GraphicsMagick 1.3.26 released

GraphicsMagick 1.3.26 (http://www.graphicsmagick.org/) is primarily a 
bug/security fix release and users are recommended to update if 
possible.

There have been some new features added in this release. The most 
significant new feature is that the EXIF orientation tag (if any) is 
updated if the image is rotated.  Support is added in the existing 
APIs and -orient command-line option to update the EXIF orientation.

Users of the Windows binary installer package will notice that the 
IMDisplay display program, ImageMagickObject DLL, and PerlMagick for 
ActivePerl are no longer included in the installer.  These components 
may still be built from source code and existing binaries should work 
with later GraphicsMagick 1.3.X DLLs, provided that they are still 
built with Visual Studio 2008.

The following are the NEWS entries for this release:


Special Issues:

* None

Security Fixes:

* DPX: Fix excessive use of memory (DOS issue) due to file header
   claiming large image dimensions but insufficient backing
   data. (CVE-2017-10799).

* JNG: Fix memory leak when reading invalid JNG image (CVE-2017-8350).

* MAT: Fix excessive use of memory (DOS issue) due to continuing
   processing with insufficient data and claimed large image
   size. Verify each file extent to make sure that it is within range
   of file size. (CVE-2017-10800).

* META: Fix heap overflow while parsing 8BIM chunk (CVE-2016-7800).

* PCX: Fix denial of service issue.

* RLE: Fix abnomally slow operation (denial of service issue) with
   intentionally corrupt colormapped file.

* PICT: Fix possible buffer overflow vulnerability given suitably
   truncated input file.

* PNG: Enforce spec requirement that the dimensions of the JPEG
   embedded in a JDAT chunk must match the JHDR dimensions
   (CVE-2016-9830).

* PNG: Avoid NULL dereference when MAGN chunk processing fails.

* SCT: Fix stack-buffer read overflow (underflow?) while reading SCT
   header.

* SGI: Fix denial of service issues.  Delay large memory allocations
   until file header has fully passed sanity checks.

* TIFF: Fix out of bounds read when reading CMYKA TIFF which claims to
   have only 2 samples per pixel (CVE-2017-6335).

* TIFF: Fix out of bounds read when reading RGB TIFF which claims to
   have only 1 sample per pixel (CVE-2017-10794).

* WPG: Fix heap overflow (CVE-2016-7996).  Fix assertion crash
   (CVE-2016-7997).

Bug fixes:

* DifferenceImage(): Fix Fix all-black difference image if an input
   file is colormapped.

* EXIF orientation was not being properly detected for some files.

* -frame: The `import` command -frame handling was improperly
   implemented and was using already freed data.

* GIF: Fixes for "Excessive LZW string data" problem.

* Magick++: Bug fixes to PathSmoothCurvetoRel::operator() and
   PathSmoothCurvetoRel::operator().

* PAM: Support writing GRAYSCALE PAM format.

* PNG: Fix memory leaks.

* SVG: Fixed a memory leak.  Fixed a possible null pointer dereference.

* TclMagick: Problem that TkMagick could not resolve functions from
   TclMagick under Linux is fixed.

* TclMagick: Fix parser validatation in magickCmd() to avoid crash
   given a syntax error.

* TIFF: Fix for reading old JPEG files (avoids "Improper call to JPEG
   library in state 0. (LibJpeg).").

* TXT: Fixed memory leak.

* XCF: Error checking is improved.

New Features:

* EXIF rotation: Support is added such that the EXIF orientation tag
   is updated when the image is rotated.

* MAT: Now support reading multiple images from Matlab V4 format.

* Magick++: Orientation method now updates orientation in EXIF
   profile, if it exists.

* Magick++: Added Image attribute method which accepts a 'char *'
   argument, and will remove the attribute if the value argument is
   NULL.

* -orient: The -orient command line option now also updates the
   orientation in the EXIF profile, if it exists.

* PGX: Support PGX JPEG 2000 format for reading and writing (within
   the bounds of what JasPer supports).

* Wand API: Added MagickAutoOrientImage(),
   MagickGetImageOrientation(), MagickSetImageOrientation(),
   MagickRemoveImageOption(), and MagickClearException().


Feature improvements:

* None

Windows Delegate Updates/Additions:

* TIFF: Updated to libtiff 4.0.8.

Build Changes:

* TclMagick: Updated configure to use latest TEA tcl.m4 version 3.10.
   Support for AM_DISTCHECK_CONFIGURE_FLAGS so that 'make distcheck'
   remembers configuration options, and also to uninstall pkgIndex.tcl.

* VisualMagick Configure: A 'quantum' command line argument is added
   to set the default quantum depth in the wizard drop-down list.  This
   This allows setting the quantum depth when the /nowizard argument
   was supplied.

Behavior Changes:

* The installer for the Windows build no longer includes IMDisplay
   (simple display program), ImageMagickDLL, and PerlMagick for
   ActiveState Perl.  These are still available to build from the
   source tree.  All of these depend on proprietary components.


Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot