Path to this page:
Subject: CVS commit: pkgsrc/graphics/GraphicsMagick
From: Thomas Klausner
Date: 2016-09-07 08:29:31
Message id: 20160907062931.B6AA8FBD1@cvs.NetBSD.org
Log Message:
Updated GraphicsMagick to 1.3.25.
1.3.25 (September 5, 2016)
==========================
Special Issues:
* None
Security Fixes:
* EscapeParenthesis(): I was notified by Gustavo Grieco of a heap
overflow in EscapeParenthesis() used in the text annotation code.
While not being able to reproduce the issue, the implementation of
this function is completely redone.
* Utah RLE: Reject truncated/absurd files which caused huge memory
allocations and/or consumed huge CPU. Problem was reported by
Agostino Sarubbo based on testing with AFL.
* SVG/MVG: Fix another case of CVE-2016-2317 (heap buffer overflow) in
the MVG rendering code (also impacts SVG).
* TIFF: Fix heap buffer read overflow while copying sized TIFF
attributes. Problem was reported by Agostino Sarubbo based on
testing with AFL.
Bug fixes:
* GetToken(): Fix obscure bug (read beyond end of string buffer)
noticed while parsing a MVG file. This problem was reported by
Gustavo Grieco.
* MVG rendering: Fix undesired hard errors when some objects were
drawn outside of the image bounds. Requests to draw objects
entirely outside of the image should be silently ignored.
* MVG/SVG rendering: Fix gradient size sanity checks which were
causing gradient requests to fail. Due to a design weakness in that
gradient images allocate resources rather than being computations at
point of use, the maximum gradient image size is now hard-limited to
5000x5000 pixels until the design problem is fixed. Some SVG icons
(as small as 8x8 pixels) authored using Inkscape request absurdly
huge gradients. Gradient sizes as large as 20,000x20,000 have been
observed in SVG icon files delivered by packages on an Ubuntu Linux
system.
* SVG: Fix some memory leaks which occur on parsing error.
New Features:
* None
Feature improvements:
* ElapsedTime(): Use clock_gettime() (when available with default
linkage) to obtain elapsed time.
* DescribeImage(): Provide 6 digits of seconds precision in in elapsed
time output. Previously the resolution was rounded up to a full
second.
Windows Delegate Updates/Additions:
* webp: Updated bundled libwebp to release 0.5.1.
* libxml: Updated bundled libxml2 to release 2.9.4.
* lcms: Updated bundled lcms2 to release 2.8.
* png: Update bundled libpng to release 1.6.24.
Build Changes:
* OpenMP is properly configured for clang 3.8 using its own '-lomp'
rather than '-lgomp'.
Behavior Changes:
* SVG: Some SVG files may be rejected due to absurdly large gradient
requests.
* The 'identify' and 'info' functionality only shows the pixel read
rate if image was not read in 'ping' mode. Provide 6 digits of
seconds precision in in elapsed time output.
Files: