GraphicsMagick 1.3.31 is available

GraphicsMagick 1.3.31 (a general-purpose image processing package, see
http://www.graphicsmagick.org/) is now available.  This release is the
product of significant bug and security fixes due to GraphicsMagick
now participating in Google's oss-fuzz project.  This release fixes 49
additional issues detected by oss-fuzz.

While it is possible that there are some regressions due to the bug
fixes (please report any discovered), all users with exposure to
untrusted inputs are recommended to upgrade to this release
as soon as possible.

I am sad to report the passing of Glenn Randers-Pehrson, a
GraphicsMagick founding member and the creator of the 'gm' program.
Glenn was both a close friend and mentor to me. Besides creating the
'gm' program, Glenn authored support for the JNG, MNG, and PNG formats
and significantly improved the BMP format.  Glenn was instrumental at
developing the GraphicsMagick documentation based on the self-invented
<imdoc> format.  Glenn set up and moderated the SourceForge mailing
mailing lists.  GraphicsMagick would not be what it is today without
Glenn and he will always be remembered.


SHA1 checksums for release files
--------------------------------

be91ea018a1313b3e52088e1e36b83df6b6f2988  GraphicsMagick-1.3.31-Q16-win32-dll.exe
8b80ca47ec44d69da03a27c25a405213b962ef75  GraphicsMagick-1.3.31-Q16-win64-dll.exe
59ff46296da8bcb5b8dbc9e6e303408fb6a8d007  GraphicsMagick-1.3.31-Q8-win32-dll.exe
ed8c8d15018425d445a543f7184446676dee11f5  GraphicsMagick-1.3.31-Q8-win64-dll.exe
41f0a65819021706339c645ae345389d29c7e1b2  GraphicsMagick-1.3.31-windows-source.7z
f3d75d226a1614988900848f4b02a147bfd4bfe5  GraphicsMagick-1.3.31.tar.bz2
608af5f8a3b0d07b6750e478bce547798edd4741  GraphicsMagick-1.3.31.tar.gz
895de825dfabdedfe25736eb80edcc2bcf71290a  GraphicsMagick-1.3.31.tar.lz
06229cbb16cc9a3eff9b1bd0426a88fb6b806bd9  GraphicsMagick-1.3.31.tar.xz

High-level summary of changes
-----------------------------

Special Issues:

* Firmware and operating system updates to address the Spectre
   vulnerability (and possibly to some extent the Meltdown
   vulnerability) have substantially penalized GraphicsMagick's OpenMP
   performance.  Performance is reduced even with GCC 7 and 8's
   improved optimizers. There does not appear to be anything we can do
   about this.

Security Fixes:

* GraphicsMagick is now participating in Google's oss-fuzz project due
   to the contributions and assistance of Alex Gaynor. Since February 4
   2018, 292 issues have been opened by oss-fuzz and 279 of those
   issues have been resolved.  The issues list is available at
   https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
   "graphicsmagick".  Issues are available for anyone to view and
   duplicate if they have been in "Verified" status for 30 days, or if
   they have been in "New" status for 90 days.  There are too many
   fixes to list here.  Please consult the GraphicsMagick ChangeLog
   file, Mercurial repository commit log, and the oss-fuzz issues list
   for details.

Bug fixes:

* See above note about oss-fuzz fixes.

* CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
   issue 571.

* Drawing recursion is limited to 100 and may be tuned via the
   MAX_DRAWIMAGE_RECURSION pre-processor definition.

* Fix reading MIFF files using legacy keyword 'color-profile' for ICC
   color profile as was used by ImageMagick 4.2.9.

* Fix reading/writing files when 'magick' is specified in lower case.
   This bug was a regression in 1.3.30.


New Features:

* TIFF: Support Zstd compression in TIFF.  This requires libtiff
   4.0.10 or later.

* TIFF: Support WebP compression in TIFF.  This requires libtiff
   4.0.10 or later.

API Updates:

* MagickMonitor() is marked as deprecated.  Code should not be using
   this function any more.

Feature improvements:

* The progress monitor callbacks (registered using MagickMonitor() or
   MagickMonitorFormatted()) are serialized via a common semaphore
   rather than via critical sections in OpenMP loops.  OpenMP loops are
   updated to use OpenMP 'atomic' and 'flush' to update shared loop
   variables rather than using a OpenMP 'critical' construct, reducing
   contention.  Performance on some targets is observed to have been
   improved by this change.

Windows Delegate Updates/Additions:

* None

Build Changes:

* There was already a 'compare' command installed with the
   '--enable-magick-compat' configure option was used but it did not
   function.  Now it functions.  There was no `compare` command in
   ImageMagick 5.5.2 and this compare command is only roughly similar
   to a `compare` command in some subsequent ImageMagick release.

* Removed Remove Ghostscript library support (--with-gslib) from
   configure script.  The 'HasGS' pre-processor defines which were
   enabled by this remain in the source code so it is still possible to
   use this library if absolutely necessary (e.g. CPPFLAGS=-DHasGS
   LIBS=-lgs).

* No longer explicitly link with the OpenMP library when it will be
   supplied already due to CFLAGS.

Behavior Changes:

* JPEG: Libjpeg-turbo is allowed 1/5th the memory resource limit
   provided for Graphicsmagick via the cinfo->mem->max_memory_to_use
   option, which is part of the IJG JPEG API/ABI, but usually not
   supported there.  This feature works for libjpeg-turbo 1.5.2 and
   later.  Limiting the memory usage is useful since libjpeg-turbo may
   otherwise consume arbitrary amounts of memory even before
   Graphicsmagick is informed of the image dimensions.

* JPEG: The maximum number of JPEG progressive scans is limited to 50.
   Otherwise some technically valid files could be read for almost
   forever.

-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt