Patch from Richard Nolde to avoid a 220898c42e6SBob Friesenhahn potentially unterminated buffer due to using an exceptionally long 221898c42e6SBob Friesenhahn file name. 222898c42e6SBob Friesenhahn 223898c42e6SBob Friesenhahn <li> tools/tiff2ps.c: improvements and enhancements from Richard Nolde 224898c42e6SBob Friesenhahn with additional command line options for Document Title, 225898c42e6SBob Friesenhahn Document Creator, and Page Orientation 226898c42e6SBob Friesenhahn 227898c42e6SBob Friesenhahn <li> tools/tiffsplit.c: abort when reading a TIFF without a byte-count 228898c42e6SBob Friesenhahn per http://bugzilla.maptools.org/show_bug.cgi?id=1996 229898c42e6SBob Friesenhahn 230898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: add fill-page option 231898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2051 232898c42e6SBob Friesenhahn 233898c42e6SBob Friesenhahn <li> tools/fax2ps.c: replace unsafe tmpfile() with mkstemp() 234898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2118 235898c42e6SBob Friesenhahn 236898c42e6SBob Friesenhahn <li> tools/tiff2pdf.c: fix colors for images with RGBA 237898c42e6SBob Friesenhahn interleaved data 238898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2250 239898c42e6SBob Friesenhahn 240898c42e6SBob Friesenhahn <li> tools/tiffcrop.c: new release by Richard Nolde 241898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2004 242898c42e6SBob Friesenhahn 243898c42e6SBob Friesenhahn <li> tools/fax2ps.c: be consistent with page-numbering 244898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2225 245898c42e6SBob Friesenhahn 246898c42e6SBob Friesenhahn <li> tools/gif2tiff.c: fix buffer overrun 247898c42e6SBob Friesenhahn http://bugzilla.maptools.org/show_bug.cgi?id=2270 248898c42e6SBob Friesenhahn 249898c42e6SBob Friesenhahn <li> tools/fax2ps.c (main): Use tmpfile() rather than mkstemp() since 250898c42e6SBob Friesenhahn it is much more portable. Tmpfile is included in ISO/IEC 251898c42e6SBob Friesenhahn 9899:1990 and the WIN32 CRT. 252898c42e6SBob Friesenhahn 253898c42e6SBob Friesenhahn</UL> 254898c42e6SBob Friesenhahn 255898c42e6SBob Friesenhahn<P><HR WIDTH=65% ALIGN=left> 256898c42e6SBob Friesenhahn 257898c42e6SBob Friesenhahn<!---------------------------------------------------------------------------> 258898c42e6SBob Friesenhahn 259898c42e6SBob Friesenhahn<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A> 260898c42e6SBob Friesenhahn 261898c42e6SBob Friesenhahn<UL> 262898c42e6SBob Friesenhahn 263898c42e6SBob Friesenhahn <li> None 264898c42e6SBob Friesenhahn 265898c42e6SBob Friesenhahn</UL> 266898c42e6SBob Friesenhahn 267*d4dd6cccSBob FriesenhahnLast updated $Date: 2016-09-25 20:05:47 $. 268898c42e6SBob Friesenhahn 269898c42e6SBob Friesenhahn</BODY> 270898c42e6SBob Friesenhahn</HTML> 271