1<HTML> 2<HEAD> 3<TITLE> 4 Changes in TIFF v4.0.7 5</TITLE> 6</HEAD> 7 8<BODY BGCOLOR=white> 9<FONT FACE="Helvetica, Arial, Sans"> 10 11<BASEFONT SIZE=4> 12<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B> 13<BASEFONT SIZE=3> 14 15<UL> 16<HR SIZE=4 WIDTH=65% ALIGN=left> 17<B>Current Version</B>: v4.0.7<BR> 18<B>Previous Version</B>: <A HREF=v4.0.6.html>v4.0.6</a><BR> 19<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff"> 20download.osgeo.org</a>, directory pub/libtiff</A><BR> 21<B>Master HTTP Site #1</B>: <A HREF="http://www.simplesystems.org/libtiff/"> 22http://www.simplesystems.org/libtiff/</a><BR> 23<B>Master HTTP Site #2</B>: <A HREF="http://libtiff.maptools.org/"> 24http://libtiff.maptools.org/</a> 25<HR SIZE=4 WIDTH=65% ALIGN=left> 26</UL> 27 28<P> 29This document describes the changes made to the software between the 30<I>previous</I> and <I>current</I> versions (see above). If you don't 31find something listed here, then it was not done in this timeframe, or 32it was not considered important enough to be mentioned. The following 33information is located here: 34<UL> 35<LI><A HREF="#highlights">Major Changes</A> 36<LI><A HREF="#configure">Changes in the software configuration</A> 37<LI><A HREF="#libtiff">Changes in libtiff</A> 38<LI><A HREF="#tools">Changes in the tools</A> 39<LI><A HREF="#contrib">Changes in the contrib area</A> 40</UL> 41<p> 42<P><HR WIDTH=65% ALIGN=left> 43 44<!---------------------------------------------------------------------------> 45 46<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A> 47 48<UL> 49 50 <LI> The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, 51 sgisv, and ycbcr are completely removed from the distribution. 52 These tools were written in the late 1980s and early 1990s for 53 test and demonstration purposes. In some cases the tools were 54 never updated to support updates to the file format, or the 55 file formats are now rarely used. In all cases these tools 56 increased the libtiff security and maintenance exposure beyond 57 the value offered by the tool. 58 59</UL> 60 61 62<P><HR WIDTH=65% ALIGN=left> 63<!---------------------------------------------------------------------------> 64 65<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A> 66 67<UL> 68 69 <LI> None 70 71</UL> 72 73<P><HR WIDTH=65% ALIGN=left> 74 75<!---------------------------------------------------------------------------> 76 77<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A> 78 79<UL> 80 81 <LI> libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted() when 82 requesting Predictor tag and that the zip/lzw codec is not 83 configured. Fixes 84 http://bugzilla.maptools.org/show_bug.cgi?id=2591 85 86 <LI> libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure 87 that values of tags with TIFF_SETGET_C16_ASCII / 88 TIFF_SETGET_C32_ASCII access are null terminated, to avoid 89 potential read outside buffer in _TIFFPrintField(). Fixes 90 http://bugzilla.maptools.org/show_bug.cgi?id=2590 91 92 <LI> libtiff/tif_dirread.c: reject images with OJPEG compression 93 that have no TileOffsets/StripOffsets tag, when OJPEG 94 compression is disabled. Prevent null pointer dereference in 95 TIFFReadRawStrip1() and other functions that expect 96 td_stripbytecount to be non NULL. Fixes 97 http://bugzilla.maptools.org/show_bug.cgi?id=2585 98 99 <LI> libtiff/tif_strip.c: make TIFFNumberOfStrips() return the 100 td->td_nstrips value when it is non-zero, instead of 101 recomputing it. This is needed in TIFF_STRIPCHOP mode where 102 td_nstrips is modified. Fixes a read outsize of array in 103 tiffsplit (or other utilities using TIFFNumberOfStrips()). 104 Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 105 (CVE-2016-9273) 106 107 <LI> libtiff/tif_predict.h, libtiff/tif_predict.c: Replace 108 assertions by runtime checks to avoid assertions in debug 109 mode, or buffer overflows in release mode. Can happen when 110 dealing with unusual tile size like YCbCr with 111 subsampling. Reported as MSVR 35105 by Axel Souchet & Vishal 112 Chauhan from the MSRC Vulnerabilities & Mitigations 113 114 <LI> libtiff/tif_dir.c: discard values of SMinSampleValue and 115 SMaxSampleValue when they have been read and the value of 116 SamplesPerPixel is changed afterwards (like when reading a 117 OJPEG compressed image with a missing SamplesPerPixel tag, and 118 whose photometric is RGB or YCbCr, forcing SamplesPerPixel 119 being 3). Otherwise when rewriting the directory (for example 120 with tiffset, we will expect 3 values whereas the array had 121 been allocated with just one), thus causing a out of bound 122 read access. Fixes 123 http://bugzilla.maptools.org/show_bug.cgi?id=2500 124 (CVE-2014-8127, duplicate: CVE-2016-3658) 125 126 <LI> libtiff/tif_dirwrite.c: avoid null pointer dereference on 127 td_stripoffset when writing directory, if FIELD_STRIPOFFSETS 128 was artificially set for a hack case in OJPEG case. Fixes 129 http://bugzilla.maptools.org/show_bug.cgi?id=2500 130 (CVE-2014-8127, duplicate: CVE-2016-3658) 131 132 <LI> libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to 133 read floating point images. 134 135 <LI> libtiff/tif_predict.c (PredictorSetup): Enforce 136 bits-per-sample requirements of floating point predictor (3). 137 Fixes CVE-2016-3622 "Divide By Zero in the tiff2rgba tool." 138 139 <LI> libtiff/tif_pixarlog.c: fix out-of-bounds write vulnerabilities 140 in heap allocated buffers. Reported as MSVR 35094. Discovered by 141 Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 142 Mitigations team. 143 144 <LI> libtiff/tif_write.c: fix issue in error code path of 145 TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp 146 members. I'm not completely sure if that could happen in 147 practice outside of the odd behaviour of t2p_seekproc() of 148 tiff2pdf). The report points that a better fix could be to 149 check the return value of TIFFFlushData1() in places where it 150 isn't done currently, but it seems this patch is enough. 151 Reported as MSVR 35095. Discovered by Axel Souchet & Vishal 152 Chauhan & Suha Can from the MSRC Vulnerabilities & Mitigations 153 team. 154 155 <LI> libtiff/tif_pixarlog.c: Fix write buffer overflow in 156 PixarLogEncode if more input samples are provided than 157 expected by PixarLogSetupEncode. Idea based on 158 libtiff-CVE-2016-3990.patch from 159 libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with 160 different and simpler check. (bugzilla #2544) 161 162 <LI> libtiff/tif_read.c: Fix out-of-bounds read on memory-mapped 163 files in TIFFReadRawStrip1() and TIFFReadRawTile1() when 164 stripoffset is beyond tmsize_t max value (reported by Mathias 165 Svensson) 166 167 <LI> libtiff/tif_read.c: make TIFFReadEncodedStrip() and 168 TIFFReadEncodedTile() directly use user provided buffer when 169 no compression (and other conditions) to save a memcpy() 170 171 <LI> libtiff/tif_write.c: make TIFFWriteEncodedStrip() and 172 TIFFWriteEncodedTile() directly use user provided buffer when 173 no compression to save a memcpy(). 174 175 <LI> libtiff/tif_luv.c: validate that for COMPRESSION_SGILOG and 176 PHOTOMETRIC_LOGL, there is only one sample per pixel. Avoid 177 potential invalid memory write on corrupted/unexpected images 178 when using the TIFFRGBAImageBegin() interface (reported by 179 Clay Wood) 180 181 <LI> libtiff/tif_pixarlog.c: fix potential buffer write overrun in 182 PixarLogDecode() on corrupted/unexpected images (reported by 183 Mathias Svensson) (CVE-2016-5875) 184 185 <LI> libtiff/libtiff.def: Added _TIFFMultiply32 and 186 _TIFFMultiply64 to libtiff.def 187 188 <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Add a '1' to the 189 HAVE_SNPRINTF definition. 190 191 <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Applied patch by 192 Edward Lam to define HAVE_SNPRINTF for Visual Studio 2015. 193 194 <LI> libtiff/tif_dirread.c: when compiled with DEFER_STRILE_LOAD, 195 fix regression, introduced on 2014-12-23, when reading a 196 one-strip file without a StripByteCounts tag. GDAL #6490 197 198 <LI> libtiff/*: upstream typo fixes (mostly contributed by Kurt 199 Schwehr) coming from GDAL internal libtiff 200 201 <LI> libtiff/tif_fax3.h: make Param member of TIFFFaxTabEnt 202 structure a uint16 to reduce size of the binary. 