Return-Path: <SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org>
Received: from el10156.bc ([10.35.4.252]) by mailafep009-svc.mx.internal
          (InterMail vM.9.07.03.027 201-2473-138-3) with ESMTP
          id <20230404130515.BYCN19826.mailafep009-svc.mx.internal@el10156.bc>
          for <chris.lindelaan@skynet.be>; Tue, 4 Apr 2023 15:05:15 +0200
Received: from [185.228.36.55] ([185.228.36.55])
 by el10156.bc with ngmta
 id 443afd6c-1752bd16683bc476; Tue, 04 Apr 2023 15:05:15 +0200
Authentication-Results: mx201.skynet.be; dkim=none (message not signed) header.i=none; spf=None smtp.pra=tiff-bounces@lists.osgeo.org; spf=Pass smtp.mailfrom=SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org; spf=PermError smtp.helo=postmaster@lists.osgeo.org
Received-SPF: None (mx201.skynet.be: no sender authenticity
  information available from domain of
  tiff-bounces@lists.osgeo.org) identity=pra;
  client-ip=140.211.15.3; receiver=mx201.skynet.be;
  envelope-from="SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="tiff-bounces@lists.osgeo.org";
  x-conformance=sidf_compatible
Received-SPF: Pass (mx201.skynet.be: domain of
  SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org
  designates 140.211.15.3 as permitted sender)
  identity=mailfrom; client-ip=140.211.15.3;
  receiver=mx201.skynet.be;
  envelope-from="SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text="v=spf1 mx a:mail.osgeo.org a:lists.osgeo.org
  a:mail.osgeo.osuosl.org ip4:140.211.15.3 a:osgeo7.osgeo.org
  a:trac.osgeo.org a:dev.trac.osgeo.org
  a:secure.osgeo.osuosl.org ip4:140.211.15.57
  ip4:140.211.15.32 ip4:140.211.15.26 ip4:140.211.15.6"
Received-SPF: PermError (mx201.skynet.be: cannot correctly
  interpret sender authenticity information from domain of
  postmaster@lists.osgeo.org) identity=helo;
  client-ip=140.211.15.3; receiver=mx201.skynet.be;
  envelope-from="SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="postmaster@lists.osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text=""
X-Ironport-Dmarc-Check-Result: validskip
IronPort-SDR: 642c1f3e_JtVPnLdSbb4sG11KovG0bv1SvuM1x1cAV8ZDr4QgcwjTkIi
 kfptbpecdgWbKCIMwhThRCgfHAa22uUxzHav4/A==
X-Proximus-RemoteIp: 140.211.15.3
X-Proximus-Mfrom: SRS0=nnd2=73=lists.osgeo.org=tiff-bounces@osgeo.org
X-Proximus-Rcpto: chris.lindelaan@skynet.be
X-IPAS-Result: =?us-ascii?q?A0GlAwAuHyxk/wMP04xaHgEBCxIMQIFEC4ErgQMZAVtWL?=
 =?us-ascii?q?AIBCE2EU4NPhS+IAy4ZhBmEOopqhySCZBSBYRgBAQIBAQEBAQkuAQoLBAEBA?=
 =?us-ascii?q?QIBA4FLAT+INCAFAQQwCQ4BAgQBAQEBAwIDAQEBAQEBAwEBAQQBAQECAQECB?=
 =?us-ascii?q?AICAQECgQYIC4UvOQ2CNwUCAxgOb4EHAQEBAQEBAQEBAQEBAQEBAQEBAQEWA?=
 =?us-ascii?q?g1SeAECAwEBASAKGQoFGQ4DAQIGAQEKOgQEAgIDASMBLwYBDAYCAQEBgnkBg?=
 =?us-ascii?q?lwDBAELrEcCgTKBAYMWnEaBZ4FBiR0Bg2qEMDaBVUR6QoMDPoJiAQSBI4QVg?=
