opj_decompress_fuzzer: remove checks regarding input dimensions (fixes #1079)
[openjpeg.git] / CHANGELOG.md
index ab99a69bc41eaab7cfa2c2fa33bfb3cd31f27d1b..e45b324658757fea3be8b032d9358b0e596ebb89 100644 (file)
@@ -1,6 +1,148 @@
 # Changelog
 
-## [v2.2.0]("https://github.com/uclouvain/openjpeg/releases/v2.2.0" ) (2017-08-03)
+## [v2.3.1](https://github.com/uclouvain/openjpeg/releases/v2.3.1) (2019-04-02)
+[Full Changelog](https://github.com/uclouvain/openjpeg/compare/v2.3.0...v2.3.1)
+
+**Closed issues:**
+
+- v2.2.0 regression for decoding images where TNsot == 0 [\#1120](https://github.com/uclouvain/openjpeg/issues/1120)
+- Int overflow in jp3d [\#1162](https://github.com/uclouvain/openjpeg/issues/1162)
+- Heap buffer overflow in opj\_j2k\_update\_image\_data\(\) triggered with Ghostscript [\#1157](https://github.com/uclouvain/openjpeg/issues/1157)
+- LINUX install doesn't work when building shared libraries is disabled [\#1155](https://github.com/uclouvain/openjpeg/issues/1155)
+- OPENJPEG null ptr dereference in openjpeg-2.3.0/src/bin/jp2/convert.c:2243 [\#1152](https://github.com/uclouvain/openjpeg/issues/1152)
+- How to drop certain subbands/layers in DWT [\#1147](https://github.com/uclouvain/openjpeg/issues/1147)
+- where is the MQ-Coder ouput stream in t2.c? [\#1146](https://github.com/uclouvain/openjpeg/issues/1146)
+- OpenJPEG 2.3 \(and 2.2?\) multi component image fails to decode with KDU v7.10 [\#1132](https://github.com/uclouvain/openjpeg/issues/1132)
+- Missing checks for header\_info.height and header\_info.width in function pnmtoimage in src/bin/jpwl/convert.c, which can lead to heap buffer overflow [\#1126](https://github.com/uclouvain/openjpeg/issues/1126)
+- Assertion Failure in jp2.c [\#1125](https://github.com/uclouvain/openjpeg/issues/1125)
+- Division-by-zero vulnerabilities in the function pi\_next\_pcrl, pi\_next\_cprl and pi\_next\_rpcl in src/lib/openjp3d/pi.c [\#1123](https://github.com/uclouvain/openjpeg/issues/1123)
+- Precinct switch \(-c\) doesn't right-shift last record to remaining resolution levels [\#1117](https://github.com/uclouvain/openjpeg/issues/1117)
+- Sample: encode J2K a data using streams??? [\#1114](https://github.com/uclouvain/openjpeg/issues/1114)
+- HIGH THROUGHPUT JPEG 2000 \(HTJ2K\) [\#1112](https://github.com/uclouvain/openjpeg/issues/1112)
+- How to build openjpeg for arm linux? [\#1108](https://github.com/uclouvain/openjpeg/issues/1108)
+- crash [\#1106](https://github.com/uclouvain/openjpeg/issues/1106)
+- JP2000 returning OPJ\_CLRSPC\_UNKNOWN color space [\#1103](https://github.com/uclouvain/openjpeg/issues/1103)
+- Compilation successful but install unsuccessful: Calling executables throws libraries missing error [\#1102](https://github.com/uclouvain/openjpeg/issues/1102)
+- fprintf format string requires 1 parameter but only 0 are given [\#1093](https://github.com/uclouvain/openjpeg/issues/1093)
+- fprintf format string requires 1 parameter but only 0 are given [\#1092](https://github.com/uclouvain/openjpeg/issues/1092)
+- sprintf buffer overflow [\#1088](https://github.com/uclouvain/openjpeg/issues/1088)
+- sprintf buffer overflow [\#1085](https://github.com/uclouvain/openjpeg/issues/1085)
+- Infinite loop when reading jp2 [\#1081](https://github.com/uclouvain/openjpeg/issues/1081)
+- missing format string parameter [\#1074](https://github.com/uclouvain/openjpeg/issues/1074)
+- Excessive Iteration in opj\_t1\_encode\_cblks \(src/lib/openjp2/t1.c\) [\#1059](https://github.com/uclouvain/openjpeg/issues/1059)
+- Out-of-bound left shift in opj\_j2k\_setup\_encoder \(src/lib/openjp2/j2k.c\) [\#1057](https://github.com/uclouvain/openjpeg/issues/1057)
+- Encode image on Unsplash [\#1054](https://github.com/uclouvain/openjpeg/issues/1054)
+- Integer overflow in opj\_t1\_encode\_cblks \(src/lib/openjp2/t1.c\) [\#1053](https://github.com/uclouvain/openjpeg/issues/1053)
+- Signed Integer Overflow - 68065512 [\#1048](https://github.com/uclouvain/openjpeg/issues/1048)
+- Similar vulnerable functions related to CVE-2017-14041 [\#1044](https://github.com/uclouvain/openjpeg/issues/1044)
+- \[ERROR\] COD marker already read. No more than one COD marker per tile.  [\#1043](https://github.com/uclouvain/openjpeg/issues/1043)
+- failing to install latest version of openjpeg from source [\#1041](https://github.com/uclouvain/openjpeg/issues/1041)
+- Trouble compressing large raw image [\#1032](https://github.com/uclouvain/openjpeg/issues/1032)
+- Download and installed code from 2.3 archive. Installing 2.2? [\#1030](https://github.com/uclouvain/openjpeg/issues/1030)
+- missing fclose [\#1029](https://github.com/uclouvain/openjpeg/issues/1029)
+- NULL Pointer Access in function imagetopnm of convert.c\(jp2\):1289 [\#860](https://github.com/uclouvain/openjpeg/issues/860)
+- NULL Pointer Access in function imagetopnm of convert.c:2226\(jp2\)  [\#859](https://github.com/uclouvain/openjpeg/issues/859)
+- Heap Buffer Overflow in function imagetotga of convert.c\(jp2\):942 [\#858](https://github.com/uclouvain/openjpeg/issues/858)
+
+**Merged pull requests:**
+
+- abi-check.sh: fix broken download URL [\#1188](https://github.com/uclouvain/openjpeg/pull/1188) ([rouault](https://github.com/rouault))
+- opj\_t1\_encode\_cblks: fix UBSAN signed integer overflow [\#1187](https://github.com/uclouvain/openjpeg/pull/1187) ([rouault](https://github.com/rouault))
+- convertbmp: detect invalid file dimensions early \(CVE-2018-6616\) [\#1172](https://github.com/uclouvain/openjpeg/pull/1172) ([hlef](https://github.com/hlef))
+- color\_apply\_icc\_profile: avoid potential heap buffer overflow [\#1170](https://github.com/uclouvain/openjpeg/pull/1170) ([rouault](https://github.com/rouault))
+- Fix multiple potential vulnerabilities and bugs [\#1168](https://github.com/uclouvain/openjpeg/pull/1168) ([Young-X](https://github.com/Young-X))
+- Fix several memory and resource leaks [\#1163](https://github.com/uclouvain/openjpeg/pull/1163) ([nforro](https://github.com/nforro))
+- Fix some potential overflow issues [\#1161](https://github.com/uclouvain/openjpeg/pull/1161) ([stweil](https://github.com/stweil))
+- jp3d/jpwl convert: fix write stack buffer overflow [\#1160](https://github.com/uclouvain/openjpeg/pull/1160) ([hlef](https://github.com/hlef))
+- Int overflow fixed [\#1159](https://github.com/uclouvain/openjpeg/pull/1159) ([ichlubna](https://github.com/ichlubna))
+- Update knownfailures- files given current configurations [\#1149](https://github.com/uclouvain/openjpeg/pull/1149) ([rouault](https://github.com/rouault))
