From a4878e96586a2c0d945324119209d0525382e1e8 Mon Sep 17 00:00:00 2001 From: Andreas Molzer Date: Wed, 22 Sep 2021 01:02:36 +0200 Subject: [PATCH 1/3] Release notes for 0.7.1 --- CHANGES.md | 15 +++++++++++++++ Cargo.toml | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 506419d..aee611d 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,18 @@ +# Version 0.7.1 + +New features: +* Encoding signed integer formats is now supported. + +Changes: +* Tile decoding should be a little faster, requires one less intermediate buffer. + +Fixes: +* Fixed a regression that caused conflict between strips and tile images, + causing errors in decoding some images. +* Use checked integer arithmetic in limit calculations, fixes overflows. +* IFD Tags are now always cleared between images. + + # Version 0.7.0 New features: diff --git a/Cargo.toml b/Cargo.toml index 4a2d7b4..31b7085 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tiff" -version = "0.7.0" +version = "0.7.1" authors = [ "ccgn", "bvssvni ", From 26e760e3030077de56c05ed4fc8eefc0aa76194c Mon Sep 17 00:00:00 2001 From: Andreas Molzer Date: Wed, 22 Sep 2021 01:13:10 +0200 Subject: [PATCH 2/3] Add notes on MSRV --- CHANGES.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index aee611d..79ddaf7 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -12,6 +12,18 @@ Fixes: * Use checked integer arithmetic in limit calculations, fixes overflows. * IFD Tags are now always cleared between images. +Notes: +Our CI has warned that this version no longer builds on `1.34.2` out of the +box. We're still committed to the MSRV on this major version yet one +dependency—`flate2`—has already bumped it in a SemVer compatible version of its +own. This is out-of-our-control (cargo's dependency resolution does not allow +us to address this in a reasonable manner). + +This can be address this by pinning the version of `flate2` to `1.0.21` in your +own files. However, you should understand that this puts you in considerable +maintenance debt as you will no longer receive any updates for this dependency +and any package that _requires_ a new version of the `1.0` series would be +incompatible with this requirement (cargo might yell at you very loudly). # Version 0.7.0 From b8459f413a7788b92dbd90bcf839d49534f21d1c Mon Sep 17 00:00:00 2001 From: Andreas Molzer Date: Wed, 22 Sep 2021 01:20:00 +0200 Subject: [PATCH 3/3] Add fuzzing work and bugs to release notes --- CHANGES.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 79ddaf7..501c610 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -2,15 +2,21 @@ New features: * Encoding signed integer formats is now supported. +* Extensive fuzzing with `cargo fuzz`. Changes: * Tile decoding should be a little faster, requires one less intermediate buffer. +* Images whose IFDs form a cycle due to their offsets will now raise an error + when the cycle would be entered (jumping back should still be supported). Fixes: * Fixed a regression that caused conflict between strips and tile images, causing errors in decoding some images. * Use checked integer arithmetic in limit calculations, fixes overflows. * IFD Tags are now always cleared between images. +* Found by fuzzing: Several memory limit overflows; JPEG now correctly + validates offsets and a minimum size of its table; Check upper limit of strip + byte size correctly; Notes: Our CI has warned that this version no longer builds on `1.34.2` out of the