2017-05-21 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* configure.ac: libtiff 4.0.8 released.

* html/v4.0.8.html: Add description of changes targeting the 4.0.8

release.

2017-05-20 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: initYCbCrConversion(): stricter validation for

refBlackWhite coefficients values. To avoid invalid float->int32 conversion.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718

Credit to OSS Fuzz

2017-05-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1] is not zero

to avoid division by zero.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665

Credit to OSS Fuzz

2017-05-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast of double to

float.

Credit to Google Autofuzz project

2017-05-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: initYCbCrConversion(): add basic validation of

luma and refBlackWhite coefficients (just check they are not NaN for now),

to avoid potential float to int overflows.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663

Credit to OSS Fuzz

2017-05-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c: PixarLogDecode(): resync tif_rawcp with

next_in and tif_rawcc with avail_in at beginning and end of function,

similarly to what is done in LZWDecode(). Likely needed so that it

works properly with latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT

mode. But untested...

2017-05-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_lzw.c: update dec_bitsleft at beginning of LZWDecode(),

and update tif_rawcc at end of LZWDecode(). This is needed to properly

work with the latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT

mode.

2017-05-14 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_luv.c: LogL16InitState(): avoid excessive memory

allocation when RowsPerStrip tag is missing.

Credit to OSS-Fuzz (locally run, on GDAL)

2017-05-14 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_packbits.c: fix out-of-buffer read in PackBitsDecode()

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563

Credit to OSS-Fuzz

2017-05-13 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32

overflows in multiply_ms() and add_ms().

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558

Credit to OSS-Fuzz

2017-05-13 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_color.c: avoid potential int32 overflow in

TIFFYCbCrToRGBInit()

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533

Credit to OSS-Fuzz

2017-05-13 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT

mode with tif_rawdataloaded when calling TIFFStartStrip() or

TIFFFillStripPartial(). This avoids reading beyond tif_rawdata

when bytecount > tif_rawdatasize.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.

Credit to OSS-Fuzz

2017-05-12 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: TIFFFillStripPartial():

avoid excessive memory allocation in case of shorten files.

Only effective on 64 bit builds.

Credit to OSS-Fuzz (locally run, on GDAL)

2017-05-12 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: TIFFFillStripPartial() / TIFFSeek(),

avoid potential integer overflows with read_ahead in

CHUNKY_STRIP_READ_SUPPORT mode. Should

especially occur on 32 bit platforms.

2017-05-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: TIFFFillStrip() and TIFFFillTile():

avoid excessive memory allocation in case of shorten files.

Only effective on 64 bit builds and non-mapped cases.

Credit to OSS-Fuzz (locally run, on GDAL)

2017-05-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c: fix memory

leak when the underlying codec (ZIP, PixarLog) succeeds its

setupdecode() method, but PredictorSetup fails.

Credit to OSS-Fuzz (locally run, on GDAL)

2017-05-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: TIFFFillStrip(): add limitation to the number

of bytes read in case td_stripbytecount[strip] is bigger than

reasonable, so as to avoid excessive memory allocation.

2017-04-28 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2bw.c: close TIFF handle in error code path.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2677

2017-04-27 Even Rouault <even.rouault at spatialys.com>

* litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.

Patch by Alan Coopersmith + complement by myself.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673

* tools/fax2tiff.c: emit appropriate message if the input file is

empty. Patch by Alan Coopersmith.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672

2017-04-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_ojpeg.c: fix potential memory leak in

OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable

and OJPEGReadHeaderInfoSecTablesAcTable

Patch by Nicolás Peña.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670

2017-04-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: fix memory leak in non DEFER_STRILE_LOAD

mode (ie default) when there is both a StripOffsets and

TileOffsets tag, or a StripByteCounts and TileByteCounts

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2689

* tools/tiff2ps.c: call TIFFClose() in error code paths.

2017-02-25 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7

-Wimplicit-fallthrough warnings.

2017-02-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c: fix memory leak in error code path of

PixarLogSetupDecode(). Patch by Nicolás Peña.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2665

2017-02-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_lzw.c: in LZWPostEncode(), increase, if necessary, the

code bit-width after flushing the remaining code and before emitting

the EOI code.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=1982

2017-01-31 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_jpeg.c: only run JPEGFixupTagsSubsampling() if the

YCbCrSubsampling tag is not explicitly present. This helps a bit to reduce

the I/O amount when te tag is present (especially on cloud hosted files).

2017-01-14 Even Rouault <even.rouault at spatialys.com>

* tools/raw2tiff.c: avoid integer division by zero.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2631

2017-01-12 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_ojpeg.c: fix leak in OJPEGReadHeaderInfoSecTablesQTable,

OJPEGReadHeaderInfoSecTablesDcTable and OJPEGReadHeaderInfoSecTablesAcTable

when read fails.

Patch by Nicolás Peña.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in Encode

functions instead of -1 when TIFFFlushData1() fails.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow and

cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based overflow.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and

http://bugzilla.maptools.org/show_bug.cgi?id=2657

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add _TIFFcalloc()

* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero

initialize tif_rawdata.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to

avoid UndefinedBehaviorSanitizer warning.

Patch by Nicolás Peña.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer

addition in TIFFReadRawStrip1() in isMapped() case.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_jpeg.c: validate BitsPerSample in JPEGSetupEncode() to avoid

undefined behaviour caused by invalid shift exponent.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement various clampings

of double to other data types to avoid undefined behaviour if the output range

isn't big enough to hold the input value.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2643

http://bugzilla.maptools.org/show_bug.cgi?id=2642

http://bugzilla.maptools.org/show_bug.cgi?id=2646

http://bugzilla.maptools.org/show_bug.cgi?id=2647

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: avoid division by floating point 0 in

TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),

and return 0 in that case (instead of infinity as before presumably)

Apparently some sanitizers do not like those divisions by zero.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedRational, replace

assertion by runtime check to error out if passed value is strictly

negative.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2535

* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that

caused double free.

Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535

2017-01-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_jpeg.c: avoid integer division by zero in

JPEGSetupEncode() when horizontal or vertical sampling is set to 0.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653

2017-01-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_jpeg.c: increase libjpeg max memory usable to

10 MB instead of libjpeg 1MB default. This helps when creating files

with "big" tile, without using libjpeg temporary files.

Related to https://trac.osgeo.org/gdal/ticket/6757

2016-12-20 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: avoid potential heap-based overflow in

t2p_readwrite_pdf_image_tile().

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640

2016-12-20 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: avoid potential invalid memory read in

t2p_writeproc.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639

2016-12-20 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: fix wrong usage of memcpy() that can trigger

unspecified behaviour.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2638

2016-12-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: fix potential memory leaks in error code

path of TIFFRGBAImageBegin().

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2627

2016-12-18 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: prevent heap-based buffer overflow in -j mode

on a paletted image. Note: this fix errors out before the overflow

happens. There could probably be a better fix.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2635

2016-12-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tiffio.h, libtiff/tif_getimage.c: add TIFFReadRGBAStripExt()

and TIFFReadRGBATileExt() variants of the functions without ext, with

an extra argument to control the stop_on_error behaviour.

2016-12-17 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2ps.c: fix 2 heap-based buffer overflows (in PSDataBW

and PSDataColorContig). Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and

http://bugzilla.maptools.org/show_bug.cgi?id=2634.

2016-12-13 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_fax3.h: revert change done on 2016-01-09 that made

Param member of TIFFFaxTabEnt structure a uint16 to reduce size of

the binary. It happens that the Hylafax software uses the tables that

follow this typedef (TIFFFaxMainTable, TIFFFaxWhiteTable,

TIFFFaxBlackTable), although they are not in a public libtiff header.

Raised by Lee Howard.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2636

2016-12-04 Even Rouault <even.rouault at spatialys.com>

* html/man/Makefile.am: remove thumbnail.1.html and rgb2ycbcr.1.html

from installed pages since the corresponding utilities are no longer

installed. Reported by Havard Eidnes

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2606

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_write.c: fix misleading indentation as warned by GCC.

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non assert check.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2605

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based

buffer overflow.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is

missing.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* man/Makefile.am: remove thumbnail.1 and rgb2ycbcr.1 from installed man

pages since the corresponding utilities are no longer installed.

Reported by Havard Eidnes

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2606

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called,

limit the return number of inks to SamplesPerPixel, so that code that parses

ink names doesn't go past the end of the buffer.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is

missing.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffinfo.c: fix null pointer dereference in -r mode when the image has

no StripByteCount tag.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2594

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix integer division by zero when BitsPerSample is missing.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in

readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2621

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so

that the output buffer is correctly incremented to avoid write outside bounds.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in

OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to

instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),

instead of a logic based on the total size of data. Which is faulty is

the total size of data is not sufficient to fill the whole image, and thus

results in reading outside of the StripByCounts/StripOffsets arrays when

using TIFFReadScanline().

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.

* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done

for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since

the above change is a better fix that makes it unnecessary.

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based buffer

overflow on generation of PixarLog / LUV compressed files, with

ColorMap, TransferFunction attached and nasty plays with bitspersample.

The fix for LUV has not been tested, but suffers from the same kind

of issue of PixarLog.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2604

2016-12-02 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that

can cause various issues, such as buffer overflows in the library.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598

2016-12-02 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in

TIFFReadEncodedStrip() that caused an integer division by zero.

Reported by Agostino Sarubbo.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596

2016-11-20 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis to

fix cppcheck clarifyCalculation warnings

* libtiff/tif_predict.c, libtiff/tif_print.c: fix printf unsigned

vs signed formatting (cppcheck invalidPrintfArgType_uint warnings)

2016-11-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* tools/fax2tiff.c (main): Applied patch by Jörg Ahrens to fix

passing client data for Win32 builds using tif_win32.c

(USE_WIN32_FILEIO defined) for file I/O. Patch was provided via

email on November 20, 2016.

2016-11-19 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff 4.0.7 released.

* configure.ac: Update for 4.0.7 release.

* tools/tiffdump.c (ReadDirectory): Remove uint32 cast to

_TIFFmalloc() argument which resulted in Coverity report. Added

more mutiplication overflow checks.

2016-11-18 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: Fix memory leak in (recent) error code path.

Fixes Coverity 1394415.

2016-11-17 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/tif_getimage.c: Fix some benign warnings which appear in

64-bit compilation under Microsoft Visual Studio of the form

"Arithmetic overflow: 32-bit value is shifted, then cast to 64-bit

value. Results might not be an expected value.". Problem was

reported on November 16, 2016 on the tiff mailing list.

2016-11-16 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not dereference

NULL pointer when values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII

access are 0-byte arrays.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression introduced

by previous fix done on 2016-11-11 for CVE-2016-9297).

Reported by Henri Salo. Assigned as CVE-2016-9448

2016-11-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* tools/tiffinfo.c (TIFFReadContigTileData): Fix signed/unsigned

comparison warning.

(TIFFReadSeparateTileData): Fix signed/unsigned comparison

warning.

* tools/tiffcrop.c (readContigTilesIntoBuffer): Fix

signed/unsigned comparison warning.

* html/v4.0.7.html: Add a file to document the pending 4.0.7

release.

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: avoid undefined behaviour related to overlapping

of source and destination buffer in memcpy() call in

t2p_sample_rgbaa_to_rgb()

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2577

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: fix potential integer overflows on 32 bit builds

in t2p_read_tiff_size()

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2576

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted()

when requesting Predictor tag and that the zip/lzw codec is not

configured.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that

values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII

access are null terminated, to avoid potential read outside buffer

in _TIFFPrintField().

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590 (CVE-2016-9297)

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: reject images with OJPEG compression that

have no TileOffsets/StripOffsets tag, when OJPEG compression is

disabled. Prevent null pointer dereference in TIFFReadRawStrip1()

and other functions that expect td_stripbytecount to be non NULL.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix multiple uint32 overflows in

writeBufferToSeparateStrips(), writeBufferToContigTiles() and

writeBufferToSeparateTiles() that could cause heap buffer overflows.

Reported by Henri Salo from Nixu Corporation.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592 (CVE-2016-9532)

2016-11-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstrips

value when it is non-zero, instead of recomputing it. This is needed in

TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of

array in tiffsplit (or other utilities using TIFFNumberOfStrips()).

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 (CVE-2016-9273)

2016-11-04 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_predic.c: fix memory leaks in error code paths added in

previous commit (fix for MSVR 35105)

2016-10-31 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_predict.h, libtiff/tif_predict.c:

Replace assertions by runtime checks to avoid assertions in debug mode,

or buffer overflows in release mode. Can happen when dealing with

unusual tile size like YCbCr with subsampling. Reported as MSVR 35105

by Axel Souchet & Vishal Chauhan from the MSRC Vulnerabilities & Mitigations

team.

2016-10-26 Even Rouault <even.rouault at spatialys.com>

* tools/fax2tiff.c: fix segfault when specifying -r without

argument. Patch by Yuriy M. Kaminskiy.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2572

2016-10-25 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dir.c: discard values of SMinSampleValue and

SMaxSampleValue when they have been read and the value of

SamplesPerPixel is changed afterwards (like when reading a

OJPEG compressed image with a missing SamplesPerPixel tag,

and whose photometric is RGB or YCbCr, forcing SamplesPerPixel

being 3). Otherwise when rewriting the directory (for example

with tiffset, we will expect 3 values whereas the array had been

allocated with just one), thus causing a out of bound read access.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500

(CVE-2014-8127, duplicate: CVE-2016-3658)

* libtiff/tif_dirwrite.c: avoid null pointer dereference on td_stripoffset

when writing directory, if FIELD_STRIPOFFSETS was artificially set

for a hack case in OJPEG case.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500

(CVE-2014-8127, duplicate: CVE-2016-3658)

2016-10-25 Even Rouault <even.rouault at spatialys.com>

* tools/tiffinfo.c: fix out-of-bound read on some tiled images.

(http://bugzilla.maptools.org/show_bug.cgi?id=2517)

* libtiff/tif_compress.c: make TIFFNoDecode() return 0 to indicate an

error and make upper level read routines treat it accordingly.

(linked to the test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)

2016-10-14 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in

readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet

& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.

2016-10-09 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on JPEG

compressed images. Reported by Tyler Bohan of Cisco Talos as

TALOS-CAN-0187 / CVE-2016-5652.

Also prevents writing 2 extra uninitialized bytes to the file stream.

2016-10-08 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd

tile width vs image width. Reported as MSVR 35103

by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &

Mitigations team.

2016-10-08 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: fix read -largely- outsize of buffer in

t2p_readwrite_pdf_image_tile(), causing crash, when reading a

JPEG compressed image with TIFFTAG_JPEGTABLES length being one.

Reported as MSVR 35101 by Axel Souchet and Vishal Chauhan from

the MSRC Vulnerabilities & Mitigations team. CVE-2016-9453

2016-10-08 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: fix read of undefined variable in case of missing

required tags. Found on test case of MSVR 35100.

* tools/tiffcrop.c: fix read of undefined buffer in

readContigStripsIntoBuffer() due to uint16 overflow. Probably not a

security issue but I can be wrong. Reported as MSVR 35100 by Axel

Souchet from the MSRC Vulnerabilities & Mitigations team.

2016-09-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* html: Change as many remotesensing.org broken links to a working

URL as possible.

2016-09-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to

read floating point images.

* libtiff/tif_predict.c (PredictorSetup): Enforce bits-per-sample

requirements of floating point predictor (3). Fixes CVE-2016-3622

"Divide By Zero in the tiff2rgba tool."

2016-09-23 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix various out-of-bounds write vulnerabilities

in heap or stack allocated buffers. Reported as MSVR 35093,

MSVR 35096 and MSVR 35097. Discovered by Axel Souchet and Vishal

Chauhan from the MSRC Vulnerabilities & Mitigations team.

* tools/tiff2pdf.c: fix out-of-bounds write vulnerabilities in

heap allocate buffer in t2p_process_jpeg_strip(). Reported as MSVR

35098. Discovered by Axel Souchet and Vishal Chauhan from the MSRC

Vulnerabilities & Mitigations team.

* libtiff/tif_pixarlog.c: fix out-of-bounds write vulnerabilities

in heap allocated buffers. Reported as MSVR 35094. Discovered by

Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &

Mitigations team.

* libtiff/tif_write.c: fix issue in error code path of TIFFFlushData1()

that didn't reset the tif_rawcc and tif_rawcp members. I'm not

completely sure if that could happen in practice outside of the odd

behaviour of t2p_seekproc() of tiff2pdf). The report points that a

better fix could be to check the return value of TIFFFlushData1() in

places where it isn't done currently, but it seems this patch is enough.

Reported as MSVR 35095. Discovered by Axel Souchet & Vishal Chauhan &

Suha Can from the MSRC Vulnerabilities & Mitigations team.

2016-09-20 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* html/man/index.html: Comment out links to documentation for

abandoned utilities.

2016-09-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_lzma.c: typo fix in comment

2016-09-04 Even Rouault <even.rouault at spatialys.com>

* libtiff/*.c: fix warnings raised by clang 3.9 -Wcomma

2016-09-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirwrite.c, libtiff/tif_color.c: fix warnings raised

by GCC 5 / clang -Wfloat-conversion

2016-08-16 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: fix C99'ism.

2016-08-15 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2bw.c: fix weight computation that could result of color

value overflow (no security implication). Fix bugzilla #2550.

Patch by Frank Freudenberg.

2016-08-15 Even Rouault <even.rouault at spatialys.com>

* tools/rgb2ycbcr.c: validate values of -v and -h parameters to

avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)

2016-08-15 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: Fix out-of-bounds write in loadImage().

From patch libtiff-CVE-2016-3991.patch from

libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)

2016-08-15 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode

if more input samples are provided than expected by PixarLogSetupEncode.

Idea based on libtiff-CVE-2016-3990.patch from

libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and

simpler check. (bugzilla #2544)

2016-08-15 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2rgba.c: Fix integer overflow in size of allocated

buffer, when -b mode is enabled, that could result in out-of-bounds

write. Based initially on patch tiff-CVE-2016-3945.patch from

libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for

invalid tests that rejected valid files. (bugzilla #2545)

2016-07-11 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcrop.c: Avoid access outside of stack allocated array

on a tiled separate TIFF with more than 8 samples per pixel.

Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360

(CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)

2016-07-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: Fix out-of-bounds read on

memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1()

when stripoffset is beyond tmsize_t max value (reported by

Mathias Svensson)

2016-07-10 Even Rouault <even.rouault at spatialys.com>

* tools/tiffdump.c: fix a few misaligned 64-bit reads warned

by -fsanitize

2016-07-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c: make TIFFReadEncodedStrip() and

TIFFReadEncodedTile() directly use user provided buffer when

no compression (and other conditions) to save a memcpy().

* libtiff/tif_write.c: make TIFFWriteEncodedStrip() and

TIFFWriteEncodedTile() directly use user provided buffer when

no compression to save a memcpy().

2016-07-01 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_luv.c: validate that for COMPRESSION_SGILOG and

PHOTOMETRIC_LOGL, there is only one sample per pixel. Avoid

potential invalid memory write on corrupted/unexpected images when

using the TIFFRGBAImageBegin() interface (reported by

Clay Wood)

2016-06-28 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c: fix potential buffer write overrun in

PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)

(CVE-2016-5875)

2016-06-15 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/libtiff.def: Added _TIFFMultiply32 and _TIFFMultiply64

to libtiff.def

2016-06-05 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* tools/Makefile.am: The libtiff tools bmp2tiff, gif2tiff,

ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed from

the distribution. The libtiff tools rgb2ycbcr and thumbnail are

only built in the build tree for testing. Old files are put in

new 'archive' subdirectory of the source repository, but not in

distribution archives. These changes are made in order to lessen

the maintenance burden.

2016-05-10 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/tif_config.vc.h (HAVE_SNPRINTF): Add a '1' to the

HAVE_SNPRINTF definition.'

2016-05-09 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/tif_config.vc.h (HAVE_SNPRINTF): Applied patch by Edward

Lam to define HAVE_SNPRINTF for Visual Studio 2015.

2016-04-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: when compiled with DEFER_STRILE_LOAD,

fix regression, introduced on 2014-12-23, when reading a one-strip

file without a StripByteCounts tag. GDAL #6490

2016-04-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* html/bugs.html: Replace Andrey Kiselev with Bob Friesenhahn for

purposes of security issue reporting.

2016-01-23 Even Rouault <even.rouault at spatialys.com>

* libtiff/*: upstream typo fixes (mostly contributed by Kurt Schwehr)

coming from GDAL internal libtiff

2016-01-09 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_fax3.h: make Param member of TIFFFaxTabEnt structure

a uint16 to reduce size of the binary.

2016-01-03 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_read.c, tif_dirread.c: fix indentation issues raised

by GCC 6 -Wmisleading-indentation

2015-12-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_pixarlog.c: avoid zlib error messages to pass a NULL

string to %s formatter, which is undefined behaviour in sprintf().

2015-12-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()

triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif

(bugzilla #2508)

2015-12-27 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_luv.c: fix potential out-of-bound writes in decode

functions in non debug builds by replacing assert()s by regular if

checks (bugzilla #2522).

Fix potential out-of-bound reads in case of short input data.

2015-12-26 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage

interface in case of unsupported values of SamplesPerPixel/ExtraSamples

for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in

TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and

CVE-2015-8683 reported by zzf of Alibaba.

2015-12-21 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: workaround false positive warning of Clang Static

Analyzer about null pointer dereference in TIFFCheckDirOffset().

2015-12-19 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_fax3.c: remove dead assignment in Fax3PutEOLgdal(). Found

by Clang Static Analyzer

2015-12-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirwrite.c: fix truncation to 32 bit of file offsets in

TIFFLinkDirectory() and TIFFWriteDirectorySec() when aligning directory

offsets on a even offset (affects BigTIFF). This was a regression of the

changeset of 2015-10-19.

2015-12-12 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_write.c: TIFFWriteEncodedStrip() and TIFFWriteEncodedTile()

should return -1 in case of failure of tif_encodestrip() as documented

* libtiff/tif_dumpmode.c: DumpModeEncode() should return 0 in case of

failure so that the above mentionned functions detect the error.

2015-12-06 Even Rouault <even.rouault at spatialys.com>

* libtiff/uvcode.h: const'ify uv_code array

2015-12-06 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirinfo.c: const'ify tiffFields, exifFields,

tiffFieldArray and exifFieldArray arrays

2015-12-06 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_print.c: constify photoNames and orientNames arrays

2015-12-06 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_close.c, libtiff/tif_extension.c : rename link

variable to avoid -Wshadow warnings

2015-11-22 Even Rouault <even.rouault at spatialys.com>

* libtiff/*.c: fix typos in comments (patch by Kurt Schwehr)

2015-11-22 Even Rouault <even.rouault at spatialys.com>

* libtiff/*.c: fix MSVC warnings related to cast shortening and

assignment within conditional expression

2015-11-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/*.c: fix clang -Wshorten-64-to-32 warnings

2015-11-18 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: initialize double* data at line 3693 to NULL

to please MSVC 2013

2015-11-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: prevent reading ColorMap or TransferFunction

if BitsPerPixel > 24, so as to avoid huge memory allocation and file

read attempts

2015-11-02 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: remove duplicated assignment (reported by

Clang static analyzer)

2015-10-28 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dir.c, libtiff/tif_dirinfo.c, libtiff/tif_compress.c,

libtiff/tif_jpeg_12.c: suppress warnings about 'no previous

declaration/prototype'

2015-10-19 Even Rouault <even.rouault at spatialys.com>

* libtiff/tiffiop.h, libtiff/tif_dirwrite.c: suffix constants by U to fix

'warning: negative integer implicitly converted to unsigned type' warning

(part of -Wconversion)

2015-10-17 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dir.c, libtiff/tif_dirread.c, libtiff/tif_getimage.c,

libtiff/tif_print.c: fix -Wshadow warnings (only in libtiff/)

2015-09-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff 4.0.6 released.

* html/v4.0.6.html: Added release notes for 4.0.6.

2015-09-06 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* tools/tiffgt.c: Silence glut API deprecation warnings on MacOS

X. Patch by Roger Leigh.

* Makefile.am: Added a 'coverity' rule to assist with Coverity

submissions.

* tools/tiff2pdf.c: Fix compiler warning about unused function

when JPEG is not available.

* tools/fax2ps.c (main): Detect failure to write to temporary

file.

2015-09-05 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* libtiff/tif_dirread.c (TIFFReadDirEntryCheckRangeSlongSlong8):

Change implementation so that it does not sometimes overflow the

range of a 32-bit int and to avoid a signed vs unsigned compare

compiler warning.

(TIFF_INT64_MAX): Avoid use of platform-specific large constants.

(TIFF_UINT32_MAX): Avoid use of platform-specific large constants.

2015-09-01 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* Makefile.am (distcheck-hook), configure.ac: Applied patches by

Roger Leigh (via tiff mailing list on 2015-09-01) to fix issue

with BSD make and to make use of cmake in 'distcheck' target

conditional on if cmake is available.

* CMakeLists.txt, Makefile.am, configure.ac: Applied patches by

Roger Leigh (via tiff mailing list on 2015-09-01).

CMake build is now included in 'distcheck' target.

Builds with CMake 2.8.9 and newer.

Tar is now resquested to use POSIX PAX format.

2015-08-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* CMakeLists.txt, libtiff/test/Makefile.am: Applied patches by

Roger Leigh (via tiff mailing list on 2015-08-31.

CMake reads all version information directly from configure.ac to

avoid duplication of values. This basically greps over the file

for the LIBTIFF_* variables, then translates them to the form

needed for cmake. This includes the release version and libtool

shared library version information.