+- CVE-2018-5785: fix issues with zero bitmasks [\#1148](https://github.com/uclouvain/openjpeg/pull/1148) ([hlef](https://github.com/hlef))
+- openjp2/jp2: Fix two format strings [\#1143](https://github.com/uclouvain/openjpeg/pull/1143) ([stweil](https://github.com/stweil))
+- Changes in pnmtoimage if image data are missing [\#1141](https://github.com/uclouvain/openjpeg/pull/1141) ([szukw000](https://github.com/szukw000))
+- Relative path to header files is hardcoded in OpenJPEGConfig.cmake.in file [\#1140](https://github.com/uclouvain/openjpeg/pull/1140) ([bukatlib](https://github.com/bukatlib))
+- Cast on uint ceildiv [\#1136](https://github.com/uclouvain/openjpeg/pull/1136) ([reverson](https://github.com/reverson))
+- Add -DBUILD\_PKGCONFIG\_FILES to install instructions [\#1133](https://github.com/uclouvain/openjpeg/pull/1133) ([robe2](https://github.com/robe2))
+- Fix some typos in code comments and documentation [\#1128](https://github.com/uclouvain/openjpeg/pull/1128) ([stweil](https://github.com/stweil))
+- Fix regression in reading files with TNsot == 0 \(refs \#1120\) [\#1121](https://github.com/uclouvain/openjpeg/pull/1121) ([rouault](https://github.com/rouault))
+- Use local type declaration for POSIX standard type only for MS compiler [\#1119](https://github.com/uclouvain/openjpeg/pull/1119) ([stweil](https://github.com/stweil))
+- Fix Mac builds [\#1104](https://github.com/uclouvain/openjpeg/pull/1104) ([rouault](https://github.com/rouault))
+- jp3d: Replace sprintf\(\) by snprintf\(\) in volumetobin\(\) [\#1101](https://github.com/uclouvain/openjpeg/pull/1101) ([kbabioch](https://github.com/kbabioch))
+- opj\_mj2\_extract: Rename output\_location to output\_prefix [\#1096](https://github.com/uclouvain/openjpeg/pull/1096) ([kbabioch](https://github.com/kbabioch))
+- mj2: Add missing variable to format string in fprintf\(\) invocation in meta\_out.c [\#1094](https://github.com/uclouvain/openjpeg/pull/1094) ([kbabioch](https://github.com/kbabioch))
+- Convert files to UTF-8 encoding [\#1090](https://github.com/uclouvain/openjpeg/pull/1090) ([stweil](https://github.com/stweil))
+- fix unchecked integer multiplication overflow [\#1080](https://github.com/uclouvain/openjpeg/pull/1080) ([setharnold](https://github.com/setharnold))
+- Fixed typos [\#1062](https://github.com/uclouvain/openjpeg/pull/1062) ([radarhere](https://github.com/radarhere))
+- Note that seek uses SEEK\_SET behavior. [\#1055](https://github.com/uclouvain/openjpeg/pull/1055) ([ideasman42](https://github.com/ideasman42))
+- Some Doxygen tags are removed [\#1050](https://github.com/uclouvain/openjpeg/pull/1050) ([szukw000](https://github.com/szukw000))
+- Fix resource leak \(CID 179466\) [\#1047](https://github.com/uclouvain/openjpeg/pull/1047) ([stweil](https://github.com/stweil))
+- Changed cmake version test to allow for cmake 2.8.11.x [\#1042](https://github.com/uclouvain/openjpeg/pull/1042) ([radarhere](https://github.com/radarhere))
+- Add missing fclose\(\) statement in error condition. [\#1037](https://github.com/uclouvain/openjpeg/pull/1037) ([gfiumara](https://github.com/gfiumara))
+
+## [v2.3.0](https://github.com/uclouvain/openjpeg/releases/v2.3.0) (2017-10-04)
+[Full Changelog](https://github.com/uclouvain/openjpeg/compare/v2.2.0...v2.3.0)
+
+**Implemented enhancements:**
+
+- Sub-tile decoding: only decode precincts and codeblocks that intersect the window specified in opj_set_decode_area() [\#990](https://github.com/uclouvain/openjpeg/pull/990) ([rouault](https://github.com/rouault))
+- Sub-tile decoding: only apply IDWT on areas that participate to the window of interest [\#1001](https://github.com/uclouvain/openjpeg/pull/1001) ([rouault](https://github.com/rouault))
+- Sub-tile decoding: memory use reduction and perf improvements [\#1010](https://github.com/uclouvain/openjpeg/pull/1010) ([rouault](https://github.com/rouault))
+- Add capability to decode only a subset of all components of an image. [\#1022](https://github.com/uclouvain/openjpeg/pull/1022) ([rouault](https://github.com/rouault))
+
+**Fixed bugs:**
+
+- Setting x offset of decode region to -1 causes opj\_decompress to go into infinite loop [\#736](https://github.com/uclouvain/openjpeg/issues/736)
+- Problem decoding multiple tiles with get\_decoded\_tile when cmap/pclr/cdef boxes are present in jp2 file [\#484](https://github.com/uclouvain/openjpeg/issues/484)
+- set reduce\_factor\_may\_fail [\#474](https://github.com/uclouvain/openjpeg/issues/474)
+- opj\_compress.exe, command line parser, infinite loop [\#469](https://github.com/uclouvain/openjpeg/issues/469)
+- Various memory access issues found via fuzzing [\#448](https://github.com/uclouvain/openjpeg/issues/448)
+- Multiple warnings when building OpenJPEG \(trunk\) [\#442](https://github.com/uclouvain/openjpeg/issues/442)
+- Bulk fuzz-testing report [\#427](https://github.com/uclouvain/openjpeg/issues/427)
+- remove all printf from openjpeg / use proper function pointer for logging [\#371](https://github.com/uclouvain/openjpeg/issues/371)
+- minor changes, clean-up [\#349](https://github.com/uclouvain/openjpeg/issues/349)
+- image-\>numcomps \> 4 [\#333](https://github.com/uclouvain/openjpeg/issues/333)
+- Improve support for region of interest [\#39](https://github.com/uclouvain/openjpeg/issues/39)
+- Public function to tell kernel type used \(5x3 vs 9x7\) [\#3](https://github.com/uclouvain/openjpeg/issues/3)
+- elf binary in source package ?  [\#1026](https://github.com/uclouvain/openjpeg/issues/1026)
+- opj\_cio\_open [\#1025](https://github.com/uclouvain/openjpeg/issues/1025)
+- Building with Visual Studio 2015 [\#1023](https://github.com/uclouvain/openjpeg/issues/1023)
+- tcd.cpp\>:1617:33: error: assigning to 'OPJ\_INT32 \*' \(aka 'int \*'\) from incompatible type 'void \*' [\#1021](https://github.com/uclouvain/openjpeg/issues/1021)
+- j2k.cpp \> comparison of address of 'p\_j2k-\>m\_cp.tcps\[0\].m\_data' not equal to a null pointer is always true [\#1020](https://github.com/uclouvain/openjpeg/issues/1020)
+- Openjpeg 2.2.0 always build shared library even though -DBUILD\_SHARED\_LIBS:bool=off [\#1019](https://github.com/uclouvain/openjpeg/issues/1019)
+- missing fclose [\#1018](https://github.com/uclouvain/openjpeg/issues/1018)
+- Use opj\_image\_data\_free instead of opj\_free for image-\>comps\[\].data [\#1014](https://github.com/uclouvain/openjpeg/issues/1014)
+- malloc poison on some compilers - cross compiling [\#1013](https://github.com/uclouvain/openjpeg/issues/1013)
+- Add OPJ\_VERSION\_MAJOR, OPJ\_VERSION\_MINOR, OPJ\_VERSION\_MICRO macros in openjpeg.h [\#1011](https://github.com/uclouvain/openjpeg/issues/1011)
+- Encode: do not perform rate control for single-tile lossless [\#1009](https://github.com/uclouvain/openjpeg/issues/1009)
+- opj\_set\_decoded\_resolution\_factor\(\): bad interaction with opj\_set\_decode\_area\(\) and/or opj\_decode\(\) [\#1006](https://github.com/uclouvain/openjpeg/issues/1006)
+- memory allocation failure with .pgx file [\#999](https://github.com/uclouvain/openjpeg/issues/999)
+- Unable to fuzz with raw image as input [\#998](https://github.com/uclouvain/openjpeg/issues/998)
+- stack-based buffer overflow write in pgxtoimage \(/convert.c\) [\#997](https://github.com/uclouvain/openjpeg/issues/997)
+- freeze with a crafted bmp [\#996](https://github.com/uclouvain/openjpeg/issues/996)
+- invalid memory write in tgatoimage \(convert.c\) [\#995](https://github.com/uclouvain/openjpeg/issues/995)
+- static build on Windows fails [\#994](https://github.com/uclouvain/openjpeg/issues/994)
+- another heap-based buffer overflow in opj\_t2\_encode\_packet \(t2.c\) [\#993](https://github.com/uclouvain/openjpeg/issues/993)
+- heap-based buffer overflow in opj\_t2\_encode\_packet \(t2.c\) [\#992](https://github.com/uclouvain/openjpeg/issues/992)
+- heap-based buffer overflow in opj\_write\_bytes\_LE \(cio.c\) \(unfixed \#985\) [\#991](https://github.com/uclouvain/openjpeg/issues/991)
+- heap overflow in opj\_compress [\#988](https://github.com/uclouvain/openjpeg/issues/988)
+- heap overflow in opj\_decompress [\#987](https://github.com/uclouvain/openjpeg/issues/987)
+- heap-based buffer overflow in opj\_bio\_byteout \(bio.c\) [\#986](https://github.com/uclouvain/openjpeg/issues/986)
+- heap-based buffer overflow in opj\_write\_bytes\_LE \(cio.c\) [\#985](https://github.com/uclouvain/openjpeg/issues/985)
+- memory allocation failure in opj\_aligned\_alloc\_n \(opj\_malloc.c\) [\#983](https://github.com/uclouvain/openjpeg/issues/983)
+- heap-base buffer overflow in opj\_mqc\_flush \(mqc.c\) [\#982](https://github.com/uclouvain/openjpeg/issues/982)
+- Decode fails for JP2s with ICC profile [\#981](https://github.com/uclouvain/openjpeg/issues/981)
+- Unit tests failing on Ubuntu 17.04 [\#916](https://github.com/uclouvain/openjpeg/issues/916)
+- Encoder crashes on small images [\#901](https://github.com/uclouvain/openjpeg/issues/901)
+- openjpeg-1.5.3 fails to compile [\#830](https://github.com/uclouvain/openjpeg/issues/830)
+- opj\_compress crops image \(win\) or creates a jp2 which cannot be decompressed \(lin\) [\#716](https://github.com/uclouvain/openjpeg/issues/716)
+- -d flag is silently ignored when decoding a single tile [\#693](https://github.com/uclouvain/openjpeg/issues/693)
+- transition away from dev-utils [\#628](https://github.com/uclouvain/openjpeg/issues/628)
+- update instructions to build with Visual Studio and 64-Bit Visual C++ Toolset. [\#1028](https://github.com/uclouvain/openjpeg/pull/1028) ([quangnh89](https://github.com/quangnh89))
+- Add missing newline at end of file [\#1024](https://github.com/uclouvain/openjpeg/pull/1024) ([stweil](https://github.com/stweil))
+- merge master into coverity\_scan to update coverity results [\#1008](https://github.com/uclouvain/openjpeg/pull/1008) ([detonin](https://github.com/detonin))
+- Use more const qualifiers [\#984](https://github.com/uclouvain/openjpeg/pull/984) ([stweil](https://github.com/stweil))
+- Changes in converttif.c for PPC64 [\#980](https://github.com/uclouvain/openjpeg/pull/980) ([szukw000](https://github.com/szukw000))
+
+## [v2.2.0](https://github.com/uclouvain/openjpeg/releases/v2.2.0) (2017-08-10)
 [Full Changelog](https://github.com/uclouvain/openjpeg/compare/v2.1.2...v2.2.0)
 
 **Implemented enhancements:**
 - Migration guide v2 [\#160](https://github.com/uclouvain/openjpeg/issues/160)
 - Cannot decompress JPEG2000Aware3.18.7.3Win32\_kdutranscode6.3.1.j2k [\#158](https://github.com/uclouvain/openjpeg/issues/158)
 - Cannot decompress JPEG2000Aware3.18.7.3Win32.j2k [\#157](https://github.com/uclouvain/openjpeg/issues/157)
-- openjpeg@googlegroups.com has disappeard [\#153](https://github.com/uclouvain/openjpeg/issues/153)
+- openjpeg@googlegroups.com has disappeared [\#153](https://github.com/uclouvain/openjpeg/issues/153)
 - OpenJPEG 1.5.0 crashes on a ridiculously big file... [\#151](https://github.com/uclouvain/openjpeg/issues/151)
 - opj\_image vs free [\#146](https://github.com/uclouvain/openjpeg/issues/146)
 - Windows .dll file invalid [\#140](https://github.com/uclouvain/openjpeg/issues/140)
 - Support unscaled 10 bit data for 2K cinema @ 48 FPS, as per DCI standard [\#671](https://github.com/uclouvain/openjpeg/issues/671)
 - Use parallel jobs in ctest [\#664](https://github.com/uclouvain/openjpeg/issues/664)
 - \[Security\]Multiple Memory error [\#663](https://github.com/uclouvain/openjpeg/issues/663)
-- lossy encoding a 16 bit TIF file : severe artifiacts in decompressed image [\#660](https://github.com/uclouvain/openjpeg/issues/660)
+- lossy encoding a 16 bit TIF file : severe artifacts in decompressed image [\#660](https://github.com/uclouvain/openjpeg/issues/660)
 - opj\_compress and opj\_decompress : get\_next\_file method uses hard-coded unix path separator [\#630](https://github.com/uclouvain/openjpeg/issues/630)
 - Uninitialized variable [\#629](https://github.com/uclouvain/openjpeg/issues/629)
 - Use of enum variable for bit flags prevents compilation as C++ source [\#619](https://github.com/uclouvain/openjpeg/issues/619)
 - Correct abi-check.sh for PR [\#791](https://github.com/uclouvain/openjpeg/pull/791) ([mayeut](https://github.com/mayeut))
 - Update tcd.c [\#790](https://github.com/uclouvain/openjpeg/pull/790) ([maddin200](https://github.com/maddin200))
 - Update lcms2 [\#773](https://github.com/uclouvain/openjpeg/pull/773) ([mayeut](https://github.com/mayeut))
-- Use lowercase for cmake commands consistenly [\#769](https://github.com/uclouvain/openjpeg/pull/769) ([julienmalik](https://github.com/julienmalik))
+- Use lowercase for cmake commands consistently [\#769](https://github.com/uclouvain/openjpeg/pull/769) ([julienmalik](https://github.com/julienmalik))
 - Ignore clang's summary warning [\#768](https://github.com/uclouvain/openjpeg/pull/768) ([julienmalik](https://github.com/julienmalik))
 - Fix UBSan gcc warning for first arg to memset non null [\#767](https://github.com/uclouvain/openjpeg/pull/767) ([julienmalik](https://github.com/julienmalik))
 - Update to libtiff-4.0.6 [\#764](https://github.com/uclouvain/openjpeg/pull/764) ([mayeut](https://github.com/mayeut))