1*cb66df4eSEven Rouault<HTML> 2*cb66df4eSEven Rouault<HEAD> 3*cb66df4eSEven Rouault<TITLE> 4*cb66df4eSEven Rouault Changes in TIFF v4.0.4beta 5*cb66df4eSEven Rouault</TITLE> 6*cb66df4eSEven Rouault</HEAD> 7*cb66df4eSEven Rouault 8*cb66df4eSEven Rouault<BODY BGCOLOR=white> 9*cb66df4eSEven Rouault<FONT FACE="Helvetica, Arial, Sans"> 10*cb66df4eSEven Rouault 11*cb66df4eSEven Rouault<BASEFONT SIZE=4> 12*cb66df4eSEven Rouault<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B> 13*cb66df4eSEven Rouault<BASEFONT SIZE=3> 14*cb66df4eSEven Rouault 15*cb66df4eSEven Rouault<UL> 16*cb66df4eSEven Rouault<HR SIZE=4 WIDTH=65% ALIGN=left> 17*cb66df4eSEven Rouault<B>Current Version</B>: v4.0.4beta<BR> 18*cb66df4eSEven Rouault<B>Previous Version</B>: <A HREF=v4.0.3.html>v4.0.3</a><BR> 19*cb66df4eSEven Rouault<B>Master FTP Site</B>: <A HREF="ftp://ftp.remotesensing.org/pub/libtiff"> 20*cb66df4eSEven Rouaultftp.remotesensing.org</a>, directory pub/libtiff</A><BR> 21*cb66df4eSEven Rouault<B>Master HTTP Site</B>: <A HREF="http://www.remotesensing.org/libtiff"> 22*cb66df4eSEven Rouaulthttp://www.remotesensing.org/libtiff</a> 23*cb66df4eSEven Rouault<HR SIZE=4 WIDTH=65% ALIGN=left> 24*cb66df4eSEven Rouault</UL> 25*cb66df4eSEven Rouault 26*cb66df4eSEven Rouault<P> 27*cb66df4eSEven RouaultThis document describes the changes made to the software between the 28*cb66df4eSEven Rouault<I>previous</I> and <I>current</I> versions (see above). If you don't 29*cb66df4eSEven Rouaultfind something listed here, then it was not done in this timeframe, or 30*cb66df4eSEven Rouaultit was not considered important enough to be mentioned. The following 31*cb66df4eSEven Rouaultinformation is located here: 32*cb66df4eSEven Rouault<UL> 33*cb66df4eSEven Rouault<LI><A HREF="#highlights">Major Changes</A> 34*cb66df4eSEven Rouault<LI><A HREF="#configure">Changes in the software configuration</A> 35*cb66df4eSEven Rouault<LI><A HREF="#libtiff">Changes in libtiff</A> 36*cb66df4eSEven Rouault<LI><A HREF="#tools">Changes in the tools</A> 37*cb66df4eSEven Rouault<LI><A HREF="#contrib">Changes in the contrib area</A> 38*cb66df4eSEven Rouault</UL> 39*cb66df4eSEven Rouault<p> 40*cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 41*cb66df4eSEven Rouault 42*cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 43*cb66df4eSEven Rouault 44*cb66df4eSEven Rouault<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A> 45*cb66df4eSEven Rouault 46*cb66df4eSEven Rouault<UL> 47*cb66df4eSEven Rouault 48*cb66df4eSEven Rouault <li> None 49*cb66df4eSEven Rouault 50*cb66df4eSEven Rouault</UL> 51*cb66df4eSEven Rouault 52*cb66df4eSEven Rouault 53*cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 54*cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 55*cb66df4eSEven Rouault 56*cb66df4eSEven Rouault<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A> 57*cb66df4eSEven Rouault 58*cb66df4eSEven Rouault<UL> 59*cb66df4eSEven Rouault 60*cb66df4eSEven Rouault <li> Updated to use Automake 1.15 and Libtool 2.4.5 61*cb66df4eSEven Rouault 62*cb66df4eSEven Rouault</UL> 63*cb66df4eSEven Rouault 64*cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 65*cb66df4eSEven Rouault 66*cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 67*cb66df4eSEven Rouault 68*cb66df4eSEven Rouault<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A> 69*cb66df4eSEven Rouault 70*cb66df4eSEven Rouault<UL> 71*cb66df4eSEven Rouault 72*cb66df4eSEven Rouault <li> TIFFCheckDirOffset(): avoid uint16 overflow 73*cb66df4eSEven Rouault when reading more than 65535 directories, and effectively error out when 74*cb66df4eSEven Rouault eaching that limit. 75*cb66df4eSEven Rouault 76*cb66df4eSEven Rouault <li> TIFFNumberOfDirectories(): generate error in case of directory count 77*cb66df4eSEven Rouault overflow. 