tiff-4.7.2

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

Changes in TIFF v4.7.2

Software configuration changes

• cmake: Fix bundle identifiers to use reverse-DNS format
• cmake: Fix and improve Apple framework build support
• cmake: Use TurboJPEG CONFIG by default (:issue:767)
• cmake: changes related to 8-/12-bit modes
• cmake: Replace CMath::CMath with direct link to avoid export.
• Support for iOS-derived builds
• Simplify cmake byte order version check
• Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
• configure.ac: Require bootstrap with at least Autoconf 2.71.

Library changes

• Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer()
• Handle negative TIFFReadFile results before state updates (:issue:854)

• tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip

• tif_read.c: Fixed division by zero in TIFFStartStrip() (:issue:777)

• tif_dirwrite.c: add integer overflow checks to allocation size calculations

• tif_print.c: add integer overflow checks to allocation size calculations

• tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop

• DumpModeSeek: add bounds check to prevent OOB pointer advance

• TIFFGrowStrips: fix use-after-free on partial realloc failure.

• Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.

• TIFFRGBAImage: avoid int overflows in put functions (:issue:830)

• tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (:issue:792)

• tif_getimage: Widen pointer-offset arithmetic in tif_getimage

• putcontig8bitYCbCr44tile: fix wrong fromskew computation (:issue:798)

• putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (:issue:753)

• TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (:issue:787)

• TIFFFillStrip/Tile(): avoid excessive memory allocation (:issue:831)
• TIFFLinkDirectory() checks for IFD loops (:issue:788)

• Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.

• TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (:issue:805)

• TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (​https://github.com/OSGeo/gdal/issues/13465)

• tif_getimage: reject tile widths that would overflow toskew (:issue:808)

• Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.

• TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (:issue:777).

• _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files

when file opened in 'O' mode (​https://issues.oss-fuzz.com/issues/471328917)

• TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode

• _TIFFMergeFields(): avoid NULL ptr dereference (:issue:755).

• Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file.

(:issue:749)

• JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory

(:issue:892)

• JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (:issue:826)

• JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3

(:issue:773)

• JPEGDecode(): fix memory leak in error code path (​https://issues.oss-fuzz.com/issues/471945501)

• tif_jpeg: reject mismatched JPEG data precision to avoid write overflow

• Fix signed left-shift UB in LogLuv RANDITHER encoding (:issue:850)

• PixarLog: error out on invalid ABGR output buffer sizes.

• PixarLog: complete ABGR bounds check for multi-row strip decoding.

• PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (:issue:824)

• PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (:issue:789).

• PixarLog codec: fix potential integer overflow/out-of-bounds access (:issue:797)

• TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (​https://issues.oss-fuzz.com/issues/506737072)

• OJPEG: fix integer overflow in subsampling buffer allocation.

• OJPEG fix potential integer overflow/out-of-bounds access (:issue:796).

• ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)

• fix null pointer deference in :issue:782.

• fix stack-overflow in :issue:784.

Other changes:

• Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (:issue:739).

• Harden integer size and offset calculations (:issue:897)

• TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication

• Move widening casts inside multiplication scope.

• Lots of compiler warning fixes related to enabling more warning flags

• Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (:issue:773)

• TIFFFillStrip(): prevent harmless unsigned integer overflow

Documentation

• Doc: TIFFFdOpen(): clarify role of filename parameter (:issue:823)

• Add libtiff/README_for_libtiff_developpers.md

Tools changes

• tools: validate numeric command-line arguments (:issue:799)

• tiff2pdf: add overflow checks to RGBA/RGBAA sample count computation

• tiff2pdf: Fix integer overflow in RGBA raster allocation in tiff2pdf by validating size computation before _TIFFrealloc() (:issue:804)

• tiffcrop: fix integer overflow in extractImageSection.

• tiffcrop: fix byte carry for left/right composite bit offsets.

• tiffcrop: recompute composite crop dimensions before allocation.

• tiffcrop: fix uint32 overflows in writeImageSections and getCropOffsets (:issue:834, :issue:835, :issue:836)

• tiffcrop: size separated region buffers from actual dimensions

• tiffcrop: Fix heap-buffer-overflow in composite mode by allocating buffer based on final image layout instead of region-based bufftotal (:issue:803)

• tiffcrop: fix undefined behaviour (:issue:790)

• tiffcrop: avoid dangling pointer in loadImage by clearing \*read_ptr after free (:issue:751)

• tiffcrop: fix undefined behaviour in reverseSamples32bits() (:issue:752)

• Fix integer wraparound checks in raw2tiff/tiffcrop and add missing zero-divisor guards in tiff2rgba (:issue:832)

• tiffsplit: use 7-digit numbered output names.

• tiffsplit: fix global-buffer-overflow (:issue:790)

• tiffsplit: check filename length (:issue:769)

• tiffcmp: validate scanline buffer sizes in mixed planar comparison to prevent out-of-bounds reads (:issue:802)

• tiffmedian: fix use after free (:issue:790)

• tiffcp: avoid integer overflow in iskew and oskew (:issue:770)

• fax2tiff: avoid endless loop on corrupt input (:issue:759)

• tiffdump: Avoid unaligned memory access for tag field values.

• tiff2ps: Checking the range of double values in before converting to int32_t. (:issue:679)

Changes to contributed and unsupported tools

• thumbnail: prevent integer overflow by capping row count at 256

• thumbnail: add/improve integer overflow check for image memory allocation.

• thumbnail: add error handling for missing strip and tile byte counts.

• thumbnail: fix Out-of-Bounds Write (:issue:790)

• rgb2ycbcr: fix integer overflow check for pixel count calculation.

• iptcutil: out-of-bound read fix (:issue:750)

[Bruce Dubbs]

Fixed at commits

ff097e9517 Update to tiff-4.7.2.
cacd8998e2 Update to accountsservice-26.27.3.
861d69c344 Update to hwdata-0.409.
403ff774f5 Add rust as a recommended dependency to git.