2019-08-11 15:25:21 by Thomas Klausner | Files touched by this commit (3557) |
Log message:
Bump PKGREVISIONs for perl 5.30.0
|
2019-08-08 22:56:40 by Nia Alarie | Files touched by this commit (4) |
Log message:
{p5-}GraphicsMagick: Update to 1.3.33
1.3.33 (July 20, 2019)
==========================
Special Issues:
* It has been discovered that the 'ICU' library (a perhaps 30MB C++
library) which is now often a libxml2 dependendency causes huge
process initialization overhead. This is noticed as unexpected
slowness when GraphicsMagick utilities are used to process small to
medium sized files. The time to initialize is often longer than the
time to read the input file, process the image, and write the output
file. If the 'ICU' dependency can not be avoided, then make sure to
use the modules build. Please lobby the 'ICU' library developers to
change their implementation to avoid long start-up times due to
merely linking with the library.
Security Fixes:
* GraphicsMagick is now participating in Google's oss-fuzz project due
to the contributions and assistance of Alex Gaynor. Since February 4
2018, 353 issues have been opened by oss-fuzz and 338 of those
issues have been resolved. The issues list is available at
https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
"graphicsmagick". Issues are available for anyone to view and
duplicate if they have been in "Verified" status for 30 days, or if
they have been in "New" status for 90 days. There are too many
fixes to list here. Please consult the GraphicsMagick ChangeLog
file, Mercurial repository commit log, and the oss-fuzz issues list
for details.
* Documentation has been added regarding security hazards due to
commands which support a '@filename' syntax.
* MontageImages(): Fix wrong length argument to strlcat() when
building montage directory, which could allow heap overwrite.
Bug fixes:
* PNG: Pass correct size value to strlcat() in module registration
code. This bug is noticed to cause problems for Apple's OS X and
Linux Alpine with musl libc. This fixes a regression introduced by
the 1.3.32 release.
* Re-implement command-line utility `'@'` file inclusion support for
`-comment`, `-draw`, `-format`, and `-label` which was removed for
the 1.3.32 release. The new implementation is isolated to
command-line utility implementation code rather than being deeply
embedded in the library and exposed in other usage contexts. This
fixes a regression introduced by the 1.3.32 release.
* CAPTION: The The CAPTION reader did not appear to work at all any
more. Now it works again, but still not very well.
* MagickXDisplayImage(): Fix heap overwrite of windows->image.name and
windows->image.icon_name buffers. This bug has surely existed since
early GraphicsMagick releases.
* MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
* AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
fixes a regression introduced by the 1.3.32 release.
* PNG: Fix saving to palette when mage has an alpha channel but no
color is marked as transparent.
* Compilation warnings in the Visual Studio WIN64 build due to the
'long' type being only 32-bits have been addressed.
New Features:
* None
API Updates:
* None
Feature improvements:
* None
Windows Delegate Updates/Additions:
* None
Build Changes:
* None
Behavior Changes:
* Support for `'@'` file inclusion support for `-comment`, `-draw`,
`-format`, and `-label` has been restored.
|
2019-07-22 00:26:08 by Thomas Klausner | Files touched by this commit (1256) |
Log message:
*: recursive bump for gdk-pixbuf2-2.38.1
|
2019-07-21 00:46:59 by Thomas Klausner | Files touched by this commit (595) |
Log message:
*: recursive bump for nettle 3.5.1
|
2019-06-18 15:30:53 by Adam Ciarcinski | Files touched by this commit (5) | |
Log message:
{p5-}GraphicsMagick: updated to 1.3.32
1.3.32:
Special Issues:
It has been discovered that the 'ICU' library (a perhaps 30MB C++ library) which \
is now often a libxml2 dependendency causes huge process initialization \
overhead. This is noticed as unexpected slowness when GraphicsMagick utilities \
are used to process small to medium sized files. The time to initialize is often \
longer than the time to read the input file, process the image, and write the \
output file. If the 'ICU' dependency can not be avoided, then make sure to use \
the modules build. Please lobby the 'ICU' library developers to change their \
implementation to avoid long start-up times due to merely linking with the \
library.
Security Fixes:
GraphicsMagick is now participating in Google's oss-fuzz project due to the \
contributions and assistance of Alex Gaynor. Since February 4 2018, 343 issues \
have been opened by oss-fuzz and 331 of those issues have been resolved. The \
issues list is available at https://bugs.chromium.org/p/oss-fuzz/issues/list \
under search term "graphicsmagick". Issues are available for anyone to \
view and duplicate if they have been in "Verified" status for 30 days, \
or if they have been in "New" status for 90 days. There are too many \
fixes to list here. Please consult the GraphicsMagick ChangeLog file, Mercurial \
repository commit log, and the oss-fuzz issues list for details.
BMP reader: Fix heap overflow in 32-bit build due to arithmetic overflow. Only \
happens if limits are changed from defaults.
BMP reader/writer: Improve buffer-size calculations to guard against buffer \
overflows.
DIB reader: Reject files which claim more than 8-bits per pixel but also claim \
to be colormapped.
DIB reader/writer: Improve buffer-size calculations to guard against buffer \
overflows.
MIFF reader: Detect end of file while reading RLE packets.
MIFF reader: Fix heap overflow (for some files using RLE compression) caused by \
a typo in the code.
MAT writer: Added missing error handling to avoid heap overflow.
MNG reader: Fixed a small heap buffer overflow.
SVG reader: Fixed a stack buffer overflow.
TGA writer: Fix heap overflow when image rows/columns are larger than 65535.
TIFF reader: Rationalize tile width/height to reject large tile sizes which are \
much larger than the image dimensions.
TIFF reader: Apply memory resource limits to strip and tile allocations.
WMF reader: Fixed a division by zero problem.
XWD reader: Many heap buffer overflows and uses of uninitialized data were fixed.
Pixel cache: Now apply resource limits to pixel nexus allocations using the same \
limits (total pixels, width, height, memory) as applied to the whole image since \
some requests are directly influenced by the input file. More tests are added \
for arithmetic overflow. Care was taken to minimize performance impact due to \
the many extra checks.
Bug fixes:
See above note about oss-fuzz fixes.
Fixed include order of magick/api.h vs wand/wand_symbols.h.
WriteImage(): Eliminate use of just-freed memory in clone_info->magick when \
throwing exception due to no support for format.
Magick++/lib/Magick++/Drawable.h: Fix use of clang diagnostic syntax.
DIB: Preserve PseudoClass opaque representation if ICO mask is opaque.
JPEG reader: Restore ability to access detailed image properties while in 'ping' \
mode.
JPEG reader: Base test for "Unreasonable dimensions" on original JPEG \
dimensions and not the scaled dimensions.
JPEG reader: Allow input files to have a compression ratio as high as 2500. \
Extremely compressed files were being rejected.
FreeType renderer: Fixed a memory leak.
PDF writer: Fixed a memory leak.
PDF writer: Fixed a thread safety problem.
PICT reader: Fix a thread safety problem.
Exception reporting: Throwing an exception was not thread safe. Now it is.
Exception reporting: Handle the case where some passed character strings refer \
to existing exception character strings.
Command-line parser now does not attempt to read a list of filenames from a file \
in '@name' syntax if the path '@name' exists. Previously it would attempt to \
read a list of file names from 'name' even if '@name' did exist.
Rendering: Short-circuit path parsing and return and error immediately if an \
error occurs.
New Features:
Added support for writing the Braille image format (by Samuel Thibault).
WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use sharp \
(and slow) RGB->YUV conversion") via -define webp:use-sharp-yuv=true.
The version command output now reports the OpenMP specification number rather \
than just the integer version identifier.
API Updates:
ReallocateImageColormap() added to re-allocate an existing colormap.
Some improperly-exposed globals are now static as they should have been.
|
2019-03-18 17:17:51 by Greg Troxel | Files touched by this commit (56) |
Log message:
Recursive bump for ghostscript default change
|
2018-11-20 11:19:29 by Adam Ciarcinski | Files touched by this commit (6) | |
Log message:
GraphicsMagick: updated to 1.3.31
1.3.31:
Special Issues:
Firmware and operating system updates to address the Spectre vulnerability (and \
possibly to some extent the Meltdown vulnerability) have substantially penalized \
GraphicsMagick's OpenMP performance. Performance is reduced even with GCC 7 and \
8's improved optimizers. There does not appear to be anything we can do about \
this.
Security Fixes:
GraphicsMagick is now participating in Google's oss-fuzz project due to the \
contributions and assistance of Alex Gaynor. Since February 4 2018, 292 issues \
have been opened by oss-fuzz and 279 of those issues have been resolved. The \
issues list is available at https://bugs.chromium.org/p/oss-fuzz/issues/list \
under search term "graphicsmagick". Issues are available for anyone to \
view and duplicate if they have been in "Verified" status for 30 days, \
or if they have been in "New" status for 90 days. There are too many \
fixes to list here. Please consult the GraphicsMagick ChangeLog file, Mercurial \
repository commit log, and the oss-fuzz issues list for details.
Bug fixes:
See above note about oss-fuzz fixes.
CINEON: Fix unexpected hang on a crafted Cineon image. SourceForge issue 571.
Drawing recursion is limited to 100 and may be tuned via the \
MAX_DRAWIMAGE_RECURSION pre-processor definition.
Fix reading MIFF files using legacy keyword 'color-profile' for ICC color \
profile as was used by ImageMagick 4.2.9.
Fix reading/writing files when 'magick' is specified in lower case. This bug was \
a regression in 1.3.30.
New Features:
TIFF: Support Zstd compression in TIFF. This requires libtiff 4.0.10 or later.
TIFF: Support WebP compression in TIFF. This requires libtiff 4.0.10 or later.
API Updates:
MagickMonitor() is marked as deprecated. Code should not be using this function \
any more.
Feature improvements:
The progress monitor callbacks (registered using MagickMonitor() or \
MagickMonitorFormatted()) are serialized via a common semaphore rather than via \
critical sections in OpenMP loops. OpenMP loops are updated to use OpenMP \
'atomic' and 'flush' to update shared loop variables rather than using a OpenMP \
'critical' construct, reducing contention. Performance on some targets is \
observed to have been improved by this change.
Build Changes:
There was already a 'compare' command installed with the \
'--enable-magick-compat' configure option was used but it did not function. Now \
it functions. There was no compare command in ImageMagick 5.5.2 and this compare \
command is only roughly similar to a compare command in some subsequent \
ImageMagick release.
Removed Remove Ghostscript library support (--with-gslib) from configure script. \
The 'HasGS' pre-processor defines which were enabled by this remain in the \
source code so it is still possible to use this library if absolutely necessary \
(e.g. CPPFLAGS=-DHasGS LIBS=-lgs).
No longer explicitly link with the OpenMP library when it will be supplied \
already due to CFLAGS.
Behavior Changes:
JPEG: Libjpeg-turbo is allowed 1/5th the memory resource limit provided for \
Graphicsmagick via the cinfo->mem->max_memory_to_use option, which is part \
of the IJG JPEG API/ABI, but usually not supported there. This feature works for \
libjpeg-turbo 1.5.2 and later. Limiting the memory usage is useful since \
libjpeg-turbo may otherwise consume arbitrary amounts of memory even before \
Graphicsmagick is informed of the image dimensions.
JPEG: The maximum number of JPEG progressive scans is limited to 50. Otherwise \
some technically valid files could be read for almost forever.
|
2018-11-14 23:22:54 by Klaus Klein | Files touched by this commit (1332) | |
Log message:
Revbump after cairo 1.16.0 update.
|
2018-11-12 04:53:16 by Ryo ONODERA | Files touched by this commit (1532) |
Log message:
Recursive revbump from hardbuzz-2.1.1
|
2018-08-22 11:48:07 by Thomas Klausner | Files touched by this commit (3558) |
Log message:
Recursive bump for perl5-5.28.0
|