Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 12525 invoked from network); 1 Sep 2008 18:05:14 -0000
Received: from cheryl.telenet-ops.be ([195.130.136.3])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 1 Sep 2008 18:05:14 -0000
Received: from vijay.telenet-ops.be (vijay.telenet-ops.be [195.130.136.9])
	by cheryl.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m81I5ECc014434
	for <info@awaresystems.be>; Mon, 1 Sep 2008 20:05:14 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by vijay.telenet-ops.be (Postfix) with SMTP id A618F60004
	for <info@awaresystems.be>; Mon,  1 Sep 2008 20:05:14 +0200 (CEST)
Received: from circe.telenet-ops.be (circe.telenet-ops.be [195.130.132.51])
	by vijay.telenet-ops.be (Postfix) with ESMTP id 9F32E60003
	for <info@awaresystems.be>; Mon,  1 Sep 2008 20:05:14 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by circe.telenet-ops.be (Postfix) with ESMTP id 55E3533E87
	for <info@awaresystems.be>; Mon,  1 Sep 2008 20:05:14 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m81I0rHI016638;
	Mon, 1 Sep 2008 14:02:07 -0400
Received: from scooby.simplesystems.org (scooby.simplesystems.org
	[65.66.246.67])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m81I0oC2016635
	for <tiff@lists.maptools.org>; Mon, 1 Sep 2008 14:00:50 -0400
Received: from freddy.simplesystems.org (freddy.simplesystems.org
	[65.66.246.65])
	by scooby.simplesystems.org (8.12.10+Sun/8.12.10) with ESMTP id
	m81I0cCI009273; Mon, 1 Sep 2008 13:00:38 -0500 (CDT)
Date: Mon, 1 Sep 2008 13:00:38 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
X-X-Sender: bfriesen@freddy.simplesystems.org
To: Ron <ron@debian.org>
Subject: Re: [Tiff] Some security fixes from RHEL
In-Reply-To: <20080901162316.GC10630@homer.shelbyville.oz>
Message-ID: <Pine.SOC.4.64.0809011251200.1110@freddy.simplesystems.org>
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<48BB143F.4020301@howardsilvan.com> <4983.1220245910@sss.pgh.pa.us>
	<20080901162316.GC10630@homer.shelbyville.oz>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 10 [X]

On Tue, 2 Sep 2008, Ron wrote:
> quite doable.  In the same way that libtiff is perfectly functional
> for people who don't want to throw random things they found on the
> internet through it.  I'm sure if people submit patches for new
> bugs they'll get applied eventually if they are correct.  The real
> beauty of free software is you can apply them any time you like,
> without having to wait for someone else to find the time for that.

The TIFF format itself comes from a world (desktop publishing, FAX, 
and scientific research) where there was no reason to distrust the 
input other than if it was accidentally corrupted.  Therefore the 
design of TIFF is quite flexible with file offsets being embedded 
directly in files, and many compression formats.  There are "corner 
cases" galore.  This makes it much more difficult to make secure for 
the web than a format like PNG or JPEG.

Regardless, people can help by discovering TIFF files which crash 
libtiff and submitting patches to eliminate the crash.  Failure to 
crash is not the same as secure but it represents forward motion.  It 
is a pity that we lost the old bug tracker system, along with all the 
outstanding bugs at that time.  We have a new bug tracker now.

Bob
======================================
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
