2018-03-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pict.c (ReadPICTImage): Check image pixel limits before allocating memory for tile. Fixes oss-fuzz 7217 "graphicsmagick/coder_PICT_fuzzer: Out-of-memory in graphicsmagick_coder_PICT_fuzzer".
2018-03-29 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/pcd.c (ReadPCDImage): Add checks for EOF. Fixes oss-fuzz issue 7180 "graphicsmagick/coder_PCDS_fuzzer: Timeout in graphicsmagick_coder_PCDS_fuzzer". (Credit to OSS-Fuzz)
2018-03-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadMNGImage): Fix SourceForge issue 554 "Divide-by-zero in ReadMNGImage (coders/png.c)". (Credit to Trace Probe)
- coders/pict.c (DecodeImage): Verify that sufficient backing data exists before allocating memory to read it. Fixes oss-fuzz 6629 "graphicsmagick/coder_PCT_fuzzer: Out-of-memory in graphicsmagick_coder_PCT_fuzzer".
2018-03-25 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/mat.c Check whether datablock is really read. Fixes oss-fuzz 7056 (Credit to OSS-Fuzz)
2018-03-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dcm.c (ReadDCMImage): Validate that samples per pixel is in valid range. Fixes oss-fuzz 6260 "graphicsmagick/coder_DCM_fuzzer: Out-of-memory in graphicsmagick_coder_DCM_fuzzer". (Credit to OSS-Fuzz)
- coders/meta.c (format8BIM): Allocate space for null termination and null terminate string. Fixes oss-fuzz 5985 "graphicsmagick/coder_8BIMTEXT_fuzzer: Heap-buffer-overflow in formatIPTCfromBuffer". (Credit to OSS-Fuzz)
- coders/fits.c (ReadFITSImage): Include number of FITS scenes in file size validations. Fixes oss-fuzz 6781 "graphicsmagick/coder_FITS_fuzzer: Timeout in graphicsmagick_coder_FITS_fuzzer". (Credit to OSS-Fuzz)
2018-03-23 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/meta.c (format8BIM): Validate size request prior to allocation. Fixes oss-fuzz issue 5974 "graphicsmagick/coder_8BIMTEXT_fuzzer: Out-of-memory in graphicsmagick_coder_8BIMTEXT_fuzzer". (Credit to OSS-Fuzz)
2018-03-23 Fojtik Jaroslav <JaFojtik@seznam.cz>
coders/mat.c Fix forged amount of frames 7076. (Credit to OSS-Fuzz)
* coders/topol.c Check for forged image that overflows file size (fuzz 6836).
2018-03-23 Greg Wolfe <gregory.wolfe@kodakalaris.com>
magick/render.c, render.h (DrawInfo, CloneDrawInfo, DrawClipPath, DrawImage, GetDrawInfo): According to the SVG spec, a clipping path is defined only by the geometry of its constituent elements, and is not dependent on fill color/opacity, stroke color/opacity, or stroke width. To ensure conformity with the spec, when a clipping path is created, these SVG elements are set to appropriate values, and any attempt to modify them is ignored.
Also, whenever a clipping path is drawn, the associated image attributes are now updated from the parent image structure. This ensures that any added or modified attributes are up to date.
2018-03-22 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/topol.c Use rather MagickSwabArrayOfUInt32() to
flip all array elements at once.
* magick/annotate.c Compilation issue - using C++ syntax in C code.
2018-03-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dpx.c (ReadDPXImage): Validate header length and offset properties. Fixes oss-fuzz "graphicsmagick/coder_DPX_fuzzer: Use-of-uninitialized-value in WriteDPXImage". (Credit to OSS-Fuzz)
2018-03-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/xpm.c (ReadXPMImage): Reject XPM if its condensed version contains non-whitespace control characters. Fixes oss-fuzz 7027 "graphicsmagick/coder_XPM_fuzzer: Timeout in graphicsmagick_coder_XPM_fuzzer". (Credit to OSS-Fuzz)
2018-03-19 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/topol.c Fix tile index overflow fuzz 6634. (Credit to OSS-Fuzz)
2018-03-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/dcm.c (DCM_ReadGrayscaleImage): Don't use rescale map if it was not allocated. This issue was induced in this development cycle due to disabling generating the rescale map. Fixes oss-fuzz 7021 "graphicsmagick/coder_DCM_fuzzer: Null-dereference READ in DCM_ReadGrayscaleImage". (Credit to OSS-Fuzz)
2018-03-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/color_lookup.c (QueryColorDatabase): Defend against partial scanf() expression matching, resulting in use of uninitialized data. Likely fixes oss-fuzz 6596 "graphicsmagick/coder_XPM_fuzzer: Use-of-uninitialized-value in IsMonochromeImage". (Credit to OSS-Fuzz)
- coders/rle.c (ReadRLEImage): Validate number of colormap bits to avoid undefined shift behavior. Fixes oss-fuzz 6630 "graphicsmagick/enhance_fuzzer: Undefined-shift in ReadRLEImage". (Credit to OSS-Fuzz)
- coders/dcm.c (DCM_ReadRGBImage): Don't use rescale map if it was not allocated. This issue was induced in this development cycle due to disabling generating the rescale map. Fixes oss-fuzz 6995 "graphicsmagick/coder_DCM_fuzzer: Null-dereference READ in DCM_ReadRGBImage". (Credit to OSS-Fuzz)
- coders/dib.c (DecodeImage): Report failure to decode to expected amount of pixel data as an error. Fixes oss-fuzz 7007 "graphicsmagick/enhance_fuzzer: Use-of-uninitialized-value in EnhanceImage". (Credit to OSS-Fuzz)
2018-01-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Prepare for 1.3.28 release.
2018-01-17 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- NEWS.txt: Update with changes since previous release.
2018-01-14 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- PerlMagick/Magick.xs: Compiler warnings reduction.
- magick/pixel_cache.h: Mark GetPixels(), GetIndexes(), and GetOnePixel() as deprecated. Compilers may produce a warning if these functions are used.
- magick/pixel_cache.c (InterpolateColor): Return black pixel if InterpolateViewColor() reports failure.
- coders/png.c (ReadMNGImage): Fix memory leak of chunk and mng_info in error path.
- coders/gif.c (ReadGIFImage): Fix memory leak of global colormap.
2018-01-13 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/symbols.h: Fix SourceForge issue #538 "13 symbols in common with ImageMagick despite --enable-symbol-prefix".
- coders/bmp.c (ReadBMPImage): Fix non-terminal loop due to unexpected bit-field mask value. Fixes SourceForge issue #541 "Infinite Loop in ReadBMPImage (coders/bmp.c)".
- coders/jpeg.c (JPEGMessageHandler): Revert code added on 2017-07-08 to promote certain warnings from libjpeg to errors. Add code to rationalize claimed image dimensions based on file size. Resolves SourceForge issue #539 "Images with libjpeg warnings result in error".
2018-01-11 Fojtik Jaroslav <JaFojtik@seznam.cz>
- coders/wpg.c Recursive ReadImage could return multiple scenes
- fixed.
2018-01-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- coders/png.c (ReadOnePNGImage): Quit 'passes' loop if we encountered an error
- magick/pixel_cache.c (SetNexus): Fix heap overwrite in AcquireCacheNexus() due to SetNexus() not using an allocated staging area for the pixels like it should. This problem impacts all 1.3.X releases. Resolves SourceForge issues 532 "heap-buffer-overflow bug in ReadWPGImage" and #531 "heap-buffer-overflow in AcquireCacheNexus".
- magick/pixel_cache.c (InterpolateViewColor): Now returns MagickPassFail rather than void. Code using this function is updated to check the return status.
2018-01-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/describe.c (DescribeImage): Discriminate between AcquireImagePixels() returning NULL or finding a transparent pixel. This avoids use of a null pointer in the case where AcquireImagePixels() returns NULL.
2017-12-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- magick/static.c: Change static module initialization to be based on an initialized list rather than a squence of function calls in order to simplify maintenance and possibly address future requirements.
2017-12-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
- Copyright.txt: Bump copyright years and rotate ChangeLog.