1cb66df4eSEven Rouault<HTML> 2cb66df4eSEven Rouault<HEAD> 3cb66df4eSEven Rouault<TITLE> 4cb66df4eSEven Rouault Changes in TIFF v4.0.4beta 5cb66df4eSEven Rouault</TITLE> 6cb66df4eSEven Rouault</HEAD> 7cb66df4eSEven Rouault 8cb66df4eSEven Rouault<BODY BGCOLOR=white> 9cb66df4eSEven Rouault<FONT FACE="Helvetica, Arial, Sans"> 10cb66df4eSEven Rouault 11cb66df4eSEven Rouault<BASEFONT SIZE=4> 12cb66df4eSEven Rouault<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B> 13cb66df4eSEven Rouault<BASEFONT SIZE=3> 14cb66df4eSEven Rouault 15cb66df4eSEven Rouault<UL> 16cb66df4eSEven Rouault<HR SIZE=4 WIDTH=65% ALIGN=left> 17cb66df4eSEven Rouault<B>Current Version</B>: v4.0.4beta<BR> 18cb66df4eSEven Rouault<B>Previous Version</B>: <A HREF=v4.0.3.html>v4.0.3</a><BR> 19*d4dd6cccSBob Friesenhahn<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff"> 20*d4dd6cccSBob Friesenhahndownload.osgeo.org</a>, directory pub/libtiff</A><BR> 21*d4dd6cccSBob Friesenhahn<B>Master HTTP Site</B>: <A HREF="http://www.simplesystems.org/libtiff/"> 22*d4dd6cccSBob Friesenhahnhttp://www.simplesystems.org/libtiff/</a> 23cb66df4eSEven Rouault<HR SIZE=4 WIDTH=65% ALIGN=left> 24cb66df4eSEven Rouault</UL> 25cb66df4eSEven Rouault 26cb66df4eSEven Rouault<P> 27cb66df4eSEven RouaultThis document describes the changes made to the software between the 28cb66df4eSEven Rouault<I>previous</I> and <I>current</I> versions (see above). If you don't 29cb66df4eSEven Rouaultfind something listed here, then it was not done in this timeframe, or 30cb66df4eSEven Rouaultit was not considered important enough to be mentioned. The following 31cb66df4eSEven Rouaultinformation is located here: 32cb66df4eSEven Rouault<UL> 33cb66df4eSEven Rouault<LI><A HREF="#highlights">Major Changes</A> 34cb66df4eSEven Rouault<LI><A HREF="#configure">Changes in the software configuration</A> 35cb66df4eSEven Rouault<LI><A HREF="#libtiff">Changes in libtiff</A> 36cb66df4eSEven Rouault<LI><A HREF="#tools">Changes in the tools</A> 37cb66df4eSEven Rouault<LI><A HREF="#contrib">Changes in the contrib area</A> 38cb66df4eSEven Rouault</UL> 39cb66df4eSEven Rouault<p> 40cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 41cb66df4eSEven Rouault 42cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 43cb66df4eSEven Rouault 44cb66df4eSEven Rouault<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A> 45cb66df4eSEven Rouault 46cb66df4eSEven Rouault<UL> 47cb66df4eSEven Rouault 48cb66df4eSEven Rouault <li> None 49cb66df4eSEven Rouault 50cb66df4eSEven Rouault</UL> 51cb66df4eSEven Rouault 52cb66df4eSEven Rouault 53cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 54cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 55cb66df4eSEven Rouault 56cb66df4eSEven Rouault<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A> 57cb66df4eSEven Rouault 58cb66df4eSEven Rouault<UL> 59cb66df4eSEven Rouault 60cb66df4eSEven Rouault <li> Updated to use Automake 1.15 and Libtool 2.4.5 61cb66df4eSEven Rouault 62cb66df4eSEven Rouault</UL> 63cb66df4eSEven Rouault 64cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 65cb66df4eSEven Rouault 66cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 67cb66df4eSEven Rouault 68cb66df4eSEven Rouault<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A> 69cb66df4eSEven Rouault 70cb66df4eSEven Rouault<UL> 71cb66df4eSEven Rouault 72cb66df4eSEven Rouault <li> TIFFCheckDirOffset(): avoid uint16 overflow 73cb66df4eSEven Rouault when reading more than 65535 directories, and effectively error out when 74cb66df4eSEven Rouault eaching that limit. 75cb66df4eSEven Rouault 76cb66df4eSEven Rouault <li> TIFFNumberOfDirectories(): generate error in case of directory count 77cb66df4eSEven Rouault overflow. 78cb66df4eSEven Rouault 79cb66df4eSEven Rouault <li> TIFFAdvanceDirectory(): If nextdir is found to 80cb66df4eSEven Rouault be defective, then set it to zero before returning error in order 81cb66df4eSEven Rouault to terminate processing of truncated TIFF. 82cb66df4eSEven Rouault 83cb66df4eSEven Rouault <li> JPEG-in-TIFF: recognize SOF2, SOF9 and SOF10 84cb66df4eSEven Rouault markers to avoid emitting a warning. Fix for compatibility with mozjpeg library. 85cb66df4eSEven Rouault Note: the default settings of mozjpeg will produce progressive scans, which 86cb66df4eSEven Rouault is forbidden by the TechNote. 87cb66df4eSEven Rouault 88cb66df4eSEven Rouault <li> JPEG-in-TIFF: Fix regression introduced in 3.9.3/4.0.0 that caused 89cb66df4eSEven Rouault all tiles/strips to include quantization tables even when the jpegtablesmode 90cb66df4eSEven Rouault had the JPEGTABLESMODE_QUANT bit set. 91cb66df4eSEven Rouault Also add explicit removal of Huffman tables when jpegtablesmode has the 92cb66df4eSEven Rouault JPEGTABLESMODE_HUFF bit set, which avoids Huffman tables to be emitted in the 93cb66df4eSEven Rouault first tile/strip (only useful in update scenarios. create-only was 94cb66df4eSEven Rouault fine) 95cb66df4eSEven Rouault 96cb66df4eSEven Rouault <li> JPEG-in-TIFF: fix segfault in JPEGFixupTagsSubsampling() on 97cb66df4eSEven Rouault corrupted image where tif->tif_dir.td_stripoffset == NULL. 98cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2471">#2471</a>) 99cb66df4eSEven Rouault 100cb66df4eSEven Rouault <li> NeXT codec: add new tests to check that we don't read outside of 101cb66df4eSEven Rouault the compressed input stream buffer. 102cb66df4eSEven Rouault 103cb66df4eSEven Rouault <li> NeXT codec: check that BitsPerSample = 2. Fixes 104cb66df4eSEven Rouault <a href="http://bugzilla.maptools.org/show_bug.cgi?id=2487">#2487</a> (CVE-2014-8129) 105cb66df4eSEven Rouault 106cb66df4eSEven Rouault <li> NeXT codec: in the "run mode", use tilewidth for tiled images 107cb66df4eSEven Rouault instead of imagewidth to avoid crash 108cb66df4eSEven Rouault 109cb66df4eSEven Rouault <li> tif_getimage.c: in OJPEG case, fix checks on strile width/height 110cb66df4eSEven Rouault in the putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile and 111cb66df4eSEven Rouault putcontig8bitYCbCr21tile cases. 112cb66df4eSEven Rouault 113cb66df4eSEven Rouault <li> in TIFFDefaultDirectory(), reset any already existing 114cb66df4eSEven Rouault extented tags installed by user code through the extender mechaninm before 115cb66df4eSEven Rouault calling the extender callback (GDAL #5054) 116cb66df4eSEven Rouault 117cb66df4eSEven Rouault <li> Fix warnings about unused parameters. 118cb66df4eSEven Rouault 119cb66df4eSEven Rouault <li> Fix various typos in comments found by Debian lintian tool (GDAL #5756) 120cb66df4eSEven Rouault 121cb66df4eSEven Rouault <li> tif_getimage.c: avoid divide by zero on invalid YCbCr subsampling. 122cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2235">#2235</a>) 123cb66df4eSEven Rouault 124cb66df4eSEven Rouault <li> tif_dirread.c: In EstimateStripByteCounts(), check return code 125cb66df4eSEven Rouault of _TIFFFillStriles(). This solves crashing bug on corrupted 126cb66df4eSEven Rouault images generated by afl. 127cb66df4eSEven Rouault 128cb66df4eSEven Rouault <li>tif_read.c: fix several invalid comparisons of a uint64 value with 129cb66df4eSEven Rouault <= 0 by casting it to int64 first. This solves crashing bug on corrupted 130cb66df4eSEven Rouault images generated by afl. 131cb66df4eSEven Rouault 132cb66df4eSEven Rouault <li>TIFFSetField(): refuse to set negative values for 133cb66df4eSEven Rouault TIFFTAG_XRESOLUTION and TIFFTAG_YRESOLUTION that cause asserts when writing 134cb66df4eSEven Rouault the directory 135cb66df4eSEven Rouault 136cb66df4eSEven Rouault <li>TIFFReadDirectory(): refuse to read ColorMap or 137cb66df4eSEven Rouault TransferFunction if BitsPerSample has not yet been read, otherwise reading 138cb66df4eSEven Rouault it later will cause user code to crash if BitsPerSample > 1 139cb66df4eSEven Rouault 140cb66df4eSEven Rouault <li> TIFFRGBAImageOK(): return FALSE if LOGLUV with 141cb66df4eSEven Rouault SamplesPerPixel != 3, or if CIELAB with SamplesPerPixel != 3 or BitsPerSample != 8 142cb66df4eSEven Rouault 143cb66df4eSEven Rouault <li> tif_config.vc.h: no longer use "#define snprintf _snprintf" with 144cb66df4eSEven Rouault Visual Studio 2015 aka VC 14 aka MSVC 1900 145cb66df4eSEven Rouault 146cb66df4eSEven Rouault <li> LZW codec: prevent potential null dereference of sp->dec_codetab in LZWPreDecode 147cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 148cb66df4eSEven Rouault 149cb66df4eSEven Rouault <li> TIFFReadBufferSetup(): avoid passing -1 size 150cb66df4eSEven Rouault to TIFFmalloc() if passed user buffer size is 0 151cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 152cb66df4eSEven Rouault 153cb66df4eSEven Rouault <li> TIFFReadDirEntryOutputErr(): Incorrect 154cb66df4eSEven Rouault count for tag should be a warning rather than an error since 155cb66df4eSEven Rouault errors terminate processing. 156cb66df4eSEven Rouault 157cb66df4eSEven Rouault <li> tif_dirinfo.c (TIFFField) : Fix data type for TIFFTAG_GLOBALPARAMETERSIFD tag. 158cb66df4eSEven Rouault 159cb66df4eSEven Rouault <li> Add definitions for TIFF/EP CFARepeatPatternDim and CFAPattern tags 160cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2457">#2457</a>) 161cb66df4eSEven Rouault 162cb66df4eSEven Rouault <li> tif_codec.c, tif_dirinfo.c: Enlarge some fixed-size buffers that weren't 163cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 164cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...) 165cb66df4eSEven Rouault <li> configure.ac: Improve pkg-config static linking by adding -lm to Libs.private when needed. 166cb66df4eSEven Rouault 167cb66df4eSEven Rouault <li> tif_write.c: tmsize_t related casting warning fixed for 168cb66df4eSEven Rouault 64bit linux. 169cb66df4eSEven Rouault 170cb66df4eSEven Rouault <li> tif_read.c: uint64/tmsize_t change for MSVC warnings. 171cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2427">#2427</a>) 172cb66df4eSEven Rouault 173cb66df4eSEven Rouault <li> Fix TIFFPrintDirectory's handling of 174cb66df4eSEven Rouault field_passcount fields: it had the TIFF_VARIABLE and 175cb66df4eSEven Rouault TIFF_VARIABLE2 cases backwards. 176cb66df4eSEven Rouault 177cb66df4eSEven Rouault <li> PixarLog codec: Improve previous patch for CVE-2012-4447 178cb66df4eSEven Rouault (to enlarge tbuf for possible partial stride at end) so that 179cb66df4eSEven Rouault overflow in the integer addition is detected. 180cb66df4eSEven Rouault 181cb66df4eSEven Rouault <li>tif_{unix,vms,win32}.c (_TIFFmalloc): ANSI C does not 182cb66df4eSEven Rouault require malloc() to return NULL pointer if requested allocation 183cb66df4eSEven Rouault size is zero. Assure that _TIFFmalloc does. 184cb66df4eSEven Rouault 185cb66df4eSEven Rouault <li>tif_zip.c: Avoid crash on NULL error messages. 186cb66df4eSEven Rouault 187cb66df4eSEven Rouault</UL> 188cb66df4eSEven Rouault 189cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 190cb66df4eSEven Rouault 191cb66df4eSEven Rouault<!--------------------------------------------------------------------------> 192cb66df4eSEven Rouault 193cb66df4eSEven Rouault<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A> 194cb66df4eSEven Rouault 195cb66df4eSEven Rouault<UL> 196cb66df4eSEven Rouault 197cb66df4eSEven Rouault <li> tiff2pdf: Fis various crashes and memory buffer access errors (oCERT-2014-013). 