RubyGems - laag-libtiff - Versions diffs - 4.0.9.0 - Mend

laag-libtiff 4.0.9.0

Files changed (629) hide show

data/vendor/gitlab.com/libtiff/libtiff/html/v4.0.7.html ADDED Viewed

@@ -0,0 +1,411 @@
+<HTML>
+<HEAD>
+<TITLE>
+	Changes in TIFF v4.0.7
+</TITLE>
+</HEAD>
+<BODY BGCOLOR=white>
+<FONT FACE="Helvetica, Arial, Sans">
+<BASEFONT SIZE=4>
+<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B>
+<BASEFONT SIZE=3>
+<UL>
+<HR SIZE=4 WIDTH=65% ALIGN=left>
+<B>Current Version</B>: v4.0.7<BR>
+<B>Previous Version</B>: <A HREF=v4.0.6.html>v4.0.6</a><BR>
+<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff">
+download.osgeo.org</a>, directory pub/libtiff</A><BR>
+<B>Master HTTP Site #1</B>: <A HREF="http://www.simplesystems.org/libtiff/">
+http://www.simplesystems.org/libtiff/</a><BR>
+<B>Master HTTP Site #2</B>: <A HREF="http://libtiff.maptools.org/">
+http://libtiff.maptools.org/</a>
+<HR SIZE=4 WIDTH=65% ALIGN=left>
+</UL>
+<P>
+This document describes the changes made to the software between the
+<I>previous</I> and <I>current</I> versions (see above).  If you don't
+find something listed here, then it was not done in this timeframe, or
+it was not considered important enough to be mentioned.  The following
+information is located here:
+<UL>
+<LI><A HREF="#highlights">Major Changes</A>
+<LI><A HREF="#configure">Changes in the software configuration</A>
+<LI><A HREF="#libtiff">Changes in libtiff</A>
+<LI><A HREF="#tools">Changes in the tools</A>
+<LI><A HREF="#contrib">Changes in the contrib area</A>
+</UL>
+<p>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A>
+<UL>
+	<LI> The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff,
+        sgisv, and ycbcr are completely removed from the distribution.
+        These tools were written in the late 1980s and early 1990s for
+        test and demonstration purposes.  In some cases the tools were
+        never updated to support updates to the file format, or the
+        file formats are now rarely used.  In all cases these tools
+        increased the libtiff security and maintenance exposure beyond
+        the value offered by the tool.
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A>
+<UL>
+  <LI> None
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A>
+<UL>
+    <LI> libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not
+        dereference NULL pointer when values of tags with
+        TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are
+        0-byte arrays.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression
+        introduced by previous fix done on 2016-11-11 for
+        CVE-2016-9297).  Reported by Henri Salo. Assigned as
+        CVE-2016-9448
+    <LI> libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted() when
+        requesting Predictor tag and that the zip/lzw codec is not
+        configured.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2591
+    <LI> libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure
+        that values of tags with TIFF_SETGET_C16_ASCII /
+        TIFF_SETGET_C32_ASCII access are null terminated, to avoid
+        potential read outside buffer in _TIFFPrintField().  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2590
+    <LI> libtiff/tif_dirread.c: reject images with OJPEG compression
+        that have no TileOffsets/StripOffsets tag, when OJPEG
+        compression is disabled. Prevent null pointer dereference in
+        TIFFReadRawStrip1() and other functions that expect
+        td_stripbytecount to be non NULL.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2585
+    <LI> libtiff/tif_strip.c: make TIFFNumberOfStrips() return the
+        td->td_nstrips value when it is non-zero, instead of
+        recomputing it. This is needed in TIFF_STRIPCHOP mode where
+        td_nstrips is modified. Fixes a read outsize of array in
+        tiffsplit (or other utilities using TIFFNumberOfStrips()).
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587
+        (CVE-2016-9273)
+    <LI> libtiff/tif_predict.h, libtiff/tif_predict.c: Replace
+        assertions by runtime checks to avoid assertions in debug
+        mode, or buffer overflows in release mode. Can happen when
+        dealing with unusual tile size like YCbCr with
+        subsampling. Reported as MSVR 35105 by Axel Souchet & Vishal
+        Chauhan from the MSRC Vulnerabilities & Mitigations
+    <LI> libtiff/tif_dir.c: discard values of SMinSampleValue and
+        SMaxSampleValue when they have been read and the value of
+        SamplesPerPixel is changed afterwards (like when reading a
+        OJPEG compressed image with a missing SamplesPerPixel tag, and
+        whose photometric is RGB or YCbCr, forcing SamplesPerPixel
+        being 3). Otherwise when rewriting the directory (for example
+        with tiffset, we will expect 3 values whereas the array had
+        been allocated with just one), thus causing a out of bound
+        read access.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2500
+        (CVE-2014-8127, duplicate: CVE-2016-3658)
+    <LI> libtiff/tif_dirwrite.c: avoid null pointer dereference on
+        td_stripoffset when writing directory, if FIELD_STRIPOFFSETS
+        was artificially set for a hack case in OJPEG case.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2500
+        (CVE-2014-8127, duplicate: CVE-2016-3658)
+    <LI> libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to
+        read floating point images.
+    <LI> libtiff/tif_predict.c (PredictorSetup): Enforce
+        bits-per-sample requirements of floating point predictor (3).
+        Fixes CVE-2016-3622 "Divide By Zero in the tiff2rgba tool."
+    <LI> libtiff/tif_pixarlog.c: fix out-of-bounds write vulnerabilities
+        in heap allocated buffers. Reported as MSVR 35094. Discovered by
+        Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
+        Mitigations team.
+    <LI> libtiff/tif_write.c: fix issue in error code path of
+        TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp
+        members. I'm not completely sure if that could happen in
+        practice outside of the odd behaviour of t2p_seekproc() of
+        tiff2pdf). The report points that a better fix could be to
+        check the return value of TIFFFlushData1() in places where it
+        isn't done currently, but it seems this patch is enough.
+        Reported as MSVR 35095. Discovered by Axel Souchet & Vishal
+        Chauhan & Suha Can from the MSRC Vulnerabilities & Mitigations
+        team.
+    <LI> libtiff/tif_pixarlog.c: Fix write buffer overflow in
+        PixarLogEncode if more input samples are provided than
+        expected by PixarLogSetupEncode.  Idea based on
+        libtiff-CVE-2016-3990.patch from
+        libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with
+        different and simpler check. (bugzilla #2544)
+    <LI> libtiff/tif_read.c: Fix out-of-bounds read on memory-mapped
+        files in TIFFReadRawStrip1() and TIFFReadRawTile1() when
+        stripoffset is beyond tmsize_t max value (reported by Mathias
+        Svensson)
+    <LI> libtiff/tif_read.c: make TIFFReadEncodedStrip() and
+        TIFFReadEncodedTile() directly use user provided buffer when
+        no compression (and other conditions) to save a memcpy()
+    <LI> libtiff/tif_write.c: make TIFFWriteEncodedStrip() and
+        TIFFWriteEncodedTile() directly use user provided buffer when
+        no compression to save a memcpy().
+    <LI> libtiff/tif_luv.c: validate that for COMPRESSION_SGILOG and
+        PHOTOMETRIC_LOGL, there is only one sample per pixel. Avoid
+        potential invalid memory write on corrupted/unexpected images
+        when using the TIFFRGBAImageBegin() interface (reported by
+        Clay Wood)
+    <LI> libtiff/tif_pixarlog.c: fix potential buffer write overrun in
+        PixarLogDecode() on corrupted/unexpected images (reported by
+        Mathias Svensson) (CVE-2016-5875)
+    <LI> libtiff/libtiff.def: Added _TIFFMultiply32 and
+        _TIFFMultiply64 to libtiff.def
+     <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Add a '1' to the
+        HAVE_SNPRINTF definition.
+    <LI> libtiff/tif_config.vc.h (HAVE_SNPRINTF): Applied patch by
+        Edward Lam to define HAVE_SNPRINTF for Visual Studio 2015.
+    <LI> libtiff/tif_dirread.c: when compiled with DEFER_STRILE_LOAD,
+        fix regression, introduced on 2014-12-23, when reading a
+        one-strip file without a StripByteCounts tag. GDAL #6490
+    <LI> libtiff/*: upstream typo fixes (mostly contributed by Kurt
+        Schwehr) coming from GDAL internal libtiff
+    <LI> libtiff/tif_fax3.h: make Param member of TIFFFaxTabEnt
+        structure a uint16 to reduce size of the binary.
+    <LI> libtiff/tif_read.c, tif_dirread.c: fix indentation issues
+        raised by GCC 6 -Wmisleading-indentation
+    <LI> libtiff/tif_pixarlog.c: avoid zlib error messages to pass a
+        NULL string to %s formatter, which is undefined behaviour in
+        sprintf().
+    <LI> libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
+        triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
+        (bugzilla #2508)
+    <LI> libtiff/tif_luv.c: fix potential out-of-bound writes in
+        decode functions in non debug builds by replacing assert()s by
+        regular if checks (bugzilla #2522).  Fix potential
+        out-of-bound reads in case of short input data.
+    <LI> libtiff/tif_getimage.c: fix out-of-bound reads in
+        TIFFRGBAImage interface in case of unsupported values of
+        SamplesPerPixel/ExtraSamples for LogLUV / CIELab. Add explicit
+        call to TIFFRGBAImageOK() in TIFFRGBAImageBegin(). Fix
+        CVE-2015-8665 reported by limingxing and CVE-2015-8683
+        reported by zzf of Alibaba.
+    <LI> libtiff/tif_dirread.c: workaround false positive warning of
+        Clang Static Analyzer about null pointer dereference in
+        TIFFCheckDirOffset().
+    <LI> libtiff/tif_fax3.c: remove dead assignment in
+        Fax3PutEOLgdal(). Found by Clang Static Analyzer
+    <LI> libtiff/tif_dirwrite.c: fix truncation to 32 bit of file
+        offsets in TIFFLinkDirectory() and TIFFWriteDirectorySec()
+        when aligning directory offsets on a even offset (affects
+        BigTIFF). This was a regression of the changeset of
+        2015-10-19.
+    <LI> libtiff/tif_write.c: TIFFWriteEncodedStrip() and
+        TIFFWriteEncodedTile() should return -1 in case of failure of
+        tif_encodestrip() as documented
+    <LI> libtiff/tif_dumpmode.c: DumpModeEncode() should return 0 in
+        case of failure so that the above mentionned functions detect
+        the error.
+    <LI> libtiff/*.c: fix MSVC warnings related to cast shortening and
+        assignment within conditional expression
+    <LI> libtiff/*.c: fix clang -Wshorten-64-to-32 warnings
+    <LI> libtiff/tif_dirread.c: prevent reading ColorMap or
+        TransferFunction if BitsPerPixel > 24, so as to avoid huge
+        memory allocation and file read attempts
+    <LI> libtiff/tif_dirread.c: remove duplicated assignment (reported
+        by Clang static analyzer)
+    <LI> libtiff/tif_dir.c, libtiff/tif_dirinfo.c,
+        libtiff/tif_compress.c, libtiff/tif_jpeg_12.c: suppress
+        warnings about 'no previous declaration/prototype'
+    <LI> libtiff/tiffiop.h, libtiff/tif_dirwrite.c: suffix constants
+        by U to fix 'warning: negative integer implicitly converted to
+        unsigned type' warning (part of -Wconversion)
+    <LI> libtiff/tif_dir.c, libtiff/tif_dirread.c,
+          libtiff/tif_getimage.c, libtiff/tif_print.c: fix -Wshadow
+          warnings (only in libtiff/)
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!-------------------------------------------------------------------------->
+<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A>
+<UL>
+    <LI> tools/Makefile.am: The libtiff tools bmp2tiff, gif2tiff,
+        ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed
+        from the distribution.  The libtiff tools rgb2ycbcr and
+        thumbnail are only built in the build tree for testing.  Old
+        files are put in new 'archive' subdirectory of the source
+        repository, but not in distribution archives.  These changes
+        are made in order to lessen the maintenance burden.
+    <LI> tools/tiff2pdf.c: avoid undefined behaviour related to
+        overlapping of source and destination buffer in memcpy() call
+        in t2p_sample_rgbaa_to_rgb() Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2577
+    <LI> tools/tiff2pdf.c: fix potential integer overflows on 32 bit
+        builds in t2p_read_tiff_size() Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2576
+    <LI> tools/fax2tiff.c: fix segfault when specifying -r without
+        argument. Patch by Yuriy M. Kaminskiy.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2572
+    <LI> tools/tiffinfo.c: fix out-of-bound read on some tiled images.
+        (http://bugzilla.maptools.org/show_bug.cgi?id=2517)
+    <LI> tools/tiffcrop.c: fix multiple uint32 overflows in
+        writeBufferToSeparateStrips(), writeBufferToContigTiles() and
+        writeBufferToSeparateTiles() that could cause heap buffer
+        overflows.  Reported by Henri Salo from Nixu Corporation.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592
+    <LI> tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
+        readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel
+        Souchet & Vishal Chauhan from the MSRC Vulnerabilities &
+        Mitigations team.
+    <LI> tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on
+        JPEG compressed images. Reported by Tyler Bohan of Cisco Talos
+        as TALOS-CAN-0187 / CVE-2016-5652.  Also prevents writing 2
+        extra uninitialized bytes to the file stream.
+    <LI> tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
+        tile width vs image width. Reported as MSVR 35103
+        by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
+        Mitigations team.
+    <LI> tools/tiff2pdf.c: fix read -largely- outsize of buffer in
+        t2p_readwrite_pdf_image_tile(), causing crash, when reading a
+        JPEG compressed image with TIFFTAG_JPEGTABLES length being
+        one.  Reported as MSVR 35101 by Axel Souchet and Vishal
+        Chauhan from the MSRC Vulnerabilities & Mitigations team.
+    <LI> tools/tiffcp.c: fix read of undefined variable in case of
+        missing required tags. Found on test case of MSVR 35100.
+    <LI> tools/tiffcrop.c: fix read of undefined buffer in
+        readContigStripsIntoBuffer() due to uint16 overflow. Probably
+        not a security issue but I can be wrong. Reported as MSVR
+        35100 by Axel Souchet from the MSRC Vulnerabilities &
+        Mitigations team.
+    <LI> tools/tiffcrop.c: fix various out-of-bounds write
+        vulnerabilities in heap or stack allocated buffers. Reported
+        as MSVR 35093, MSVR 35096 and MSVR 35097. Discovered by Axel
+        Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
+        Mitigations team.
+    <LI> tools/tiff2pdf.c: fix out-of-bounds write vulnerabilities in
+        heap allocate buffer in t2p_process_jpeg_strip(). Reported as
+        MSVR 35098. Discovered by Axel Souchet and Vishal Chauhan from
+        the MSRC Vulnerabilities & Mitigations team.
+    <LI> tools/tiff2bw.c: fix weight computation that could result of
+        color value overflow (no security implication). Fix bugzilla
+        #2550.  Patch by Frank Freudenberg.
+    <LI> tools/rgb2ycbcr.c: validate values of -v and -h parameters to
+        avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)
+    <LI> tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
+        From patch libtiff-CVE-2016-3991.patch from
+        libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla
+        #2543)
+    <LI> tools/tiff2rgba.c: Fix integer overflow in size of allocated
+        buffer, when -b mode is enabled, that could result in
+        out-of-bounds write. Based initially on patch
+        tiff-CVE-2016-3945.patch from libtiff-4.0.3-25.el7_2.src.rpm
+        by Nikola Forro, with correction for invalid tests that
+        rejected valid files. (bugzilla #2545)
+    <LI> tools/tiffcrop.c: Avoid access outside of stack allocated
+        array on a tiled separate TIFF with more than 8 samples per
+        pixel.  Reported by Kaixiang Zhang of the Cloud Security Team,
+        Qihoo 360 (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 /
+        #2559)
+    <LI> tools/tiffdump.c: fix a few misaligned 64-bit reads warned by
+        -fsanitize
+    <LI> tools/tiffdump.c (ReadDirectory): Remove uint32 cast to
+        _TIFFmalloc() argument which resulted in Coverity report.
+        Added more mutiplication overflow checks.
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A>
+<UL>
+  <LI> None
+</UL>
+Last updated $Date: 2016-11-19 17:47:40 $.
+</BODY>
+</HTML>

data/vendor/gitlab.com/libtiff/libtiff/html/v4.0.8.html ADDED Viewed

@@ -0,0 +1,445 @@
+<HTML>
+<HEAD>
+<TITLE>
+	Changes in TIFF v4.0.8
+</TITLE>
+</HEAD>
+<BODY BGCOLOR=white>
+<FONT FACE="Helvetica, Arial, Sans">
+<BASEFONT SIZE=4>
+<B><FONT SIZE=+3>T</FONT>IFF <FONT SIZE=+2>C</FONT>HANGE <FONT SIZE=+2>I</FONT>NFORMATION</B>
+<BASEFONT SIZE=3>
+<UL>
+<HR SIZE=4 WIDTH=65% ALIGN=left>
+<B>Current Version</B>: v4.0.8<BR>
+<B>Previous Version</B>: <A HREF=v4.0.7.html>v4.0.7</a><BR>
+<B>Master FTP Site</B>: <A HREF="ftp://download.osgeo.org/libtiff">
+download.osgeo.org</a>, directory pub/libtiff</A><BR>
+<B>Master HTTP Site #1</B>: <A HREF="http://www.simplesystems.org/libtiff/">
+http://www.simplesystems.org/libtiff/</a><BR>
+<B>Master HTTP Site #2</B>: <A HREF="http://libtiff.maptools.org/">
+http://libtiff.maptools.org/</a>
+<HR SIZE=4 WIDTH=65% ALIGN=left>
+</UL>
+<P>
+This document describes the changes made to the software between the
+<I>previous</I> and <I>current</I> versions (see above).  If you don't
+find something listed here, then it was not done in this timeframe, or
+it was not considered important enough to be mentioned.  The following
+information is located here:
+<UL>
+<LI><A HREF="#highlights">Major Changes</A>
+<LI><A HREF="#configure">Changes in the software configuration</A>
+<LI><A HREF="#libtiff">Changes in libtiff</A>
+<LI><A HREF="#tools">Changes in the tools</A>
+<LI><A HREF="#contrib">Changes in the contrib area</A>
+</UL>
+<p>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="highlights"><B><FONT SIZE=+3>M</FONT>AJOR CHANGES:</B></A>
+<UL>
+	<LI> None
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="configure"><B><FONT SIZE=+3>C</FONT>HANGES IN THE SOFTWARE CONFIGURATION:</B></A>
+<UL>
+  <LI> None
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="libtiff"><B><FONT SIZE=+3>C</FONT>HANGES IN LIBTIFF:</B></A>
+<UL>
+    <LI> libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis
+        to fix cppcheck clarifyCalculation warnings *
+        libtiff/tif_predict.c, libtiff/tif_print.c: fix printf
+        unsigned vs signed formatting (cppcheck
+        invalidPrintfArgType_uint warnings)
+    <LI> libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
+        TIFFReadEncodedStrip() that caused an integer division by
+        zero.  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2596
+    <LI> libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
+        buffer overflow on generation of PixarLog / LUV compressed
+        files, with ColorMap, TransferFunction attached and nasty
+        plays with bitspersample.  The fix for LUV has not been
+        tested, but suffers from the same kind of issue of PixarLog.
+        Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2604
+    <LI> libtiff/tif_strip.c: revert the change in
+        TIFFNumberOfStrips() done for
+        http://bugzilla.maptools.org/show_bug.cgi?id=2587 /
+        CVE-2016-9273 since the above change is a better fix that
+        makes it unnecessary.
+    <LI> libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip()
+        to instanciate compute ntrips as
+        TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a
+        logic based on the total size of data. Which is faulty is the
+        total size of data is not sufficient to fill the whole image,
+        and thus results in reading outside of the
+        StripByCounts/StripOffsets arrays when using
+        TIFFReadScanline().  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2608.
+    <LI> libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of
+        failure in OJPEGPreDecode(). This will avoid a divide by zero,
+        and potential other issues.  Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
+    <LI> libtiff/tif_write.c: fix misleading indentation as warned by GCC.
+    <LI> libtiff/tif_fax3.h: revert change done on 2016-01-09 that
+        made Param member of TIFFFaxTabEnt structure a uint16 to
+        reduce size of the binary. It happens that the Hylafax
+        software uses the tables that follow this typedef
+        (TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable),
+        although they are not in a public libtiff header.  Raised by
+        Lee Howard.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2636
+    <LI> libtiff/tiffio.h, libtiff/tif_getimage.c: add
+        TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants of
+        the functions without ext, with an extra argument to control
+        the stop_on_error behaviour.
+    <LI> libtiff/tif_getimage.c: fix potential memory leaks in error
+        code path of TIFFRGBAImageBegin().  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2627
+    <LI> libtiff/tif_jpeg.c: increase libjpeg max memory usable to 10
+        MB instead of libjpeg 1MB default. This helps when creating
+        files with "big" tile, without using libjpeg temporary files.
+        Related to https://trac.osgeo.org/gdal/ticket/6757
+    <LI> libtiff/tif_jpeg.c: avoid integer division by zero in
+        JPEGSetupEncode() when horizontal or vertical sampling is set
+        to 0.  Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653
+    <LI> libtiff/tif_dirwrite.c: in
+        TIFFWriteDirectoryTagCheckedRational, replace assertion by
+        runtime check to error out if passed value is strictly
+        negative.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2535
+    <LI> libtiff/tif_dirread.c: avoid division by floating point 0 in
+        TIFFReadDirEntryCheckedRational() and
+        TIFFReadDirEntryCheckedSrational(), and return 0 in that case
+        (instead of infinity as before presumably) Apparently some
+        sanitizers do not like those divisions by zero.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2644
+    <LI> libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement
+        various clampings of double to other data types to avoid
+        undefined behaviour if the output range isn't big enough to
+        hold the input value.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2643
+        http://bugzilla.maptools.org/show_bug.cgi?id=2642
+        http://bugzilla.maptools.org/show_bug.cgi?id=2646
+        http://bugzilla.maptools.org/show_bug.cgi?id=2647
+    <LI> libtiff/tif_jpeg.c: validate BitsPerSample in
+        JPEGSetupEncode() to avoid undefined behaviour caused by
+        invalid shift exponent.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2648
+    <LI> libtiff/tif_read.c: avoid potential undefined behaviour on
+        signed integer addition in TIFFReadRawStrip1() in isMapped()
+        case.  Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
+    <LI> libtiff/tif_getimage.c: add explicit uint32 cast in
+        putagreytile to avoid UndefinedBehaviorSanitizer warning.
+        Patch by Nicolás Peña.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2658
+    <LI> libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc()
+        to zero initialize tif_rawdata.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2651
+    <LI> libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add
+    _TIFFcalloc()
+    <LI> libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in
+        Encode functions instead of -1 when TIFFFlushData1() fails.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130
+    <LI> libtiff/tif_ojpeg.c: fix leak in
+        OJPEGReadHeaderInfoSecTablesQTable,
+        OJPEGReadHeaderInfoSecTablesDcTable and
+        OJPEGReadHeaderInfoSecTablesAcTable when read fails.  Patch by
+        Nicolás Peña.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2659
+    <LI> libtiff/tif_jpeg.c: only run JPEGFixupTagsSubsampling() if
+        the YCbCrSubsampling tag is not explicitly present. This helps
+        a bit to reduce the I/O amount when the tag is present
+        (especially on cloud hosted files).
+    <LI> libtiff/tif_lzw.c: in LZWPostEncode(), increase, if
+        necessary, the code bit-width after flushing the remaining
+        code and before emitting the EOI code.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=1982
+    <LI> libtiff/tif_pixarlog.c: fix memory leak in error code path of
+        PixarLogSetupDecode(). Patch by Nicolás Peña.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2665
+    <LI> libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7
+        -Wimplicit-fallthrough warnings.
+    <LI> libtiff/tif_dirread.c: fix memory leak in non
+        DEFER_STRILE_LOAD mode (ie default) when there is both a
+        StripOffsets and TileOffsets tag, or a StripByteCounts and
+        TileByteCounts Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2689
+    <LI> libtiff/tif_ojpeg.c: fix potential memory leak in
+        OJPEGReadHeaderInfoSecTablesQTable,
+        OJPEGReadHeaderInfoSecTablesDcTable and
+        OJPEGReadHeaderInfoSecTablesAcTable Patch by Nicolás Peña.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670
+    <LI> libtiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.
+        Patch by Alan Coopersmith + complement by myself.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2673
+    <LI> libtiff/tif_read.c: TIFFFillStrip(): add limitation to the
+        number of bytes read in case td_stripbytecount[strip] is
+        bigger than reasonable, so as to avoid excessive memory
+        allocation.
+    <LI> libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c: fix memory
+        leak when the underlying codec (ZIP, PixarLog) succeeds its
+        setupdecode() method, but PredictorSetup fails.  Credit to
+        OSS-Fuzz (locally run, on GDAL)
+    <LI> libtiff/tif_read.c: TIFFFillStrip() and TIFFFillTile(): avoid
+        excessive memory allocation in case of shorten files.  Only
+        effective on 64 bit builds and non-mapped cases.  Credit to
+        OSS-Fuzz (locally run, on GDAL)
+    <LI> libtiff/tif_read.c: TIFFFillStripPartial() / TIFFSeek(),
+        avoid potential integer overflows with read_ahead in
+        CHUNKY_STRIP_READ_SUPPORT mode. Should
+        especially occur on 32 bit platforms.
+    <LI> libtiff/tif_read.c: TIFFFillStripPartial(): avoid excessive
+        memory allocation in case of shorten files.  Only effective on
+        64 bit builds.  Credit to OSS-Fuzz (locally run, on GDAL)
+    <LI> libtiff/tif_read.c: update tif_rawcc in
+        CHUNKY_STRIP_READ_SUPPORT mode with tif_rawdataloaded when
+        calling TIFFStartStrip() or TIFFFillStripPartial(). This
+        avoids reading beyond tif_rawdata when bytecount >
+        tif_rawdatasize.  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.
+        Credit to OSS-Fuzz
+    <LI> libtiff/tif_color.c: avoid potential int32 overflow in
+        TIFFYCbCrToRGBInit() Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533
+        Credit to OSS-Fuzz
+    <LI> libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32
+        overflows in multiply_ms() and add_ms().  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558
+        Credit to OSS-Fuzz
+    <LI> libtiff/tif_packbits.c: fix out-of-buffer read in
+        PackBitsDecode() Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
+        Credit to OSS-Fuzz
+    <LI> libtiff/tif_luv.c: LogL16InitState(): avoid excessive memory
+        allocation when RowsPerStrip tag is missing.
+        Credit to OSS-Fuzz (locally run, on GDAL)
+    <LI> libtiff/tif_lzw.c: update dec_bitsleft at beginning of
+        LZWDecode(), and update tif_rawcc at end of LZWDecode(). This
+        is needed to properly work with the latest chnges in
+        tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.
+    <LI> libtiff/tif_pixarlog.c: PixarLogDecode(): resync tif_rawcp
+        with next_in and tif_rawcc with avail_in at beginning and end
+        of function, similarly to what is done in LZWDecode(). Likely
+        needed so that it works properly with latest chnges in
+        tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode. But untested...
+    <LI> libtiff/tif_getimage.c: initYCbCrConversion(): add basic
+        validation of luma and refBlackWhite coefficients (just check
+        they are not NaN for now), to avoid potential float to int
+        overflows.  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663
+        Credit to OSS Fuzz
+    <LI> libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
+        of double to float.  Credit to Google Autofuzz project
+    <LI> libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
+        is not zero to avoid division by zero.  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
+        Credit to OSS Fuzz
+    <LI> libtiff/tif_read.c: _TIFFVSetField(): fix outside range cast
+        of double to float.  Credit to Google Autofuzz project
+    <LI> libtiff/tif_getimage.c: initYCbCrConversion(): check luma[1]
+        is not zero to avoid division by zero.  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
+        Credit to OSS Fuzz
+    <LI> libtiff/tif_getimage.c: initYCbCrConversion(): stricter
+        validation for refBlackWhite coefficients values. To avoid
+        invalid float->int32 conversion.  Fixes
+        https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718
+        Credit to OSS Fuzz
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!-------------------------------------------------------------------------->
+<A NAME="tools"><B><FONT SIZE=+3>C</FONT>HANGES IN THE TOOLS:</B></A>
+<UL>
+    <LI> tools/fax2tiff.c (main): Applied patch by Jörg Ahrens to fix
+        passing client data for Win32 builds using tif_win32.c
+        (USE_WIN32_FILEIO defined) for file I/O.  Patch was provided
+        via email on November 20, 2016.
+    <LI> tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips
+        that can cause various issues, such as buffer overflows in the
+        library.  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2598
+    <LI> tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i
+        (ignore) mode so that the output buffer is correctly
+        incremented to avoid write outside bounds.  Reported by
+        Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2620
+    <LI> tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in
+        readSeparateStripsIntoBuffer() to avoid read outside of heap
+        allocated buffer.  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2621
+    <LI> tools/tiffcrop.c: fix integer division by zero when
+        BitsPerSample is missing.  Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
+    <LI> tools/tiffinfo.c: fix null pointer dereference in -r mode
+        when the image has no StripByteCount tag.  Reported by
+        Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2594
+    <LI> tools/tiffcp.c: avoid potential division by zero is
+        BitsPerSamples tag is missing.  Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
+    <LI> tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, )
+        is called, limit the return number of inks to SamplesPerPixel,
+        so that code that parses ink names doesn't go past the end of
+        the buffer.  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2599
+    <LI> tools/tiffcp.c: avoid potential division by zero is
+        BitsPerSamples tag is missing.  Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
+    <LI> tools/tiffcp.c: fix uint32 underflow/overflow that can cause
+        heap-based buffer overflow.  Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
+    <LI> tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non
+        assert check.  Reported by Agostino Sarubbo.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2605
+    <LI> tools/tiff2ps.c: fix 2 heap-based buffer overflows (in
+        PSDataBW and PSDataColorContig). Reported by Agostino Sarubbo.
+        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
+        http://bugzilla.maptools.org/show_bug.cgi?id=2634.
+    <LI> tools/tiff2pdf.c: prevent heap-based buffer overflow in -j
+        mode on a paletted image. Note: this fix errors out before the
+        overflow happens. There could probably be a better fix.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2635
+    <LI> tools/tiff2pdf.c: fix wrong usage of memcpy() that can
+        trigger unspecified behaviour.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2638
+    <LI> tools/tiff2pdf.c: avoid potential invalid memory read in
+        t2p_writeproc.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2639
+    <LI> tools/tiff2pdf.c: avoid potential heap-based overflow in
+        t2p_readwrite_pdf_image_tile().  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2640
+    <LI> tools/tiffcrop.c: remove extraneous TIFFClose() in error code
+        path, that caused double free.  Related to
+        http://bugzilla.maptools.org/show_bug.cgi?id=2535
+    <LI> tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
+        and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap
+        based overflow.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
+        http://bugzilla.maptools.org/show_bug.cgi?id=2657
+    <LI> tools/raw2tiff.c: avoid integer division by zero.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2631
+    <LI> tools/tiff2ps.c: call TIFFClose() in error code paths.
+    <LI> tools/fax2tiff.c: emit appropriate message if the input file
+        is empty. Patch by Alan Coopersmith.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2672
+    <LI> tools/tiff2bw.c: close TIFF handle in error code path.  Fixes
+        http://bugzilla.maptools.org/show_bug.cgi?id=2677
+</UL>
+<P><HR WIDTH=65% ALIGN=left>
+<!--------------------------------------------------------------------------->
+<A NAME="contrib"><B><FONT SIZE=+3>C</FONT>HANGES IN THE CONTRIB AREA:</B></A>
+<UL>
+  <LI> None
+</UL>
+Last updated $Date: 2017-05-21 17:47:46 $.
+</BODY>
+</HTML>