2018-02-09 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dib.c (ReadDIBImage): Validate that image width is not too negative such that it's absolute value can not fit in 32-bit unsigned width. Resolves oss-fuzz issue 6179 "graphicsmagick/coder_ICO_fuzzer: Integer-overflow in ReadDIBImage". (Credit to OSS-Fuzz)
- coders/dcm.c (funcDCM_BitsStored): Validate DICOM datum size. Use a different means to determine the maximum value which does not use excessive shifting. Resolves oss-fuzz issue 6165 "graphicsmagick/coder_DCM_fuzzer: Undefined-shift in funcDCM_BitsStored". (Credit to OSS-Fuzz)
2018-02-08 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dpx.c (ReadWordU32BE): Add casts to avoid default type promotion from unsigned char to 'int' leading to undefined behavior for 24 bit shift. Fixes oss-fuzz issue 6058 "graphicsmagick/coder_DPX_fuzzer: Undefined-shift in ReadWordU32BE". (Credit to OSS-Fuzz) (ReadDPXImage): Require that the file has at least one element. Add bountiful casts for values which are left-shifted. Fixes oss-fuzz issue 5962 "graphicsmagick/coder_DPX_fuzzer: Undefined-shift in ReadDPXImage". (Credit to OSS-Fuzz)
- coders/dcm.c (DCM_ReadOffsetTable): Add casts Add casts to avoid default type promotion from unsigned char to 'int' leading to undefined behavior for 16 bit shift. Fixes oss-fuzz issue 5980 "graphicsmagick/coder_DCM_fuzzer: Undefined-shift in DCM_ReadOffsetTable". (Credit to OSS-Fuzz)
- magick/module_aliases.h (ModuleAliases): Add missing mapping from "ICODIB" format to "DIB" module.
- magick/import.c (ImportUInt32Quantum): Add casts to avoid default type promotion from unsigned char to 'int' leading to undefined behavior for 24 bit shift. Fixes oss-fuzz "graphicsmagick/coder_P7_fuzzer: Undefined-shift in ImportRGBQuantumType". (Credit to OSS-Fuzz)
2018-02-07 Fojtik Jaroslav <JaFojtik@seznam.cz>
coders/wpg.c Fix oss-fuzz issue 5964 "graphicsmagick/coder_MAT_fuzzer: Heap-use-after-free in GetLocaleExceptionMessage". (Credit to OSS-Fuzz)
Greg Wolfe <gregory.wolfe@kodakalaris.com>
magick/render.c (IsPoint): Fixed a bug in which IsPoint() would reject as a valid coordinate value strings that did not begin with an integer: e.g., "0.25" would be accepted, but ".25" would not.
2018-02-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/cut.c (ReadCUTImage): Fix DestroyImageInfo() of NULL pointer leading to assertion. Fixes oss-fuzz issue 6067 "graphicsmagick/coder_CUT_fuzzer: Unknown signal in DestroyImageInfo".
- coders/tga.c (ReadTGAImage): Throw exception rather than assertion for unexpected comment size. Fixes oss-fuzz issue 5961 "graphicsmagick/coder_ICB_fuzzer: ASSERT: (size_t) (tga_info.id_length+1) == commentsize".
2018-02-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pdf.c (WritePDFImage): Free 'xref' allocation before error return. Fixes oss-fuzz issue 5968 "graphicsmagick/coder_EPDF_fuzzer: Direct-leak in MagickRealloc".
2018-02-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pdb.c (ReadPDBImage): Fix heap buffer overflow if blob is already at EOF when comment is read. Fixes oss-fuzz issue 5997 "graphicsmagick/coder_PDB_fuzzer: Heap-buffer-overflow in SetImageAttribute".
- coders/dpx.c (ReadDPXImage): Fix memory leak of user data if user data is truncated. Fix consumption of one uninitialized stack bytes. Fixes oss-fuzz issue 5973: graphicsmagick/enhance_fuzzer: Direct-leak in ReadDPXImage.
- coders/pnm.c (ReadPNMImage): Detect and avoid division by zero. Fixes Issue 5959 in oss-fuzz: graphicsmagick/coder_P7_fuzzer: Divide-by-zero in ReadPNMImage
- magick/xwindow.c (MagickXClientMessage): Eliminate valgrind gripe about use of uninitialized stack data by clearing allocation to zero. (MagickXMakeImage): Eliminate valgrind gripe about use of uninitialized heap data by clearing allocation to zero.
- coders/pwp.c (ReadPWPImage): Remove bogus EOF test on an image with a closed blob. Fixes Issue 5957 in oss-fuzz: graphicsmagick/coder_PWP_fuzzer: ASSERT: image->blob->type != UndefinedStream.
- www/Changes.rst: Fix typo with spelling "ChangeLog-2017.html". Resolves SourceForge issue #544 "dead link 2017 changelog page on GraphicsMagick web site".
2018-02-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/static.c (OpenModule): Assure that status is initialized. Resolves Coverity 261207 "Uninitialized scalar variable".
- wand/magick_wand.c (MagickHasColormap): New function to test if the image has a colormap. (MagickIsGrayImage): New function to test if the image uses only gray pixels. (MagickIsMonochromeImage): New function to test if the image uses only monochrome pixels. (MagickIsOpaqueImage): New function to test if the image uses only opaque pixels. (MagickIsPaletteImage): New function to test if the image is based on a color palette. Above functions are written by Troy Patteson and submitted via SourceForge patch #54 "Wand API patches: has colormap, is gray image, is monochrome image, is opaque image, is palette image".
- fuzzing: Added initial OSS-Fuzz integration by Alex Gaynor. From SourceForge patch #55 "OSS-Fuzz integration"
- coders/png.c (ReadMNGImage): Fix free using possibly unallocated pointer value.
- magick/blob.c (SeekBlob): Remove implicit extension of blob allocation size based on seek offset. Besides making an assumption about how the blob memory was allocated, this reallocation feature provides a memory DOS opportunity. Resolves issue reported by Alex Gaynor via email entitled "Security issue with memory management in Magick++" to the graphicsmagick-security list on 31 Jan 2018. (SeekBlob):
- coders/jpeg.c (ReadIPTCProfile): Revert inadvertent wrong return codes added by change on December 9, 2017. Fixes SourceForge bug 542 "Improper call to JPEG library in state 201" since 1.3.28.
2018-02-01 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- magick/annotate.c (RenderFreetype): Fixed the text opacity computation in RenderFreeType(). This bug caused the text fill color to bleed into the character cell when the SVG "fill-opacity" is less than 1.0.
2018-02-01 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- magick/attribute.c (CloneImageAttributes): Fixed a bug in which the source image attributes would always replace the destination image attributes instead of being appended to them, and the destination image attributes would become a memory leak.
2018-01-31 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- coders/svg.c (SVGStartElement): Fixed a bug in which the x,y location values for a <text> or <tspan> were overwritten by the x,y values for the next <tspan> before the previous values were used. This caused the text associated with the previous <text> or <tspan> to appear at the location specified for the next <tspan>.
2018-01-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/static.c: Use !defined(SupportMagickModules) to enable static module loader. Fixes SourceForge bug #543 "Multiple definition of "OpenModule" (etc) when cross-compiling shared".
2018-01-29 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- coders/svg.c (SVGStartElement): A terminating '>' in a geometry string is interpreted to mean that the dimensions of an image should only be changed if its width or height exceeds the geometry specification. For an unapparent and undocumented reason, a terminating '>', if present, was being nulled out, making this feature unusable for SVG files (now fixed).
2018-01-29 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- coders/svg.c (ReadSVGImage): If there is a geometry string in image_info->size (e.g., gm convert -size "50x50%" in.svg out.png), AllocateImage() sets image->columns and image->rows to the width and height values from the size string. However, this makes no sense if the size string was something like "50x50%" (we'll get columns = rows = 50). So we set columns and rows to 0 after AllocateImage(), which is the same as if no size string was supplied by the client. This also results in svg_info.bounds to be set to 0,0 (i.e., unknown), so that svg_info.bounds will later be set using the image size information from either the svg "canvas" width/height or from the viewbox. Later, variable "page" is set from svg_info->bounds. Then the geometry string in image_info->size gets applied to the (now known) "page" width and height when SvgStartElement() calls GetMagickGeometry(), and the intended result is obtained.
2018-01-24 Greg Wolfe <gregory.wolfe@kodakalaris.com>
- coders/svg.c (SVGStartElement): When the density (DPI) is specified using the ImageInfo::density member, the derived scale factor is incorrectly applied a second time to the width and height members of variable RectangleInfo page. Fixes SourceForge ticket #451.
2018-01-23 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/static.c: Use a lazy-loader for static modules with the same external interface as the lazy-loader for dynamic modules.
2018-01-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Prepare for 1.3.28 release.
2018-01-17 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Update with changes since previous release.
2018-01-14 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- PerlMagick/Magick.xs: Compiler warnings reduction.
- magick/pixel_cache.h: Mark GetPixels(), GetIndexes(), and GetOnePixel() as deprecated. Compilers may produce a warning if these functions are used.
- magick/pixel_cache.c (InterpolateColor): Return black pixel if InterpolateViewColor() reports failure.
- coders/png.c (ReadMNGImage): Fix memory leak of chunk and mng_info in error path.
- coders/gif.c (ReadGIFImage): Fix memory leak of global colormap.
2018-01-13 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/symbols.h: Fix SourceForge issue #538 "13 symbols in common with ImageMagick despite --enable-symbol-prefix".
- coders/bmp.c (ReadBMPImage): Fix non-terminal loop due to unexpected bit-field mask value. Fixes SourceForge issue #541 "Infinite Loop in ReadBMPImage (coders/bmp.c)".
- coders/jpeg.c (JPEGMessageHandler): Revert code added on 2017-07-08 to promote certain warnings from libjpeg to errors. Add code to rationalize claimed image dimensions based on file size. Resolves SourceForge issue #539 "Images with libjpeg warnings result in error".
2018-01-11 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/wpg.c Recursive ReadImage could return multiple scenes
- fixed.
2018-01-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOnePNGImage): Quit 'passes' loop if we encountered an error
- magick/pixel_cache.c (SetNexus): Fix heap overwrite in AcquireCacheNexus() due to SetNexus() not using an allocated staging area for the pixels like it should. This problem impacts all 1.3.X releases. Resolves SourceForge issues 532 "heap-buffer-overflow bug in ReadWPGImage" and #531 "heap-buffer-overflow in AcquireCacheNexus".
- magick/pixel_cache.c (InterpolateViewColor): Now returns MagickPassFail rather than void. Code using this function is updated to check the return status.
2018-01-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/describe.c (DescribeImage): Discriminate between AcquireImagePixels() returning NULL or finding a transparent pixel. This avoids use of a null pointer in the case where AcquireImagePixels() returns NULL.
2017-12-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/static.c: Change static module initialization to be based on an initialized list rather than a squence of function calls in order to simplify maintenance and possibly address future requirements.
2017-12-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- Copyright.txt: Bump copyright years and rotate ChangeLog.