1<HTML> 2<HEAD> 3<TITLE> 4 Changes in TIFF v4.0.7 5</TITLE> 6</HEAD> 7 8<BODY BGCOLOR=white> 9<FONT FACE="Helvetica, Arial, Sans"> 10 11<BASEFONT SIZE=4> 12<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B> 13<BASEFONT SIZE=3> 14 15<UL> 16<HR SIZE=4 WIDTH=65% ALIGN=left> 17<B>Current Version</B>: v4.0.7<BR> 18<B>Previous Version</B>: <A HREF=v4.0.6.html>v4.0.6</a><BR> 19<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff"> 20download.osgeo.org</a>, directory pub/libtiff</A><BR> 21<B>Master HTTP Site #1</B>: <A HREF="http://www.simplesystems.org/libtiff/"> 22http://www.simplesystems.org/libtiff/</a><BR> 23<B>Master HTTP Site #2</B>: <A HREF="http://libtiff.maptools.org/"> 24http://libtiff.maptools.org/</a> 25<HR SIZE=4 WIDTH=65% ALIGN=left> 26</UL> 27 28<P> 29This document describes the changes made to the software between the 30<I>previous</I> and <I>current</I> versions (see above). If you don't 31find something listed here, then it was not done in this timeframe, or 32it was not considered important enough to be mentioned. The following 33information is located here: 34<UL> 35<LI><A HREF="#highlights">Major Changes</A> 36<LI><A HREF="#configure">Changes in the software configuration</A> 37<LI><A HREF="#libtiff">Changes in libtiff</A> 38<LI><A HREF="#tools">Changes in the tools</A> 39<LI><A HREF="#contrib">Changes in the contrib area</A> 40</UL> 41<p> 42<P><HR WIDTH=65% ALIGN=left> 43 44<!---------------------------------------------------------------------------> 45 46<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A> 47 48<UL> 49 50 <LI> The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, 51 sgisv, and ycbcr are completely removed from the distribution. 52 These tools were written in the late 1980s and early 1990s for 53 test and demonstration purposes. In some cases the tools were 54 never updated to support updates to the file format, or the 55 file formats are now rarely used. In all cases these tools 56 increased the libtiff security and maintenance exposure beyond 57 the value offered by the tool. 58 59</UL> 60 61 62<P><HR WIDTH=65% ALIGN=left> 63<!---------------------------------------------------------------------------> 64 65<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A> 66 67<UL> 68 69 <LI> None 70 71</UL> 72 73<P><HR WIDTH=65% ALIGN=left> 74 75<!---------------------------------------------------------------------------> 76 77<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A> 78 79<UL> 80 81 <LI> libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted() when 82 requesting Predictor tag and that the zip/lzw codec is not 83 configured. Fixes 84 http://bugzilla.maptools.org/show_bug.cgi?id=2591 85 86 <LI> libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure 87 that values of tags with TIFF_SETGET_C16_ASCII / 88 TIFF_SETGET_C32_ASCII access are null terminated, to avoid 89 potential read outside buffer in _TIFFPrintField(). Fixes 90 http://bugzilla.maptools.org/show_bug.cgi?id=2590 91 92 <LI> libtiff/tif_dirread.c: reject images with OJPEG compression 93 that have no TileOffsets/StripOffsets tag, when OJPEG 94 compression is disabled. Prevent null pointer dereference in 95 TIFFReadRawStrip1() and other functions that expect 96 td_stripbytecount to be non NULL. Fixes 97 http://bugzilla.maptools.org/show_bug.cgi?id=2585 98 99 <LI> tools/tiffcrop.c: fix multiple uint32 overflows in 100 writeBufferToSeparateStrips(), writeBufferToContigTiles() and 101 writeBufferToSeparateTiles() that could cause heap buffer 102 overflows. Reported by Henri Salo from Nixu Corporation. 103 Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592 104 105 <LI> libtiff/tif_strip.c: make TIFFNumberOfStrips() return the 106 td->td_nstrips value when it is non-zero, instead of 107 recomputing it. This is needed in TIFF_STRIPCHOP mode where 108 td_nstrips is modified. Fixes a read outsize of array in 109 tiffsplit (or other utilities using TIFFNumberOfStrips()). 110 Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 111 (CVE-2016-9273) 112 113 <LI> libtiff/tif_predict.h, libtiff/tif_predict.c: Replace 114 assertions by runtime checks to avoid assertions in debug 115 mode, or buffer overflows in release mode. Can happen when 116 dealing with unusual tile size like YCbCr with 117 subsampling. Reported as MSVR 35105 by Axel Souchet & Vishal 118 Chauhan from the MSRC Vulnerabilities & Mitigations 119 120 <LI> libtiff/tif_dir.c: discard values of SMinSampleValue and 121 SMaxSampleValue when they have been read and the value of 122 SamplesPerPixel is changed afterwards (like when reading a 123 OJPEG compressed image with a missing SamplesPerPixel tag, and 124 whose photometric is RGB or YCbCr, forcing SamplesPerPixel 125 being 3). Otherwise when rewriting the directory (for example 126 with tiffset, we will expect 3 values whereas the array had 127 been allocated with just one), thus causing a out of bound 128 read access. Fixes 129 http://bugzilla.maptools.org/show_bug.cgi?id=2500 130 (CVE-2014-8127, duplicate: CVE-2016-3658) 131 132 <LI> libtiff/tif_dirwrite.c: avoid null pointer dereference on 133 td_stripoffset when writing directory, if FIELD_STRIPOFFSETS 134 was artificially set for a hack case in OJPEG case. Fixes 135 http://bugzilla.maptools.org/show_bug.cgi?id=2500 136 (CVE-2014-8127, duplicate: CVE-2016-3658) 137 138 <LI> libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to 139 read floating point images. 140 141 <LI> libtiff/tif_predict.c (PredictorSetup): Enforce 142 bits-per-sample requirements of floating point predictor (3). 143 Fixes CVE-2016-3622 "Divide By Zero in the tiff2rgba tool." 144 145 <LI> libtiff/tif_pixarlog.c: fix out-of-bounds write vulnerabilities 146 in heap allocated buffers. Reported as MSVR 35094. Discovered by 147 Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 148 Mitigations team. 149 150 <LI> libtiff/tif_write.c: fix issue in error code path of 151 TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp 152 members. I'm not completely sure if that could happen in 153 practice outside of the odd behaviour of t2p_seekproc() of 154 tiff2pdf). The report points that a better fix could be to 155 check the return value of TIFFFlushData1() in places where it 156 isn't done currently, but it seems this patch is enough. 157 Reported as MSVR 35095. Discovered by Axel Souchet & Vishal 158 Chauhan & Suha Can from the MSRC Vulnerabilities & Mitigations 159 team. 160 161 <LI> libtiff/tif_pixarlog.c: Fix write buffer overflow in 162 PixarLogEncode if more input samples are provided than 163 expected by PixarLogSetupEncode. Idea based on 164 libtiff-CVE-2016-3990.patch from 165 libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with 166 different and simpler check. (bugzilla #2544) 167 168 <LI> libtiff/tif_read.c: Fix out-of-bounds read on memory-mapped 169 files in TIFFReadRawStrip1() and TIFFReadRawTile1() when 170 stripoffset is beyond tmsize_t max value (reported by Mathias 171 Svensson) 172 173 <LI> libtiff/tif_read.c: make TIFFReadEncodedStrip() and 174 TIFFReadEncodedTile() directly use user provided buffer when 175 no compression (and other conditions) to save a memcpy() 176 177 <LI> libtiff/tif_write.c: make TIFFWriteEncodedStrip() and 178 TIFFWriteEncodedTile() directly use user provided buffer when 179 no compression to save a memcpy(). 180 181 <LI> libtiff/tif_luv.c: validate that for COMPRESSION_SGILOG and 182 PHOTOMETRIC_LOGL, there is only one sample per pixel. Avoid 183 potential invalid memory write on corrupted/unexpected images 184 when using the TIFFRGBAImageBegin() interface (reported by 185 Clay Wood) 186 187 <LI> libtiff/tif_pixarlog.c: fix potential buffer write overrun in 188 PixarLogDecode() on corrupted/unexpected images (reported by 189 Mathias Svensson) (CVE-2016-5875) 190 191 <LI> libtiff/libtiff.def: Added _TIFFMultiply32 and 192 _TIFFMultiply64 to libtiff.def 193 194 <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Add a '1' to the 195 HAVE_SNPRINTF definition. 196 197 <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Applied patch by 198 Edward Lam to define HAVE_SNPRINTF for Visual Studio 2015. 199 200 <LI> libtiff/tif_dirread.c: when compiled with DEFER_STRILE_LOAD, 201 fix regression, introduced on 2014-12-23, when reading a 202 one-strip file without a StripByteCounts tag. GDAL #6490 203 204 <LI> libtiff/*: upstream typo fixes (mostly contributed by Kurt 205 Schwehr) coming from GDAL internal libtiff 206 207 <LI> libtiff/tif_fax3.h: make Param member of TIFFFaxTabEnt 208 structure a uint16 to reduce size of the binary. 209 210 <LI> libtiff/tif_read.c, tif_dirread.c: fix indentation issues 211 raised by GCC 6 -Wmisleading-indentation 212 213 <LI> libtiff/tif_pixarlog.c: avoid zlib error messages to pass a 214 NULL string to %s formatter, which is undefined behaviour in 215 sprintf(). 216 217 <LI> libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode() 218 triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif 219 (bugzilla #2508) 220 221 <LI> libtiff/tif_luv.c: fix potential out-of-bound writes in 222 decode functions in non debug builds by replacing assert()s by 223 regular if checks (bugzilla #2522). Fix potential 224 out-of-bound reads in case of short input data. 225 226 <LI> libtiff/tif_getimage.c: fix out-of-bound reads in 227 TIFFRGBAImage interface in case of unsupported values of 228 SamplesPerPixel/ExtraSamples for LogLUV / CIELab. Add explicit 229 call to TIFFRGBAImageOK() in TIFFRGBAImageBegin(). Fix 230 CVE-2015-8665 reported by limingxing and CVE-2015-8683 231 reported by zzf of Alibaba. 232 233 <LI> libtiff/tif_dirread.c: workaround false positive warning of 234 Clang Static Analyzer about null pointer dereference in 235 TIFFCheckDirOffset(). 236 237 <LI> libtiff/tif_fax3.c: remove dead assignment in 238 Fax3PutEOLgdal(). Found by Clang Static Analyzer 239 240 <LI> libtiff/tif_dirwrite.c: fix truncation to 32 bit of file 241 offsets in TIFFLinkDirectory() and TIFFWriteDirectorySec() 242 when aligning directory offsets on a even offset (affects 243 BigTIFF). This was a regression of the changeset of 244 2015-10-19. 245 246 <LI> libtiff/tif_write.c: TIFFWriteEncodedStrip() and 247 TIFFWriteEncodedTile() should return -1 in case of failure of 248 tif_encodestrip() as documented 249 250 <LI> libtiff/tif_dumpmode.c: DumpModeEncode() should return 0 in 251 case of failure so that the above mentionned functions detect 252 the error. 253 254 <LI> libtiff/*.c: fix MSVC warnings related to cast shortening and 255 assignment within conditional expression 256 257 <LI> libtiff/*.c: fix clang -Wshorten-64-to-32 warnings 258 259 <LI> libtiff/tif_dirread.c: prevent reading ColorMap or 260 TransferFunction if BitsPerPixel > 24, so as to avoid huge 261 memory allocation and file read attempts 262 263 <LI> libtiff/tif_dirread.c: remove duplicated assignment (reported 264 by Clang static analyzer) 265 266 <LI> libtiff/tif_dir.c, libtiff/tif_dirinfo.c, 267 libtiff/tif_compress.c, libtiff/tif_jpeg_12.c: suppress 268 warnings about 'no previous declaration/prototype' 269 270 <LI> libtiff/tiffiop.h, libtiff/tif_dirwrite.c: suffix constants 271 by U to fix 'warning: negative integer implicitly converted to 272 unsigned type' warning (part of -Wconversion) 273 274 <LI> libtiff/tif_dir.c, libtiff/tif_dirread.c, 275 libtiff/tif_getimage.c, libtiff/tif_print.c: fix -Wshadow 276 warnings (only in libtiff/) 277 278</UL> 279 280<P><HR WIDTH=65% ALIGN=left> 281 282<!--------------------------------------------------------------------------> 283 284<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A> 285 286<UL> 287 288 <LI> tools/Makefile.am: The libtiff tools bmp2tiff, gif2tiff, 289 ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed 290 from the distribution. The libtiff tools rgb2ycbcr and 291 thumbnail are only built in the build tree for testing. Old 292 files are put in new 'archive' subdirectory of the source 293 repository, but not in distribution archives. These changes 294 are made in order to lessen the maintenance burden. 295 296 <LI> tools/tiff2pdf.c: avoid undefined behaviour related to 297 overlapping of source and destination buffer in memcpy() call 298 in t2p_sample_rgbaa_to_rgb() Fixes 299 http://bugzilla.maptools.org/show_bug.cgi?id=2577 300 301 <LI> tools/tiff2pdf.c: fix potential integer overflows on 32 bit 302 builds in t2p_read_tiff_size() Fixes 303 http://bugzilla.maptools.org/show_bug.cgi?id=2576 304 305 <LI> tools/fax2tiff.c: fix segfault when specifying -r without 306 argument. Patch by Yuriy M. Kaminskiy. Fixes 307 http://bugzilla.maptools.org/show_bug.cgi?id=2572 308 309 <LI> tools/tiffinfo.c: fix out-of-bound read on some tiled images. 310 (http://bugzilla.maptools.org/show_bug.cgi?id=2517) 311 312 <LI> tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in 313 readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel 314 Souchet & Vishal Chauhan from the MSRC Vulnerabilities & 315 Mitigations team. 316 317 <LI> tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on 318 JPEG compressed images. Reported by Tyler Bohan of Cisco Talos 319 as TALOS-CAN-0187 / CVE-2016-5652. Also prevents writing 2 320 extra uninitialized bytes to the file stream. 321 322 <LI> tools/tiffcp.c: fix out-of-bounds write on tiled images with odd 323 tile width vs image width. Reported as MSVR 35103 324 by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 325 Mitigations team. 326 327 <LI> tools/tiff2pdf.c: fix read -largely- outsize of buffer in 328 t2p_readwrite_pdf_image_tile(), causing crash, when reading a 329 JPEG compressed image with TIFFTAG_JPEGTABLES length being 330 one. Reported as MSVR 35101 by Axel Souchet and Vishal 331 Chauhan from the MSRC Vulnerabilities & Mitigations team. 332 333 <LI> tools/tiffcp.c: fix read of undefined variable in case of 334 missing required tags. Found on test case of MSVR 35100. 335 336 <LI> tools/tiffcrop.c: fix read of undefined buffer in 337 readContigStripsIntoBuffer() due to uint16 overflow. Probably 338 not a security issue but I can be wrong. Reported as MSVR 339 35100 by Axel Souchet from the MSRC Vulnerabilities & 340 Mitigations team. 341 342 <LI> tools/tiffcrop.c: fix various out-of-bounds write 343 vulnerabilities in heap or stack allocated buffers. Reported 344 as MSVR 35093, MSVR 35096 and MSVR 35097. Discovered by Axel 345 Souchet and Vishal Chauhan from the MSRC Vulnerabilities & 346 Mitigations team. 347 348 <LI> tools/tiff2pdf.c: fix out-of-bounds write vulnerabilities in 349 heap allocate buffer in t2p_process_jpeg_strip(). Reported as 350 MSVR 35098. Discovered by Axel Souchet and Vishal Chauhan from 351 the MSRC Vulnerabilities & Mitigations team. 352 353 <LI> tools/tiff2bw.c: fix weight computation that could result of 354 color value overflow (no security implication). Fix bugzilla 355 #2550. Patch by Frank Freudenberg. 356 357 <LI> tools/rgb2ycbcr.c: validate values of -v and -h parameters to 358 avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569) 359 360 <LI> tools/tiffcrop.c: Fix out-of-bounds write in loadImage(). 361 From patch libtiff-CVE-2016-3991.patch from 362 libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla 363 #2543) 364 365 366 <LI> tools/tiff2rgba.c: Fix integer overflow in size of allocated 367 buffer, when -b mode is enabled, that could result in 368 out-of-bounds write. Based initially on patch 369 tiff-CVE-2016-3945.patch from libtiff-4.0.3-25.el7_2.src.rpm 370 by Nikola Forro, with correction for invalid tests that 371 rejected valid files. (bugzilla #2545) 372 373 <LI> tools/tiffcrop.c: Avoid access outside of stack allocated 374 array on a tiled separate TIFF with more than 8 samples per 375 pixel. Reported by Kaixiang Zhang of the Cloud Security Team, 376 Qihoo 360 (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / 377 #2559) 378 379 <LI> tools/tiffdump.c: fix a few misaligned 64-bit reads warned by 380 -fsanitize 381 382</UL> 383 384<P><HR WIDTH=65% ALIGN=left> 385 386<!---------------------------------------------------------------------------> 387 388<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A> 389 390<UL> 391 392 <LI> None 393 394</UL> 395 396Last updated $Date: 2016-11-12 18:30:47 $. 397 398</BODY> 399</HTML> 400