198cb66df4eSEven Rouault <li> tiff2pdf: fix buffer overflow on some YCbCr JPEG compressed images. 199cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2445">#2445</a>) 200cb66df4eSEven Rouault <li> tiff2pdf: fix buffer overflow on YCbCr JPEG compressed image. 201cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2443">#2443</a>) 202cb66df4eSEven Rouault <li> tiff2pdf: check return code of TIFFGetField() when reading TIFFTAG_SAMPLESPERPIXEL 203cb66df4eSEven Rouault <li> tiff2pdf: fix crash due to invalid tile count. 204cb66df4eSEven Rouault <li> tiff2pdf: Detect invalid settings of BitsPerSample/SamplesPerPixel for CIELAB / ITULAB 205cb66df4eSEven Rouault <li> tiff2pdf: Assure that memory size calculations for 206cb66df4eSEven Rouault _TIFFmalloc() do not overflow the range of tmsize_t. 207cb66df4eSEven Rouault <li> tiff2pdf: Avoid crash when TIFFTAG_TRANSFERFUNCTION tag returns one channel, 208cb66df4eSEven Rouault with the other two channels set to NULL. 209cb66df4eSEven Rouault <li> tiff2pdf: close PDF file. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2479">#2479</a>) 210cb66df4eSEven Rouault <li> tiff2pdf: Preserve input file directory order when pages 211cb66df4eSEven Rouault are tagged with the same page number. 212cb66df4eSEven Rouault <li> tiff2pdf.c: terminate after failure of allocating ycbcr buffer 213cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2449">#2449</a> CVE-2013-4232) 214cb66df4eSEven Rouault <li> tiff2pdf: Rewrite JPEG marker parsing in 215cb66df4eSEven Rouault t2p_process_jpeg_strip to be at least marginally competent. The 216cb66df4eSEven Rouault approach is still fundamentally flawed, but at least now it won't 217cb66df4eSEven Rouault stomp all over memory when given bogus input. Fixes CVE-2013-1960. 218cb66df4eSEven Rouault <li> tiffdump: Guard against arithmetic overflow when calculating allocation buffer sizes. 219cb66df4eSEven Rouault <li> tiffdump: fix crash due to overflow of entry count. 220cb66df4eSEven Rouault <li> tiffdump: Fix double-free bug. 221cb66df4eSEven Rouault <li> tiffdump: detect cycle in TIFF directory chaining. 222cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2463">#2463</a>) 223cb66df4eSEven Rouault <li> tiffdump: avoid passing a NULL pointer to read() if seek() failed before. 224cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 225cb66df4eSEven Rouault <li> tiff2bw: when Photometric=RGB, the utility only works if SamplesPerPixel = 3. Enforce that. 226cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2485">#2485</a>, CVE-2014-8127) 227cb66df4eSEven Rouault <li> pal2rgb, thumbnail: fix crash by disabling TIFFTAG_INKNAMES copying. 228cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2484">#2484</a>, CVE-2014-8127) 229cb66df4eSEven Rouault <li> thumbnail: fix out-of-buffer write. 230cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2489">#2489</a>, CVE-2014-8128) 231cb66df4eSEven Rouault <li> thumbnail, tiffcmp: only read/write TIFFTAG_GROUP3OPTIONS 232cb66df4eSEven Rouault or TIFFTAG_GROUP4OPTIONS if compression is COMPRESSION_CCITTFAX3 or 233cb66df4eSEven Rouault COMPRESSION_CCITTFAX4. 234cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2493">#2493</a>, CVE-2014-8128) 235cb66df4eSEven Rouault <li> tiffcp: fix crash when converting YCbCr JPEG-compressed to none. 236cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2480">#2480</a>) 237cb66df4eSEven Rouault <li> bmp2tiff: fix crash due to int overflow related to input BMP dimensions 238cb66df4eSEven Rouault <li> tiffcrop: fix crash due to invalid TileWidth/TileHeight 239cb66df4eSEven Rouault <li> tiffcrop: fix segfault if bad value passed to -Z option 240cb66df4eSEven Rouault ( <a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 241cb66df4eSEven Rouault and add missing va_end in dump_info 242cb66df4eSEven Rouault <li> thumbnail, tiffcrop: "fix" heap read over-run found with 243cb66df4eSEven Rouault Valgrind and Address Sanitizer on test suite 244cb66df4eSEven Rouault <li> fax2ps: check malloc()/realloc() result. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2470">#2470</a>) 245cb66df4eSEven Rouault <li> gif2tiff: apply patch for CVE-2013-4243. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2451">#2451</a>) 246cb66df4eSEven Rouault <li> gif2tiff: fix possible OOB write. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2452">#2452</a>, CVE-2013-4244) 247cb66df4eSEven Rouault <li> gif2tiff: Be more careful about corrupt or hostile input files (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2450">#2450</a>, CVE-2013-4231) 248cb66df4eSEven Rouault <li> tiff2rgba: fix usage message in that zip was wrongly described 249cb66df4eSEven Rouault <li> tiffinfo: Default various values fetched with TIFFGetField() to avoid being uninitialized. 250cb66df4eSEven Rouault <li> tiff2ps: Fix bug in auto rotate option code. 251cb66df4eSEven Rouault <li> ppm2tiff: avoid zero size buffer vulnerability (CVE-2012-4564). 252cb66df4eSEven Rouault check the linebytes calculation too, get the max() calculation 253cb66df4eSEven Rouault straight, avoid redundant error messages, check for malloc 254cb66df4eSEven Rouault failure. 255cb66df4eSEven Rouault <li> tiffset: now supports a -u option to unset a tag. 256cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2419">#2419</a>) 257cb66df4eSEven Rouault <li> Fix warnings about unused parameters. 258cb66df4eSEven Rouault <li> rgb2ycbcr, tiff2bw, tiff2pdf, tiff2ps, tiffcrop, tiffdither : 259cb66df4eSEven Rouault Enlarge some fixed-size buffers that weren't 260cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 261cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to 262cb66df4eSEven Rouault protect against overflow of fixed-size buffers. This responds in 263cb66df4eSEven Rouault particular to CVE-2013-1961 concerning overflow in tiff2pdf.c's 264cb66df4eSEven Rouault t2p_write_pdf_page(). 265cb66df4eSEven Rouault <li>html/man/tiff2ps.1.html, html/man/tiffcp.1.html, 266cb66df4eSEven Rouault html/man/tiffdither.1.html, man/tiff2ps.1, man/tiffcp.1, 267cb66df4eSEven Rouault man/tiffdither.1, tools/tiff2ps.c, tools/tiffcp.c, 268cb66df4eSEven Rouault tools/tiffdither.c: Sync tool usage printouts and man pages with 269cb66df4eSEven Rouault reality 270cb66df4eSEven Rouault 271cb66df4eSEven Rouault</UL> 272cb66df4eSEven Rouault 273cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 274cb66df4eSEven Rouault 275cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 276cb66df4eSEven Rouault 277cb66df4eSEven Rouault<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A> 278cb66df4eSEven Rouault 279cb66df4eSEven Rouault<UL> 280cb66df4eSEven Rouault 281cb66df4eSEven Rouault <li> Fix warnings about variables set but not used. 282cb66df4eSEven Rouault <li> contrib/dbs/xtiff/xtiff.c: Enlarge some fixed-size buffers that weren't 283cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 284cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to 285cb66df4eSEven Rouault protect against overflow of fixed-size buffers. 286cb66df4eSEven Rouault</UL> 287cb66df4eSEven Rouault 288*d4dd6cccSBob FriesenhahnLast updated $Date: 2016-09-25 20:05:47 $. 289cb66df4eSEven Rouault 290cb66df4eSEven Rouault</BODY> 291cb66df4eSEven Rouault</HTML> 292