GraphicsMagick 1.3.25 is available

GraphicsMagick 1.3.25 is primarily a bug/security fix release and
users are recommended to update if possible. The only user-visible
feature change is that there is much more precision for elapsed time
indication on systems which have the clock_gettime() function. The
'identify' utility now shows 6 digits of seconds precision for elapsed
time.

Windows users will benefit from updates to latest WebP, libxml2,
lcms2, and libpng.

The following is an overview of changes since the previous release:

Special Issues:

* None

Security Fixes:

* EscapeParenthesis(): I was notified by Gustavo Grieco of a heap
   overflow in EscapeParenthesis() used in the text annotation code.
   While not being able to reproduce the issue, the implementation of
   this function is completely redone.

* Utah RLE: Reject truncated/absurd files which caused huge memory
   allocations and/or consumed huge CPU.  Problem was reported by
   Agostino Sarubbo based on testing with AFL.

* SVG/MVG: Fix another case of CVE-2016-2317 (heap buffer overflow) in
   the MVG rendering code (also impacts SVG).

* TIFF: Fix heap buffer read overflow while copying sized TIFF
   attributes.  Problem was reported by Agostino Sarubbo based on
   testing with AFL.

Bug fixes:

* GetToken(): Fix obscure bug (read beyond end of string buffer)
   noticed while parsing a MVG file.  This problem was reported by
   Gustavo Grieco.

* MVG rendering: Fix undesired hard errors when some objects were
   drawn outside of the image bounds.  Requests to draw objects
   entirely outside of the image should be silently ignored.

* MVG/SVG rendering: Fix gradient size sanity checks which were
   causing gradient requests to fail.  Due to a design weakness in that
   gradient images allocate resources rather than being computations at
   point of use, the maximum gradient image size is now hard-limited to
   5000x5000 pixels until the design problem is fixed.  Some SVG icons
   (as small as 8x8 pixels) authored using Inkscape request absurdly
   huge gradients.  Gradient sizes as large as 20,000x20,000 have been
   observed in SVG icon files delivered by packages on an Ubuntu Linux
   system.

* SVG: Fix some memory leaks which occur on parsing error.

New Features:

* None

Feature improvements:

* ElapsedTime(): Use clock_gettime() (when available with default
   linkage) to obtain elapsed time.

* DescribeImage(): Provide 6 digits of seconds precision in in elapsed
   time output.  Previously the resolution was rounded up to a full
   second.

Windows Delegate Updates/Additions:

* webp: Updated bundled libwebp to release 0.5.1.

* libxml: Updated bundled libxml2 to release 2.9.4.

* lcms: Updated bundled lcms2 to release 2.8.

* png: Update bundled libpng to release 1.6.24.

Build Changes:

* OpenMP is properly configured for clang 3.8 using its own '-lomp'
   rather than '-lgomp'.

Behavior Changes:

* SVG: Some SVG files may be rejected due to absurdly large gradient
   requests.

* The 'identify' and 'info' functionality only shows the pixel read
   rate if image was not read in 'ping' mode. Provide 6 digits of
   seconds precision in in elapsed time output.


Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

------------------------------------------------------------------------------