GraphicsMagick 1.3.34 is now available

GraphicsMagick 1.3.34 (a general-purpose image processing package, see
http://www.graphicsmagick.org/) is now available.  This release is the
product of significant bug and security fixes due to GraphicsMagick
participating in Google's oss-fuzz project.  This release fixes 38
issues detected by oss-fuzz (some of which were transient build
issues) as well as a number of issues reported via the SourceForge bug
tracker, or discovered via testing.

While it is possible that there are some regressions due to the bug
fixes (please report any discovered), all users with exposure to
untrusted inputs are recommended to upgrade to this release
as soon as possible.

SHA1 checksums for release files
--------------------------------

b0c6fe59a3d6b53b7cc3e71449029a7b7380aa21  GraphicsMagick-1.3.34-Q16-win32-dll.exe
b083ad27f61fa45aa088a833798f2829be5de177  GraphicsMagick-1.3.34-Q16-win64-dll.exe
33b83d6933e6db1b0ed0d2fbdba5870c2731380e  GraphicsMagick-1.3.34-Q8-win32-dll.exe
c99dfc3f09a41714f7cc2c3871510ff8a9f8f248  GraphicsMagick-1.3.34-Q8-win64-dll.exe
d7c68ca178811f19e90f1b25fb7e180d5da20a43  GraphicsMagick-1.3.34-windows-source.7z
91f736cd0b681663e51217075c1ec650a58cc2cb  GraphicsMagick-1.3.34.tar.bz2
15421cec6f1197c888c88607eed81aaea3815090  GraphicsMagick-1.3.34.tar.gz
df76c7a12ee05502a34ca7bf6e253dccdfbfd075  GraphicsMagick-1.3.34.tar.lz
cc1b77b7f2e4b0b345f97f7963704dbb4d0d3e3b  GraphicsMagick-1.3.34.tar.xz
f42cbde853bb5a73ba9f985e76292ca31384608b  GraphicsMagick-1.3.34.tar.zst

High-level summary of changes
-----------------------------

Special Issues:

* It has been discovered that the 'ICU' library (a perhaps 30MB C++
   library) which is now often a libxml2 dependendency causes huge
   process initialization overhead.  This is noticed as unexpected
   slowness when GraphicsMagick utilities are used to process small to
   medium sized files.  The time to initialize the 'ICU' library is
   often longer than the time that GraphicsMagick would otherwise
   require to read the input file, process the image, and write the
   output file.  If the 'ICU' dependency can not be avoided, then make
   sure to use the modules build so there is only impact for file
   formats which require libxml2.  Please lobby the 'ICU' library
   developers to change their implementation to avoid long start-up
   times due to merely linking with the library.

Security Fixes:

* GraphicsMagick is now participating in Google's oss-fuzz project due
   to the contributions and assistance of Alex Gaynor. Since February 4
   2018, 386 issues have been opened by oss-fuzz (some of which were
   benign build issues) and 376 of those issues have been resolved.
   The issues list is available at
   https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
   "graphicsmagick".  Issues are available for anyone to view and
   duplicate if they have been in "Verified" status for 30 days, or if
   they have been in "New" status for 90 days.  There are too many
   fixes to list here.  Please consult the GraphicsMagick ChangeLog
   file, Mercurial repository commit log, and the oss-fuzz issues list
   for details.

Bug fixes:

* DPS: Eliminate a memory leak.

* Debug Trace: Only output text to terminate an XML format log file if
   XML format is active.

* EXIF Parser: Detect non-terminal parsing and report an error.

* EXIF Parser: Eliminate heap buffer overflows.

* HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.

* MAT: Implement subimage/subrange support.

* MVG: Address non-terminal loops, excessive run-time, thrown
   assertions, divide-by-zero, heap overflow, and memory leaks.

* OpenModule(): Now properly case-insensitive, as it used to be.

* PCX: Verify that pixel region is not negative. Assure that opacity
   channel is initialized to opaqueOpacity.  Update DirectClass
   representation while PseudoClass representation is updated.  Improve
   read performance with uncompressed PCX.

* PICT: Fix heap overflow in PICT writer.

* PNG: Fix validation of raw profile length.

* PNG: Skip coalescing layers if there is only one layer.

* PNM: Fix denial of service opportunity by limiting the length of PNM
   comment text.

* WPG: Avoid Avoid dereferencing a null pointer.

* WPG: Implement subimage/subrange support.

* WPG: Improve performance when reading an embedded image.

* Wand library: In MagickClearException(), destroy any existing
   exception info before re-initializing the exception info or else
   there will be a memory leak.

* XPM: Rquire that image properties appear in the first 512 bytes of
   the XPM file header.

New Features:

* Visual Studio build supports JBIG and WebP compression in TIFF format.

API Updates:

* None

Feature improvements:

* Compliles clean using GCC 9.

Windows Delegate Updates/Additions:

* bzlib: bzip is updated to 1.0.8 release.

* jbig: jbigkit is updated to 2.1 release.

* lcms: lcms2 is updated to 2.9 release.

* libxml: libxml2 is updated to 2.9.10 release.

* png: libpng is updated to 1.6.37 release.

* tiff: libtiff is updated to 4.1.0 release.

* webp: libwebp is updated to the 1.0.3 release.

* zlib: zlib is updated to 1.2.11 release.

* TIFF: Now also supports reading JBIG-compressed TIFF, and
   reading/writing WebP-compressed TIFF.  A number of libtiff feature
   options which are now commonly enabled were disabled and are now
   enabled by default.

Build Changes:

* MinGW: Static and shared library builds were not working.  Only the
   modules build was actually working!

* Python scripts related to the build (enabled by
   --enable-maintainer-mode) are now compatible with Python 3.

* Now supports using Google gperftools tcmalloc library for the memory
   allocator.  This improves performance for certain repetitive
   work-loads and heavily-threaded algorithms.

* Configure now reports the status of zstd (FaceBook Zstandard)
   compression in its configuration summary.

* TclMagick: Address many issues mentioned by SourceForge issue #420
   "TclMagick issues and patch".

Behavior Changes:

* PNG: Post-processing to convert the image type in the PNG reader
   based on a specified magick prefix string is now disabled.  This can
   (and should) be done after the image has been returned.

* Trace Logging: The compiled-in logging default is always to stderr,
   which may be over-ridden using log.mgk as soon as it is loaded.

* Windows Build: Search registry key HKEY_CURRENT_USER as well as
   HKEY_LOCAL_MACHINE when searching for Ghostscript.  By following the
   procedure documented in SourceForge bug 615 "GhostScript
   installation check", this allows for local user installations
   without "administrator" privileges.

Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt