diff options
| author | Patrick J Volkerding <volkerdi@slackware.com> | 2013-11-04 17:08:47 +0000 |
|---|---|---|
| committer | Eric Hameleers <alien@slackware.com> | 2018-05-31 22:57:36 +0200 |
| commit | 76fc4757ac91ac7947a01fb7b53dddf9a78a01d1 (patch) | |
| tree | 9b98e6e193c7870cb27ac861394c1c4592850922 /source/l/libtiff | |
| parent | 9664bee729d487bcc0a0bc35859f8e13d5421c75 (diff) | |
| download | current-76fc4757ac91ac7947a01fb7b53dddf9a78a01d1.tar.gz | |
Slackware 14.1slackware-14.1
Mon Nov 4 17:08:47 UTC 2013
Slackware 14.1 x86_64 stable is released!
It's been another interesting release cycle here at Slackware bringing
new features like support for UEFI machines, updated compilers and
development tools, the switch from MySQL to MariaDB, and many more
improvements throughout the system. Thanks to the team, the upstream
developers, the dedicated Slackware community, and everyone else who
pitched in to help make this release a reality.
The ISOs are off to be replicated, a 6 CD-ROM 32-bit set and a
dual-sided
32-bit/64-bit x86/x86_64 DVD. Please consider supporting the Slackware
project by picking up a copy from store.slackware.com. We're taking
pre-orders now, and offer a discount if you sign up for a subscription.
Have fun! :-)
Diffstat (limited to 'source/l/libtiff')
| -rw-r--r-- | source/l/libtiff/libtiff-CVE-2012-1173.patch | 71 | ||||
| -rwxr-xr-x | source/l/libtiff/libtiff.SlackBuild | 7 | ||||
| -rw-r--r-- | source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff | 3813 | ||||
| -rw-r--r-- | source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff | 23 | ||||
| -rw-r--r-- | source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff | 24 | ||||
| -rw-r--r-- | source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff | 24 |
6 files changed, 3889 insertions, 73 deletions
diff --git a/source/l/libtiff/libtiff-CVE-2012-1173.patch b/source/l/libtiff/libtiff-CVE-2012-1173.patch deleted file mode 100644 index 0ada700b..00000000 --- a/source/l/libtiff/libtiff-CVE-2012-1173.patch +++ /dev/null @@ -1,71 +0,0 @@ -This patch is submitted to upstream for CVE-2012-1173 - - -diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c ---- tiff-3.9.5.orig/libtiff/tif_getimage.c 2010-07-08 12:17:59.000000000 -0400 -+++ tiff-3.9.5/libtiff/tif_getimage.c 2012-03-14 14:49:25.796728783 -0400 -@@ -673,18 +673,24 @@ - unsigned char* p2; - unsigned char* pa; - tsize_t tilesize; -+ tsize_t bufsize; - int32 fromskew, toskew; - int alpha = img->alpha; - uint32 nrow; - int ret = 1, flip; - - tilesize = TIFFTileSize(tif); -- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize); -+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize); -+ if (bufsize == 0) { -+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate"); -+ return (0); -+ } -+ buf = (unsigned char*) _TIFFmalloc(bufsize); - if (buf == 0) { - TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); - return (0); - } -- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize); -+ _TIFFmemset(buf, 0, bufsize); - p0 = buf; - p1 = p0 + tilesize; - p2 = p1 + tilesize; -@@ -880,17 +886,23 @@ - uint32 rowsperstrip, offset_row; - uint32 imagewidth = img->width; - tsize_t stripsize; -+ tsize_t bufsize; - int32 fromskew, toskew; - int alpha = img->alpha; - int ret = 1, flip; - - stripsize = TIFFStripSize(tif); -- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize); -+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize); -+ if (bufsize == 0) { -+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate"); -+ return (0); -+ } -+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize); - if (buf == 0) { - TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); - return (0); - } -- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize); -+ _TIFFmemset(buf, 0, bufsize); - p1 = p0 + stripsize; - p2 = p1 + stripsize; - pa = (alpha?(p2+stripsize):NULL); -diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h ---- tiff-3.9.5.orig/libtiff/tiffiop.h 2011-03-28 09:43:43.000000000 -0400 -+++ tiff-3.9.5/libtiff/tiffiop.h 2012-03-14 14:49:25.797728754 -0400 -@@ -246,7 +246,7 @@ - #define TIFFroundup(x, y) (TIFFhowmany(x,y)*(y)) - - /* Safe multiply which returns zero if there is an integer overflow */ --#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0) -+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) - - #define TIFFmax(A,B) ((A)>(B)?(A):(B)) - #define TIFFmin(A,B) ((A)<(B)?(A):(B)) diff --git a/source/l/libtiff/libtiff.SlackBuild b/source/l/libtiff/libtiff.SlackBuild index 91ec64fa..7cdd7b71 100755 --- a/source/l/libtiff/libtiff.SlackBuild +++ b/source/l/libtiff/libtiff.SlackBuild @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright 2005-2012 Patrick J. Volkerding, Sebeka, Minnesota, USA +# Copyright 2005-2013 Patrick J. Volkerding, Sebeka, Minnesota, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -63,7 +63,10 @@ rm -rf tiff-$VERSION tar xvf $CWD/tiff-$VERSION.tar.?z* || exit 1 cd tiff-$VERSION -zcat $CWD/libtiff-CVE-2012-1173.patch.gz | patch -p1 --verbose || exit 1 +zcat $CWD/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff.gz | patch -p1 --verbose || exit 1 +zcat $CWD/tiff-3.9.7_CVE-2013-4231.diff.gz | patch -p1 --verbose || exit 1 +zcat $CWD/tiff-3.9.7_CVE-2013-4232.diff.gz | patch -p1 --verbose || exit 1 +zcat $CWD/tiff-3.9.7_CVE-2013-4244.diff.gz | patch -p1 --verbose || exit 1 chown -R root:root . find . \ diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff b/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff new file mode 100644 index 00000000..2ee6847c --- /dev/null +++ b/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff @@ -0,0 +1,3813 @@ +From 304327d825c7ba6a9f560d0ca792304f0b03e3b3 Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Sun, 11 Aug 2013 +Subject: Multiple CVEs addressed and bugs fixed. + +Mega-patch against libtiff-3.9.7 constructed from upstream commits +that syncs it to the last CVS revision (5/2/2013). It fixes: + + a. CVE-2012-4447 + b. CVE-2012-4564 + c. CVE-2013-1960 + d. CVE-2013-1961 + e. auto-rotate option bug + f. TIFFPrintDirectory bug +--- + ChangeLog | 781 ++++++++++++++++++++++-------------------- + Makefile.in | 2 + aclocal.m4 | 6 + build/Makefile.in | 2 + contrib/Makefile.in | 2 + contrib/acorn/Makefile.in | 2 + contrib/addtiffo/Makefile.in | 2 + contrib/dbs/Makefile.in | 2 + contrib/dbs/xtiff/Makefile.in | 2 + contrib/dbs/xtiff/xtiff.c | 6 + contrib/iptcutil/Makefile.in | 2 + contrib/mac-cw/Makefile.in | 2 + contrib/mac-mpw/Makefile.in | 2 + contrib/mfs/Makefile.in | 2 + contrib/pds/Makefile.in | 2 + contrib/ras/Makefile.in | 2 + contrib/stream/Makefile.in | 2 + contrib/tags/Makefile.in | 2 + contrib/win_dib/Makefile.in | 2 + html/Makefile.in | 2 + html/images/Makefile.in | 2 + html/man/Makefile.in | 2 + libtiff/Makefile.in | 2 + libtiff/tif_codec.c | 5 + libtiff/tif_dirinfo.c | 4 + libtiff/tif_pixarlog.c | 94 ++--- + libtiff/tif_print.c | 15 + man/Makefile.in | 2 + port/Makefile.in | 2 + test/Makefile.in | 2 + tools/Makefile.in | 2 + tools/ppm2tiff.c | 39 +- + tools/rgb2ycbcr.c | 5 + tools/tiff2bw.c | 4 + tools/tiff2pdf.c | 313 ++++++++-------- + tools/tiff2ps.c | 20 - + tools/tiffcrop.c | 12 + tools/tiffdither.c | 4 + 38 files changed, 728 insertions(+), 628 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index c18d495..2d8bc7c 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,51 @@ ++2013-05-02 Tom Lane <tgl@sss.pgh.pa.us> ++ ++ * tools/tiff2pdf.c: Rewrite JPEG marker parsing in ++ t2p_process_jpeg_strip to be at least marginally competent. The ++ approach is still fundamentally flawed, but at least now it won't ++ stomp all over memory when given bogus input. Fixes CVE-2013-1960. ++ ++2013-05-02 Tom Lane <tgl@sss.pgh.pa.us> ++ ++ * contrib/dbs/xtiff/xtiff.c, libtiff/tif_codec.c, ++ libtiff/tif_dirinfo.c, tools/rgb2ycbcr.c, tools/tiff2bw.c, ++ tools/tiff2pdf.c, tools/tiff2ps.c, tools/tiffcrop.c, ++ tools/tiffdither.c: Enlarge some fixed-size buffers that weren't ++ large enough, and eliminate substantially all uses of sprintf(buf, ++ ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to ++ protect against overflow of fixed-size buffers. This responds in ++ particular to CVE-2013-1961 concerning overflow in tiff2pdf.c's ++ t2p_write_pdf_page(), but in general it seems like a good idea to ++ deprecate use of sprintf(). ++ ++2013-01-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> ++ ++ * tools/tiff2ps.c:Fix bug in auto rotate option code. Once a ++ rotation angle was set by the auto rotate check, it was retained ++ for all pages that followed instead of being retested for each ++ page. Patch by Richard Nolde. ++ ++2012-12-12 Tom Lane <tgl@sss.pgh.pa.us> ++ ++ * libtiff/tif_print.c: Back-patch recent fixes in ++ TIFFPrintDirectory to make it handle field_passcount fields sanely ++ for both TIFF_VARIABLE and TIFF_VARIABLE2 cases. ++ ++2012-12-10 Tom Lane <tgl@sss.pgh.pa.us> ++ ++ * tools/ppm2tiff.c: Back-patch fix for CVE-2012-4564. ++ ++2012-12-10 Tom Lane <tgl@sss.pgh.pa.us> ++ ++ * libtiff/tif_pixarlog.c: Back-patch recent security fixes for ++ tif_pixarlog.c, namely the fix for CVE-2012-4447 and protections ++ against accessing outside the lookup arrays for out of range ++ inputs. ++ ++2012-11-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> ++ ++ * automake: Update Automake to 1.12.5 release. ++ + 2012-09-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + + * libtiff 3.9.7 released. +@@ -31,7 +79,7 @@ + + * libtiff/tif_dirread.c: Avoid trusting samplesperpixel's default + of 1 for purposes of trimming tags. This is to get some super +- crappy OJPEG files to work again. Grr. ++ crappy OJPEG files to work again. Grr. + http://bugzilla.maptools.org/show_bug.cgi?id=2348 + + 2012-06-01 Frank Warmerdam <warmerdam@google.com> +@@ -101,8 +149,8 @@ + * libtiff/tiffiop.h: avoid declaring int64/uint64 on AIX with XLC + where they are already available. (#2301) + +- * libtiff/tif_thunder.c: Correct potential buffer overflow with +- thunder encoded files with wrong bitspersample set. The libtiff ++ * libtiff/tif_thunder.c: Correct potential buffer overflow with ++ thunder encoded files with wrong bitspersample set. The libtiff + development team would like to thank Marin Barbella and TippingPoint's + Zero Day Initiative for reporting this vulnerability (ZDI-CAN-1004, + CVE-2011-1167). +@@ -110,18 +158,18 @@ + + 2011-03-10 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_fax3.h: Fix to last change allowing zero length ++ * libtiff/tif_fax3.h: Fix to last change allowing zero length + runs at the start of a scanline - needed for legal cases. + + 2011-03-02 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_fax3.h: Protect against a fax VL(n) codeword commanding +- a move left. Without this, a malicious input file can generate an +- indefinitely large series of runs without a0 ever reaching the right ++ * libtiff/tif_fax3.h: Protect against a fax VL(n) codeword commanding ++ a move left. Without this, a malicious input file can generate an ++ indefinitely large series of runs without a0 ever reaching the right + margin, thus overrunning our buffer of run lengths. Per CVE-2011-0192. +- This is a modified version of a patch proposed by Drew Yao of Apple +- Product Security. It adds an unexpected() report, and disallows the +- equality case, since emitting a run without increasing a0 still allows ++ This is a modified version of a patch proposed by Drew Yao of Apple ++ Product Security. It adds an unexpected() report, and disallows the ++ equality case, since emitting a run without increasing a0 still allows + buffer overrun. + + 2011-02-25 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -133,7 +181,7 @@ + 2011-01-03 Lee Howard <faxguy@howardsilvan.com> + + * libtiff/tif_jpeg.c: Fix regressions with 2 and 3 band images +- caused by commit on 2010-12-14. Submitted by e-mail from ++ caused by commit on 2010-12-14. Submitted by e-mail from + Even Rouault <even.rouault@mines-paris.org> + + 2010-12-31 Olivier Paquet <olivier.paquet@gmail.com> +@@ -188,13 +236,13 @@ + + 2010-12-12 Lee Howard <faxguy@howardsilvan.com> + +- * tools/tiff2pdf.c: fix colors for images with RGBA ++ * tools/tiff2pdf.c: fix colors for images with RGBA + interleaved data + http://bugzilla.maptools.org/show_bug.cgi?id=2250 + + 2010-12-11 Lee Howard <faxguy@howardsilvan.com> + +- * tools/tiff2pdf.c: remove invalid duplication for Lab ++ * tools/tiff2pdf.c: remove invalid duplication for Lab + http://bugzilla.maptools.org/show_bug.cgi?id=2162 + + 2010-12-11 Lee Howard <faxguy@howardsilvan.com> +@@ -236,7 +284,7 @@ + + 2010-12-07 Lee Howard <faxguy@howardsilvan.com> + +- * libtiff/tif_jpeg.c, libtiff/tif_strip.c: apply patch for ++ * libtiff/tif_jpeg.c, libtiff/tif_strip.c: apply patch for + CVE-2010-3087 per bug + http://bugzilla.maptools.org/show_bug.cgi?id=2140 + +@@ -248,7 +296,7 @@ + 2010-09-25 Lee Howard <faxguy@howardsilvan.com> + + * tools/tiff2ps.c: improvements and enhancements from Richard Nolde +- with additional command line options for Document Title, ++ with additional command line options for Document Title, + Document Creator, and Page Orientation + + 2010-07-13 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> +@@ -349,14 +397,14 @@ + * libtiff/tif_dirread.c: Fixed bad handling of out of order tags + definated late by a codec (#2210) + +- * libtiff/tif_dirread.c: Fixed inadequate validation of the ++ * libtiff/tif_dirread.c: Fixed inadequate validation of the + SubjectDistance field (#2212). + +- * tiff2pdf.c: Fix assorted bugs in tiff2pdf: missing "return" +- in t2p_read_tiff_size() causes t2p->tiff_datasize to be set entirely +- wrong for COMPRESSION_JPEG case, resulting in memory stomp if actual +- size is larger. Also, there are a bunch of places that try to +- memset() a malloc'd buffer before checking for malloc failure, which ++ * tiff2pdf.c: Fix assorted bugs in tiff2pdf: missing "return" ++ in t2p_read_tiff_size() causes t2p->tiff_datasize to be set entirely ++ wrong for COMPRESSION_JPEG case, resulting in memory stomp if actual ++ size is larger. Also, there are a bunch of places that try to ++ memset() a malloc'd buffer before checking for malloc failure, which + would result in core dump if there actually were a failure. (#2211) + + 2010-06-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> +@@ -452,13 +500,13 @@ + + 2010-05-07 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_jpeg.c: Ensure that quality is always set in +- JPEGPreEncode(), not just when we want to output local tables. ++ * libtiff/tif_jpeg.c: Ensure that quality is always set in ++ JPEGPreEncode(), not just when we want to output local tables. + Otherwise the quality used during compression may not be right and + might not match the tables in the tables tag. This bug only occurs + when seeking between directories in the midst of writing blocks. + http://trac.osgeo.org/gdal/ticket/3539 +- ++ + 2010-05-05 Olivier Paquet <olivier.paquet@gmail.com> + + * libtiff/tif_print.c: Have TIFFTAG_REFERENCEBLACKWHITE always print 6 +@@ -476,11 +524,11 @@ + 2010-02-22 Lee Howard <faxguy@howardsilvan.com> + + * libtiff/tif_jpeg.c: Do not generate a JPEGTables tag when creating +- the JPEG TIFF as is is not required in order to prevent it from +- being unused and filled with invalid data. (Leave it to be ++ the JPEG TIFF as is is not required in order to prevent it from ++ being unused and filled with invalid data. (Leave it to be + generated by later activity.) + http://bugzilla.maptools.org/show_bug.cgi?id=2135 +- * tools/tiff2pdf.c: Write the JPEG SOI headers into the TIFF strip ++ * tools/tiff2pdf.c: Write the JPEG SOI headers into the TIFF strip + data rather than skipping them. This fixes the ability to view in + Acrobat Reader, Evince, and Ghostscript. + http://bugzilla.maptools.org/show_bug.cgi?id=2135 +@@ -491,13 +539,13 @@ + 2010-01-06 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_dir.c: Ensure tile and scanline sizes are reset +- when moving to new directories. ++ when moving to new directories. + http://bugzilla.maptools.org/show_bug.cgi?id=1936 + + 2009-12-03 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_jpeg.c: Fix a couple of issues that trigger failures in +- some cases when using TIFFReadScanline() with JPEG compressed ++ some cases when using TIFFReadScanline() with JPEG compressed + subsampled ycbcr images. + http://bugzilla.maptools.org/show_bug.cgi?id=1936 + +@@ -610,7 +658,7 @@ + + 2009-06-22 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_lzw.c: Fix buffer underflow bug. ++ * libtiff/tif_lzw.c: Fix buffer underflow bug. + http://bugzilla.maptools.org/show_bug.cgi?id=2065 + + 2009-06-03 Frank Warmerdam <warmerdam@pobox.com> +@@ -621,7 +669,7 @@ + + 2009-02-12 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_luv.c: Fix handling of tiled logluv images. ++ * libtiff/tif_luv.c: Fix handling of tiled logluv images. + http://bugzilla.maptools.org/show_bug.cgi?id=2005 + + 2009-01-23 Frank Warmerdam <warmerdam@pobox.com> +@@ -635,7 +683,7 @@ + + 2009-01-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + +- * tools/tiff2ps.c: Remove spurious message printed to stderr. ++ * tools/tiff2ps.c: Remove spurious message printed to stderr. + + 2009-01-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + +@@ -668,7 +716,7 @@ + 2008-12-31 Frank Warmerdam <warmerdam@pobox.com> + + * tools/tiffcrop.c, man/tiffcrop.1: A major update from Richard +- Nolde. ++ Nolde. + + 2008-12-21 Frank Warmerdam <warmerdam@pobox.com> + +@@ -678,7 +726,7 @@ + + 2008-12-21 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_getimage.c, tiffio.h: More ABI corrections. ++ * libtiff/tif_getimage.c, tiffio.h: More ABI corrections. + Removed SubsamplingHor/Ver from TIFFRGBAImage structure. + http://bugzilla.maptools.org/show_bug.cgi?id=1980 + +@@ -719,15 +767,15 @@ + + 2008-05-24 Frank Warmerdam <warmerdam@pobox.com> + +- * tif_codec.c: Avoid NULL pointer dereferencing for exotic ++ * tif_codec.c: Avoid NULL pointer dereferencing for exotic + compression codec codes. + + * tif_dirread.c: zero tif->tif_dir after freeing the directory + in TIFFReadCustomDirectory(). I don't exactly remember why this +- was important. ++ was important. + + * tif_dirwrite.c: Fix potential memory leak writing large double +- tags. ++ tags. + + * tif_dirread.c: Fix unchecked malloc result. + +@@ -747,12 +795,12 @@ + + 2007-11-22 Frank Warmerdam <warmerdam@pobox.com> + +- * tif_write.c: Rip out the fancy logic in TIFFAppendToStrip() for +- establishing if an existing tile can be rewritten to the same location +- by comparing the current size to all the other blocks in the same +- directory. This is dangerous in many situations and can easily ++ * tif_write.c: Rip out the fancy logic in TIFFAppendToStrip() for ++ establishing if an existing tile can be rewritten to the same location ++ by comparing the current size to all the other blocks in the same ++ directory. This is dangerous in many situations and can easily + corrupt a file. (observed in esoteric GDAL situation that's hard to +- document). This change involves leaving the stripbytecount[] values ++ document). This change involves leaving the stripbytecount[] values + unaltered till TIFFAppendToStrip(). Now we only write a block back + to the same location it used to be at if the new data is the same + size or smaller - otherwise we move it to the end of file. +@@ -760,17 +808,17 @@ + * tif_dirwrite.c: Try to avoid writing out a full readbuffer of tile + data when writing the directory just because we have BEENWRITING at + some point in the past. This was causing odd junk to be written out +- in a tile of data when a single tile had an interleaving of reading +- and writing with reading last. (highlighted by gdal +- autotest/gcore/tif_write.py test 7. ++ in a tile of data when a single tile had an interleaving of reading ++ and writing with reading last. (highlighted by gdal ++ autotest/gcore/tif_write.py test 7. + + * tif_predict.c: use working buffer in PredictorEncodeTile to avoid +- modifying callers buffer. ++ modifying callers buffer. + http://trac.osgeo.org/gdal/ticket/1965 + +- * tif_predict.c/h, tif_lzw.c, tif_zip.c: Improvements so that ++ * tif_predict.c/h, tif_lzw.c, tif_zip.c: Improvements so that + predictor based encoding and decoding works in read-write update +- mode properly. ++ mode properly. + http://trac.osgeo.org/gdal/ticket/1948 + + 2007-10-05 Frank Warmerdam <warmerdam@pobox.com> +@@ -785,7 +833,7 @@ + + 2007-07-18 Andrey Kiselev <dron@ak4719.spb.edu> + +- * libtiff/{Makefile.am, Makefile.v}: Do not distribute tiffconf.h, ++ * libtiff/{Makefile.am, Makefile.v}: Do not distribute tiffconf.h, + remove tif_config.h/tiffconf.h during cleaning. As per bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=1573 +@@ -803,14 +851,13 @@ + 2007-07-03 Andrey Kiselev <dron@ak4719.spb.edu> + + * tools/tiff2ps.c: Added support 16-bit images as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1566 + + Patch from William Bader. + + * tools/tiff2pdf.c: Fix for TIFFTAG_JPEGTABLES tag fetching and + significant upgrade of the whole utility as per bug +- + http://bugzilla.remotesensing.org/show_bug.cgi?id=1560 + + Now we don't need tiffiop.h in tiff2pdf anymore and will open output +@@ -828,7 +875,7 @@ + + * libtiff/tif_dirwrite.c: Fixed problem introduced with a fix for a + byte swapping issue +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1363 + + As per bug +@@ -846,7 +893,7 @@ + * libtiff/{tif_dir.h, tif_dirread.c, tif_dirinfo.c, tif_jpeg.c, + tif_fax3.c, tif_jbig.c, tif_luv.c, tif_ojpeg.c, tif_pixarlog.c, + tif_predict.c, tif_zip.c}: Finally fix bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1274 + + by introducing _TIFFMergeFieldInfo() returning integer error status +@@ -857,7 +904,7 @@ + + 2007-04-07 Frank Warmerdam <warmerdam@pobox.com> + +- * contrib/addtiffo/tif_overview.c: Fix problems with odd sized output ++ * contrib/addtiffo/tif_overview.c: Fix problems with odd sized output + blocks in TIFF_DownSample_Subsampled() (bug 1542). + + 2007-04-06 Frank Warmerdam <warmerdam@pobox.com> +@@ -865,20 +912,20 @@ + * libtiff/tif_jpeg.c: Changed JPEGInitializeLibJPEG() so that it + will convert from decompressor to compressor or compress to decompress + if required by the force arguments. This works around a problem in +- where the JPEGFixupTestSubsampling() may cause a decompressor to ++ where the JPEGFixupTestSubsampling() may cause a decompressor to + be setup on a directory when later a compressor is required with the +- force flag set. Occurs with the addtiffo program for instance. ++ force flag set. Occurs with the addtiffo program for instance. + + 2007-04-06 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/tif_dirwrite.c: Fixed swapping of byte arrays stored + in-place in tag offsets as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1363 + + * tools/tiffcrop.c, man/tiffcrop.1: Significant update in + functionality from Richard Nolde. As per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1525 + + 2007-03-28 Frank Warmerdam <warmerdam@pobox.com> +@@ -886,15 +933,15 @@ + * libtiff/tif_fax3.c: "inline static" -> "static inline" for IRIC CC. + + 2007-03-07 Joris Van Damme <joris.at.lebbeke@skynet.be> +- ++ + * libtiff/tif_getimage.c: workaround for 'Fractional scanline' error reading + OJPEG images with rowsperstrip that is not a multiple of vertical subsampling + factor. This bug is mentioned in: + http://bugzilla.remotesensing.org/show_bug.cgi?id=1390 +- http://www.asmail.be/msg0054766825.html ++ http://www.asmail.be/msg0054766825.html + + 2007-03-07 Joris Van Damme <joris.at.lebbeke@skynet.be> +- ++ + * libtiff/tif_win32.c: made inclusion of windows.h unconditional + + * libtiff/tif_win32.c: replaced preprocessor indication for consiously +@@ -944,14 +991,14 @@ + larger than 2GB. Fixes bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=890 +- ++ + Idea submitted by Matt Hancher. + + 2007-01-31 Andrey Kiselev <dron@ak4719.spb.edu> + + * tools/tif2rgba.c: This utility does not work properly on big-endian + architectures. It was fixed including the bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1149 + + 2007-01-15 Mateusz Loskot <mateusz@loskot.net> +@@ -968,15 +1015,15 @@ + + 2006-11-19 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_write.c: TIFFAppendToStrip() - clear sorted flag if +- we move a strip. +- http://bugzilla.remotesensing.org/show_bug.cgi?id=1359 ++ * libtiff/tif_write.c: TIFFAppendToStrip() - clear sorted flag if ++ we move a strip. ++ http://bugzilla.remotesensing.org/show_bug.cgi?id=1359 + + 2006-10-13 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/tif_dir.c: More fixes for vulnerabilities, reported + in Gentoo bug (): +- ++ + http://bugs.gentoo.org/show_bug.cgi?id=142383 + + * libtiff/contrib/dbs/xtiff/xtiff.c: Make xtiff utility compilable. +@@ -1010,12 +1057,12 @@ + * libtiff/tif_lzw.c, libtiff/tif_zip.c: Fixed problems with mixing + encoding and decoding on the same read-write TIFF handle. The LZW + code can now maintain encode and decode state at the same time. The +- ZIP code will switch back and forth as needed. ++ ZIP code will switch back and forth as needed. + http://bugzilla.remotesensing.org/show_bug.cgi?id=757 + + 2006-09-20 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff: Rename config.h.vc and tif_config.h.vc to config.vc.h and ++ * libtiff: Rename config.h.vc and tif_config.h.vc to config.vc.h and + tif_config.vc.h for easier identification by folks using an IDE. + + 2006-07-25 Frank Warmerdam <warmerdam@pobox.com> +@@ -1030,7 +1077,7 @@ + + 2006-07-12 Frank Warmerdam <warmerdam@pobox.com> + +- * tif_dirwrite.c: make sure to use uint32 for wordcount in ++ * tif_dirwrite.c: make sure to use uint32 for wordcount in + TIFFWriteNormanTag if writecount is VARIABLE2 for ASCII fields. + It already seems to have been done for other field types. Needed + for "tiffset" on files with geotiff ascii text. +@@ -1058,9 +1105,9 @@ + 2006-06-17 Frank Warmerdam <warmerdam@pobox.com> + + * tif_readdir.c: Added case in EstimateStripByteCounts() for tiled +- files. Modified TIFFReadDirectory() to not invoke ++ files. Modified TIFFReadDirectory() to not invoke + EstimateStripByteCounts() for case where entry 0 and 1 are unequal +- but one of them is zero. ++ but one of them is zero. + http://bugzilla.remotesensing.org/show_bug.cgi?id=1204 + + 2006-06-08 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -1088,7 +1135,7 @@ + * {configure, configure.ac, libtiff/tif_jbig.c, tools/tiffcp.c}: Added + support for JBIG compression scheme (34661 code) contributed by Lee + Howard. As per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=896 + + * configure, configure.ac: OJPEG support enabled by default. +@@ -1127,7 +1174,7 @@ + 2006-04-18 Frank Warmerdam <warmerdam@pobox.com> + + * nmake.opt: use /EHsc for VS2005 compatibility. Also define +- _CRT_SECURE_NO_DEPRECATE to avoid noise on VS2005. ++ _CRT_SECURE_NO_DEPRECATE to avoid noise on VS2005. + + 2006-04-12 Joris Van Damme <joris.at.lebbeke@skynet.be> + +@@ -1135,7 +1182,7 @@ + non-subsampled YCbCr (i.e. separate YCbCr with subsampling [1,1]) + + 2006-04-11 Joris Van Damme <joris.at.lebbeke@skynet.be> +- ++ + * libtiff/tif_getimage.c: Revision of all RGB(A) put routines + - Conversion of unassociated alpha to associated alpha now done with + more performant LUT, and calculation more correct +@@ -1144,21 +1191,21 @@ + - Bugfix of handling of 16bit RGB with unassociated alpha + + 2006-04-11 Joris Van Damme <joris.at.lebbeke@skynet.be> +- +- * libtiff/tif_getimage.c: +- - When there is no alpha, gtTileSeparate and gtStripSeparate allocated +- buffer for alpha strile and filled it, only to never read it back. ++ ++ * libtiff/tif_getimage.c: ++ - When there is no alpha, gtTileSeparate and gtStripSeparate allocated ++ buffer for alpha strile and filled it, only to never read it back. + Removed allocation and fill. +- - Minor rename of vars in gtTileSeparate and gtStripSeparate ++ - Minor rename of vars in gtTileSeparate and gtStripSeparate + anticipating planned functionality extension + + 2006-04-08 Joris Van Damme <joris.at.lebbeke@skynet.be> + +- * libtiff/tif_getimage.c: renamed pickTileContigCase to PickContigCase +- and pickTileSeparateCase to PickSeparateCase as both work on strips as ++ * libtiff/tif_getimage.c: renamed pickTileContigCase to PickContigCase ++ and pickTileSeparateCase to PickSeparateCase as both work on strips as + well + +- * libtiff/tif_getimage.c: moved img->get selection from ++ * libtiff/tif_getimage.c: moved img->get selection from + TIFFRGBAImageBegin into PickContigCase and PickSeparateCase to create + logical hook for planned functionality extension + +@@ -1169,9 +1216,9 @@ + + 2006-04-07 Joris Van Damme <joris.at.lebbeke@skynet.be> + +- * libtiff/tif_getimage.c: replaced usage of TIFFScanlineSize in ++ * libtiff/tif_getimage.c: replaced usage of TIFFScanlineSize in + gtStripContig with TIFFNewScanlineSize so as to fix buggy behaviour +- on subsampled images - this ought to get sorted when we feel brave ++ on subsampled images - this ought to get sorted when we feel brave + enough to replace TIFFScanlineSize alltogether + + * libtiff/tif_ojpeg.c: fixed bug in OJPEGReadSkip +@@ -1180,13 +1227,13 @@ + + * libtiff/tiffio.h: added new type tstrile_t + +- * libtiff/tif_dir.h: changed types of td_stripsperimage and td_nstrips +- to new tstrile_t, types of td_stripoffset and td_stripbytecount to ++ * libtiff/tif_dir.h: changed types of td_stripsperimage and td_nstrips ++ to new tstrile_t, types of td_stripoffset and td_stripbytecount to + toff_t* + + * libtiff/tif_ojpeg.c: totally new implementation + +- * libtiff/tif_dirread.c: added several hacks to suit new support of ++ * libtiff/tif_dirread.c: added several hacks to suit new support of + OJPEG + + * libtiff/tif_getimage.c: removed TIFFTAG_JPEGCOLORMODE handling +@@ -1226,7 +1273,7 @@ + + * libtiff/tif_getimage.c: added putcontig8bitYCbCr12tile + +- * libtiff/tif_read.c: added support for new TIFF_NOREADRAW flag to ++ * libtiff/tif_read.c: added support for new TIFF_NOREADRAW flag to + prepare the path for new tif_ojpeg.c + + 2006-03-23 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -1342,7 +1389,7 @@ + + * libtiff/tif_write.c: Small code rearrangement in TIFFWriteScanline() + to avoid crash as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1081. + + 2006-02-26 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -1392,7 +1439,7 @@ + 2006-02-07 Frank Warmerdam <warmerdam@pobox.com> + + * tools/tiff2pdf.c: Fixed support for non-YCbCr encoded JPEG +- compressed TIFF files, per submission from Dan Cobra. ++ compressed TIFF files, per submission from Dan Cobra. + + 2006-02-07 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -1424,7 +1471,7 @@ + + * libtiff/tif_dirread.c: Use _TIFFGetExifFieldInfo() instead of + _TIFFGetFieldInfo() in TIFFReadEXIFDirectory() call as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1026. + + 2006-01-23 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -1490,7 +1537,7 @@ + + 2005-12-26 Andrey Kiselev <dron@ak4719.spb.edu> + +- * libtiff/{tif_dir.c, tif_dir.h, tif_dirread.c, tif_dirinfo.c}: ++ * libtiff/{tif_dir.c, tif_dir.h, tif_dirread.c, tif_dirinfo.c}: + tiffFieldInfo and exifFieldInfo arrays definitions moved back to + tif_dirinfo.c; added _TIFFGetFieldInfo() and _TIFFGetExifFieldInfo() + private functions to retrieve FieldInfo arrays. +@@ -1517,10 +1564,10 @@ + + 2005-12-23 Joris Van Damme <joris.at.lebbeke@skynet.be> + +- * libtiff/tiffio.h: fixed typo that potentially resulted in ++ * libtiff/tiffio.h: fixed typo that potentially resulted in + redefininition of USE_WIN32_FILEIO + +- * libtiff/*: Added more 'dual-mode' error handling: Done TIFFWarning ++ * libtiff/*: Added more 'dual-mode' error handling: Done TIFFWarning + calls in core LibTiff. + + 2005-12-21 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -1530,10 +1577,10 @@ + + 2005-12-21 Joris Van Damme <joris.at.lebbeke@skynet.be> + +- * libtiff/*, contrib/*: Added 'dual-mode' error handling, enabling ++ * libtiff/*, contrib/*: Added 'dual-mode' error handling, enabling + newer code to get context indicator in error handler and still +- remain compatible with older code: Done TIFFError calls everywhere +- except in tools ++ remain compatible with older code: Done TIFFError calls everywhere ++ except in tools + + 2005-12-20 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -1606,7 +1653,7 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=1002 + + * .cvsignore: many files added, and a few update according +- to suggestion of Brad HArds on tiff mailing list. ++ to suggestion of Brad HArds on tiff mailing list. + + 2005-11-03 Frank Warmerdam <warmerdam@pobox.com> + +@@ -1631,7 +1678,7 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=946 + + * tools/bmp2tiff.c: Fixed possible integer overflow error as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=965 + + * libtiff/tif_dirinfo.c: Make XResolution, YResolution and +@@ -1641,7 +1688,7 @@ + + * tools/tiffsplit.c: Copy fax related fields over splitted parts + as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=983 + + 2005-10-21 Frank Warmerdam <warmerdam@pobox.com> +@@ -1697,7 +1744,7 @@ + + * libtiff/tif_dir.c: When prefreeing tv->value in TIFFSetFieldV + also set it to NULL to avoid double free when re-setting custom +- string fields as per: ++ string fields as per: + + http://bugzilla.remotesensing.org/show_bug.cgi?id=922 + +@@ -1733,7 +1780,7 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=831 + + Remove TIFFFetchExtraSamples() function, use TIFFFetchNormalTag() +- instead. ++ instead. + + * libtiff/tiffconf.h.in: One more attempt to fix the AIX bug + +@@ -1904,7 +1951,7 @@ + + 2005-05-22 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_dirread.c: Changed the code that computes ++ * libtiff/tif_dirread.c: Changed the code that computes + stripbytecount[0] if it appears bogus to ignore if stripoffset[0] is + zero. This is a common case with GDAL indicating a "null" tile/strip. + +@@ -1914,8 +1961,8 @@ + + 2005-05-06 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_dirread.c: Applied similar change to +- TIFFFetchPerSampleLongs and TIFFFetchPerSampleAnys. ++ * libtiff/tif_dirread.c: Applied similar change to ++ TIFFFetchPerSampleLongs and TIFFFetchPerSampleAnys. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=843 + +@@ -1965,7 +2012,7 @@ + + * man/TIFFSetField.3tiff: Fixed definition of the TIFFTAG_INKNAMES tag + as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=816 + + 2005-03-30 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -2075,7 +2122,7 @@ + + * libtiff/tiffio.h: Move TIFFOpenW() function into the extern "C"{} + block as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=763 + + 2005-02-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> +@@ -2096,7 +2143,7 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=320 + + * tools/tiff2ps.c: Fixed problem with page sizes as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=742 + + 2005-01-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> +@@ -2137,7 +2184,7 @@ + TIFFRGBAImageBegin() as per bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=739 +- ++ + 2005-01-12 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/tif_jpeg.c: Added ability to read/write the fax specific +@@ -2166,7 +2213,7 @@ + * libtiff/tiff.h: Restore back the workaround for AIX Visual Age C + compiler to avoid double definition of BSD types as per bug + +- http://bugzilla.remotesensing.org/show_bug.cgi?id=39 ++ http://bugzilla.remotesensing.org/show_bug.cgi?id=39 + + * libtiff/Makefile.am: Place the C++ stream API in the separate + library called libtiffxx to avoid unneeded dependencies. Probably +@@ -2190,7 +2237,7 @@ + + * libtiff/tif_getimage.c: More fixes for multiple-alpha-channelled + RGB-images as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=713 + + +@@ -2226,7 +2273,7 @@ + 2004-12-15 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_getimage.c: #define A1 bracketing for clean build on +- SunPro compiler. ++ SunPro compiler. + + 2004-12-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + +@@ -2238,7 +2285,7 @@ + + * libtiff/tif_dirwrite.c: Always write TIFFTAG_SUBIFD using LONG type + as per bugs +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=703 + + and +@@ -2258,9 +2305,9 @@ + + * libtiff/tif_config.in.vc: Removed unneded definitions for + read/open/close/lseek functions to fix the +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=680 +- ++ + 2004-12-03 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/{tif_dir.c, tif_dirread.c}: Remove TIFFReassignTagToIgnore() +@@ -2296,7 +2343,7 @@ + + 2004-11-26 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/makefile.vc: make it easier to rename the libtiff DLL. ++ * libtiff/makefile.vc: make it easier to rename the libtiff DLL. + + 2004-11-24 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -2393,7 +2440,7 @@ + per bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=648 +- ++ + * libtiff/{tif_jpeg.c, tif_ojpeg.c}: TIFFTAG_JPEGTABLES should have + uint32 count. Use this type everywhere. + +@@ -2406,7 +2453,7 @@ + * tools/tiff2rgba.c: removed extra newlines in usage message. + + 2004-10-30 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/tif_dirwrite.c: Improvements in tag writing code. + + * tools/tiff2ps.c: Fixed wrong variable data type when read Position +@@ -2421,7 +2468,7 @@ + + * libtiff/tif_fax3.c: Fixed case with the wrong decode routines + choosing when the incorrect Group4Options tag set. As per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=323 + + * libtiff/tif_dirwrite.c: Fixed problem with passing count variable of +@@ -2440,7 +2487,7 @@ + * tools/tiff2pdf.c: added casts to avoid warnings. + + * libtiff/libtiff.def: Added several more entry points required +- to link fax2tiff.c against the DLL on windows. ++ to link fax2tiff.c against the DLL on windows. + + 2004-10-27 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -2511,7 +2558,7 @@ + 2004-10-08 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_dirinfo.c: Fix bug with tif_foundfield and reallocation +- of tif_fieldinfo. ++ of tif_fieldinfo. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=630 + +@@ -2543,7 +2590,7 @@ + + 2004-09-30 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_dirinfo.c: changed type of XMLPacket (tag 700) to ++ * libtiff/tif_dirinfo.c: changed type of XMLPacket (tag 700) to + TIFFTAG_BYTE instead of TIFFTAG_UNDEFINED to comply with the info + in the Adobe XMP Specification. + +@@ -2563,7 +2610,7 @@ + 2004-09-26 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/{tif_dir.h, tif_dir.c, tif_dirread.c, tif_write.c}: +- Optimize checking for the strip bounds. ++ Optimize checking for the strip bounds. + + * libtiff/{tif_dirread.c, tif_strip.c}: TIFFScanlineSize() and + TIFFRasterScanlineSize() functions report zero in the case of integer +@@ -2714,7 +2761,7 @@ + here + + http://www.asmail.be/msg0054799560.html +- ++ + for details. + + * tools/fax2tiff.c: Use the new functions in the code. +@@ -2842,11 +2889,11 @@ + * tools/tiffsplit.c: Fixed problem with unproperly written multibyte + files. Now output files will be written using the same byte order + flag as in the input image. See +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=574 +- ++ + for details. +- ++ + 2004-05-19 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_print.c: added (untested) support for printing +@@ -2858,7 +2905,7 @@ + + * libtiff/tif_fax3.c: Avoid reading CCITT compression options + if compression type mismatches. See +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=565 + + 2004-04-30 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -2903,7 +2950,7 @@ + 2004-04-04 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_open.c: close clientdata if TIFFClientOpen() fails +- via bad2. ++ via bad2. + + 2004-03-26 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -2930,10 +2977,10 @@ + + 2004-02-26 Andrey Kiselev <dron@ak4719.spb.edu> + +- * tools/tiffsplit.c: Copy JPEGTables tag contents for JPEG compressed ++ * tools/tiffsplit.c: Copy JPEGTables tag contents for JPEG compressed + images. Reported by Artem Mirolubov. + +- * libtiff/tif_dirread.c: Fixed problem with handling TIFF_UNDEFINED ++ * libtiff/tif_dirread.c: Fixed problem with handling TIFF_UNDEFINED + tag type in TIFFFetchNormalTag() as per bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=508 +@@ -2955,8 +3002,8 @@ + 2004-01-30 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/libtiff.def: Added TIFFCurrentDirOffset, TIFFWriteCheck, +- TIFFRGBAImageOK, and TIFFNumberOfDirectories as suggested by +- Scott Reynolds. ++ TIFFRGBAImageOK, and TIFFNumberOfDirectories as suggested by ++ Scott Reynolds. + + 2004-01-29 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -2974,7 +3021,7 @@ + file if TIFFFdOpen() failed as per bug + + http://bugzilla.remotesensing.org/show_bug.cgi?id=468 +- ++ + * libtiff/tif_open.c: More fixes for + + http://bugzilla.remotesensing.org/show_bug.cgi?id=468 +@@ -2998,7 +3045,7 @@ + * libtiff/tif_dirwrite.c: Fixed handling of writable ASCII tags that + are field_passcount=TRUE properly. Arguably anonymous custom tags + should be declared as passcount=FALSE, but I don't want to change +- that without a careful review. ++ that without a careful review. + + 2004-01-20 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -3161,8 +3208,8 @@ + + 2003-11-17 Frank Warmerdam <warmerdam@pobox.com> + +- * tif_dirread.c: do not mark all anonymously defined tags to be +- IGNOREd. ++ * tif_dirread.c: do not mark all anonymously defined tags to be ++ IGNOREd. + + 2003-11-17 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -3202,15 +3249,15 @@ + + 2003-11-09 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_tile.c: remove spurious use of "s" (sample) in the ++ * libtiff/tif_tile.c: remove spurious use of "s" (sample) in the + planarconfig_contig case in TIFFComputeTile(). + + http://bugzilla.remotesensing.org/show_bug.cgi?id=387 + + 2003-11-09 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/tiffiop.h: New macros: TIFFmax, TIFFmin and TIFFrint. +- ++ + 2003-11-07 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/{tiffio.h, tif_strip.c}, man/{TIFFstrip.3t, libtiff.3t}: +@@ -3277,11 +3324,11 @@ + function TIFFReadRGBAImageOriented() implemented to retrieve raster + array with user-specified origin position as suggested by Jason Frank. + See +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=322 + + for details. +- ++ + * tools/tiff2rgba.c: Switched to use TIFFReadRGBAImageOriented() + instead of TIFFReadRGBAImage(). + +@@ -3362,9 +3409,9 @@ + encoded write functions use tif_postdecode() to apply byte order + swapping (swab) to the application passed data buffer if the same + would be done when reading. This allows us to write pixel data with +- more than 8 bits per sample to existing files of a non-native byte ++ more than 8 bits per sample to existing files of a non-native byte + order. One side effect of this change is the applications buffer +- itself is altered in this case by the act of writing. ++ itself is altered in this case by the act of writing. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=171 + +@@ -3390,9 +3437,9 @@ + 2003-07-08 Frank Warmerdam <warmerdam@pobox.com> + + * tif_aux.c, tif_codec.c, tif_dir.c, tif_dirread.c, tif_extension.c, +- tif_fax3.c, tif_getimage.c, tif_luv.c, tif_lzw.c, tif_next.c, ++ tif_fax3.c, tif_getimage.c, tif_luv.c, tif_lzw.c, tif_next.c, + tif_packbits.c, tif_predict.c, tif_print.c, tif_swab.c, tif_thunder.c: +- avoid casting warning at /W4. ++ avoid casting warning at /W4. + + 2003-07-03 Andrey Kiselev <dron@ak4719.spb.edu> + +@@ -3414,11 +3461,11 @@ + + * libtiff/tif_dirinfo.c: TIFFDataWidth() returns 0 in case of + unknown data type. +- ++ + 2003-06-19 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_print.c: fixed some serious bugs when printing +- custom tags ... almost certain to crash. ++ custom tags ... almost certain to crash. + + * libtiff/tif_dirread.c: Don't ignore custom fields that are + autodefined. Not sure how this got to be like this. +@@ -3429,12 +3476,12 @@ + + * tools/tiffcmp.c, man/tiffcmp.1: Fixed problem with unused data + comparing as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=349 + + `-z' option now can be used to set the number of reported different + bytes. +- ++ + 2003-06-09 Andrey Kiselev <dron@ak4719.spb.edu> + + * tools/tiffcp.c, man/tiffcp.1: Added possibility to specify value -1 +@@ -3460,7 +3507,7 @@ + 2003-05-25 Andrey Kiselev <dron@ak4719.spb.edu> + + * tools/fax2tiff.c: Page numbering fixed, as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=341 + + 2003-05-20 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -3526,7 +3573,7 @@ + + * tools/tiffcp.c: Fixed problem with colorspace conversion for JPEG + encoded images. See bug entries +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=275 + + and +@@ -3587,16 +3634,16 @@ + + * libtiff/tif_jpeg.c: Modified to defer initialization of jpeg + library so that we can check if there is already any tile/strip data +- before deciding between creating a compressor or a decompressor. ++ before deciding between creating a compressor or a decompressor. + + 2003-01-31 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_write.c: TIFFWriteCheck() now fails if the image is +- a pre-existing compressed image. That is, image writing to ++ a pre-existing compressed image. That is, image writing to + pre-existing compressed images is not allowed. + + * libtiff/tif_open.c: Removed error if opening a compressed file +- in update mode. ++ in update mode. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=198 + +@@ -3609,16 +3656,16 @@ + * cut 3.6.0 Beta release. + + 2002-12-20 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * tools/fax2ps.c, man/fax2ps.1: Page size was determined + in wrong way as per bug +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=239 + + 2002-12-17 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_dirread.c: Allow wrong sized arrays in +- TIFFFetchStripThing(). ++ * libtiff/tif_dirread.c: Allow wrong sized arrays in ++ TIFFFetchStripThing(). + + http://bugzilla.remotesensing.org/show_bug.cgi?id=49 + +@@ -3632,7 +3679,7 @@ + * libtiff/tif_dir.c: fixed bug with resetting an existing custom + field value. + +- * libtiff/tif_dir.c: Fixed potential problem with ascii "custom" ++ * libtiff/tif_dir.c: Fixed potential problem with ascii "custom" + tags in TIFFVGetField() ... added missing break. + + 2002-10-14 Frank Warmerdam <warmerdam@pobox.com> +@@ -3644,11 +3691,11 @@ + the eps by redefining the colorimage operator will get messed up. + Patch supplied by William Bader. + +- * Makefile.in: added tif_extension.c to file list as per ++ * Makefile.in: added tif_extension.c to file list as per + http://bugzilla.remotesensing.org/show_bug.cgi?id=218. + + 2002-10-11 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * configure, config.site, libtiff/{tif_unix.c, Makefile.in}: Fix for + large files (>2GiB) supporting. New option in the config.site: + LARGEFILE="yes". Should be enough for I/O of the large files. +@@ -3680,13 +3727,13 @@ + 2002-10-06 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_jpeg.c: fixed problem with boolean defined with wrong +- size on windows. Use #define boolean hack. ++ size on windows. Use #define boolean hack. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=188 + + * libtiff/tiff.h: Don't do special type handling in tiff.h unless + USING_VISUALAGE is defined. +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=39 + + 2002-10-03 Frank Warmerdam <warmerdam@pobox.com> +@@ -3697,30 +3744,30 @@ + + * libtiff/tif_dirread.c: Another fix for the fetching SBYTE arrays + by the TIFFFetchByteArray() function. Should finally resolve +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=52 +- ++ + * configure: Set -DPIXARLOG_SUPPORT option along with -DZIP_SUPPORT + + * html/Makefile.in: New targets added: html and groffhtml for + producing HTML representations of the manual pages automatically. + html target uses man2html tool, groffhtml uses groff tool. +- ++ + 2002-09-29 Frank Warmerdam <warmerdam@pobox.com> + + * configure, libtiff/Makefile.in: Added SCO OpenServer 5.0.6 support +- from John H. DuBois III. ++ from John H. DuBois III. + + 2002-09-15 Andrey Kiselev <dron@ak4719.spb.edu> + + * Makefile.in, /man/{raw2tiff.1, Makefile.in, libtiff.3}: Added + manual page for raw2tiff(1) tool. +- ++ + 2002-09-12 Andrey Kiselev <dron@ak4719.spb.edu> + + * /libtiff/{tiffio.h, tif_dir.h}: TIFFDataWidth() declaration moved to + the tiffio.h header file. +- ++ + * Makefile.in, /man/{TIFFDataWidth.3t, Makefile.in, libtiff.3}: Added + manual page for TIFFDataWidth() function + +@@ -3730,8 +3777,8 @@ + as per http://bugzilla.remotesensing.org/show_bug.cgi?id=196. + + * tools/tiff2ps.c: Don't emit BeginData/EndData DSC comments +- since we are unable to properly include the amount to skip. +- ++ since we are unable to properly include the amount to skip. ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=80 + + 2002-09-02 Andrey Kiselev <dron@ak4719.spb.edu> +@@ -3741,7 +3788,7 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=52 + + 2002-08-22 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * /libtiff/tif_dirinfo.c: Further additions to free custom fields + in _TIFFSetupFieldInfo() function. + See http://bugzilla.remotesensing.org/show_bug.cgi?id=169 for details. +@@ -3750,14 +3797,14 @@ + LZWDecode() and LZWDecodeCompat(). + Fixes http://bugzilla.remotesensing.org/show_bug.cgi?id=190 + and http://bugzilla.remotesensing.org/show_bug.cgi?id=100 +- ++ + * /libtiff/tif_lzw.c: + Added check for valid code lengths in LZWDecode() and + LZWDecodeCompat(). Fixes + http://bugzilla.remotesensing.org/show_bug.cgi?id=115 + + 2002-08-16 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * /libtiff/{Makefile.vc, libtiff.def}: + Missed declarations added. + +@@ -3768,7 +3815,7 @@ + + http://bugzilla.remotesensing.org/show_bug.cgi?id=177 + +- * tif_dir.h: changed FIELD_CODEC to 66 from 64 to avoid overlap ++ * tif_dir.h: changed FIELD_CODEC to 66 from 64 to avoid overlap + with FIELD_CUSTOM as mentioned in bug 169. + + * tif_close.c: added logic to free dynamically created anonymous +@@ -3777,31 +3824,31 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=169 + + 2002-08-10 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * /tools/{raw2tiff.c, Makefile.in, Makefile.lcc, Makefile.vc}: + New tool: raw2tiff --- raw images to TIFF converter. No manual page yet. + + 2002-07-31 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_jpeg.c: Fixed problem with setting of nrows in ++ * libtiff/tif_jpeg.c: Fixed problem with setting of nrows in + JPEGDecode() as per bugzilla bug (issue 1): + + http://bugzilla.remotesensing.org/show_bug.cgi?id=129 + + * libtiff/{tif_jpeg.c,tif_strip.c,tif_print.c}: Hacked tif_jpeg.c to + fetch TIFFTAG_YCBCRSUBSAMPLING from the jpeg data stream if it isn't +- present in the tiff tags. ++ present in the tiff tags. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=168 + + * libtiff/tif_read.c, libtiff/tif_write.c: TIFFReadScanline() and + TIFFWriteScanline() now set tif_row explicitly in case the codec has +- fooled with the value. ++ fooled with the value. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=129 + + 2002-06-22 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * /tools/tiff2ps.c: Added workaround for some software that may crash + when last strip of image contains fewer number of scanlines than + specified by the `/Height' variable. See +@@ -3817,8 +3864,8 @@ + + 2002-06-11 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/contrib/win95: renamed to contrib/win_dib. Added new +- Tiffile.cpp example of converting TIFF files into a DIB on Win32. ++ * libtiff/contrib/win95: renamed to contrib/win_dib. Added new ++ Tiffile.cpp example of converting TIFF files into a DIB on Win32. + This one is described in: + + http://bugzilla.remotesensing.org/show_bug.cgi?id=143 +@@ -3834,21 +3881,21 @@ + http://bugzilla.remotesensing.org/show_bug.cgi?id=131 + + 2002-04-26 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/libtiff.def: Added missed declaration. +- ++ + 2002-04-22 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * tools/fax2tiff.c: Updated to reflect latest changes in libtiff. + Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=125 + + 2002-04-20 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/tif_open.c: Pointers to custom procedures + in TIFFClientOpen() are checked to be not NULL-pointers. +- ++ + 2002-04-18 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/libtiff.def: Added missed declarations. + + * libtiff/tif_pixarlog.c: Updated for using tif_tagmethods structure. +@@ -3858,14 +3905,14 @@ + * libtiff/tif_lzw.c: Additional checks for data integrity introduced. + Should finally close + http://bugzilla.remotesensing.org/show_bug.cgi?id=100 +- ++ + 2002-04-10 Andrey Kiselev <dron@ak4719.spb.edu> + + * tools/tiff2ps: Division by zero fixed. + Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=88 + + 2002-04-09 Andrey Kiselev <dron@ak4719.spb.edu> +- ++ + * libtiff/: tif_dirwrite.c, tif_write.c, tiffio.h: + TIFFCheckpointDirectory() routine added. + Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=124 +@@ -3897,7 +3944,7 @@ + replaced by warnings. Now libtiff should read corrupted LZW-compressed + files by skipping bad strips. + Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=100 +- ++ + 2002-04-03 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_dirwrite.c: Removed some dead code. +@@ -3919,18 +3966,18 @@ + + http://bugzilla.remotesensing.org/show_bug.cgi?id=111 + +- * tif_print.c: Fixed so that ASCII FIELD_CUSTOM values with ++ * tif_print.c: Fixed so that ASCII FIELD_CUSTOM values with + passcount set FALSE can be printed (such as TIFFTAG_SOFTWARE). + +- * libtiff/tif_dir.c,tif_dirinfo.c,tif_dir.h,tif_ojpeg.c: modified so ++ * libtiff/tif_dir.c,tif_dirinfo.c,tif_dir.h,tif_ojpeg.c: modified so + that TIFFTAG_SOFTWARE uses FIELD_CUSTOM as an example. + + 2002-03-26 Dwight Kelly <dbmalloc@remotesensing.org> + + * libtiff/: tiff.h, tif_dir.c, tif_dir.h, tif_dirinfo.c, tif_dirread.c, + tif_dirwrite.c: Added get/put code for new tag XMLPACKET as defined +- in Adobe XMP Technote. Added missing INKSET tag value from TIFF 6.0 spec +- INKSET_MULTIINK (=2). Added missing tags from Adobe TIFF technotes: ++ in Adobe XMP Technote. Added missing INKSET tag value from TIFF 6.0 spec ++ INKSET_MULTIINK (=2). Added missing tags from Adobe TIFF technotes: + CLIPPATH, XCLIPPATHUNITS, YCLIPPATHUNITS, OPIIMAGEID, OPIPROXY and + INDEXED. Added PHOTOMETRIC tag value from TIFF technote 4 ICCLAB (=9). + +@@ -3989,7 +4036,7 @@ + + http://bugzilla.remotesensing.org/show_bug.cgi?id=94 + +- * man/Makefile.in: Patch DESTDIR handling ++ * man/Makefile.in: Patch DESTDIR handling + + http://bugzilla.remotesensing.org/show_bug.cgi?id=95 + +@@ -4027,9 +4074,9 @@ + + 2002-01-04 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_jpeg.c: fixed computation of segment_width for +- tiles files to avoid error about it not matching the +- cinfo.d.image_width values ("JPEGPreDecode: Improper JPEG strip/tile ++ * libtiff/tif_jpeg.c: fixed computation of segment_width for ++ tiles files to avoid error about it not matching the ++ cinfo.d.image_width values ("JPEGPreDecode: Improper JPEG strip/tile + size.") for ITIFF files. Apparently the problem was incorporated since + 3.5.5, presumably during the OJPEG/JPEG work recently. + +@@ -4039,7 +4086,7 @@ + + http://bugzilla.remotesensing.org/show_bug.cgi?id=94 + +- * libtiff/tif_getimage.c: If DEFAULT_EXTRASAMPLE_AS_ALPHA is 1 ++ * libtiff/tif_getimage.c: If DEFAULT_EXTRASAMPLE_AS_ALPHA is 1 + (defined in tiffconf.h - 1 by default) then the RGBA interface + will assume that a fourth extra sample is ASSOCALPHA if the + EXTRASAMPLE value isn't set for it. This changes the behaviour of +@@ -4051,9 +4098,9 @@ + + 2001-12-12 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_jpeg.c: allow jpeg data stream sampling values to +- override those from tiff directory. This makes this work with +- ImageGear generated files. ++ * libtiff/tif_jpeg.c: allow jpeg data stream sampling values to ++ override those from tiff directory. This makes this work with ++ ImageGear generated files. + + 2001-12-07 Frank Warmerdam <warmerdam@pobox.com> + +@@ -4066,7 +4113,7 @@ + * Reissue 3.5.7 release. + + * libtiff/mkversion.c: Fix output of TIFF_VERSION to be +- YYYYMMDD so that it is increasing over time. ++ YYYYMMDD so that it is increasing over time. + + * Makefile.in: Ensure that tiffvers.h is regenerated in the + make release target. +@@ -4091,8 +4138,8 @@ + + 2001-10-10 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tiff.h: I have created COMPRESSION_CCITT_T4, +- COMPRESSION_CCITT_T6, TIFFTAG_T4OPTIONS and TIFFTAG_T6OPTIONS aliases ++ * libtiff/tiff.h: I have created COMPRESSION_CCITT_T4, ++ COMPRESSION_CCITT_T6, TIFFTAG_T4OPTIONS and TIFFTAG_T6OPTIONS aliases + in keeping with TIFF 6.0 standard in tiff.h + + http://bugzilla.remotesensing.org/show_bug.cgi?id=83 +@@ -4112,10 +4159,10 @@ + error about LZW not being available. + + * libtiff/tif_dir.c: propagate failure to initialize compression +- back from TIFFSetField() as an error status, so applications can ++ back from TIFFSetField() as an error status, so applications can + detect failure. + +- * libtiff/tif_dir.c: removed the auto replacement of ++ * libtiff/tif_dir.c: removed the auto replacement of + COMPRESSION_LZW with COMPRESSION_NONE in _TIFFVSetField(). + + * Removed Makefile, tools/Makefile, port/install.sh, man/Makefile +@@ -4123,7 +4170,7 @@ + + 2001-09-22 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_ojpeg.c: new update from Scott. ++ * libtiff/tif_ojpeg.c: new update from Scott. + + 2001-09-09 Frank Warmerdam <warmerdam@pobox.com> + +@@ -4142,7 +4189,7 @@ + + http://bugzilla.remotesensing.org/show_bug.cgi?id=47 + +- * tools/tiff2ps.c: added OJPEG YCbCr to RGB support. ++ * tools/tiff2ps.c: added OJPEG YCbCr to RGB support. + + * libtiff/tif_ojpeg.c: Applied substantial patch from Scott. + +@@ -4151,14 +4198,14 @@ + * libtiff/tif_packbits.c: fixed memory overrun error. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=77 +- ++ + 2001-08-31 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_getimage.c: relax handling of contig case where + there are extra samples that are supposed to be ignored. This +- should now work for 8bit greyscale or palletted images. ++ should now work for 8bit greyscale or palletted images. + +- http://bugzilla.remotesensing.org/show_bug.cgi?id=75 ++ http://bugzilla.remotesensing.org/show_bug.cgi?id=75 + + 2001-08-28 Frank Warmerdam <warmerdam@pobox.com> + +@@ -4171,15 +4218,15 @@ + + * libtiff/tif_getimage.c: Use memmove() instead of TIFFmemcpy() + in TIFFReadRGBATile() to avoid issues in cases of overlapping +- buffers. See Bug 69 in Bugzilla. ++ buffers. See Bug 69 in Bugzilla. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=69 +- ++ + * tools/tiff2rgba.c: fixed getopt() call so that -b works again. + + 2001-08-09 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tiff.h, libtiff/tif_fax3.c: added check for __LP64__ ++ * libtiff/tiff.h, libtiff/tif_fax3.c: added check for __LP64__ + when checking for 64 bit architectures as per bugzilla bug 67. + + 2001-07-27 Frank Warmerdam <warmerdam@pobox.com> +@@ -4189,7 +4236,7 @@ + + 2001-07-20 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_jpeg.c: Define HAVE_BOOLEAN on windows if RPCNDR.H ++ * libtiff/tif_jpeg.c: Define HAVE_BOOLEAN on windows if RPCNDR.H + has been included. + + 2001-07-19 Frank Warmerdam <warmerdam@pobox.com> +@@ -4201,11 +4248,11 @@ + + * libtiff/tif_ojpeg.c: updates from Scott. Handles colors + much better. Now depends on having patched libjpeg as per +- patch in contrib/ojpeg/*. ++ patch in contrib/ojpeg/*. + + 2001-07-17 Frank Warmerdam <warmerdam@pobox.com> + +- * */Makefile.in: added DESTDIR support. ++ * */Makefile.in: added DESTDIR support. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=60 + +@@ -4213,20 +4260,20 @@ + + * configure, libtiff/Makefile.in: applied OpenBSD patches + as per: +- ++ + http://bugzilla.remotesensing.org/show_bug.cgi?id=61 + + 2001-06-28 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/tif_getimage.c: Fixed so that failure is properly +- reported by gtTileContig, gtStripContig, gtTileSeparate and ++ reported by gtTileContig, gtStripContig, gtTileSeparate and + gtStripSeparate. + + See http://bugzilla.remotesensing.org/show_bug.cgi?id=51 + +- * tiffcmp.c: Fixed multi samples per pixel support for ContigCompare. ++ * tiffcmp.c: Fixed multi samples per pixel support for ContigCompare. + Updated bug section of tiffcmp.1 to note tiled file issues. +- ++ + See http://bugzilla.remotesensing.org/show_bug.cgi?id=53 + + 2001-06-22 Frank Warmerdam <warmerdam@pobox.com> +@@ -4267,10 +4314,10 @@ + + 2001-05-08 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tif_dirinfo.c: moved pixar and copyright flags to ++ * libtiff/tif_dirinfo.c: moved pixar and copyright flags to + ensure everything is in order. + +- * libtiff/libtiff.def: added TIFFCreateDirectory and ++ * libtiff/libtiff.def: added TIFFCreateDirectory and + TIFFDefaultStripSize as per: + + http://bugzilla.remotesensing.org/show_bug.cgi?id=46 +@@ -4279,10 +4326,10 @@ + + * libtiff/tif_dirinfo.c: Modified the TIFF_BYTE definition for + TIFFTAG_PHOTOSHOP to use a writecount of TIFF_VARIABLE2 (-3) to +- force use of uint32 counts instead of short counts. ++ force use of uint32 counts instead of short counts. + + * libtiff/tif_dirwrite.c: Added support for TIFF_VARIABLE2 in the +- case of writing TIFF_BYTE/TIFF_SBYTE fields. ++ case of writing TIFF_BYTE/TIFF_SBYTE fields. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=43 + +@@ -4318,20 +4365,20 @@ + with the inttypes.h include file on AIX. + + See http://bugzilla.remotesensing.org/show_bug.cgi?id=39 +- ++ + * VERSION: update to 3.5.7 beta in preparation for release. + + * configure/config.site: modified to check if -lm is needed for + MACHDEPLIBS if not supplied by config.site. Needed for Darwin. + +- * config.guess: updated wholesale to an FSF version apparently +- from 1998 (as opposed to 1994). This is mainly inspired by ++ * config.guess: updated wholesale to an FSF version apparently ++ from 1998 (as opposed to 1994). This is mainly inspired by + providing for MacOS X support. + + 2001-03-29 Frank Warmerdam <warmerdam@pobox.com> + + * configure, Makefile.in, etc: added support for OPTIMIZER being +- set from config.site. ++ set from config.site. + + 2001-03-28 Frank Warmerdam <warmerdam@pobox.com> + +@@ -4350,7 +4397,7 @@ + (in particular short ones) print properly. + + See http://bugzilla.remotesensing.org/show_bug.cgi?id=35 +- ++ + * tiff2ps.c/tiff2ps.1: Substantial changes to tiff2ps by + Bruce A. Mallett. See check message for detailed information + on all the changes, including a faster encoder, fixes for level +@@ -4358,7 +4405,7 @@ + + 2001-03-27 Frank Warmerdam <warmerdam@pobox.com> + +- * libtiff/tiffio.h: Changed "#if LOGLUV_PUBLIC" to ++ * libtiff/tiffio.h: Changed "#if LOGLUV_PUBLIC" to + "#ifdef LOGLUV_PUBLIC" so it will work with VisualAge on AIX. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=39 +@@ -4370,7 +4417,7 @@ + + 2001-03-13 Frank Warmerdam <warmerdam@pobox.com> + +- * tif_getimage.c: Added support for 16bit minisblack/miniswhite ++ * tif_getimage.c: Added support for 16bit minisblack/miniswhite + images in RGBA interface. + + 2001-03-02 Frank Warmerdam <warmerdam@pobox.com> +@@ -4381,29 +4428,29 @@ + + * Brent Roman contributed updated tiffcp utility (and tiffcp.1) + with support for extracting subimages with the ,n syntax, and also +- adding the -b bias removal flag. ++ adding the -b bias removal flag. + + 2001-02-16 Frank Warmerdam <warmerdam@pobox.com> + + * libtiff/libtiff.def: Brent Roman submitted new version adding +- serveral missing entry points. ++ serveral missing entry points. + + * libtiff/tif_dirinfo.c: don't declare tiffFieldInfo static on VMS. +- Some sort of weird VMS thing. ++ Some sort of weird VMS thing. + + http://bugzilla.remotesensing.org/show_bug.cgi?id=31 + +- * tif_luv.c/tiff.h/tiffio.h: +- New version of TIFF LogLuv (SGILOG) modules contributed by Greg Ward ++ * tif_luv.c/tiff.h/tiffio.h: ++ New version of TIFF LogLuv (SGILOG) modules contributed by Greg Ward + (greg@shutterfly.com). He writes: + + 1) I improved the gamut-mapping function in tif_luv.c for imaginary +- colors, because some images were being super-saturated on the input ++ colors, because some images were being super-saturated on the input + side and this resulted in some strange color shifts in the output. + + 2) I added a psuedotag in tiff.h to control random dithering during +- LogLuv encoding. This is turned off by default for 32-bit LogLuv and +- on for 24-bit LogLuv output. Dithering improves the average color ++ LogLuv encoding. This is turned off by default for 32-bit LogLuv and ++ on for 24-bit LogLuv output. Dithering improves the average color + accuracy over the image. + + 3) I added a #define for LOG_LUV_PUBLIC, which is enabled by default in +@@ -4416,20 +4463,20 @@ + 2001-01-23 Frank Warmerdam <warmerdam@pobox.com> + + * tif_fax3.c: keep rw_mode flag internal to fax3 state to remember +- whether we are encoding or decoding. This is to ensure graceful ++ whether we are encoding or decoding. This is to ensure graceful + recovery if TIFFClientOpen() discovers an attempt to open a compressed +- file for "r+" access, and subsequently close it, as it resets the ++ file for "r+" access, and subsequently close it, as it resets the + tif_mode flag to O_RDONLY in this case to avoid writes, confusing the + compressor's concept of whether it is in encode or decode mode. + +-2001-01-08 Mike Welles <mike@bangstate.com> ++2001-01-08 Mike Welles <mike@bangstate.com> + + * Makefile.in: Now cleaning up after itself after creating the .tar.gz and .zip +- ++ + 2001-01-07 Frank Warmerdam <warmerdam@pobox.com> + + * html/libtiff.html: Fixed arguments in example for TIFFRGBAImageGet() +- as per bug report by Patrick Connor. ++ as per bug report by Patrick Connor. + + 2000-12-28 Frank Warmerdam <warmerdam@pobox.com> + +@@ -4437,12 +4484,12 @@ + + * Fixed libtiff/makefile.vc to make tiffvers.h not version.h. + +-2000-12-22 Mike Welles <mike@bangstate.com> ++2000-12-22 Mike Welles <mike@bangstate.com> + * added link to CVS mirror from index.html +- +- * updated html/internals.html to note that LZW compression is +- not supported by default. +- ++ ++ * updated html/internals.html to note that LZW compression is ++ not supported by default. ++ + 2000-12-22 Frank Warmerdam <warmerdam@pobox.com> + + * updated html/libtiff.html to not point at Niles' old JPL web site +@@ -4454,19 +4501,19 @@ + Leonard Rosenthol <leonardr@lazerware.com>. May interfere + with correct building on older systems. If so, please let me know. + +-2000-12-19 Mike Welles <mike@bangsate.com> ++2000-12-19 Mike Welles <mike@bangsate.com> + +- * Took out LZW Encoding from tif_lzw.c ++ * Took out LZW Encoding from tif_lzw.c + + * Created HOWTO-RELEASE + + * Created html/v3.5.6.html + + * updated index.html +- ++ + 2000-12-01 Frank Warmerdam <warmerdam@pobox.com> + +- * Added patches for EOFB support in tif_fax3.c and tif_fax3.h. ++ * Added patches for EOFB support in tif_fax3.c and tif_fax3.h. + Patches supplied by Frank Cringle <fdc@cliwe.ping.de> + Example file at: ftp://ftp.remotesensing.org/pub/libtiff/eofb_396.tif + +@@ -4480,30 +4527,30 @@ + targets so libtiff.so will be built with an explicit dependency + on libm.so. + +- * libtiff/Makefile.in: Use softlinks to link libtiff.so.3 to +- libtiff.so.3.5.5. ++ * libtiff/Makefile.in: Use softlinks to link libtiff.so.3 to ++ libtiff.so.3.5.5. + +- * libtiff/Makefile.in & configure: Remove all references to the ALPHA +- file, or ALPHA version logic. Added stuff about DIST_POINT in ++ * libtiff/Makefile.in & configure: Remove all references to the ALPHA ++ file, or ALPHA version logic. Added stuff about DIST_POINT in + place of DIST_TYPE and the alpha release number stuff. + + 2000-11-22 Frank Warmerdam <warmerdam@pobox.com> + + * I have applied a patch from Steffen Moeller <moeller@ebi.ac.uk> to +- the configure script so that it now accepts the --prefix, and +- --exec-prefix directives. ++ the configure script so that it now accepts the --prefix, and ++ --exec-prefix directives. + + 2000-11-13 Frank Warmerdam <warmerda@cs46980-c> + +- * I have made a variety of modifications in an effort to ensure the ++ * I have made a variety of modifications in an effort to ensure the + TIFFLIB_VERSION macro is automatically generated from the RELEASE-DATE +- file which seems to be updated regularly. ++ file which seems to be updated regularly. + +- o mkversion.c now reads RELEASE-DATE and emits TIFFLIB_VERSION in +- version include file. +- o renamed version.h to tiffvers.h because we now have to install it +- with the public libtiff include files. +- o include tiffvers.h in tiffio.h. ++ o mkversion.c now reads RELEASE-DATE and emits TIFFLIB_VERSION in ++ version include file. ++ o renamed version.h to tiffvers.h because we now have to install it ++ with the public libtiff include files. ++ o include tiffvers.h in tiffio.h. + o updated tif_version.c to use tiffvers.h. + o Updated Makefile.in accordingly. + +@@ -4517,13 +4564,13 @@ + See http://bugzilla.remotesensing.org/show_bug.cgi?id=20 + Some patches from Rick LaMont of Dot C Software. + +- * Modified tif_packbits.c encoder to avoid compressing more ++ * Modified tif_packbits.c encoder to avoid compressing more + data than provided if rowsize doesn't factor into provided data + (such as occurs for YCbCr). + + 2000-10-19 Frank Warmerdam <warmerda@cs46980-c> + +- * tools/rgb2ycbcr.c: fixed output strip size to account for vertical ++ * tools/rgb2ycbcr.c: fixed output strip size to account for vertical + roundup if rows_per_strip not a multiple of vertical sample size. + + 2000-10-16 Frank Warmerdam <warmerda@cs46980-c> +@@ -4539,8 +4586,8 @@ + 2000-10-12 Frank Warmerdam <warmerda@cs46980-c> + + * Modified tiff2bw to ensure portions add to 100%, and that +- white is properly recovered. +- ++ white is properly recovered. ++ + See bug http://bugzilla.remotesensing.org/show_bug.cgi?id=15 + Patch c/o Stanislav Brabec <utx@penguin.cz> + +@@ -4554,26 +4601,26 @@ + + 2000-09-27 Frank Warmerdam <warmerda@cs46980-c> + +- * Added GNULDdso target an`d switched linux and freebsd to use it. ++ * Added GNULDdso target an`d switched linux and freebsd to use it. + + 2000-09-26 Frank Warmerdam <warmerda@cs46980-c> + + * Applied patch for 0x0000 sequences in tif_fax3.h's definition +- of EXPAND1D() as per bug 11 (from Roman). ++ of EXPAND1D() as per bug 11 (from Roman). + + 2000-09-25 Frank Warmerdam <warmerda@cs46980-c> + * Fixed tiffcomp.h to avoid win32 stuff if unix #defined, to improve + cygwin compatibility. + + * Applied patch from Roman Shpount to tif_fax3.c. This seems to +- be a proper fix to the buffer sizing problem. See ++ be a proper fix to the buffer sizing problem. See + http://bugzilla.remotesensing.org/show_bug.cgi?id=11 + + * Fixed tif_getimage.c to fix overrun bug with YCbCr images without + downsampling. http://bugzilla.remotesensing.org/show_bug.cgi?id=10 + Thanks to Nick Lamb <njl98r@ecs.soton.ac.uk> for reporting the + bug and proving the patch. +- ++ + 2000-09-18 Frank Warmerdam <warmerda@cs46980-c> + + * Fixed tif_jpeg.c so avoid destroying the decompressor before +@@ -4603,15 +4650,15 @@ + * Tentatively added support for SAMPLEFORMAT_COMPLEXIEEEFP, and + SAMPLEFORMAT_COMPLEXINT. + +-2000-07-13 Mike Welles <mike@onshore.com> ++2000-07-13 Mike Welles <mike@onshore.com> ++ ++ * index.html, bugs.html: added bugzilla info. + +- * index.html, bugs.html: added bugzilla info. +- + 2000-07-12 Frank Warmerdam <warmerda@rommel.atlsci.com> + + * tif_read.c: fix subtle bug with determining the number of + rows for strips that are the last strip in a separation but +- not the last strip of all in TIFFReadEncodedStrip(). ++ not the last strip of all in TIFFReadEncodedStrip(). + + * Applied 16/32 bit fix to tif_fax3.c. Fix supplied by + Peter Skarpetis <peters@serendipity-software.com.au> +@@ -4633,7 +4680,7 @@ + + * libtiff/tif_dirread.c: Don't use estimate strip byte count for + one tile/strip images with an offset, and byte count of zero. These +- could be "unpopulated" images. ++ could be "unpopulated" images. + + 2000-04-18 Frank Warmerdam <warmerda@rommel.atlsci.com> + +@@ -4648,17 +4695,17 @@ Tue Apr 18 16:18:08 2000 Frank Warmerdam <warmerda@esabot.atlsci.com> + 2000-04-12 Mike Welles <mike@onshore.com> + * configure: Fixed stupid mistake in libc6 test on Linux + +-2000-04-04 Mike Welles <mike@onshore.com> ++2000-04-04 Mike Welles <mike@onshore.com> + * tif_win32.c: Applied patch to fix overreads and ovverwrites +- caught by BoundsChecker. From Arvan Pritchard +- <arvan.pritchard@infomatix.co.uk> (untested). +- +- * tif_getimage.c: Applied patch to silence VC6 warnings. From ++ caught by BoundsChecker. From Arvan Pritchard ++ <arvan.pritchard@infomatix.co.uk> (untested). ++ ++ * tif_getimage.c: Applied patch to silence VC6 warnings. From + Arvan Pritchard <arvan.pritchard@informatix.co.uk> +- +- * tif_lzw.c: Applied patch to silence VC6 warnings. From ++ ++ * tif_lzw.c: Applied patch to silence VC6 warnings. From + Arvan Pritchard <arvan.pritchard@informatix.co.uk> +- ++ + 2000-03-28 Frank Warmerdam <warmerda@cs46980-c> + + * Added contrib/stream (stream io) code submitted by Avi Bleiweiss. +@@ -4668,34 +4715,34 @@ Tue Apr 18 16:18:08 2000 Frank Warmerdam <warmerda@esabot.atlsci.com> + * fax2ps: Fixed mixup of width and height in bounding box statement + as per submission by Nalin Dahyabhai <nalin@redhat.com>. + +-2000-03-27 Mike Welles <mike@onshore.com> ++2000-03-27 Mike Welles <mike@onshore.com> + +- * fax2ps: Modified printruns to take uint32 instead of uint16. +- Patch courtesy of Bernt Herd <herd@herdsoft.com> +- +-2000-03-20 Mike Welles <mike@onshore.com> ++ * fax2ps: Modified printruns to take uint32 instead of uint16. ++ Patch courtesy of Bernt Herd <herd@herdsoft.com> + +- * configure: added test for libc6 for linux targets. Bug reported by ++2000-03-20 Mike Welles <mike@onshore.com> ++ ++ * configure: added test for libc6 for linux targets. Bug reported by + Stanislav Brabec <utx@k332.feld.cvut.cz> + +- * Added 3.5 docs to html/Makefile.in. ++ * Added 3.5 docs to html/Makefile.in. + Thanks to Stanislav Brabec <utx@k332.feld.cvut.cz> + +- * configure: fixed bugs in sed scripts +- (applied sed script s:/@:s;@:;s:/s;;:;: to configure). ++ * configure: fixed bugs in sed scripts ++ (applied sed script s:/@:s;@:;s:/s;;:;: to configure). + fix submitted to Stanislav Brabec <utx@k332.feld.cvut.cz> + +- * tools/iptcutil was not in files list, and wasn't being ++ * tools/iptcutil was not in files list, and wasn't being + added to tar archive. Updated Makefile.in. + + 2000-03-17 Frank Warmerdam <warmerda@cs46980-c> + + * tif_fax3.c: Fixed serious bug introduced during the uint16->uint32 +- conversion for the run arrays. ++ conversion for the run arrays. + + 2000-03-03 Frank Warmerdam <warmerda@cs46980-c.mtnk1.on.wave.home.com> + +- * Set td_sampleformat default to SAMPLEFORMAT_UINT instead of ++ * Set td_sampleformat default to SAMPLEFORMAT_UINT instead of + SAMPLEFORMAT_VOID in TIFFDefaultDirectory() in tif_dir.c. + + 2000-03-02 Frank Warmerdam <warmerda@cs46980-c.mtnk1.on.wave.home.com> +@@ -4716,20 +4763,20 @@ Tue Feb 15 22:01:05 2000 Frank Warmerdam <warmerda@gdal.velocet.ca> + set to 1, and added default (off) setting in tiffconf.h. This + should eventually be set by the configure script somehow. + +- The original work on all these 2-4GB changes was done by ++ The original work on all these 2-4GB changes was done by + Peter Smith (psmith@creo.com). + + * Modified tif_win32.c to support 2-4GB seeks. + + * tentatively changed toff_t to be unsigned instead of signed to +- facilitate support for 2-4GB files. ++ facilitate support for 2-4GB files. + + * Updated a variety of files to use toff_t. Fixed some mixups + between toff_t and tsize_t. + + Fri Jan 28 10:13:49 2000 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Largely reimplemented contrib/addtiffo to avoid temp files, ++ * Largely reimplemented contrib/addtiffo to avoid temp files, + updating the TIFF file in place. Fixed a few other bugs to. + + * Set tif_rawdatasize to zero when freeing raw data buffer in +@@ -4738,7 +4785,7 @@ Fri Jan 28 10:13:49 2000 Frank Warmerdam <warmerda@gdal.velocet.ca> + * Enabled "REWRITE_HACK" in tif_write.c by default. + + * Fix bug in tif_write.c when switching between reading one directory +- and writing to another. ++ and writing to another. + + * Made TIFFWriteCheck() public, and added TIFFCreateDirectory() + +@@ -4750,41 +4797,41 @@ Tue Jan 4 13:39:00 2000 Frank Warmerdam <warmerda@gdal.velocet.ca> + + * Added libtiff/libtiff.def to TIFFILES distribution list. + +-Mon Dec 27 12:13:39 EST 1999 Mike Welles <mike@onshore.com> ++Mon Dec 27 12:13:39 EST 1999 Mike Welles <mike@onshore.com> + +- * Created lzw compression kit, as a new module (libtiff-lzw-compression-kit). ++ * Created lzw compression kit, as a new module (libtiff-lzw-compression-kit). + + * Altered descriptions in tools to reflect "by default" lzw not supported + +- * Updated index.html to note lzw compression kit. +- ++ * Updated index.html to note lzw compression kit. ++ + Tue Dec 21 14:01:51 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Added fax3sm_winnt.c to distribution list in Makefile.in. ++ * Added fax3sm_winnt.c to distribution list in Makefile.in. + + Tue Dec 21 11:04:45 EST 1999 Mike Welles <mike@onshore.com> *** 3.5.4 release *** +- +- * Aadded Pixar tag support. Contributed by Phil Beffery <phil@pixar.com> + +- * Made one more change to tif_dir.c for removal of LZW compression. Also added notice +- when LZW compression invoked. ++ * Aadded Pixar tag support. Contributed by Phil Beffery <phil@pixar.com> ++ ++ * Made one more change to tif_dir.c for removal of LZW compression. Also added notice ++ when LZW compression invoked. + + * Changed default compression in tools to TIFF_PACKBITS, and changed usage descriptions + in tools to reflect removal of LZW compression +- ++ + Mon Dec 20 18:39:02 EST 1999 Mike Welles <mike@onshore.com> + +- * Fixed bug that caused LZW (non) compression to segfault. Added +- warning about LZW compression removed being removed, and why. ++ * Fixed bug that caused LZW (non) compression to segfault. Added ++ warning about LZW compression removed being removed, and why. ++ ++ * Added nostrip to install in tools/Makefile.in so that debugging ++ symbols are kept. + +- * Added nostrip to install in tools/Makefile.in so that debugging +- symbols are kept. +- + Tue Dec 7 12:04:47 EST 1999 Mike Welles <mike@onshore.com> + +- * Added patch from Ivo Penzar <ivo.penzar@infolink-software.com>, +- supporting Adobe ZIP deflate. Untested. +- ++ * Added patch from Ivo Penzar <ivo.penzar@infolink-software.com>, ++ supporting Adobe ZIP deflate. Untested. ++ + Sat Dec 4 15:47:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + * Made Packbits the default compression in tools/tiff2rgba.c instead +@@ -4794,12 +4841,12 @@ Tue Nov 30 14:41:43 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> *** 3.5 + + * Added tif_luv to contrib/djgpp/Makefile.lib. + +-Tue Nov 30 14:15:32 EST 1999 Mike Welles <mike@onshore.com> ++Tue Nov 30 14:15:32 EST 1999 Mike Welles <mike@onshore.com> ++ ++ * Added zip creation to relase makefile target + +- * Added zip creation to relase makefile target ++ * Added html for TIFFWriteTile.3t man page. + +- * Added html for TIFFWriteTile.3t man page. +- + Tue Nov 30 09:20:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + * Added some changes to tif_write.c to support rewriting existing +@@ -4812,26 +4859,26 @@ Mon Nov 29 11:43:42 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + Sun Nov 28 20:36:18 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Added notes on use of makefile.vc in build.html, and fixed ++ * Added notes on use of makefile.vc in build.html, and fixed + email subscription address. + +-199-11-28 Mike Welles <mike@onshore.com> ++1999-11-28 Mike Welles <mike@onshore.com> + +- * Fixed apocalypse-inducing y2k bug in contrib/ras/ras2tiff.c ++ * Fixed apocalypse-inducing y2k bug in contrib/ras/ras2tiff.c + + * Did some casts cleaning up to reduce compiler warnings in tif_fax3.c, +- from Bruce Carmeron <cameron@petris.com> -- modifications of +- changes made by Frank (sun cc still complained on cast). ++ from Bruce Carmeron <cameron@petris.com> -- modifications of ++ changes made by Frank (sun cc still complained on cast). + + * Added tiffconf.h to install target per request from Bill + Radcliffe <billr@corbis.com>: "We need a way for ImageMagick to + know features have been compiled into the TIFF library in order to +- handle things properly". +- ++ handle things properly". ++ + Sat Nov 27 16:49:21 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + * fixed various VC++ warnings as suggested by Gilles Vollant +- <info@winimage.com>. ++ <info@winimage.com>. + + Wed Nov 24 12:08:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +@@ -4840,59 +4887,59 @@ Wed Nov 24 12:08:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + 1999-11-22 Mike Welles <mike@onshore.com> + * HTML-ized the man pages, added to html/man +- +- * Removed LZW Compression to comply with Unisys patent extortion. +- +-1999-09-29 Mike Welles <mike@onshore.com> +- * Corrected one remaining 16 -> 32 bit value in tif_fax3.c, +- From Ivo Penzar <ivo.penzar@infolink-software.com. ++ ++ * Removed LZW Compression to comply with Unisys patent extortion. ++ ++1999-09-29 Mike Welles <mike@onshore.com> ++ * Corrected one remaining 16 -> 32 bit value in tif_fax3.c, ++ From Ivo Penzar <ivo.penzar@infolink-software.com. + + * Added patch from Ivo Penzar to have TiffAdvanceDirectory handle + memory mapped files. <ivo.penzar@infolink-software.com> +- ++ + 1999-09-26 Mike Welles <mike@onshore.com> *** 3.5.2 release *** +- * Corrected alpha versioning. ++ * Corrected alpha versioning. + +- * Removed distinction between alpha and release targets in Makefile.in. ++ * Removed distinction between alpha and release targets in Makefile.in. + +- * added release.stamp target, which tags cvs tree, and updates ++ * added release.stamp target, which tags cvs tree, and updates + "RELEASE-DATE" + +- * added releasediff target, which diffs tree with source as of ++ * added releasediff target, which diffs tree with source as of + date in "RELEASE-DATE" +- +- * Ticked up version to 3.5.2 (alpha 01 -- but I think we'll moving +- away from alpha/non-alpha distinctions). + +- * updated html to reflect release +- ++ * Ticked up version to 3.5.2 (alpha 01 -- but I think we'll moving ++ away from alpha/non-alpha distinctions). ++ ++ * updated html to reflect release ++ + 1999-09-23 <warmerda@CS46980-B> + + * Set O_BINARY for tif_unix.c open() ... used on cygwin for instance. + + * Added CYGWIN case in configure. + +-Fri Sep 17 00:13:51 CEST 1999 Mike Welles <mike@onshore.com> ++Fri Sep 17 00:13:51 CEST 1999 Mike Welles <mike@onshore.com> ++ ++ * Applied Francois Dagand's patch to handle fax decompression bug. ++ (sizes >= 65536 were failing) + +- * Applied Francois Dagand's patch to handle fax decompression bug. +- (sizes >= 65536 were failing) +- + Tue Sep 14 21:31:43 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Applied "a" mode fix to tif_win32.c/TIFFOpen() as suggested ++ * Applied "a" mode fix to tif_win32.c/TIFFOpen() as suggested + by Christopher Lawton <clawton@mathworks.com> + + Wed Sep 8 08:19:18 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Added IRIX/gcc, and OSF/1 4.x support on behalf of ++ * Added IRIX/gcc, and OSF/1 4.x support on behalf of + Albert Chin-A-Young <china@thewrittenword.com> + +- * Added TIFFReassignTagToIgnore() API on behalf of ++ * Added TIFFReassignTagToIgnore() API on behalf of + Bruce Cameron <cameron@petris.com>. Man page still pending. + + Wed Aug 25 11:39:07 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * Added test target in Makefile, test_pics.sh script and pics/*.rpt ++ * Added test target in Makefile, test_pics.sh script and pics/*.rpt + files to provide for a rudimentary testsuite. + + * Added contrib/tags back from old distribution ... fixed up a bit. +@@ -4900,7 +4947,7 @@ Wed Aug 25 11:39:07 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + 1999-08-16 <warmerda@CS46980-B> + + * Added simple makefile.vc makefiles for building with MS VC++ +- on Windows NT/98/95 in console mode. Stuff in contrib/win* make give ++ on Windows NT/98/95 in console mode. Stuff in contrib/win* make give + better solutions for some users. + + Mon Aug 16 21:52:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> +@@ -4910,20 +4957,20 @@ Mon Aug 16 21:52:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + + 1999-08-16 Michael L. Welles <mike@kurtz.fake> + +- * Updated html/index.html with anon CVS instructions. ++ * Updated html/index.html with anon CVS instructions. + + Mon Aug 16 13:18:41 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> + +- * pre-remove so link before softlink in LINUXdso action in ++ * pre-remove so link before softlink in LINUXdso action in + libtiff/Makefile.in to avoid failure on LINUXdso builds other than + the first. + + * Fixed problem with cvtcmap() in tif_getimage.c modifying the + colormaps owned by the TIFF handle itself when trying to fixup wrong + (eight bit) colormaps. Corrected by maintaining a private copy of +- the colormap. ++ the colormap. + +- * Added TIFFReadRGBATile()/TIFFReadRGBAStrip() support in ++ * Added TIFFReadRGBATile()/TIFFReadRGBAStrip() support in + tif_getimage.c. + + * CVS Repository placed at remotesensing.org. ChangeLog added. +diff --git a/Makefile.in b/Makefile.in +index 72fbbf3..2ed5682 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/aclocal.m4 b/aclocal.m4 +index d7d14c8..9293eda 100644 +--- a/aclocal.m4 ++++ b/aclocal.m4 +@@ -1,4 +1,4 @@ +-# generated automatically by aclocal 1.12.4 -*- Autoconf -*- ++# generated automatically by aclocal 1.12.5 -*- Autoconf -*- + + # Copyright (C) 1996-2012 Free Software Foundation, Inc. + +@@ -34,7 +34,7 @@ AC_DEFUN([AM_AUTOMAKE_VERSION], + [am__api_version='1.12' + dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to + dnl require some minimum version. Point them to the right macro. +-m4_if([$1], [1.12.4], [], ++m4_if([$1], [1.12.5], [], + [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl + ]) + +@@ -50,7 +50,7 @@ m4_define([_AM_AUTOCONF_VERSION], []) + # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced. + # This function is AC_REQUIREd by AM_INIT_AUTOMAKE. + AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION], +-[AM_AUTOMAKE_VERSION([1.12.4])dnl ++[AM_AUTOMAKE_VERSION([1.12.5])dnl + m4_ifndef([AC_AUTOCONF_VERSION], + [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl + _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) +diff --git a/build/Makefile.in b/build/Makefile.in +index 1a316b1..cea7a08 100644 +--- a/build/Makefile.in ++++ b/build/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/Makefile.in b/contrib/Makefile.in +index ae67554..72be7a3 100644 +--- a/contrib/Makefile.in ++++ b/contrib/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/acorn/Makefile.in b/contrib/acorn/Makefile.in +index 1e966b4..5a73941 100644 +--- a/contrib/acorn/Makefile.in ++++ b/contrib/acorn/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/addtiffo/Makefile.in b/contrib/addtiffo/Makefile.in +index 25a6e8b..e07640c 100644 +--- a/contrib/addtiffo/Makefile.in ++++ b/contrib/addtiffo/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/dbs/Makefile.in b/contrib/dbs/Makefile.in +index f5b3ee5..d5e7b40 100644 +--- a/contrib/dbs/Makefile.in ++++ b/contrib/dbs/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/dbs/xtiff/Makefile.in b/contrib/dbs/xtiff/Makefile.in +index 2d1ce94..c655c54 100644 +--- a/contrib/dbs/xtiff/Makefile.in ++++ b/contrib/dbs/xtiff/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/dbs/xtiff/xtiff.c b/contrib/dbs/xtiff/xtiff.c +index 7fe3977..de0b2a7 100644 +--- a/contrib/dbs/xtiff/xtiff.c ++++ b/contrib/dbs/xtiff/xtiff.c +@@ -1,5 +1,5 @@ + /* +- * $Id: xtiff.c,v 1.2.2.1 2010-06-08 18:50:40 bfriesen Exp $ ++ * $Id: xtiff.c,v 1.2.2.2 2013-05-02 14:44:43 tgl Exp $ + * + * xtiff - view a TIFF file in an X window + * +@@ -512,9 +512,9 @@ SetNameLabel() + Arg args[1]; + + if (tfMultiPage) +- sprintf(buffer, "%s - page %d", fileName, tfDirectory); ++ snprintf(buffer, sizeof(buffer), "%s - page %d", fileName, tfDirectory); + else +- strcpy(buffer, fileName); ++ snprintf(buffer, sizeof(buffer), "%s", fileName); + XtSetArg(args[0], XtNlabel, buffer); + XtSetValues(labelWidget, args, 1); + } +diff --git a/contrib/iptcutil/Makefile.in b/contrib/iptcutil/Makefile.in +index 75b1ca3..5858c03 100644 +--- a/contrib/iptcutil/Makefile.in ++++ b/contrib/iptcutil/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/mac-cw/Makefile.in b/contrib/mac-cw/Makefile.in +index a94a33a..054d44e 100644 +--- a/contrib/mac-cw/Makefile.in ++++ b/contrib/mac-cw/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/mac-mpw/Makefile.in b/contrib/mac-mpw/Makefile.in +index 8fdaae1..7dd27d7 100644 +--- a/contrib/mac-mpw/Makefile.in ++++ b/contrib/mac-mpw/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/mfs/Makefile.in b/contrib/mfs/Makefile.in +index 230c925..4ee41af 100644 +--- a/contrib/mfs/Makefile.in ++++ b/contrib/mfs/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/pds/Makefile.in b/contrib/pds/Makefile.in +index 3511f62..fa0bcf7 100644 +--- a/contrib/pds/Makefile.in ++++ b/contrib/pds/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/ras/Makefile.in b/contrib/ras/Makefile.in +index 88907bf..e33a00f 100644 +--- a/contrib/ras/Makefile.in ++++ b/contrib/ras/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/stream/Makefile.in b/contrib/stream/Makefile.in +index 9c9dffb..1c36a7f 100644 +--- a/contrib/stream/Makefile.in ++++ b/contrib/stream/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/tags/Makefile.in b/contrib/tags/Makefile.in +index e378f32..891d565 100644 +--- a/contrib/tags/Makefile.in ++++ b/contrib/tags/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/contrib/win_dib/Makefile.in b/contrib/win_dib/Makefile.in +index 0f68e76..45bf928 100644 +--- a/contrib/win_dib/Makefile.in ++++ b/contrib/win_dib/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/html/Makefile.in b/html/Makefile.in +index b9f86c8..a85ebd6 100644 +--- a/html/Makefile.in ++++ b/html/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/html/images/Makefile.in b/html/images/Makefile.in +index 1b96240..eaf50a3 100644 +--- a/html/images/Makefile.in ++++ b/html/images/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/html/man/Makefile.in b/html/man/Makefile.in +index 3a5278e..98226c3 100644 +--- a/html/man/Makefile.in ++++ b/html/man/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/libtiff/Makefile.in b/libtiff/Makefile.in +index 6a7c415..69e59c7 100644 +--- a/libtiff/Makefile.in ++++ b/libtiff/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/libtiff/tif_codec.c b/libtiff/tif_codec.c +index d5c6fd1..5a38184 100644 +--- a/libtiff/tif_codec.c ++++ b/libtiff/tif_codec.c +@@ -1,4 +1,4 @@ +-/* $Id: tif_codec.c,v 1.10.2.2 2010-06-08 18:50:41 bfriesen Exp $ */ ++/* $Id: tif_codec.c,v 1.10.2.3 2013-05-02 14:44:43 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -104,7 +104,8 @@ _notConfigured(TIFF* tif) + const TIFFCodec* c = TIFFFindCODEC(tif->tif_dir.td_compression); + char compression_code[20]; + +- sprintf( compression_code, "%d", tif->tif_dir.td_compression ); ++ snprintf(compression_code, sizeof(compression_code), "%d", ++ tif->tif_dir.td_compression ); + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "%s compression support is not configured", + c ? c->name : compression_code ); +diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c +index 76ef572..417a2e3 100644 +--- a/libtiff/tif_dirinfo.c ++++ b/libtiff/tif_dirinfo.c +@@ -1,4 +1,4 @@ +-/* $Id: tif_dirinfo.c,v 1.65.2.10 2010-07-06 14:14:41 dron Exp $ */ ++/* $Id: tif_dirinfo.c,v 1.65.2.11 2013-05-02 14:44:43 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -869,7 +869,7 @@ _TIFFCreateAnonFieldInfo(TIFF *tif, ttag_t tag, TIFFDataType field_type) + * note that this name is a special sign to TIFFClose() and + * _TIFFSetupFieldInfo() to free the field + */ +- sprintf(fld->field_name, "Tag %d", (int) tag); ++ snprintf(fld->field_name, 32, "Tag %d", (int) tag); + + return fld; + } +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index ed8eb40..6e127fb 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -1,4 +1,4 @@ +-/* $Id: tif_pixarlog.c,v 1.15.2.4 2010-06-08 18:50:42 bfriesen Exp $ */ ++/* $Id: tif_pixarlog.c,v 1.15.2.5 2012-12-10 17:38:54 tgl Exp $ */ + + /* + * Copyright (c) 1996-1997 Sam Leffler +@@ -117,9 +117,9 @@ horizontalAccumulateF(uint16 *wp, int n, int stride, float *op, + if (n >= stride) { + mask = CODE_MASK; + if (stride == 3) { +- t0 = ToLinearF[cr = wp[0]]; +- t1 = ToLinearF[cg = wp[1]]; +- t2 = ToLinearF[cb = wp[2]]; ++ t0 = ToLinearF[cr = (wp[0] & mask)]; ++ t1 = ToLinearF[cg = (wp[1] & mask)]; ++ t2 = ToLinearF[cb = (wp[2] & mask)]; + op[0] = t0; + op[1] = t1; + op[2] = t2; +@@ -136,10 +136,10 @@ horizontalAccumulateF(uint16 *wp, int n, int stride, float *op, + op[2] = t2; + } + } else if (stride == 4) { +- t0 = ToLinearF[cr = wp[0]]; +- t1 = ToLinearF[cg = wp[1]]; +- t2 = ToLinearF[cb = wp[2]]; +- t3 = ToLinearF[ca = wp[3]]; ++ t0 = ToLinearF[cr = (wp[0] & mask)]; ++ t1 = ToLinearF[cg = (wp[1] & mask)]; ++ t2 = ToLinearF[cb = (wp[2] & mask)]; ++ t3 = ToLinearF[ca = (wp[3] & mask)]; + op[0] = t0; + op[1] = t1; + op[2] = t2; +@@ -183,9 +183,9 @@ horizontalAccumulate12(uint16 *wp, int n, int stride, int16 *op, + if (n >= stride) { + mask = CODE_MASK; + if (stride == 3) { +- t0 = ToLinearF[cr = wp[0]] * SCALE12; +- t1 = ToLinearF[cg = wp[1]] * SCALE12; +- t2 = ToLinearF[cb = wp[2]] * SCALE12; ++ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12; ++ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12; ++ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12; + op[0] = CLAMP12(t0); + op[1] = CLAMP12(t1); + op[2] = CLAMP12(t2); +@@ -202,10 +202,10 @@ horizontalAccumulate12(uint16 *wp, int n, int stride, int16 *op, + op[2] = CLAMP12(t2); + } + } else if (stride == 4) { +- t0 = ToLinearF[cr = wp[0]] * SCALE12; +- t1 = ToLinearF[cg = wp[1]] * SCALE12; +- t2 = ToLinearF[cb = wp[2]] * SCALE12; +- t3 = ToLinearF[ca = wp[3]] * SCALE12; ++ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12; ++ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12; ++ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12; ++ t3 = ToLinearF[ca = (wp[3] & mask)] * SCALE12; + op[0] = CLAMP12(t0); + op[1] = CLAMP12(t1); + op[2] = CLAMP12(t2); +@@ -247,9 +247,9 @@ horizontalAccumulate16(uint16 *wp, int n, int stride, uint16 *op, + if (n >= stride) { + mask = CODE_MASK; + if (stride == 3) { +- op[0] = ToLinear16[cr = wp[0]]; +- op[1] = ToLinear16[cg = wp[1]]; +- op[2] = ToLinear16[cb = wp[2]]; ++ op[0] = ToLinear16[cr = (wp[0] & mask)]; ++ op[1] = ToLinear16[cg = (wp[1] & mask)]; ++ op[2] = ToLinear16[cb = (wp[2] & mask)]; + n -= 3; + while (n > 0) { + wp += 3; +@@ -260,10 +260,10 @@ horizontalAccumulate16(uint16 *wp, int n, int stride, uint16 *op, + op[2] = ToLinear16[(cb += wp[2]) & mask]; + } + } else if (stride == 4) { +- op[0] = ToLinear16[cr = wp[0]]; +- op[1] = ToLinear16[cg = wp[1]]; +- op[2] = ToLinear16[cb = wp[2]]; +- op[3] = ToLinear16[ca = wp[3]]; ++ op[0] = ToLinear16[cr = (wp[0] & mask)]; ++ op[1] = ToLinear16[cg = (wp[1] & mask)]; ++ op[2] = ToLinear16[cb = (wp[2] & mask)]; ++ op[3] = ToLinear16[ca = (wp[3] & mask)]; + n -= 4; + while (n > 0) { + wp += 4; +@@ -342,9 +342,9 @@ horizontalAccumulate8(uint16 *wp, int n, int stride, unsigned char *op, + if (n >= stride) { + mask = CODE_MASK; + if (stride == 3) { +- op[0] = ToLinear8[cr = wp[0]]; +- op[1] = ToLinear8[cg = wp[1]]; +- op[2] = ToLinear8[cb = wp[2]]; ++ op[0] = ToLinear8[cr = (wp[0] & mask)]; ++ op[1] = ToLinear8[cg = (wp[1] & mask)]; ++ op[2] = ToLinear8[cb = (wp[2] & mask)]; + n -= 3; + while (n > 0) { + n -= 3; +@@ -355,10 +355,10 @@ horizontalAccumulate8(uint16 *wp, int n, int stride, unsigned char *op, + op[2] = ToLinear8[(cb += wp[2]) & mask]; + } + } else if (stride == 4) { +- op[0] = ToLinear8[cr = wp[0]]; +- op[1] = ToLinear8[cg = wp[1]]; +- op[2] = ToLinear8[cb = wp[2]]; +- op[3] = ToLinear8[ca = wp[3]]; ++ op[0] = ToLinear8[cr = (wp[0] & mask)]; ++ op[1] = ToLinear8[cg = (wp[1] & mask)]; ++ op[2] = ToLinear8[cb = (wp[2] & mask)]; ++ op[3] = ToLinear8[ca = (wp[3] & mask)]; + n -= 4; + while (n > 0) { + n -= 4; +@@ -393,9 +393,9 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op, + mask = CODE_MASK; + if (stride == 3) { + op[0] = 0; +- t1 = ToLinear8[cb = wp[2]]; +- t2 = ToLinear8[cg = wp[1]]; +- t3 = ToLinear8[cr = wp[0]]; ++ t1 = ToLinear8[cb = (wp[2] & mask)]; ++ t2 = ToLinear8[cg = (wp[1] & mask)]; ++ t3 = ToLinear8[cr = (wp[0] & mask)]; + op[1] = t1; + op[2] = t2; + op[3] = t3; +@@ -413,10 +413,10 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op, + op[3] = t3; + } + } else if (stride == 4) { +- t0 = ToLinear8[ca = wp[3]]; +- t1 = ToLinear8[cb = wp[2]]; +- t2 = ToLinear8[cg = wp[1]]; +- t3 = ToLinear8[cr = wp[0]]; ++ t0 = ToLinear8[ca = (wp[3] & mask)]; ++ t1 = ToLinear8[cb = (wp[2] & mask)]; ++ t2 = ToLinear8[cg = (wp[1] & mask)]; ++ t3 = ToLinear8[cr = (wp[0] & mask)]; + op[0] = t0; + op[1] = t1; + op[2] = t2; +@@ -630,10 +630,10 @@ PixarLogGuessDataFmt(TIFFDirectory *td) + return guess; + } + +-static uint32 +-multiply(size_t m1, size_t m2) ++static tsize_t ++multiply(tsize_t m1, tsize_t m2) + { +- uint32 bytes = m1 * m2; ++ tsize_t bytes = m1 * m2; + + if (m1 && bytes / m1 != m2) + bytes = 0; +@@ -641,6 +641,20 @@ multiply(size_t m1, size_t m2) + return bytes; + } + ++static tsize_t ++add_ms(tsize_t m1, tsize_t m2) ++{ ++ tsize_t bytes = m1 + m2; ++ ++ /* if either input is zero, assume overflow already occurred */ ++ if (m1 == 0 || m2 == 0) ++ bytes = 0; ++ else if (bytes <= m1 || bytes <= m2) ++ bytes = 0; ++ ++ return bytes; ++} ++ + static int + PixarLogSetupDecode(TIFF* tif) + { +@@ -661,6 +675,8 @@ PixarLogSetupDecode(TIFF* tif) + td->td_samplesperpixel : 1); + tbuf_size = multiply(multiply(multiply(sp->stride, td->td_imagewidth), + td->td_rowsperstrip), sizeof(uint16)); ++ /* add one more stride in case input ends mid-stride */ ++ tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride); + if (tbuf_size == 0) + return (0); + sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size); +diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c +index 7634f6e..2b255da 100644 +--- a/libtiff/tif_print.c ++++ b/libtiff/tif_print.c +@@ -1,4 +1,4 @@ +-/* $Id: tif_print.c,v 1.36.2.5 2010-07-06 14:05:30 dron Exp $ */ ++/* $Id: tif_print.c,v 1.36.2.6 2012-12-12 23:18:05 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -514,8 +514,19 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags) + continue; + + if(fip->field_passcount) { +- if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1) ++ if (fip->field_readcount == TIFF_VARIABLE2 ) { ++ if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1) ++ continue; ++ } else if (fip->field_readcount == TIFF_VARIABLE ) { ++ uint16 small_value_count; ++ if(TIFFGetField(tif, tag, &small_value_count, &raw_data) != 1) ++ continue; ++ value_count = small_value_count; ++ } else { ++ assert (fip->field_readcount == TIFF_VARIABLE ++ || fip->field_readcount == TIFF_VARIABLE2); + continue; ++ } + } else { + if (fip->field_readcount == TIFF_VARIABLE + || fip->field_readcount == TIFF_VARIABLE2) +diff --git a/man/Makefile.in b/man/Makefile.in +index a007da7..cac0721 100644 +--- a/man/Makefile.in ++++ b/man/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/port/Makefile.in b/port/Makefile.in +index 6674109..f95d58f 100644 +--- a/port/Makefile.in ++++ b/port/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/test/Makefile.in b/test/Makefile.in +index 61ea1ff..f88959f 100644 +--- a/test/Makefile.in ++++ b/test/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/tools/Makefile.in b/tools/Makefile.in +index 47dcec8..6f3d517 100644 +--- a/tools/Makefile.in ++++ b/tools/Makefile.in +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.12.4 from Makefile.am. ++# Makefile.in generated by automake 1.12.5 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2012 Free Software Foundation, Inc. +diff --git a/tools/ppm2tiff.c b/tools/ppm2tiff.c +index 6078459..ec8be5d 100644 +--- a/tools/ppm2tiff.c ++++ b/tools/ppm2tiff.c +@@ -1,4 +1,4 @@ +-/* $Id: ppm2tiff.c,v 1.13.2.2 2010-06-08 18:50:44 bfriesen Exp $ */ ++/* $Id: ppm2tiff.c,v 1.13.2.3 2012-12-10 18:27:35 tgl Exp $ */ + + /* + * Copyright (c) 1991-1997 Sam Leffler +@@ -68,6 +68,17 @@ BadPPM(char* file) + exit(-2); + } + ++static tsize_t ++multiply_ms(tsize_t m1, tsize_t m2) ++{ ++ tsize_t bytes = m1 * m2; ++ ++ if (m1 && bytes / m1 != m2) ++ bytes = 0; ++ ++ return bytes; ++} ++ + int + main(int argc, char* argv[]) + { +@@ -85,6 +96,7 @@ main(int argc, char* argv[]) + int c; + extern int optind; + extern char* optarg; ++ tsize_t scanline_size; + + if (argc < 2) { + fprintf(stderr, "%s: Too few arguments\n", argv[0]); +@@ -217,7 +229,8 @@ main(int argc, char* argv[]) + } + switch (bpp) { + case 1: +- linebytes = (spp * w + (8 - 1)) / 8; ++ /* if round-up overflows, result will be zero, OK */ ++ linebytes = (multiply_ms(spp, w) + (8 - 1)) / 8; + if (rowsperstrip == (uint32) -1) { + TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, h); + } else { +@@ -226,15 +239,31 @@ main(int argc, char* argv[]) + } + break; + case 8: +- linebytes = spp * w; ++ linebytes = multiply_ms(spp, w); + TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, + TIFFDefaultStripSize(out, rowsperstrip)); + break; + } +- if (TIFFScanlineSize(out) > linebytes) ++ if (linebytes == 0) { ++ fprintf(stderr, "%s: scanline size overflow\n", infile); ++ (void) TIFFClose(out); ++ exit(-2); ++ } ++ scanline_size = TIFFScanlineSize(out); ++ if (scanline_size == 0) { ++ /* overflow - TIFFScanlineSize already printed a message */ ++ (void) TIFFClose(out); ++ exit(-2); ++ } ++ if (scanline_size < linebytes) + buf = (unsigned char *)_TIFFmalloc(linebytes); + else +- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); ++ buf = (unsigned char *)_TIFFmalloc(scanline_size); ++ if (buf == NULL) { ++ fprintf(stderr, "%s: Not enough memory\n", infile); ++ (void) TIFFClose(out); ++ exit(-2); ++ } + if (resolution > 0) { + TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution); + TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution); +diff --git a/tools/rgb2ycbcr.c b/tools/rgb2ycbcr.c +index 0b30b51..527c036 100644 +--- a/tools/rgb2ycbcr.c ++++ b/tools/rgb2ycbcr.c +@@ -1,4 +1,4 @@ +-/* $Id: rgb2ycbcr.c,v 1.9.2.2 2010-06-08 18:50:44 bfriesen Exp $ */ ++/* $Id: rgb2ycbcr.c,v 1.9.2.3 2013-05-02 14:44:44 tgl Exp $ */ + + /* + * Copyright (c) 1991-1997 Sam Leffler +@@ -326,7 +326,8 @@ tiffcvt(TIFF* in, TIFF* out) + TIFFSetField(out, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG); + { char buf[2048]; + char *cp = strrchr(TIFFFileName(in), '/'); +- sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in)); ++ snprintf(buf, sizeof(buf), "YCbCr conversion of %s", ++ cp ? cp+1 : TIFFFileName(in)); + TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf); + } + TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion()); +diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c +index 8fbf061..98908d1 100644 +--- a/tools/tiff2bw.c ++++ b/tools/tiff2bw.c +@@ -1,4 +1,4 @@ +-/* $Id: tiff2bw.c,v 1.12.2.2 2010-07-02 12:03:27 dron Exp $ */ ++/* $Id: tiff2bw.c,v 1.12.2.3 2013-05-02 14:44:44 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -201,7 +201,7 @@ main(int argc, char* argv[]) + } + } + TIFFSetField(out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_MINISBLACK); +- sprintf(thing, "B&W version of %s", argv[optind]); ++ snprintf(thing, sizeof(thing), "B&W version of %s", argv[optind]); + TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing); + TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw"); + outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); +diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c +index dee6435..c55b927 100644 +--- a/tools/tiff2pdf.c ++++ b/tools/tiff2pdf.c +@@ -1,4 +1,4 @@ +-/* $Id: tiff2pdf.c,v 1.37.2.22 2012-07-19 15:43:31 tgl Exp $ ++/* $Id: tiff2pdf.c,v 1.37.2.24 2013-05-02 14:54:18 tgl Exp $ + * + * tiff2pdf - converts a TIFF image to a PDF document + * +@@ -3337,33 +3337,56 @@ int t2p_process_jpeg_strip( + uint32 height){ + + tsize_t i=0; +- uint16 ri =0; +- uint16 v_samp=1; +- uint16 h_samp=1; +- int j=0; +- +- i++; +- +- while(i<(*striplength)){ ++ ++ while (i < *striplength) { ++ tsize_t datalen; ++ uint16 ri; ++ uint16 v_samp; ++ uint16 h_samp; ++ int j; ++ int ncomp; ++ ++ /* marker header: one or more FFs */ ++ if (strip[i] != 0xff) ++ return(0); ++ i++; ++ while (i < *striplength && strip[i] == 0xff) ++ i++; ++ if (i >= *striplength) ++ return(0); ++ /* SOI is the only pre-SOS marker without a length word */ ++ if (strip[i] == 0xd8) ++ datalen = 0; ++ else { ++ if ((*striplength - i) <= 2) ++ return(0); ++ datalen = (strip[i+1] << 8) | strip[i+2]; ++ if (datalen < 2 || datalen >= (*striplength - i)) ++ return(0); ++ } + switch( strip[i] ){ +- case 0xd8: +- /* SOI - start of image */ ++ case 0xd8: /* SOI - start of image */ + _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2); + *bufferoffset+=2; +- i+=2; + break; +- case 0xc0: +- case 0xc1: +- case 0xc3: +- case 0xc9: +- case 0xca: ++ case 0xc0: /* SOF0 */ ++ case 0xc1: /* SOF1 */ ++ case 0xc3: /* SOF3 */ ++ case 0xc9: /* SOF9 */ ++ case 0xca: /* SOF10 */ + if(no==0){ +- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2); +- for(j=0;j<buffer[*bufferoffset+9];j++){ +- if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp) +- h_samp = (buffer[*bufferoffset+11+(2*j)]>>4); +- if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp) +- v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f); ++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2); ++ ncomp = buffer[*bufferoffset+9]; ++ if (ncomp < 1 || ncomp > 4) ++ return(0); ++ v_samp=1; ++ h_samp=1; ++ for(j=0;j<ncomp;j++){ ++ uint16 samp = buffer[*bufferoffset+11+(3*j)]; ++ if( (samp>>4) > h_samp) ++ h_samp = (samp>>4); ++ if( (samp & 0x0f) > v_samp) ++ v_samp = (samp & 0x0f); + } + v_samp*=8; + h_samp*=8; +@@ -3377,45 +3400,43 @@ int t2p_process_jpeg_strip( + (unsigned char) ((height>>8) & 0xff); + buffer[*bufferoffset+6]= + (unsigned char) (height & 0xff); +- *bufferoffset+=strip[i+2]+2; +- i+=strip[i+2]+2; +- ++ *bufferoffset+=datalen+2; ++ /* insert a DRI marker */ + buffer[(*bufferoffset)++]=0xff; + buffer[(*bufferoffset)++]=0xdd; + buffer[(*bufferoffset)++]=0x00; + buffer[(*bufferoffset)++]=0x04; + buffer[(*bufferoffset)++]=(ri >> 8) & 0xff; + buffer[(*bufferoffset)++]= ri & 0xff; +- } else { +- i+=strip[i+2]+2; + } + break; +- case 0xc4: +- case 0xdb: +- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2); +- *bufferoffset+=strip[i+2]+2; +- i+=strip[i+2]+2; ++ case 0xc4: /* DHT */ ++ case 0xdb: /* DQT */ ++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2); ++ *bufferoffset+=datalen+2; + break; +- case 0xda: ++ case 0xda: /* SOS */ + if(no==0){ +- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2); +- *bufferoffset+=strip[i+2]+2; +- i+=strip[i+2]+2; ++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2); ++ *bufferoffset+=datalen+2; + } else { + buffer[(*bufferoffset)++]=0xff; + buffer[(*bufferoffset)++]= + (unsigned char)(0xd0 | ((no-1)%8)); +- i+=strip[i+2]+2; + } +- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1); +- *bufferoffset+=(*striplength)-i-1; ++ i += datalen + 1; ++ /* copy remainder of strip */ ++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i); ++ *bufferoffset+= *striplength - i; + return(1); + default: +- i+=strip[i+2]+2; ++ /* ignore any other marker */ ++ break; + } ++ i += datalen + 1; + } +- + ++ /* failed to find SOS marker */ + return(0); + } + #endif +@@ -3605,7 +3626,9 @@ tsize_t t2p_write_pdf_header(T2P* t2p, TIFF* output){ + char buffer[16]; + int buflen=0; + +- buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff); ++ buflen = snprintf(buffer, sizeof(buffer), "%%PDF-%u.%u ", ++ t2p->pdf_majorversion&0xff, ++ t2p->pdf_minorversion&0xff); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7); + +@@ -3619,10 +3642,10 @@ tsize_t t2p_write_pdf_header(T2P* t2p, TIFF* output){ + tsize_t t2p_write_pdf_obj_start(uint32 number, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + +- buflen=sprintf(buffer, "%lu", (unsigned long)number); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number); + written += t2pWriteFile(output, (tdata_t) buffer, buflen ); + written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7); + +@@ -3661,13 +3684,13 @@ tsize_t t2p_write_pdf_name(unsigned char* name, TIFF* output){ + written += t2pWriteFile(output, (tdata_t) "/", 1); + for (i=0;i<namelen;i++){ + if ( ((unsigned char)name[i]) < 0x21){ +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + nextchar=1; + } + if ( ((unsigned char)name[i]) > 0x7E){ +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + nextchar=1; +@@ -3675,57 +3698,57 @@ tsize_t t2p_write_pdf_name(unsigned char* name, TIFF* output){ + if (nextchar==0){ + switch (name[i]){ + case 0x23: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x25: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x28: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x29: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x2F: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x3C: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x3E: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x5B: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x5D: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x7B: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x7D: +- sprintf(buffer, "#%.2X", name[i]); ++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); + buffer[sizeof(buffer) - 1] = '\0'; + written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; +@@ -3840,14 +3863,14 @@ tsize_t t2p_write_pdf_stream_end(TIFF* output){ + tsize_t t2p_write_pdf_stream_dict(tsize_t len, uint32 number, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + written += t2pWriteFile(output, (tdata_t) "/Length ", 8); + if(len!=0){ + written += t2p_write_pdf_stream_length(len, output); + } else { +- buflen=sprintf(buffer, "%lu", (unsigned long)number); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); + } +@@ -3888,10 +3911,10 @@ tsize_t t2p_write_pdf_stream_dict_end(TIFF* output){ + tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + +- buflen=sprintf(buffer, "%lu", (unsigned long)len); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)len); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "\n", 1); + +@@ -3905,7 +3928,7 @@ tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){ + tsize_t t2p_write_pdf_catalog(T2P* t2p, TIFF* output) + { + tsize_t written = 0; +- char buffer[16]; ++ char buffer[32]; + int buflen = 0; + + written += t2pWriteFile(output, +@@ -3944,7 +3967,6 @@ tsize_t t2p_write_pdf_info(T2P* t2p, TIFF* input, TIFF* output) + written += t2p_write_pdf_string(t2p->pdf_datetime, output); + } + written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11); +- _TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer)); + snprintf(buffer, sizeof(buffer), "libtiff / tiff2pdf - %d", TIFFLIB_VERSION); + written += t2p_write_pdf_string(buffer, output); + written += t2pWriteFile(output, (tdata_t) "\n", 1); +@@ -4085,7 +4107,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output) + { + tsize_t written=0; + tdir_t i=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + int page=0; +@@ -4093,7 +4115,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output) + (tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26); + page = t2p->pdf_pages+1; + for (i=0;i<t2p->tiff_pagecount;i++){ +- buflen=sprintf(buffer, "%d", page); ++ buflen=snprintf(buffer, sizeof(buffer), "%d", page); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + if ( ((i+1)%8)==0 ) { +@@ -4108,8 +4130,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output) + } + } + written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10); +- _TIFFmemset(buffer, 0x00, 16); +- buflen=sprintf(buffer, "%d", t2p->tiff_pagecount); ++ buflen=snprintf(buffer, sizeof(buffer), "%d", t2p->tiff_pagecount); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6); + +@@ -4124,28 +4145,28 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){ + + unsigned int i=0; + tsize_t written=0; +- char buffer[16]; ++ char buffer[256]; + int buflen=0; + + written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_pages); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); + written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11); +- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1); ++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1); ++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2); ++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x2); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2); ++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y2); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "] \n", 3); + written += t2pWriteFile(output, (tdata_t) "/Contents ", 10); +- buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1)); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(object + 1)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); + written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15); +@@ -4153,15 +4174,13 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){ + written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12); + for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount;i++){ + written += t2pWriteFile(output, (tdata_t) "/Im", 3); +- buflen = sprintf(buffer, "%u", t2p->pdf_page+1); ++ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "_", 1); +- buflen = sprintf(buffer, "%u", i+1); ++ buflen = snprintf(buffer, sizeof(buffer), "%u", i+1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- buflen = sprintf( +- buffer, +- "%lu", ++ buflen = snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +@@ -4173,12 +4192,10 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){ + } else { + written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12); + written += t2pWriteFile(output, (tdata_t) "/Im", 3); +- buflen = sprintf(buffer, "%u", t2p->pdf_page+1); ++ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- buflen = sprintf( +- buffer, +- "%lu", ++ buflen = snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +@@ -4187,9 +4204,7 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){ + if(t2p->tiff_transferfunctioncount != 0) { + written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13); + t2pWriteFile(output, (tdata_t) "/GS1 ", 5); +- buflen = sprintf( +- buffer, +- "%lu", ++ buflen = snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(object + 3)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +@@ -4562,7 +4577,7 @@ tsize_t t2p_write_pdf_page_content_stream(T2P* t2p, TIFF* output){ + if(t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount>0){ + for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount; i++){ + box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box; +- buflen=sprintf(buffer, ++ buflen=snprintf(buffer, sizeof(buffer), + "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n", + t2p->tiff_transferfunctioncount?"/GS1 gs ":"", + box.mat[0], +@@ -4577,7 +4592,7 @@ tsize_t t2p_write_pdf_page_content_stream(T2P* t2p, TIFF* output){ + } + } else { + box=t2p->pdf_imagebox; +- buflen=sprintf(buffer, ++ buflen=snprintf(buffer, sizeof(buffer), + "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n", + t2p->tiff_transferfunctioncount?"/GS1 gs ":"", + box.mat[0], +@@ -4602,59 +4617,48 @@ tsize_t t2p_write_pdf_xobject_stream_dict(ttile_t tile, + TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output); + written += t2pWriteFile(output, + (tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im", + 42); +- buflen=sprintf(buffer, "%u", t2p->pdf_page+1); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + if(tile != 0){ + written += t2pWriteFile(output, (tdata_t) "_", 1); +- buflen=sprintf(buffer, "%lu", (unsigned long)tile); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)tile); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } + written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8); +- _TIFFmemset((tdata_t)buffer, 0x00, 16); + if(tile==0){ +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_width); + } else { + if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){ +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth); + } else { +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth); + } + } + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9); +- _TIFFmemset((tdata_t)buffer, 0x00, 16); + if(tile==0){ +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_length); + } else { + if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){ +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength); + } else { +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength); + } + } + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19); +- _TIFFmemset((tdata_t)buffer, 0x00, 16); +- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13); + written += t2p_write_pdf_xobject_cs(t2p, output); +@@ -4698,11 +4702,10 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){ + t2p->pdf_colorspace ^= T2P_CS_PALETTE; + written += t2p_write_pdf_xobject_cs(t2p, output); + t2p->pdf_colorspace |= T2P_CS_PALETTE; +- buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 ); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", (0x0001 << t2p->tiff_bitspersample)-1 ); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " ", 1); +- _TIFFmemset(buffer, 0x00, 16); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs ); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_palettecs ); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7); + return(written); +@@ -4736,10 +4739,10 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){ + X_W /= Y_W; + Z_W /= Y_W; + Y_W = 1.0F; +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "/Range ", 7); +- buflen=sprintf(buffer, "[%d %d %d %d] \n", ++ buflen=snprintf(buffer, sizeof(buffer), "[%d %d %d %d] \n", + t2p->pdf_labrange[0], + t2p->pdf_labrange[1], + t2p->pdf_labrange[2], +@@ -4755,26 +4758,26 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){ + tsize_t t2p_write_pdf_transfer(T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25); + if(t2p->tiff_transferfunctioncount == 1){ +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(t2p->pdf_xrefcount + 1)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + } else { + written += t2pWriteFile(output, (tdata_t) "[ ", 2); +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(t2p->pdf_xrefcount + 1)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(t2p->pdf_xrefcount + 2)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)(t2p->pdf_xrefcount + 3)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); +@@ -4796,7 +4799,7 @@ tsize_t t2p_write_pdf_transfer_dict(T2P* t2p, TIFF* output, uint16 i){ + written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17); + written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19); + written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18); +- buflen=sprintf(buffer, "/Size [%u] \n", (1<<t2p->tiff_bitspersample)); ++ buflen=snprintf(buffer, sizeof(buffer), "/Size [%u] \n", (1<<t2p->tiff_bitspersample)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19); + written += t2p_write_pdf_stream_dict(1<<(t2p->tiff_bitspersample+1), 0, output); +@@ -4823,7 +4826,7 @@ tsize_t t2p_write_pdf_transfer_stream(T2P* t2p, TIFF* output, uint16 i){ + tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[128]; ++ char buffer[256]; + int buflen=0; + + float X_W=0.0; +@@ -4891,16 +4894,16 @@ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){ + written += t2pWriteFile(output, (tdata_t) "<< \n", 4); + if(t2p->pdf_colorspace & T2P_CS_CALGRAY){ + written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12); + } + if(t2p->pdf_colorspace & T2P_CS_CALRGB){ + written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", ++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", + X_R, Y_R, Z_R, + X_G, Y_G, Z_G, + X_B, Y_B, Z_B); +@@ -4919,11 +4922,11 @@ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){ + tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_icccs); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7); + +@@ -4933,11 +4936,11 @@ tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){ + tsize_t t2p_write_pdf_xobject_icccs_dict(T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + written += t2pWriteFile(output, (tdata_t) "/N ", 3); +- buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel); ++ buflen=snprintf(buffer, sizeof(buffer), "%u \n", t2p->tiff_samplesperpixel); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11); + t2p->pdf_colorspace ^= T2P_CS_ICCBASED; +@@ -5002,7 +5005,7 @@ tsize_t t2p_write_pdf_xobject_decode(T2P* t2p, TIFF* output){ + tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[16]; ++ char buffer[32]; + int buflen=0; + + if(t2p->pdf_compression==T2P_COMPRESS_NONE){ +@@ -5017,41 +5020,33 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output + written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9); + if(tile==0){ + written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_width); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); +- buflen=sprintf(buffer, "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_length); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { + if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){ + written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { + written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } + if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){ + written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { + written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); +- buflen=sprintf( +- buffer, +- "%lu", ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } +@@ -5078,21 +5073,17 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output + if(t2p->pdf_compressionquality%100){ + written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13); + written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14); +- _TIFFmemset(buffer, 0x00, 16); +- buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_compressionquality%100); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " /Columns ", 10); +- _TIFFmemset(buffer, 0x00, 16); +- buflen = sprintf(buffer, "%lu", ++ buflen = snprintf(buffer, sizeof(buffer), "%lu", + (unsigned long)t2p->tiff_width); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " /Colors ", 9); +- _TIFFmemset(buffer, 0x00, 16); +- buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_samplesperpixel); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19); +- _TIFFmemset(buffer, 0x00, 16); +- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample); ++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) ">>\n", 3); + } +@@ -5112,16 +5103,16 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output + tsize_t t2p_write_pdf_xreftable(T2P* t2p, TIFF* output){ + + tsize_t written=0; +- char buffer[21]; ++ char buffer[64]; + int buflen=0; + uint32 i=0; + + written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7); +- buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1)); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount + 1)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); + written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22); + for (i=0;i<t2p->pdf_xrefcount;i++){ +- sprintf(buffer, "%.10lu 00000 n \n", ++ snprintf(buffer, sizeof(buffer), "%.10lu 00000 n \n", + (unsigned long)t2p->pdf_xrefoffsets[i]); + written += t2pWriteFile(output, (tdata_t) buffer, 20); + } +@@ -5145,17 +5136,14 @@ tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output) + snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand()); + + written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17); +- buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1)); ++ buflen = snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount+1)); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); +- _TIFFmemset(buffer, 0x00, 32); + written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_catalog); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); +- _TIFFmemset(buffer, 0x00, 32); + written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_info); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); +- _TIFFmemset(buffer, 0x00, 32); + written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11); + written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid, + sizeof(t2p->pdf_fileid) - 1); +@@ -5163,9 +5151,8 @@ tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output) + written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid, + sizeof(t2p->pdf_fileid) - 1); + written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16); +- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref); ++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_startxref); + written += t2pWriteFile(output, (tdata_t) buffer, buflen); +- _TIFFmemset(buffer, 0x00, 32); + written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7); + + return(written); +diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c +index 2d02b23..b9befe7 100644 +--- a/tools/tiff2ps.c ++++ b/tools/tiff2ps.c +@@ -1,4 +1,4 @@ +-/* $Id: tiff2ps.c,v 1.35.2.7 2011-04-09 16:53:56 bfriesen Exp $ */ ++/* $Id: tiff2ps.c,v 1.35.2.9 2013-05-02 14:44:44 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -44,6 +44,11 @@ + + /* + * Revision history ++ * 2013-Jan-21 ++ * Richard Nolde: Fix bug in auto rotate option code. Once a ++ * rotation angle was set by the auto rotate check, it was ++ * retained for all pages that followed instead of being ++ * retested for each page. + * + * 2010-Sep-17 + * Richard Nolde: Reinstate code from Feb 2009 that never got +@@ -423,9 +428,10 @@ main(int argc, char* argv[]) + /* auto rotate requires a specified page width and height */ + if (auto_rotate == TRUE) + { ++ /* + if ((pageWidth == 0) || (pageHeight == 0)) + TIFFWarning ("-r auto", " requires page height and width specified with -h and -w"); +- ++ */ + if ((maxPageWidth > 0) || (maxPageHeight > 0)) + { + TIFFError ("-r auto", " is incompatible with maximum page width/height specified by -H or -W"); +@@ -1594,6 +1600,8 @@ int TIFF2PS(FILE* fd, TIFF* tif, double pgwidth, double pgheight, double lm, dou + } + if (generateEPSF) + break; ++ if (auto_rotate) ++ rotation = 0.0; + TIFFGetFieldDefaulted(tif, TIFFTAG_SUBFILETYPE, &subfiletype); + } while (((subfiletype & FILETYPE_PAGE) || printAll) && TIFFReadDirectory(tif)); + +@@ -1783,8 +1791,8 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h) + imageOp = "imagemask"; + + (void)strcpy(im_x, "0"); +- (void)sprintf(im_y, "%lu", (long) h); +- (void)sprintf(im_h, "%lu", (long) h); ++ (void)snprintf(im_y, sizeof(im_y), "%lu", (long) h); ++ (void)snprintf(im_h, sizeof(im_h), "%lu", (long) h); + tile_width = w; + tile_height = h; + if (TIFFIsTiled(tif)) { +@@ -1805,7 +1813,7 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h) + } + if (tile_height < h) { + fputs("/im_y 0 def\n", fd); +- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h); ++ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h); + } + } else { + repeat_count = tf_numberstrips; +@@ -1817,7 +1825,7 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h) + fprintf(fd, "/im_h %lu def\n", + (unsigned long) tile_height); + (void)strcpy(im_h, "im_h"); +- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h); ++ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h); + } + } + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index d00c912..6c53e74 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -1,4 +1,4 @@ +-/* $Id: tiffcrop.c,v 1.3.2.15 2010-12-14 02:03:55 faxguy Exp $ */ ++/* $Id: tiffcrop.c,v 1.3.2.16 2013-05-02 14:44:44 tgl Exp $ */ + + /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of + * the image data through additional options listed below +@@ -2077,7 +2077,7 @@ update_output_file (TIFF **tiffout, char *mode, int autoindex, + return 1; + } + +- sprintf (filenum, "-%03d%s", findex, export_ext); ++ snprintf(filenum, sizeof(filenum), "-%03d%s", findex, export_ext); + filenum[14] = '\0'; + strncat (exportname, filenum, 15); + } +@@ -2230,8 +2230,8 @@ main(int argc, char* argv[]) + + /* dump.infilename is guaranteed to be NUL termimated and have 20 bytes + fewer than PATH_MAX */ +- memset (temp_filename, '\0', PATH_MAX + 1); +- sprintf (temp_filename, "%s-read-%03d.%s", dump.infilename, dump_images, ++ snprintf(temp_filename, sizeof(temp_filename), "%s-read-%03d.%s", ++ dump.infilename, dump_images, + (dump.format == DUMP_TEXT) ? "txt" : "raw"); + if ((dump.infile = fopen(temp_filename, dump.mode)) == NULL) + { +@@ -2249,8 +2249,8 @@ main(int argc, char* argv[]) + + /* dump.outfilename is guaranteed to be NUL termimated and have 20 bytes + fewer than PATH_MAX */ +- memset (temp_filename, '\0', PATH_MAX + 1); +- sprintf (temp_filename, "%s-write-%03d.%s", dump.outfilename, dump_images, ++ snprintf(temp_filename, sizeof(temp_filename), "%s-write-%03d.%s", ++ dump.outfilename, dump_images, + (dump.format == DUMP_TEXT) ? "txt" : "raw"); + if ((dump.outfile = fopen(temp_filename, dump.mode)) == NULL) + { +diff --git a/tools/tiffdither.c b/tools/tiffdither.c +index dee2a02..a0cb857 100644 +--- a/tools/tiffdither.c ++++ b/tools/tiffdither.c +@@ -1,4 +1,4 @@ +-/* $Id: tiffdither.c,v 1.9.2.1 2010-06-08 18:50:44 bfriesen Exp $ */ ++/* $Id: tiffdither.c,v 1.9.2.2 2013-05-02 14:44:45 tgl Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -256,7 +256,7 @@ main(int argc, char* argv[]) + TIFFSetField(out, TIFFTAG_FILLORDER, fillorder); + else + CopyField(TIFFTAG_FILLORDER, shortv); +- sprintf(thing, "Dithered B&W version of %s", argv[optind]); ++ snprintf(thing, sizeof(thing), "Dithered B&W version of %s", argv[optind]); + TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing); + CopyField(TIFFTAG_PHOTOMETRIC, shortv); + CopyField(TIFFTAG_ORIENTATION, shortv); diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff new file mode 100644 index 00000000..79eeb449 --- /dev/null +++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff @@ -0,0 +1,23 @@ +From 5d19703933eaa59f97be9c88237fe00593f180ae Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Mon, 19 Aug 2013 +Subject: CVE-2013-4231 + +* tools/gif2tiff.c: Be more careful about corrupt or + hostile input files (#2450, CVE-2013-4231) + +--- + gif2tiff.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/gif2tiff.c 2013-08-20 ++++ b/tools/gif2tiff.c 2013-08-20 +@@ -329,6 +329,8 @@ readraster(void) + int status = 1; + + datasize = getc(infile); ++ if (datasize > 12) ++ return 0; + clear = 1 << datasize; + eoi = clear + 1; + avail = clear + 2; diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff new file mode 100644 index 00000000..b86f8f4a --- /dev/null +++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff @@ -0,0 +1,24 @@ +From 8a2f9160cc4c52c73a62adef4d9282b2bd6e7ff1 Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Mon, 19 Aug 2013 +Subject: CVE-2013-4232 + +* tools/tiff2pdf.c: terminate after failure of allocating + ycbcr buffer (bug #2449, CVE-2013-4232) + +--- + tiff2pdf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/tiff2pdf.c 2013-08-20 ++++ b/tools/tiff2pdf.c 2013-08-20 +@@ -2457,7 +2457,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +- _TIFFfree(buffer); ++ _TIFFfree(buffer); ++ return(0); + } else { + buffer=samplebuffer; + t2p->tiff_datasize *= t2p->tiff_samplesperpixel; diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff new file mode 100644 index 00000000..4f8c5432 --- /dev/null +++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff @@ -0,0 +1,24 @@ +From 7f4cfaec643863fcdc260da46af8d6581974101d Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Mon, 19 Aug 2013 +Subject: CVE-2013-4244 + +* tools/gif2tiff.c: fix possible OOB write (#2452, CVE-2013-4244) + +--- + gif2tiff.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/tools/gif2tiff.c 2013-08-20 ++++ b/tools/gif2tiff.c 2013-08-20 +@@ -396,6 +398,10 @@ process(register int code, unsigned char + } + + if (oldcode == -1) { ++ if (code >= clear) { ++ fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear); ++ return 0; ++ } + *(*fill)++ = suffix[code]; + firstchar = oldcode = code; + return 1; |