78*cb66df4eSEven Rouault 79*cb66df4eSEven Rouault <li> TIFFAdvanceDirectory(): If nextdir is found to 80*cb66df4eSEven Rouault be defective, then set it to zero before returning error in order 81*cb66df4eSEven Rouault to terminate processing of truncated TIFF. 82*cb66df4eSEven Rouault 83*cb66df4eSEven Rouault <li> JPEG-in-TIFF: recognize SOF2, SOF9 and SOF10 84*cb66df4eSEven Rouault markers to avoid emitting a warning. Fix for compatibility with mozjpeg library. 85*cb66df4eSEven Rouault Note: the default settings of mozjpeg will produce progressive scans, which 86*cb66df4eSEven Rouault is forbidden by the TechNote. 87*cb66df4eSEven Rouault 88*cb66df4eSEven Rouault <li> JPEG-in-TIFF: Fix regression introduced in 3.9.3/4.0.0 that caused 89*cb66df4eSEven Rouault all tiles/strips to include quantization tables even when the jpegtablesmode 90*cb66df4eSEven Rouault had the JPEGTABLESMODE_QUANT bit set. 91*cb66df4eSEven Rouault Also add explicit removal of Huffman tables when jpegtablesmode has the 92*cb66df4eSEven Rouault JPEGTABLESMODE_HUFF bit set, which avoids Huffman tables to be emitted in the 93*cb66df4eSEven Rouault first tile/strip (only useful in update scenarios. create-only was 94*cb66df4eSEven Rouault fine) 95*cb66df4eSEven Rouault 96*cb66df4eSEven Rouault <li> JPEG-in-TIFF: fix segfault in JPEGFixupTagsSubsampling() on 97*cb66df4eSEven Rouault corrupted image where tif->tif_dir.td_stripoffset == NULL. 98*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2471">#2471</a>) 99*cb66df4eSEven Rouault 100*cb66df4eSEven Rouault <li> NeXT codec: add new tests to check that we don't read outside of 101*cb66df4eSEven Rouault the compressed input stream buffer. 102*cb66df4eSEven Rouault 103*cb66df4eSEven Rouault <li> NeXT codec: check that BitsPerSample = 2. Fixes 104*cb66df4eSEven Rouault <a href="http://bugzilla.maptools.org/show_bug.cgi?id=2487">#2487</a> (CVE-2014-8129) 105*cb66df4eSEven Rouault 106*cb66df4eSEven Rouault <li> NeXT codec: in the "run mode", use tilewidth for tiled images 107*cb66df4eSEven Rouault instead of imagewidth to avoid crash 108*cb66df4eSEven Rouault 109*cb66df4eSEven Rouault <li> tif_getimage.c: in OJPEG case, fix checks on strile width/height 110*cb66df4eSEven Rouault in the putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile and 111*cb66df4eSEven Rouault putcontig8bitYCbCr21tile cases. 112*cb66df4eSEven Rouault 113*cb66df4eSEven Rouault <li> in TIFFDefaultDirectory(), reset any already existing 114*cb66df4eSEven Rouault extented tags installed by user code through the extender mechaninm before 115*cb66df4eSEven Rouault calling the extender callback (GDAL #5054) 116*cb66df4eSEven Rouault 117*cb66df4eSEven Rouault <li> Fix warnings about unused parameters. 118*cb66df4eSEven Rouault 119*cb66df4eSEven Rouault <li> Fix various typos in comments found by Debian lintian tool (GDAL #5756) 120*cb66df4eSEven Rouault 121*cb66df4eSEven Rouault <li> tif_getimage.c: avoid divide by zero on invalid YCbCr subsampling. 122*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2235">#2235</a>) 123*cb66df4eSEven Rouault 124*cb66df4eSEven Rouault <li> tif_dirread.c: In EstimateStripByteCounts(), check return code 125*cb66df4eSEven Rouault of _TIFFFillStriles(). This solves crashing bug on corrupted 126*cb66df4eSEven Rouault images generated by afl. 127*cb66df4eSEven Rouault 128*cb66df4eSEven Rouault <li>tif_read.c: fix several invalid comparisons of a uint64 value with 129*cb66df4eSEven Rouault <= 0 by casting it to int64 first. This solves crashing bug on corrupted 130*cb66df4eSEven Rouault images generated by afl. 131*cb66df4eSEven Rouault 132*cb66df4eSEven Rouault <li>TIFFSetField(): refuse to set negative values for 133*cb66df4eSEven Rouault TIFFTAG_XRESOLUTION and TIFFTAG_YRESOLUTION that cause asserts when writing 134*cb66df4eSEven Rouault the directory 135*cb66df4eSEven Rouault 136*cb66df4eSEven Rouault <li>TIFFReadDirectory(): refuse to read ColorMap or 137*cb66df4eSEven Rouault TransferFunction if BitsPerSample has not yet been read, otherwise reading 138*cb66df4eSEven Rouault it later will cause user code to crash if BitsPerSample > 1 139*cb66df4eSEven Rouault 140*cb66df4eSEven Rouault <li> TIFFRGBAImageOK(): return FALSE if LOGLUV with 141*cb66df4eSEven Rouault SamplesPerPixel != 3, or if CIELAB with SamplesPerPixel != 3 or BitsPerSample != 8 142*cb66df4eSEven Rouault 143*cb66df4eSEven Rouault <li> tif_config.vc.h: no longer use "#define snprintf _snprintf" with 144*cb66df4eSEven Rouault Visual Studio 2015 aka VC 14 aka MSVC 1900 145*cb66df4eSEven Rouault 146*cb66df4eSEven Rouault <li> LZW codec: prevent potential null dereference of sp->dec_codetab in LZWPreDecode 147*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 148*cb66df4eSEven Rouault 149*cb66df4eSEven Rouault <li> TIFFReadBufferSetup(): avoid passing -1 size 150*cb66df4eSEven Rouault to TIFFmalloc() if passed user buffer size is 0 151*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 152*cb66df4eSEven Rouault 153*cb66df4eSEven Rouault <li> TIFFReadDirEntryOutputErr(): Incorrect 154*cb66df4eSEven Rouault count for tag should be a warning rather than an error since 155*cb66df4eSEven Rouault errors terminate processing. 156*cb66df4eSEven Rouault 157*cb66df4eSEven Rouault <li> tif_dirinfo.c (TIFFField) : Fix data type for TIFFTAG_GLOBALPARAMETERSIFD tag. 158*cb66df4eSEven Rouault 159*cb66df4eSEven Rouault <li> Add definitions for TIFF/EP CFARepeatPatternDim and CFAPattern tags 160*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2457">#2457</a>) 161*cb66df4eSEven Rouault 162*cb66df4eSEven Rouault <li> tif_codec.c, tif_dirinfo.c: Enlarge some fixed-size buffers that weren't 163*cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 164*cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...) 165*cb66df4eSEven Rouault <li> configure.ac: Improve pkg-config static linking by adding -lm to Libs.private when needed. 166*cb66df4eSEven Rouault 167*cb66df4eSEven Rouault <li> tif_write.c: tmsize_t related casting warning fixed for 168*cb66df4eSEven Rouault 64bit linux. 169*cb66df4eSEven Rouault 170*cb66df4eSEven Rouault <li> tif_read.c: uint64/tmsize_t change for MSVC warnings. 171*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2427">#2427</a>) 172*cb66df4eSEven Rouault 173*cb66df4eSEven Rouault <li> Fix TIFFPrintDirectory's handling of 174*cb66df4eSEven Rouault field_passcount fields: it had the TIFF_VARIABLE and 175*cb66df4eSEven Rouault TIFF_VARIABLE2 cases backwards. 176*cb66df4eSEven Rouault 177*cb66df4eSEven Rouault <li> PixarLog codec: Improve previous patch for CVE-2012-4447 178*cb66df4eSEven Rouault (to enlarge tbuf for possible partial stride at end) so that 179*cb66df4eSEven Rouault overflow in the integer addition is detected. 180*cb66df4eSEven Rouault 181*cb66df4eSEven Rouault <li>tif_{unix,vms,win32}.c (_TIFFmalloc): ANSI C does not 182*cb66df4eSEven Rouault require malloc() to return NULL pointer if requested allocation 183*cb66df4eSEven Rouault size is zero. Assure that _TIFFmalloc does. 184*cb66df4eSEven Rouault 185*cb66df4eSEven Rouault <li>tif_zip.c: Avoid crash on NULL error messages. 186*cb66df4eSEven Rouault 187*cb66df4eSEven Rouault</UL> 188*cb66df4eSEven Rouault 189*cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 190*cb66df4eSEven Rouault 191*cb66df4eSEven Rouault<!--------------------------------------------------------------------------> 192*cb66df4eSEven Rouault 193*cb66df4eSEven Rouault<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A> 194*cb66df4eSEven Rouault 195*cb66df4eSEven Rouault<UL> 196*cb66df4eSEven Rouault 197*cb66df4eSEven Rouault <li> tiff2pdf: Fis various crashes and memory buffer access errors (oCERT-2014-013). 198*cb66df4eSEven Rouault <li> tiff2pdf: fix buffer overflow on some YCbCr JPEG compressed images. 199*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2445">#2445</a>) 200*cb66df4eSEven Rouault <li> tiff2pdf: fix buffer overflow on YCbCr JPEG compressed image. 201*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2443">#2443</a>) 202*cb66df4eSEven Rouault <li> tiff2pdf: check return code of TIFFGetField() when reading TIFFTAG_SAMPLESPERPIXEL 203*cb66df4eSEven Rouault <li> tiff2pdf: fix crash due to invalid tile count. 204*cb66df4eSEven Rouault <li> tiff2pdf: Detect invalid settings of BitsPerSample/SamplesPerPixel for CIELAB / ITULAB 205*cb66df4eSEven Rouault <li> tiff2pdf: Assure that memory size calculations for 206*cb66df4eSEven Rouault _TIFFmalloc() do not overflow the range of tmsize_t. 207*cb66df4eSEven Rouault <li> tiff2pdf: Avoid crash when TIFFTAG_TRANSFERFUNCTION tag returns one channel, 208*cb66df4eSEven Rouault with the other two channels set to NULL. 209*cb66df4eSEven Rouault <li> tiff2pdf: close PDF file. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2479">#2479</a>) 210*cb66df4eSEven Rouault <li> tiff2pdf: Preserve input file directory order when pages 211*cb66df4eSEven Rouault are tagged with the same page number. 212*cb66df4eSEven Rouault <li> tiff2pdf.c: terminate after failure of allocating ycbcr buffer 213*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2449">#2449</a> CVE-2013-4232) 214*cb66df4eSEven Rouault <li> tiff2pdf: Rewrite JPEG marker parsing in 215*cb66df4eSEven Rouault t2p_process_jpeg_strip to be at least marginally competent. The 216*cb66df4eSEven Rouault approach is still fundamentally flawed, but at least now it won't 217*cb66df4eSEven Rouault stomp all over memory when given bogus input. Fixes CVE-2013-1960. 218*cb66df4eSEven Rouault <li> tiffdump: Guard against arithmetic overflow when calculating allocation buffer sizes. 219*cb66df4eSEven Rouault <li> tiffdump: fix crash due to overflow of entry count. 220*cb66df4eSEven Rouault <li> tiffdump: Fix double-free bug. 221*cb66df4eSEven Rouault <li> tiffdump: detect cycle in TIFF directory chaining. 222*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2463">#2463</a>) 223*cb66df4eSEven Rouault <li> tiffdump: avoid passing a NULL pointer to read() if seek() failed before. 224*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 225*cb66df4eSEven Rouault <li> tiff2bw: when Photometric=RGB, the utility only works if SamplesPerPixel = 3. Enforce that. 226*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2485">#2485</a>, CVE-2014-8127) 227*cb66df4eSEven Rouault <li> pal2rgb, thumbnail: fix crash by disabling TIFFTAG_INKNAMES copying. 228*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2484">#2484</a>, CVE-2014-8127) 229*cb66df4eSEven Rouault <li> thumbnail: fix out-of-buffer write. 230*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2489">#2489</a>, CVE-2014-8128) 231*cb66df4eSEven Rouault <li> thumbnail, tiffcmp: only read/write TIFFTAG_GROUP3OPTIONS 232*cb66df4eSEven Rouault or TIFFTAG_GROUP4OPTIONS if compression is COMPRESSION_CCITTFAX3 or 233*cb66df4eSEven Rouault COMPRESSION_CCITTFAX4. 234*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2493">#2493</a>, CVE-2014-8128) 235*cb66df4eSEven Rouault <li> tiffcp: fix crash when converting YCbCr JPEG-compressed to none. 236*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2480">#2480</a>) 237*cb66df4eSEven Rouault <li> bmp2tiff: fix crash due to int overflow related to input BMP dimensions 238*cb66df4eSEven Rouault <li> tiffcrop: fix crash due to invalid TileWidth/TileHeight 239*cb66df4eSEven Rouault <li> tiffcrop: fix segfault if bad value passed to -Z option 240*cb66df4eSEven Rouault ( <a href="http://bugzilla.maptools.org/show_bug.cgi?id=2459">#2459</a>) 241*cb66df4eSEven Rouault and add missing va_end in dump_info 242*cb66df4eSEven Rouault <li> thumbnail, tiffcrop: "fix" heap read over-run found with 243*cb66df4eSEven Rouault Valgrind and Address Sanitizer on test suite 244*cb66df4eSEven Rouault <li> fax2ps: check malloc()/realloc() result. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2470">#2470</a>) 245*cb66df4eSEven Rouault <li> gif2tiff: apply patch for CVE-2013-4243. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2451">#2451</a>) 246*cb66df4eSEven Rouault <li> gif2tiff: fix possible OOB write. (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2452">#2452</a>, CVE-2013-4244) 247*cb66df4eSEven Rouault <li> gif2tiff: Be more careful about corrupt or hostile input files (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2450">#2450</a>, CVE-2013-4231) 248*cb66df4eSEven Rouault <li> tiff2rgba: fix usage message in that zip was wrongly described 249*cb66df4eSEven Rouault <li> tiffinfo: Default various values fetched with TIFFGetField() to avoid being uninitialized. 250*cb66df4eSEven Rouault <li> tiff2ps: Fix bug in auto rotate option code. 251*cb66df4eSEven Rouault <li> ppm2tiff: avoid zero size buffer vulnerability (CVE-2012-4564). 252*cb66df4eSEven Rouault check the linebytes calculation too, get the max() calculation 253*cb66df4eSEven Rouault straight, avoid redundant error messages, check for malloc 254*cb66df4eSEven Rouault failure. 255*cb66df4eSEven Rouault <li> tiffset: now supports a -u option to unset a tag. 256*cb66df4eSEven Rouault (<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2419">#2419</a>) 257*cb66df4eSEven Rouault <li> Fix warnings about unused parameters. 258*cb66df4eSEven Rouault <li> rgb2ycbcr, tiff2bw, tiff2pdf, tiff2ps, tiffcrop, tiffdither : 259*cb66df4eSEven Rouault Enlarge some fixed-size buffers that weren't 260*cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 261*cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to 262*cb66df4eSEven Rouault protect against overflow of fixed-size buffers. This responds in 263*cb66df4eSEven Rouault particular to CVE-2013-1961 concerning overflow in tiff2pdf.c's 264*cb66df4eSEven Rouault t2p_write_pdf_page(). 265*cb66df4eSEven Rouault <li>html/man/tiff2ps.1.html, html/man/tiffcp.1.html, 266*cb66df4eSEven Rouault html/man/tiffdither.1.html, man/tiff2ps.1, man/tiffcp.1, 267*cb66df4eSEven Rouault man/tiffdither.1, tools/tiff2ps.c, tools/tiffcp.c, 268*cb66df4eSEven Rouault tools/tiffdither.c: Sync tool usage printouts and man pages with 269*cb66df4eSEven Rouault reality 270*cb66df4eSEven Rouault 271*cb66df4eSEven Rouault</UL> 272*cb66df4eSEven Rouault 273*cb66df4eSEven Rouault<P><HR WIDTH=65% ALIGN=left> 274*cb66df4eSEven Rouault 275*cb66df4eSEven Rouault<!---------------------------------------------------------------------------> 276*cb66df4eSEven Rouault 277*cb66df4eSEven Rouault<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A> 278*cb66df4eSEven Rouault 279*cb66df4eSEven Rouault<UL> 280*cb66df4eSEven Rouault 281*cb66df4eSEven Rouault <li> Fix warnings about variables set but not used. 282*cb66df4eSEven Rouault <li> contrib/dbs/xtiff/xtiff.c: Enlarge some fixed-size buffers that weren't 283*cb66df4eSEven Rouault large enough, and eliminate substantially all uses of sprintf(buf, 284*cb66df4eSEven Rouault ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to 285*cb66df4eSEven Rouault protect against overflow of fixed-size buffers. 286*cb66df4eSEven Rouault</UL> 287*cb66df4eSEven Rouault 288*cb66df4eSEven RouaultLast updated $Date: 2015-01-26 15:14:45 $. 289*cb66df4eSEven Rouault 290*cb66df4eSEven Rouault</BODY> 291*cb66df4eSEven Rouault</HTML> 292