GraphicsMagick 1.3.30 is released

GraphicsMagick 1.3.30 (a general-purpose image processing package) is
now available.  This release is the product of significant bug and
security fixes due to GraphicsMagick now participating in Google's
oss-fuzz project.  This release fixes 57 additional issues detected by
oss-fuzz.

While it is possible that there are some regressions due to the bug
fixes (please report any discovered), all users with exposure to
untrusted inputs are recommended to upgrade to this release
as soon as possible.


SHA1 checksums for release files
--------------------------------

3eb4e6b12540e64bd1d78913e221ec5f3573fb55  GraphicsMagick-1.3.30-Q16-win32-dll.exe
0089fc322981ae80d91c5f90677fd0b2248553ed  GraphicsMagick-1.3.30-Q16-win64-dll.exe
e72483764d1d3989551d942814e3e6b4e957d6af  GraphicsMagick-1.3.30-Q8-win32-dll.exe
958e0eeb7c6546af4d631b4fc0c6e6c456afb7a2  GraphicsMagick-1.3.30-Q8-win64-dll.exe
23ebf24cda305de63ce895cdfb45cc13b5d26d84  GraphicsMagick-1.3.30.tar.bz2
f4e8d73a2913327aad3f65069bce5fde6255e2ca  GraphicsMagick-1.3.30.tar.gz
34415ba815ed91b4b89d71bedb70440c26329271  GraphicsMagick-1.3.30.tar.lz
e9b1f6b84739eef3e112d4905e3d72b1e6983abd  GraphicsMagick-1.3.30.tar.xz
f9ada3357597cec76771bf26fd1828c47a353acf  GraphicsMagick-1.3.30-windows-source.7z


High-level summary of changes
-----------------------------

Special Issues:

* None

Security Fixes:

* GraphicsMagick is now participating in Google's oss-fuzz project due
   to the contributions and assistance of Alex Gaynor. Since February 4
   2018, 238 issues have been opened by oss-fuzz and 230 of those
   issues have been resolved.  The issues list is available at
   https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
   "graphicsmagick".  Issues are available for anyone to view and
   duplicate if they have been in "Verified" status for 30 days, or if
   they have been in "New" status for 90 days.  There are too many
   fixes to list here.  Please consult the GraphicsMagick ChangeLog
   file, Mercurial repository commit log, and the oss-fuzz issues list
   for details.

* SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
   PointInfo arrays.  This is another manefestation of CVE-2016-2317,
   which should finally be fixed correctly due to active
   detection/correction of pending overflow rather than using
   estimation.

Bug fixes:

* Many oss-fuzz fixes are bug fixes.

* Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).

* MIFF: Detect end of file while reading image directory.

* SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).

* The AlphaCompositePixel macro was producing wrong results when the
   output alpha value was not 100% opaque. This is a regression
   introduced in 1.3.29.

* TILE: Fix problem with tiling JPEG images because the size request
   used by the TILE algorithm was also causing re-scaling in the JPEG
   reader.  The problem is solved by stripping the size request before
   reading the image.

New Features:

* None

API Updates:

* The size of PrimitiveInfo (believed to be an internal/private
   structure but in a header which is installed, has been increased to
   store a 'flags' argument. This is intended to be an internal
   interface but but may be detected as an ABI change.

Feature improvements:

* None

Windows Delegate Updates/Additions:

* None

Build Changes:

* The oss-fuzz build script (fuzzing/oss-fuzz-build.sh) now includes
   many delegate libraries such as zlib, libpng, libtiff, libjpeg, and
   freetype, resulting in more comprehensive testing.  The Q16 build is
   now being tested rather than the 'configure' default of Q8.

Behavior Changes:

* JPEG: The JPEG reader now allows 3 warnings of any particular type
   before giving up on reading and throwing an exception.  This choice
   was made after observing files which produce hundreds of warnings
   and consume massive amounts of memory before reading the image data
   has even started.  It is currently unknown how many files which were
   previously accepted will be rejected by default.  The number of
   allowed warnings may be adjusted using '-define
   jpeg:max-warnings=<value>'.  The default limit will be adjusted
   based on reported user experiences and may be adjusted prior to
   compilation via the MaxWarningCount definition in coders/jpeg.c.


-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot