GraphicsMagick 1.3.21 released

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

---559023410-94428632-1425174033=:3653
Content-Type: TEXT/PLAIN; format=flowed; charset=ISO-8859-15
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by blade.simplesystems.org
	id t211eX8t017895

GraphicsMagick is a general purpose cross-platform image processing=20
package consisting of utilities, libraries, scripting extensions, and=20
GUIs for dealing with images.  Read about it at=20
"http://www.graphicsmagick.org/".

GraphicsMagick 1.3.21 is now released, and is the 56th release since=20
its first release in 2003.  It contains an abnormally huge number of=20
security fixes due to the kind assistance of security researchers who=20
provided test files which could crash earlier releases of the=20
software, or waste resources.  Any site which might encounter=20
untrusted files should be using this release.

Release files may be downloaded from SourceForge at=20
"https://sourceforge.net/projects/graphicsmagick/files/".

Significant changes that users may need to be aware of in this release=20
are that Magick++ (C++ API) breaks the ABI (API is still 100%=20
compatible) and so any C++ applications using it will need to be=20
re-compiled to use the updated C++ library.  If a C++ application can=20
not be immediately re-compiled, then it may continue to use the=20
Magick++ library from a previous 1.3.X release while using the=20
improved C libraries from this release.  The C ABI is still compatible=20
with all previous 1.3.X releases.

Resource limits for image width and height have been added and the=20
default limits have been set so that width and height fit comfortably=20
within the range of a 32-bit integer (even for 64-bit builds).  The=20
limits may be raised if desired.

The remaining is the full summarized NEWS for this release.  See the=20
ChangeLog files for more detail:

1.3.21 (February 28, 2015)
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Thanks:

   * Gynvael Coldwind and Mateusz Jurczyk of the Google Security Team
     provided test files which allowed us to find and fix security
     problems in the software.

   * Hanno B=F6ck provided test files which allowed us to find and fix
     security problems in the software.

   * Tobias Ospelt provided test files and advice which allowed us to
     find and fix security problems in the software.

   * Michal Zalewski provided test files which allowed us to find and
     fix security problems in the software.

   * Jodie Cunningham did lots of fuzzing to find issues and set up the
     project on Coverity for automatic analysis.

   * American fuzzy lop was used to produce and discover many of the
     files which caused problems for the software.

   * AddressSanitizer (ASan) was used to detect and isolate memory
     access issues.

   * Valgrind was used to detect and isolate memory access issues as
     well as memory leaks

Special Issues:

   * Due to `GCC bug 53967`_, several key agorithms (e.g. convolution)
     may execute much faster (e.g. 2-3X) for x86-64 and/or when SSE is
     enabled for floating point math (`-mfpmath=3Dsse`) if the GCC option
     `-frename-registers` is used. Default 32-bit builds do not
     experience the problem since they use '387 math.  It is not clear
     in what version of GCC this problem started but it was not noticed
     by the developers until the GCC 4.6 timeframe.  Other compilers do
     not suffer from this bug.  Please lobby the GCC project to fix
     this embarrassing performance bug.

   * Magick++: Any libraries or applications using Magick++ should be
     rebuilt in order to use this new release.  Libraries and
     applications will be able to continue to use prior versions of
     Magick++ without being re-built, while benefiting from updated C
     libraries, provided that the system supports library versioning.

Security Fixes:

   * Annotate: Some requestable text-subsitution attributes caused a
     crash.

   * All formats: Image dimensions are checked to assure that they are
     within limits before proceeding to read the image.

   * BMP: Fix hang (endless loop) for certain files.

   * DCM: Fix crash as well as small heap over-write.

   * DPX: Fix crash due to DPX file reporting more elements than it
     has.

   * MNG: Validate MHDR chunk length to avoid huge memory allocation
     and DOS.

   * PCX: Fix for CVE-2014-8355. Validate file header in order to avoid
     buffer overun later.

   * PDB: Detect arithmetic overflows when calculating buffer sizes.
     Fix crash in writer when image width is not even multiple of 16.
     Fix buffer overrun with 2 and 4-bit PDB image files.

   * PNM: Validate PGM, PPM, and PAM header MaxValue parameter to avoid
     crash on poorly-formed input.

   * PNG: Impose a 10-million limit on dimensions when reading a PNG
     file to avoid denial of service.

   * PSD: Avoid problems caused by huge PSD colormap size.

   * PSD: Fix small stack over-write if more than 99 layers are written
     to PSD format.

   * PSD: Returns immediately if pixel limit was exceeded.

   * RLE: URT RLE reader is now more robust with errant files.

   * SUN: Header validation is now made fully robust, and arithmetic
     overflows in buffer-size calculations are detected to avoid heap
     overwrite.

   * TIFF: Fix crashes for photometrics which may delivery one or three
     samples per pixel (was assuming always three).

   * VIFF: Fixes to prevent buffer overflow.  Validate colormap indexes.

   * Windows delegates: Fix unexpected argument splitting when invoking
     an external delegate program via delegates.mgk.

   * WPG: Fix use of NULL pointers.  Fix buffer overflows.

   * XPM: Detect truncated row and quit with error rather than
     over-running a buffer.

   * XWD: Improve header validation.  Added to UnstableCoderClass since
     the reader for this format should not be entrusted with
     untrustworthy input.

Bug fixes:

   * CIN: Fix problem with text attribute values which are not NULL
     terminated.  Validate sizes claimed by Cineon header.

   * Coverity: Fixes for many issues detected by Coverity scan (see
     ChangeLog).

   * DPX: Fix problem with text attribute values which are not NULL
     terminated.

   * DPX: Fix severe corruption of little-endian 32-bit packed output.
     Corruption was severe enough that it would have been noticed
     immediately.

   * Delegates: Fix possible memory leaks when invoking external
     application.

   * FITS: Properly validate values provided by file header.

   * GIF: Fix use of uninitialized data.

   * JBIG: Fix memory leaks.

   * JNG: Fix double-free error in error path.

   * JPEG: Verify the number of output components before attempting to
     decode the image.

   * Magick++: Image resolutionUnits() was not always returning correct
     value.

   * Magick++: Locking has not been working properly since the code was
     written in 1998.  Apparently the issue has not been significant
     enough to cause run-time issues.

   * ICO: Windows icon reader is now much more robust.

   * MIFF: Reader now quits with an error if zip or bzip2 stream is
     corrupted.

   * MAT: Fix memory leaks.

   * PALM: Reader now reads various input formats (up to version 2)
     correctly whereas it was crashing or otherwise malfunctioning
     before.  More work remains, particularly in the writer.

   * PCX: Eliminate memory leaks in error paths.

   * PDB: In PDB writer, void possible under-allocation due to
     arthimetic overflow when allocating packets.

   * PICT: Fix PICT reader crash with corrupted file.

   * PNG: Fix double-free error in error path.

   * PNG: Fixed handling of transparency when writing indexed PNG.

   * PNG: Avoid reading beyond the end of a tEXt keyword.

   * PSD: Fix error when reading PSDs files which have no layers.

   * RLA: Fix possible crash due to file header.

   * Signal Handling: Signal handling is now more robust and handles
     SIGSEGV and other critical signals.  The sole purpose of the
     default signal handling is to remove any temporary files and quit.
     An informative message is printed for signals other than SIGINT.

   * SUN: Sun raster reader was not completely robust. Now it is.

   * SWF: Fix pixel cache access errors in 'ping' mode.

   * Text annotation: An empty text string is no longer treated as an
     error.

   * Text annotation: Fix regression added in 1.3.19 which caused
     spurious drawing errors to be produced while rendering with text
     when all of the text is off the left-hand side of the image.

   * TIFF: Fix unreliable reading JBIG compressed files by forcing use
     of strip reader rather than sometimes using scanline reader (which
     libtiff's JBIG codec does not support).

   * TIFF: Fix reading or writing planar min-is-white or min-is-black
     images with an associated alpha channel.

   * WebP: WebP writer now writes truely lossless output when
     requested.

   * identify / GetImageStatistics(): Failed to compute statistics for
     the Black channel of CMYK image files.

   * VICAR: Fix problem with continuing to "read" data when there is no
     more data left to read.

   * WMF: Fix memory leaks.

   * WPG: Fix potential DOS due to long reads during an error
     condition.

   * XPM: Avoid strncpy() of overlapping memory.  Fixed memory leaks in
     error paths.  Fixed bad memory access caused by empty file.

New Features:

   * compose: Supports composite operator names similar to the major
     *Magick brand, without losing any any compatibility with previous
     naming.

   * ICO: Windows ICO reader now supports reading PNG-encoded files.

   * Magick++ Geometry: New methods limitPixels() and fillArea() to
     support '@' and '^' geometry qualifiers.  This enancement breaks
     the ABI due to previous use of inline methods and no place to put
     the new flags.

   * Magick++ Image::extent(): New method to place image on sized
     canvas of constant color using gravity.

   * Magick++ Image::formatExpression(): New method format a string
     based on a format similar to command-line -format.

   * Magick++ Image::resize(): New method to resize image specifying
     geometry, filter, and blur.

   * Magick++ STL extentImage: New New function object to invoke image
     extent method.

   * Magick++ Image::quiet().  New method which blocks (ignores)
     warning exceptions when passed a 'true' argument.

   * Resource limits: Added support for image Width and Height limits.
     Default image Width and Height limits are based on the range of a
     32-bit signed integer, even for 64-bit builds which may have
     sufficient numeric range to image an entire galaxy.  Limits may be
     increased as desired.

   * TIFF: Use define tiff:ignore-tags to ignore tags in 'corrupted'
     files with unknown and invalid tags.  Use to read TIFF files which
     otherwise can not be read due to errors.

   * TIFF: Use '-define tiff:report-warnings=3Dtrue' to enable that
     warnings reported by libtiff are thrown as warning exceptions so
     that they may be caught or will be reported at the gm
     command-line.

   * Windows Exceptions: A handler is registered (due to calling
     InitializeMagick()) to capture Windows Exceptions in a similar
     manner to the existing POSIX signal handler.  If an application is
     using the library and wants to provide it own Windows exception
     handling, then it should make any changes after invoking
     InitializeMagick().

Feature improvements:

   * None.

Performance Improvements:

   * None.

Windows Delegate Updates/Additions:

   * PNG: Update bundled libpng to 1.6.16.  Resolves known security
     issues.

   * FreeType: Update bundled Freetype to 2.5.4.  Resolves known
     security issues.

   * WebP: Update bundled WebP to 0.4.2 release.

   * WebP is auto-linked in Visual Studio.

Build Changes:

   * WebP is not included in the build when building with Visual Studio
     6 (1998 vintage compiler!) since it requires more modern C.

Behavior Changes:

   * AVI: Support for this format is removed since the implementation
     was worthless.

   * TIFF: Now uses YCbCr encoding when JPEG compression is requested
     for an RGB image.

--=20
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen=
/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
---559023410-94428632-1425174033=:3653
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/
---559023410-94428632-1425174033=:3653
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Graphicsmagick-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/graphicsmagick-announce

---559023410-94428632-1425174033=:3653--