7.1.2-24
Added 1
- add profile_fuzzer for raw EXIF/XMP/IPTC/ICC parsing
Changed 3
- don't raise exceptions for warnings in the constructors of CoderInfo and Color
- use Visual Studio 2026 in the Windows build
- update Windows dependencies
Fixed 13
- reject mtv files with zero columns or rows
- reject tga files with zero columns or rows
- reject cineon files with zero columns or rows
- reject farbfeld files with zero columns or rows
- free the chunk when hitting max loop
- set a limit on the profile size when fuzzing images
- free profile when the color profile is invalid
- add extra checks to prevent an overflow on 32-bit systems
- add missing check for returning an image with zero columns or rows
- add extra checks when pinging an image with zero dimensions
- fix possible memory leak
- close the blob before the dimensions are checked
- construct full path from directory + basename
Security 1
- fix heap-based overflow vulnerability
Merged
- reject mtv files with zero columns or rows #8758
- reject tga files with zero columns or rows #8756
- reject cineon files with zero columns or rows #8754
- build(deps): bump ubuntu from 22.04 to 26.04 in /.devcontainer #8751
- reject farbfeld files with zero columns or rows #8750
- build(deps): bump caphyon/advinst-github-action from 2.0.2 to 2.0.3 #8742
- build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 #8749
- Add profile_fuzzer for raw EXIF/XMP/IPTC/ICC parsing #8736
Commits
- beta release 48756ca
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vgh5-r42g-4j44 8fa8b81
- revert 9b3ca35
- Make sure we free the chunk when hitting max loop. dd198f9
- Also set a limit on the profile size when fuzzing images. cca7092
- Corrected version check to fix the build error reported in #8740. 37af688
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6mwj-rp89-6j5j 404ff84
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2hhq-c99x-492r 017c7ef
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9hqg-xf93-ghfw 08b9f27
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v62-8fq6-cp9m 3a12d63
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h36c-3666-h489 9ee8217
- Added condition to disable msix preparation in a pull request. e4505b7
- https://github.com/ImageMagick/ImageMagick/issues/8745 f579a0b
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p 3705205
- Another correction of the version check. 3ad556b
- restore 45d9ea7
- fix poxxible memory leak 1742ae8
- construct full path from directory + basename 9023658
- optimized 0cd09b0
- provision paths on demand 565ba49
- cosmetic a7e0b04
- remove superflous assignment 50ffad2
- Corrected the delete. f5bd852
- Added extra try catch in case a warning is thrown. 3e969e5
- Don’t raise exceptions for warnings in the constructors of CoderInfo and Color. 4ac379a
- Added missing check for returning an image with zero columns or rows (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc) 84fbcef
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669 d1bf6bc
- add include statement 179b3fb
- potential heak based overflow per spartancodex 0ff2644
- increase increment 6987ef0
- adjust heap overflow check fee84f2
- check for maximum image size limit 5d7f453
- make that max aa37d05
- revert 6b0d497
- Silenced warning. fc4321f
- Also close the image blob to make sure we close it properly. b01c173
- remove extraneous heap check e341fd9
- directly iterate over the policy linked-list 4bedfd7
- Updated configure. 05b8aa1
- Updated the Windows dependencies. 80db294
- Use Visual Studio 2026 in the Windows build. 82e3b84
- Corrected the header. 0c44b7a
- Added extra checks to prevent an overflow on 32-bit systems (GHSA-4v89-6mgq-6rgc) 44df3a5
- Free profile when the color profile is invalid. b091a08
- Corrected the path for docker and added pip to dependabot.yml 9a998b5
- Close the blob before the dimensions are checked. a526846
- fix -clip issue 3703262
- cast required 49ea262
- Update python and the installed packages in the doc-check. 8c6b002
- Added extra checks when pinging an image with zero dimensions. 6eb7297
- revert ac4a219
- https://github.com/ImageMagick/ImageMagick/issues/8753 3c45ab0
- release 271b6bc