2017-11-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/sfw.c (SFWScan): Fix heap buffer overflow (CVE-2017-13134). Notified of problem via email (including a patch) from Petr Gajdos on Mon, 6 Nov 2017.
2017-11-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/export.c: Add not-null check for indexes pointer where needed.
- magick/import.c: Add not-null check for indexes pointer with associated exception report where the indexes pointer is needed. (ImportCMYKQuantumType): Was wrongly importing an opacity channel in some cases. Would have crashed if these cases were ever used.
- coders/wpg.c (ReadWPGImage): Assure that colormapped image is a PseudoClass type with valid colormapped indexes. Fixes SourceForge bug 519 "Null Pointer Dereference (Write) with malformed WPG Image".
2017-10-28 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/render.c (DrawImage): Fix SourceForge bug #517 "Push operations in DrawImage can lead to negative strncpy when looking for pop". Interestingly, valgrind and ASAN only detected a problem with one of the test cases since exercised code which updated an array using the index. It appears that Linux strncpy() simply ignores the bad request.
2017-10-27 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOneJNGImage): Make sure that a reasonable exception is reported to the user when there is a read failure.
2017-10-26 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOneJNGImage): Reject JNG files with unreasonable dimensions given the file size.
2017-10-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOneJNGImage): Fix SourceForge bug #518 "Null pointer in". Also make sure that errors are reported properly due to problems with transferring JPEG scanlines. (ReadOneJNGImage): Add more checks for null value returned from SetImagePixels().
2017-10-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/describe.c (DescribeImage): Fix possible heap read overflow while accessing heap data, and possible information disclosure while describing the IPTC profile. Report was provided via email from Maor Shwartz to the graphicsmagick-security mail alias on Thu, 19 Oct 2017. Independent security researchers, Jeremy Heng (@nn_amon) and Terry Chia (Ayrx), reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Please note that this interface is usually (but not exclusively) used from within the command-line utility program, in which case there is not much useful information which might be disclosed. (DescribeImage): Fix possible heap write overflow when describing visual image directory. Report was provided via email from Maor Shwartz to the graphicsmagick-security mail alias on Thu, 19 Oct 2017. Independent security researchers, Jeremy Heng (@nn_amon) and Terry Chia (Ayrx), reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Please note that this interface is usually (but not exclusively) used from within the command-line utility program, in which case the only harm would be a program crash.
2017-10-14 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/studio.h (NumberOfObjectsInArray): The NumberOfObjectsInArray() macro is used to compute the number of whole objects in an array. Instead it was rounding up, resulting in scrambling the heap beyond the allocation. Fixes CVE-2017-13737 "There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack."
2017-10-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dcm.c (ReadDCMImage): Fix SourceForge issue #512 "NULL Pointer Dereference in DICOM Decoder".
- coders/pict.c (ReadPICTImage): Fix SourceForge issue #511 "Memory Allocation error due to malformed image file".
2017-09-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/gif.c (WriteGIFImage): Fix SourceForge issue #491 "memory leak in WriteGIFImage".
2017-09-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/rle.c (ReadRLEImage): Fix SourceForge issue #458 "Heap out of bounds read in ReadRLEImage()".
2017-09-16 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pnm.c (ReadPNMImage): Require that XV 332 format have 256 colors. Fixes SourceForge issue #465 "NULL Pointer Dereference triggered by malformed file". In our own testing the test case produced an assertion failure because assertions were enabled.
- magick/colormap.c (AllocateImageColormap): Use unsigned array index.
2017-09-10 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/wpg.c (InsertRow): Fix crash which occurs if image is not PseudoClass but a PseudoColor scanline is needed. Resolves SourceForge issue #449 "Null pointer dereference in InsertRow()".
- magick/render.c (DrawImage): Fix SourceForge issue #448 "Heap out of bounds read in DrawDashPolygon()". Problem was reported by Kamil Frankowicz on August 28, 2017.
2017-08-27 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c (ReadOneJNGImage): Fix for SourceForge issue "#440 use-after-free in CloseBlob (blob.c) (INCOMPLETE FIX FOR CVE-2017-11403)" and SourceForge issue #438 "heap use after free in CloseBlob".
2017-08-26 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/xbm.c (ReadXBMImage): Fix two denial of service (DOS) issues in ReadXBMImage() which result in the reader not returning. Problem was reported via email on Wed Aug 23 2017 by Xiaohei and Wangchu from Alibaba Security Team.
- coders/jnx.c (ReadJNXImage): Fix denial of service (DOS) issue in ReadJNXImage() whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests. Problem was reported via email on Wed Aug 23 2017 by Xiaohei and Wangchu from Alibaba Security Team.
2017-08-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pnm.c (ReadPNMImage): Verify that sufficient file data exists to support what the file header requires before allocating memory for it. Fixes problem reported by Agostino Sarubbo via email on Wed, 12 Jul 2017 and reported yet again via SourceForge bug #441 "memory allocation failure in MagickRealloc".
2017-08-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/sun.c (ReadSUNImage): Fix failure to allocate memory due to inadequate file data to support claimed image width and height. First notified by email from Agostino Sarubbo on 14 Jul 2017 and then again as SourceForge bug #442 "memory allocation failure in magickmalloc".
2017-08-16 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/svg.c (GetStyleTokens): Fix SourceForge bugs 434 "heap buffer overflow in GetStyleTokens", 435 "null pointer dereference_in_SVGStartElement", and 436 "heap buffer overflow in GetStyleTokens" which all originated from a heap buffer overflow in GetStyleStokens(), or inconsistent initialization. Now the implementation truncates parsing for poorly-formed input (to avoid buffer overflow) while still correctly parsing well-formed input. The reproducers and problem reports are attributed to "ADLab of Venustech".
2017-08-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/gif.c (ReadGIFImage): Assure that global colormap is initialized.
2017-07-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/sun.c: Fix heap read overflow while indexing into colormap. Problem was reported via email on 17 Jul 2017 by Agostino Sarubbo.
2017-07-31 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c (ReadMNGImage): Stop a leak when rejecting a MNG image with dimensions that are too large.
2017-07-26 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/wmf.c (ReadWMFImage): Eliminate use of already freed heap data in error reporting path. Problem was reported via email by Agostino Sarubbo on Fri, 14 Jul 2017
2017-07-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pcl.c (WritePCLImage): Fix null pointer dereference in PCL writer when writing monochrome images. Problem was reported by LCatro via email on July 18.
- magick/pixel_cache.c (PersistCache): Fix memory leak while writing a MPC file. Problem was reported by LCatro via email on July 18.
- coders/map.c (WriteMAPImage): Fix null pointer dereference or segmentation violation in the MAP writer if the input image is not already colormapped. Problem was reported by LCatro via email on July 18.
2017-07-08 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/jpeg.c (ReadJPEGImage): Defer creating pixel cache until after successfully reading first scanline. Classify some serious libjpeg reported "warnings" as errors and quit processing scanlines immediately upon first error so that corrupt JPEG does not consume excessive resources. Resolves excessive resource consumption issue reported for two JPEG files provided via email by LCatro on Tue, 4 Jul 2017.
2017-07-08 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOneJNGImage): Fix double-frees caused by commit on 2017-07-06.
2017-07-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Make sure is up to date.
- www/index.rst: Update for 1.3.26 release.
- version.sh: Update library versioning for 1.3.26 release.
- magick/command.c (BatchCommand): Add ferror() checks around batch input loop.
2017-07-03 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Reject a PNG file if the file size is too small (less than 61 bytes). Reject a JNG file if it is too small (less than 147 bytes).
- coders/jpeg.c: Reject a JPEG file if the file size is too small (less than 107 bytes).
2017-07-02 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dpx.c (ReadDPXImage): Compute required file size and verify that sufficient data exists in file before allocating memory to decode the image data. Resolves problem with DPX file with valid header (but a huge claimed image width) provided provided via email on Thu, 29 Jun 2017 by LCatro. This issue has been assigned CVE-2017-10799.
2016-07-02 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Check whether reported object size overflows file size.
2016-07-01 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Safety check for forged and or corrupted data. This issue has been assigned CVE-2017-10800.
2017-07-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/tiff.c ("QuantumTransferMode"): Use a generalized method to enforce that buffer overflow can not happen while importing pixels. Resolves problem with RGB TIFF claiming only one sample per pixel provided via email on Thu, 29 Jun 2017 by LCatro. This issue has been assigned CVE-2017-10794.
2017-06-29 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/command.c: Convert bare 'unsigned int' to MagickPassFail where suitable to make intentions clear. Convert True/False to MagickTrue/MagickFalse or MagickPass/MagickFail according to purpose. This is a continuation of a gradual migration and does not represent an API change.
2017-06-25 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Avoid NULL dereference when MAGN chunk processing fails (https://sourceforge.net/p/graphicsmagick/bugs/426/). Expand TABs.
2017-06-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Update NEWS with changes since the previous release.
- www/programming.rst: Switch the Lua link to https://github.com/arcapos/luagraphicsmagick, which is a more complete and direct interface from Lua to GraphicsMagick's Wand API.
2017-06-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- VisualMagick/installer/gm-foo-dll.iss: Remove PerlMagick from the slim Inno Setup installer builder and remove mention of PerlMagick from the installer documentation.
- TclMagick/generic/TclMagick.c (magickCmd): Resolve SourceForge patch #51 "TclMagick: memory access error; possible segfault". (newMagickObj): Fix formatting of pointer value so it is 64-bit safe. Resolves SourceForge patch #50 "TclMagick: 64-bit portability issue".
- coders/pict.c (ReadPICTImage): Avoid possible use of negative value when indexing array, which would cause buffer overflow. Resolves SourceForge issue #427 "One possible buffer overflow vulnerability in GraphicsMagick-1.3.25/coders/pict.c:ReadPICTImage()".
2017-06-22 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Stop memory leak when reading invalid JNG image. Fixes CVE-2017-8350.
2017-06-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c: Fix lcms2.h inclusion logic.
- wand/magick_wand.c (MagickSetImageOrientation): Eliminate use of snprintf, which is not supported by older Visual Studio.
2017-06-09 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Accept exIf chunks whose data segment erroneously begins with "Exif00".
2017-06-01 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Removed experimental zxIF chunk support. That proposal is dead.
2017-05-27 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- config/log.mgk: Added documentation suggested by SourceForge issue #419 "Consider a small patch to log.mgk".
- www/Changes.rst: Add missing link to most recent changes.
2017-05-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- www/Magick++/Image.rst: Improve documentation for Magick++ Image::iccColorProfile() and Image::renderingIntent().
2017-05-21 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- tiff: Update to libtiff 4.0.8.
2017-03-19 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Quieted a new Coverity complaint about a potential text buffer overrun.
2017-03-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/image.c (SetImageInfo): Ignore empty magic prefix specification and do not remove colon character from start of filename. Resolves SourceForge bug #415 "Inconsistent Behavior w/ input_file Parameter".
2017-03-18 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Added new private orNT PNG chunk, to preserve image->orientation when it is defined and not the default TopLeft.
- coders/jpeg.c: Mention image->orientation in the log when writing a JPEG.
2017-03-15 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c (WriteOnePNGImage): Add version info about gm, libpng, zlib, and lcms to the PNG debug log.
2017-03-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/command.c (ImportImageCommand): Fix handling of -frame options. Option handling was incorrect due to option checking the frame option after it had been freed. Checking the frame dash option before freeing the argument solves the problem. From patch provided by Victor Ananjevsky as SourceForge patch #49 "-frame doesn't work in gm import".
- Magick++/lib/Image.cpp (attribute): Added Image attribute method which accepts a 'char *' argument, and will remove the attribute if the value argument is NULL. From patch provided by "Gints" as SourceForge patch #46 "C++ api - method to clear/remove attribute".
- VisualMagick/configure/configure.cpp (InitInstance): Applied patch by Paul McConkey to allow the quantum command line argument to set the default value in the wizard drop list. This allows setting the quantum depth when the /nowizard argument was supplied. Resolves SourceForge patch #48 "When running from the command line configure.exe does not use the quantum argument". The provided configure.exe still needs to be rebuilt to incorporate this change.
- magick/command.c (MogrifyImage): The -orient command now also updates the orientation in the EXIF profile, if it exists.
- Magick++/lib/Image.cpp (orientation): Update orientation in EXIF profile, if it exists.
2017-03-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/jp2.c: Support PGX JPEG 2000 format for reading and writing (within the bounds of what JasPer supports).
2017-02-23 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/tiff.c (QuantumTransferMode): Fix out of bounds read when reading CMYKA TIFF which claims to have only 2 samples per pixel. Problem was reported via email on February 15, 2017 by Valon Chu. This issue was assigned CVE-2017-6335.
2017-01-29 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- doc/options.imdoc (-geometry): Geometry documentation changes suggested by Jon Wong.
2017-01-26 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Added support for a proposed new PNG chunk (zxIf, read-only) that is currently being discussed on the png-mng-misc at lists.sourceforge.net mailing list. Enable exIf and zxIf with CPPFLAGS="-DexIf_SUPPORTED -DxzIf_SUPPORTED". If exIf is enabled, only the uncompressed exIF chunk will be written and the hex-encoded zTXt chunk containing the raw Exif profile won't be written.
2017-01-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/msl.c (MSLStartElement): Change test for NULL image pointer to before it is used rather than after it is used. Problem reported by Petr Gajdos on 2017-01-25.
2017-01-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- TclMagick/unix/m4/tcl.m4: Update tcl.m4 to TEA 3.10. File supplied by Massimo Manghi.
2017-01-21 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Added support for a proposed new PNG chunk (exIf read-write, eXIf read-only) that is currently being discussed on the png-mng-misc at lists.sourceforge.net mailing list.
2017-01-21 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- coders/png.c: Added read_user_chunk_callback() function and used it to implement a private PNG caNv (canvas) chunk for remembering the original dimensions and offsets when an image is cropped. Previously we used the oFFs chunk for this purpose, but this had potential conflicts with other applications that also use the oFFs chunk.
2017-01-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- TclMagick/Makefile.am (AM_DISTCHECK_CONFIGURE_FLAGS): Applied patch by Massimo Manghi to set AM_DISTCHECK_CONFIGURE_FLAGS so that 'make distcheck' remembers configuration options, and also to uninstall pkgIndex.tcl.
- magick/image.c (SetImageEx): Use PixelIterateMonoSet() for possibly improved efficiency.
- magick/pixel_iterator.c (PixelIterateMonoSet): New pixel iterator intended for use when initializing image pixels, without regard to existing values.
2017-01-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- Copyright.txt: Bump copyright years and rotate ChangeLog.