2016-05-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
config/delegates.mgk.in: Gnuplot files are inherently insecure. Remove delegates support for reading them. Reported by John Lightsey via private email.
Added -dSAFER to Ghostscript invokations in delegates.mgk for more secure execution. Reported by David Chan via SourceForge bug "#386 ghostscript delegates should explicitly use -dSAFER.".
magick/constitute.c (ReadImages): Avoid possible infinite ReadImage() recursion.
2016-05-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/render.c (DrawPolygonPrimitive): Fix divide by zero exception encountered while reading file "sigfpe.svg" posted by Gustavo Grieco on May 1, 2016 to the oss-security mailing list with subject "CVE request: DoS in multiple versions of GraphicsMagick". (DrawDashPolygon): Fix endless loop problem caused by negative stroke-dasharray arguments. Resolves problem observed while reading file "circular.svg" posted by Gustavo Grieco on May 1, 2016 to the oss-security mailing list with subject "CVE request: DoS in multiple versions of GraphicsMagick".
- magick/import.c (ImportViewPixelArea): Fix assertion while reading TIFF file gkkxrilssm.tiff.105123337066 provided by Gustavo Grieco.
2016-04-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/locale.c (ReadLOCALEImage): Make sure to close blob before returning.
- coders/svg.c ("C"): Provide a hack work-around for double-quoted font-family argument.
- magick/render.c (DrawImage): Make SVG path and other primitive parsing more robust. Fixes SEGV when reading files provided by CVE-2016-2318 test cases. Fixes CVE-2016-2318 completely.
2016-04-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/render.c (DrawImage): Fix heap buffer overflow when reading aaphrbkwwe.svg.-1114777018469422437 from CVE-2016-2317 test cases. This resolves CVE-2016-2317 completely.
2016-04-23 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/command.c (MogrifyImageCommand): Added mogrify -preserve-timestamp option to preserve file access and modification timestamps. Contributed by Niko Rosvall via SourceForge patch #45 "preserve-timestamp option for mogrify command."
2016-04-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/blob.c: Added ReadBlobLSBSignedShort(), ReadBlobMSBSignedShort(), ReadBlobLSBSignedLong(),ReadBlobMSBSignedLong(), WriteBlobLSBSignedShort(), WriteBlobLSBSignedLong(), WriteBlobMSBSignedLong(), WriteBlobMSBSignedShort() for doing I/O on signed integer types without the need for dangerous casts or unexpected values due to signed/unsigned conversion.
2016-04-17 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Updated with latest changes.
- magick/constitute.c (ReadImage): Added asserts to check that the I/O blob is not still open in the returned image since this causes problems.
- magick/blob.c (CloneBlobInfo): Use a cloning approach which does not require manually keeping structure members in sync.
- coders/msl.c (ProcessMSLScript): Need to close I/O blob before returning.
- coders/psd.c (ReadPSDImage): Assure that allocated image is not dereferenced before checking if it is NULL. Check some memory calculations for overflow. (ReadPSDImage): Need to close I/O blob before returning.
- coders/dib.c (ReadDIBImage): Use DestroyBlob() rather than DestroyBlobInfo().
- coders/bmp.c (ReadBMPImage): Use DestroyBlob() rather than DestroyBlobInfo().
- magick/blob.c: Improve blob tracing.
2016-04-13 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/bmp.c (ReadBMPImage): Fix reading 24-bit Microsoft BMP which claims to have a colormap.
2016-04-13 Fojtik Jaroslav <JaFojtik@seznam.cz>
- PerlMagick/t/input_complex_lsb_double_V4.mat Demo Matlab V4 complex file.
- coders/mat.c Missing break added.
2016-04-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/xpm.c (ReadXPMImage): Fix SourceForge issue #361 "out-of-bounds read in coders/xpm.c:150:24"
- coders/psd.c (ReadPSDImage): Add some defensive code to assure that image layers are not freed twice.
2016-04-10 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/log.c (InitializeLogInfo): Simplify LogInfo structure and its allocation in order to lessen the amount of fixed overhead.
2016-04-04 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/jp2.c (WriteJP2Image): Fix SourceForge issue #378 "jp2: impossible to create lossless jpeg-2000". With this fix, specifying 'define jp2:rate=1.0' or '-quality 100' results in a lossless JP2 file.
2016-04-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/common.h: Update for GCC 5.
- PerlMagick/MANIFEST: Update PerlMagick manifest.
- PerlMagick/t/{read.t, write.t}: Add tests for MAT v4.
2016-04-03 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Matlab V4 attempt to read complex part of data.
2016-04-02 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- PerlMagick/t/features.pl.in: Provide a way that PerlMagick feature tests can test if a feature is supported. Use it to make the PSD test optional.
- coders/Makefile.am: Only build PSD module if ENABLE_BROKEN_CODERS is enabled.
- magick/module.c (UnloadModule): Only invoke the module unregister function if it is defined. The module register function is not defined if either the register or unregister functions were not found in the module which was loaded.
2016-04-02 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Matlab V4 files are also rotated.
* PerlMagick/t/input_gray_lsb_double_V4.mat Demo Matlab V4 file.
2016-04-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/magick.c (GetMagickInfo): Only declare that ExceptionInfo argument is not used if modules are not supported.
2016-03-28 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Attempt to read Matlab V4 files.
2016-03-27 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/image.c (DestroyImage): Simply return if image is NULL since it is more user-friendly.
- magick/shear.c (RotateImage): Fix Coverity issue 124519 "Logically dead code".
- magick/effect.c (BlurImage): Fix Coverity issue 124520 "Dereference after null check".
- coders/pdb.c (WritePDBImage): Fix SourceForge bug #360 "out-of-bounds read in utilities/gm+0x80fcc71) (PDB reader)".
- coders/meta.c (convertHTMLcodes): Fix SourceForge bug #373 "out-of-bounds read in coders/meta.c:444:50" (ReadMETAImage): Fix SourceForge bug #364 "out-of-bounds write in coders/meta.c:1331:7".
2016-03-26 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/sgi.c (ReadSGIImage): Fix SourceForge bug #366 "out-of-bounds write in coders/sgi.c:528:4" and bug #369 "out-of-bounds write in coders/sgi.c:535:4".
- coders/rle.c (ReadRLEImage): Fix SourceForge bug #371 "out-of-bounds read in coders/rle.c:633:39".
2016-03-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dib.c (ReadDIBImage): Fix SourceForge bug #367 "out-of-bounds read in coders/dib.c:706:13" and bug #370 "out-of-bounds read in coders/dib.c:716:15".
- coders/pict.c (ReadPICTImage): Fix SourceForge bug #365 "out-of-bounds read in magick/image.c:1305:3"
- magick/utility.c (GetPageGeometry): Fix SourceForge bug #374 "out-of-bounds write in magick/utility.c:4355:7"
2016-03-23 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/miff.c (ReadMIFFImage): Fix SourceForge bug #376 "SIGABRT in magick/colorspace.c:1052".
- magick/shear.c (RotateImage): Fix SourceForge bug #375 "SIGABRT in magick/image.c:1230".
- coders/sun.c (DecodeImage): Fix SourceForge bug #368 "out-of-bounds read in coders/sun.c:223:17" and bug #363 "out-of-bounds read in coders/sun.c:221:16".
2016-03-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/svg.c (GetUserSpaceCoordinateValue): Fix stack buffer overflow when reading file 'aaphrbkwwe.svg.-632425326915265752' from CVE-2016-2317 problem files. Partial fix for SourceForge bug #358 "CVE-2016-2317 - SVG heap/stack buffer overflows".
- magick/utility.c (MagickGetToken): New private function to replace GetToken(). The new function accepts a token buffer length argument. GetToken() is modified to assume a token buffer length 'MaxTextExtent'. All code using GetToken() is updated to use MagickGetToken().
- coders/svg.c: Fix heap buffer overflow when reading file "aaphrbkwwe.svg.4495884156523242589" from CVE-2016-2317 problem files. Partial fix for SourceForge bug #358 "CVE-2016-2317 - SVG heap/stack buffer overflows".
2016-03-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/psd.c (ReadPSDImage): Fix SourceForge bug #341 "out-of-bounds read in coders/psd.c:1435". (WriteWhiteBackground): Fix SourceForge bug #350 "SEGV in coders/psd.c:1685". (DecodeImage): Fix SourceForge bug #351 "heap-buffer-overflow in coders/psd.c:142". (ReadPSDImage): Fix SourceForge bug #342 "out-of-bounds write in coders/psd.c:892"
- coders/xcf.c (load_tile): Fix SourceForge bug #337 "heap-buffer-overflow in coders/xcf.c:373".
- coders/pict.c (WritePICTImage): Fix SourceForge bug #340 "out-of-bounds write in coders/pict.c:1929".
- coders/pdb.c (WritePDBImage): Fix SourceForge bug #348 "heap-buffer-overflow in coders/pdb.c:949:26".
- coders/xpm.c (ReadXPMImage): Fix SourceForge bug #334 "heap-buffer-overflow in coders/xpm.c:150".
2016-03-09 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Fixed huge image limitation.
2016-03-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/sun.c (WriteSUNImage): Fix SourceForge bug #343 "out-of-bounds write in coders/sun.c:962".
- coders/rle.c (ReadRLEImage): Fix SourceForge bug #344 "out-of-bounds write in coders/rle.c:524".
- coders/xpm.c (ReadXPMImage): Fix SourceForge bug #335 "out-of-bounds read in coders/xpm.c:154 ".
2016-03-06 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
- doc/options.imdoc (-extent): Revised the example to clarify the interaction of -gravity with the "geometry" offsets.
2016-03-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- configure.ac: Add support for --enable-broken-coders which determines if broken or hazardous file format support should be enabled in the build. Currently Adobe Photoshop (PSD) format is included in this category.
- Rotate Changelog for new year. Update documentation copyrights for new year.
2016-03-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- tiff/libtiff/tif_config.h (HAVE_SNPRINTF): Define HAVE_SNPRINTF when using Microsoft Visual C++ 14 (Visual Studio 2015) or later. This is based on advice by Pablo Elpuro.
2016-02-21 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- Magick++/lib/Image.cpp (xResolution): New method to support setting the horizontal resolution with double precision. (yResolution): New method to support setting the vertical resolution with double precision.
- www/Hg.rst: Document the ssh public keys for the server hosting the development Mercurial repository.
2016-02-16 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/xpm.c (ReadXPMImage): Fix SourceForge bug #333 heap-buffer-overflow in coders/xpm.c:409.