Changes in TIFF v4.7.2

References

Current Version

v4.7.2 (tag v4.7.2)

Previous Version

v4.7.1

Primary Download Site

https://download.osgeo.org/libtiff/

Home HTTP Site #1

https://libtiff.gitlab.io/libtiff/

Home HTTP Site #2

http://www.simplesystems.org/libtiff/

This document provides a summary of significant changes made to the software between the previous and current versions (see above). A fully-detailed change summary is provided by the ChangeLog file included in the release package and by the Git commit history.

Major changes

None

Software configuration changes

  • cmake: Fix bundle identifiers to use reverse-DNS format

  • cmake: Fix and improve Apple framework build support

  • cmake: Use TurboJPEG CONFIG by default (issue #767)

  • cmake: changes related to 8-/12-bit modes

  • cmake: Replace CMath::CMath with direct link to avoid export.

  • Support for iOS-derived builds

  • Simplify cmake byte order version check

  • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions

  • configure.ac: Require bootstrap with at least Autoconf 2.71.

Library changes

New/improved functionalities:

  • Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)

API/ABI breaks:

  • None

Bug fixes:

  • Handle negative TIFFReadFile results before state updates (issue #854)

  • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip

  • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)

  • tif_dirwrite.c: add integer overflow checks to allocation size calculations

  • tif_print.c: add integer overflow checks to allocation size calculations

  • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop

  • DumpModeSeek: add bounds check to prevent OOB pointer advance

  • TIFFGrowStrips: fix use-after-free on partial realloc failure.

  • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.

  • TIFFRGBAImage: avoid int overflows in put functions (issue #830)

  • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)

  • tif_getimage: Widen pointer-offset arithmetic in tif_getimage

  • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)

  • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)

  • TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)

  • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)

  • TIFFLinkDirectory() checks for IFD loops (issue #788)

  • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.

  • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)

  • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)

  • tif_getimage: reject tile widths that would overflow toskew (issue #808)

  • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.

  • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).

  • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files

    when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)

  • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode

  • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).

  • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file.

    (issue #749)

  • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory

    (issue #892)

  • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)

  • JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3

    (issue #773)

  • JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)

  • tif_jpeg: reject mismatched JPEG data precision to avoid write overflow

  • Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)

  • PixarLog: error out on invalid ABGR output buffer sizes.

  • PixarLog: complete ABGR bounds check for multi-row strip decoding.

  • PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)

  • PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).

  • PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)

  • TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)

  • OJPEG: fix integer overflow in subsampling buffer allocation.

  • OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).

  • OJPEG fix potential integer overflow/out-of-bounds access (issue #796).

  • ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)

  • fix null pointer deference in issue #782.

  • fix stack-overflow in issue #784.

Other changes:

  • Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).

  • Harden integer size and offset calculations (issue #897)

  • TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication

  • Move widening casts inside multiplication scope.

  • Lots of compiler warning fixes related to enabling more warning flags

  • Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)

  • TIFFFillStrip(): prevent harmless unsigned integer overflow

Documentation

  • Doc: TIFFFdOpen(): clarify role of filename parameter (issue #823)

  • Add libtiff/README_for_libtiff_developpers.md

Tools changes

New/improved functionality:

None

Bug fixes:

  • tools: validate numeric command-line arguments (issue #799)

  • tiff2pdf: add overflow checks to RGBA/RGBAA sample count computation

  • tiff2pdf: Fix integer overflow in RGBA raster allocation in tiff2pdf by validating size computation before _TIFFrealloc() (issue #804)

  • tiffcrop: fix integer overflow in extractImageSection.

  • tiffcrop: fix byte carry for left/right composite bit offsets.

  • tiffcrop: recompute composite crop dimensions before allocation.

  • tiffcrop: fix uint32 overflows in writeImageSections and getCropOffsets (issue #834, issue #835, issue #836)

  • tiffcrop: size separated region buffers from actual dimensions

  • tiffcrop: Fix heap-buffer-overflow in composite mode by allocating buffer based on final image layout instead of region-based bufftotal (issue #803)

  • tiffcrop: fix undefined behaviour (issue #790)

  • tiffcrop: avoid dangling pointer in loadImage by clearing *read_ptr after free (issue #751)

  • tiffcrop: fix undefined behaviour in reverseSamples32bits() (issue #752)

  • Fix integer wraparound checks in raw2tiff/tiffcrop and add missing zero-divisor guards in tiff2rgba (issue #832)

  • tiffsplit: use 7-digit numbered output names.

  • tiffsplit: fix global-buffer-overflow (issue #790)

  • tiffsplit: check filename length (issue #769)

  • tiffcmp: validate scanline buffer sizes in mixed planar comparison to prevent out-of-bounds reads (issue #802)

  • tiffmedian: fix use after free (issue #790)

  • tiffcp: avoid integer overflow in iskew and oskew (issue #770)

  • fax2tiff: avoid endless loop on corrupt input (issue #759)

  • tiffdump: Avoid unaligned memory access for tag field values.

  • tiff2ps: Checking the range of double values in before converting to int32_t. (issue #679)

Changes to contributed and unsupported tools

  • thumbnail: prevent integer overflow by capping row count at 256

  • thumbnail: add/improve integer overflow check for image memory allocation.

  • thumbnail: add error handling for missing strip and tile byte counts.

  • thumbnail: fix Out-of-Bounds Write (issue #790)

  • rgb2ycbcr: fix integer overflow check for pixel count calculation.

  • iptcutil: out-of-bound read fix (issue #750)