203 204 <LI> libtiff/tif_read.c, tif_dirread.c: fix indentation issues 205 raised by GCC 6 -Wmisleading-indentation 206 207 <LI> libtiff/tif_pixarlog.c: avoid zlib error messages to pass a 208 NULL string to %s formatter, which is undefined behaviour in 209 sprintf(). 210 211 <LI> libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode() 212 triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif 213 (bugzilla #2508) 214 215 <LI> libtiff/tif_luv.c: fix potential out-of-bound writes in 216 decode functions in non debug builds by replacing assert()s by 217 regular if checks (bugzilla #2522). Fix potential 218 out-of-bound reads in case of short input data. 219 220 <LI> libtiff/tif_getimage.c: fix out-of-bound reads in 221 TIFFRGBAImage interface in case of unsupported values of 222 SamplesPerPixel/ExtraSamples for LogLUV / CIELab. Add explicit 223 call to TIFFRGBAImageOK() in TIFFRGBAImageBegin(). Fix 224 CVE-2015-8665 reported by limingxing and CVE-2015-8683 225 reported by zzf of Alibaba. 226 227 <LI> libtiff/tif_dirread.c: workaround false positive warning of 228 Clang Static Analyzer about null pointer dereference in 229 TIFFCheckDirOffset(). 230 231 <LI> libtiff/tif_fax3.c: remove dead assignment in 232 Fax3PutEOLgdal(). Found by Clang Static Analyzer 233 234 <LI> libtiff/tif_dirwrite.c: fix truncation to 32 bit of file 235 offsets in TIFFLinkDirectory() and TIFFWriteDirectorySec() 236 when aligning directory offsets on a even offset (affects 237 BigTIFF). This was a regression of the changeset of 238 2015-10-19. 239 240 <LI> libtiff/tif_write.c: TIFFWriteEncodedStrip() and 241 TIFFWriteEncodedTile() should return -1 in case of failure of 242 tif_encodestrip() as documented 243 244 <LI> libtiff/tif_dumpmode.c: DumpModeEncode() should return 0 in 245 case of failure so that the above mentionned functions detect 246 the error. 247 248 <LI> libtiff/*.c: fix MSVC warnings related to cast shortening and 249 assignment within conditional expression 250 251 <LI> libtiff/*.c: fix clang -Wshorten-64-to-32 warnings 252 253 <LI> libtiff/tif_dirread.c: prevent reading ColorMap or 254 TransferFunction if BitsPerPixel > 24, so as to avoid huge 255 memory allocation and file read attempts 256 257 <LI> libtiff/tif_dirread.c: remove duplicated assignment (reported 258 by Clang static analyzer) 259 260 <LI> libtiff/tif_dir.c, libtiff/tif_dirinfo.c, 261 libtiff/tif_compress.c, libtiff/tif_jpeg_12.c: suppress 262 warnings about 'no previous declaration/prototype' 263 264 <LI> libtiff/tiffiop.h, libtiff/tif_dirwrite.c: suffix constants 265 by U to fix 'warning: negative integer implicitly converted to 266 unsigned type' warning (part of -Wconversion) 267 268 <LI> libtiff/tif_dir.c, libtiff/tif_dirread.c, 269 libtiff/tif_getimage.c, libtiff/tif_print.c: fix -Wshadow 270 warnings (only in libtiff/) 271 272</UL> 273 274<P><HR WIDTH=65% ALIGN=left> 275 276<!--------------------------------------------------------------------------> 277 278<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A> 279 280<UL> 281 282 <LI> tools/Makefile.am: The libtiff tools bmp2tiff, gif2tiff, 283 ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed 284 from the distribution. The libtiff tools rgb2ycbcr and 285 thumbnail are only built in the build tree for testing. Old 286 files are put in new 'archive' subdirectory of the source 287 repository, but not in distribution archives. These changes 288 are made in order to lessen the maintenance burden. 289 290 <LI> tools/tiff2pdf.c: avoid undefined behaviour related to 291 overlapping of source and destination buffer in memcpy() call 292 in t2p_sample_rgbaa_to_rgb() Fixes 293 http://bugzilla.maptools.org/show_bug.cgi?id=2577 294 295 <LI> tools/tiff2pdf.c: fix potential integer overflows on 32 bit 296 builds in t2p_read_tiff_size() Fixes 297 http://bugzilla.maptools.org/show_bug.cgi?id=2576 298 299 <LI> tools/fax2tiff.c: fix segfault when specifying -r without 300 argument. Patch by Yuriy M. Kaminskiy. Fixes 301 http://bugzilla.maptools.org/show_bug.cgi?id=2572 302 303 <LI> tools/tiffinfo.c: fix out-of-bound read on some tiled images. 304 (http://bugzilla.maptools.org/show_bug.cgi?id=2517) 305 306 <LI> tools/tiffcrop.c: fix multiple uint32 overflows in 307 writeBufferToSeparateStrips(), writeBufferToContigTiles() and 308 writeBufferToSeparateTiles() that could cause heap buffer 309 overflows. Reported by Henri Salo from Nixu Corporation. 310 Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592 311 312 <LI> tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in 313 readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel 314 Souchet & Vishal Chauhan from the MSRC Vulnerabilities & 315 Mitigations team. 316 317 <LI> tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on 318 JPEG compressed images. Reported by Tyler Bohan of Cisco Talos 319 as TALOS-CAN-0187 / CVE-2016-5652. Also prevents writing 2 320 extra uninitialized bytes to the file stream. 321 322 <LI> tools/tiffcp.c: fix out-of-bounds write on tiled images with odd 323 tile width vs image width. Reported as MSVR 35103 324 by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 325 Mitigations team. 326 327 <LI> tools/tiff2pdf.c: fix read -largely- outsize of buffer in 328 t2p_readwrite_pdf_image_tile(), causing crash, when reading a 329 JPEG compressed image with TIFFTAG_JPEGTABLES length being 330 one. Reported as MSVR 35101 by Axel Souchet and Vishal 331 Chauhan from the MSRC Vulnerabilities & Mitigations team. 332 333 <LI> tools/tiffcp.c: fix read of undefined variable in case of 334 missing required tags. Found on test case of MSVR 35100. 335 336 <LI> tools/tiffcrop.c: fix read of undefined buffer in 337 readContigStripsIntoBuffer() due to uint16 overflow. Probably 338 not a security issue but I can be wrong. Reported as MSVR 339 35100 by Axel Souchet from the MSRC Vulnerabilities & 340 Mitigations team. 341 342 <LI> tools/tiffcrop.c: fix various out-of-bounds write 343 vulnerabilities in heap or stack allocated buffers. Reported 344 as MSVR 35093, MSVR 35096 and MSVR 35097. Discovered by Axel 345 Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 346 Mitigations team. 347 348 <LI> tools/tiff2pdf.c: fix out-of-bounds write vulnerabilities in 349 heap allocate buffer in t2p_process_jpeg_strip(). Reported as 350 MSVR 35098. Discovered by Axel Souchet and Vishal Chauhan from 351 the MSRC Vulnerabilities & Mitigations team. 352 353 <LI> tools/tiff2bw.c: fix weight computation that could result of 354 color value overflow (no security implication). Fix bugzilla 355 #2550. Patch by Frank Freudenberg. 356 357 <LI> tools/rgb2ycbcr.c: validate values of -v and -h parameters to 358 avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569) 359 360 <LI> tools/tiffcrop.c: Fix out-of-bounds write in loadImage(). 361 From patch libtiff-CVE-2016-3991.patch from 362 libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla 363 #2543) 364 365 366 <LI> tools/tiff2rgba.c: Fix integer overflow in size of allocated 367 buffer, when -b mode is enabled, that could result in 368 out-of-bounds write. Based initially on patch 369 tiff-CVE-2016-3945.patch from libtiff-4.0.3-25.el7_2.src.rpm 370 by Nikola Forro, with correction for invalid tests that 371 rejected valid files. (bugzilla #2545) 372 373 <LI> tools/tiffcrop.c: Avoid access outside of stack allocated 374 array on a tiled separate TIFF with more than 8 samples per 375 pixel. Reported by Kaixiang Zhang of the Cloud Security Team, 376 Qihoo 360 (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / 377 #2559) 378 379 <LI> tools/tiffdump.c: fix a few misaligned 64-bit reads warned by 380 -fsanitize 381 382</UL> 383 384<P><HR WIDTH=65% ALIGN=left> 385 386<!---------------------------------------------------------------------------> 387 388<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A> 389 390<UL> 391 392 <LI> None 393 394</UL> 395 396Last updated $Date: 2016-11-12 21:43:44 $. 397 398</BODY> 399</HTML> 400