 =?us-ascii?q?mcEkRmIUoE0dIEgDoE9gQQCCQIRa4EQCGmBeUACDWQLDm+BSoMmBA4DGSsdN?=
 =?us-ascii?q?goCAQt1PxYfCQsgBlhtLBETBQMLFSpHBAg4Bhw0BgEKAggPEg8GJkQOQjc0E?=
 =?us-ascii?q?waBBgsOEQNQgUcEL4FfBkudNoFvCA8BBR05KmMCEwEuESuSHWePZQ6gGzQHg?=
 =?us-ascii?q?3+BUwYMig2LQIFWh2oGEy6pQpdxII0zmkuBYz0rgS4zGiNQgmcJVA4PkhKFF?=
 =?us-ascii?q?IpnPzQ8AgcBCgEBAwmJRYF/AQE?=
IronPort-PHdr: A9a23:mmdWOBa7TGImyi4AmhiiZP3/LTH72IqcDmcuAnoPtbtCf+yZ8oj4O
 wSHvLMx1gKPB9uKoK8Uw8Pt8IneGkU4qa6bt34DdJEeHzQksu4x2zIaPcieFEfgJ+TrZSFpV
 O5LVVti4m3peRMNQJW2aFLduGC94iAPERvjKwV1Ov71GonPhMiryuy+4ZLebxtIiTanf79/L
 RG7oQrRu8QVnIBvNrs/xhzVr3RHfOhb2XlmLk+JkRbm4cew8p9j8yBOtP8k6sVNT6b0cbkmQ
 LJBFDgpPHw768PttRnYUAuA/WAcXXkMkhpJGAfK8hf3VYrsvyTgt+p93C6aPdDqTb0xRD+v4
 btnRAPuhSwaMTMy7WPZhdFqjK9DoxyvqRNwzIDKboGbNPRxfL7TfcsYSGRDQ8pcWTBNDZ+iY
 IsUFOcBOPpUopPnqlcSoxazBw+hD/7vxD9SgX/22LU33es/EQ7Y2gwrAs4AsHPJrNrvKacSV
 fy1x7TPwDrdcfNZxzH95JLSchAmvPGDR69wcc7NyUQ0DAPFlk+fqZDkPzyP0uQMs3Ob4/B8W
 uKojm4qsgd8qSWgyckwkIfGnJ4Vykza+iVjxoY4Pd21RFJ/bNOqFJZeuSOXO5V1T88+XW1kp
 Cc3x7watZO/fCYHyYgqyh3dZvCbfYaF4RLuWeeMLTp6hn9od66ziha0/EO9xOP8Ucy030xLr
 ipDitTMsWsN1xPN5ciAUPd9+V2h2TmX2wDI8uFLO1w0lavBJJ4lwr8wjYAfvljEHi/znkj9k
 ayYdl089+S15Onrfq/qqoGBO4NpkA3yL6QjltaxDOggLAQCQmqW9f6+2bH/50H1XbZHg/Msn
 qXEtJ3XJ8IWrbOjDQBPyIYs8RO/Ai+m0NsGmXkHK0pIeBaGj4jyJ1HOO+r0DfCkg1Sjjjhrw
 OrKPrr7ApXCNnTDkbHhcqhh60NE1QY+wsxT64hKBr0cPf7/QFL9udzCAhI3KwC0xvzoCNR51
 oMQQ2KPBaqZPbvPv1GU++wjP/GBZIkTuDngNfQo//zjgHEhlF8ZfKmpxocXaGuiEvRhOEWZb
 mTjgtAbHWcNpAo+Q/TniEGDUT5daXa+Rrkz5jYmCIKgEYjMWJutjaeG3CegEZ1ZeGdGBkqLE
 XfyeIWIQ/EMZzmKLc97jjMETaShS5Mm1Ry2qQP206BnIfbM+i0EqZLj08B46PHTlREo9Dx0F
 N6R02WMT2Fyg2wHWTs207plrkx70VqDyqt4gvxeFdNN+/NFSBw1OoCPh9F8EM34DwLdYs+SG
 hHhRtS9HSp3Sck+zthIZFxyXNCrjxTG1iztBKcJlruNH9so86zSjEX3PNt3nnPP1a09iAs6Q
 8VBcHern7Ny7BT7A4/Sj17fkL2leKNa2zTCo3yex2iDt10NTQhrTK/eVmoebEaFkNLi+0niQ
 raiBK5yMhdd0dXQbexOa8b1lhNBX/juP5LZeW32nm6xAROBwPSLdJbrfGMGmzncBkZXrgYI4
 HymOAEyCz30pmvfCCBpR07ubU2p6+RntX6gUmcwzhqWdAtmzLW4/VgSn/PLUO4Z3L8PpHI8r
 S5pFk22xdPcBom8oF9aYaFVfJtp+0pD3H/xuRZwM5qtM+ZuiwhaOxh2sU3G0xRsFp4GltMlo
 XRsyxB9eoyC11YUWi2V29jKPaDeN23utESidaPQnEvZzd+L/rsn8+wxt1TquBCyUEEl9iM0g
 JFuz3KA68CSX0IpWpXrXxNvn/Abj7TKOHFkoZjXxHthLe++v2yK19EoAb4jzRCtN5daPbifH
 QD/W8sdG4C1KeMsllToJhIJNexf7ug1asWhcfbVkLWzMrNGmzSrxX9C/Jg7yliFojZ9ROCN1
 ZEYxfqVxSODVizglxGmqc/6nsZDfz5BVnGnx33cDZVKLrZ3YZ5NDG6vJ8OtwdArvKTWAyte8
 lL5UgxdjcuoYgaJKVvm0gBXk0MNrim7mCW2ijZzjjcio7G32zfBzuOkcwAIaSZQXGc3tVr2J
 KWuldcAFFOtcxBvlBah4hPiwLNHoa1kM2TJaUNJZDTtaWZ5Xaa38L2YbKaj8bsOtiNaGKS5c
 QrCE/jmoAoc3j+lFWYMjDY8PyqnvJn0hVRzlX6dIXBvrXHYZdAVp1+X5drSQuRU1yYHQy8wg
 CfeB1y1Nd2ktduOkJKLvue7XmOnHppdFEujhZ+BuiX+72p3BxayhNi3m8b7Ck49yiD20J9tT
 yqJ5Bfwb4/31rirZPp9dxoNZhe04M57F4di14oo0chMgT5A38zTpCdByjS7K9hQ1KPgYWBYQ
 C5Rm4eT+wv03kB/aHiElOebHj2QxNVsY96ibyYYwCU4uopxMpzMubpCkXEg/QHtqQPKfeM7m
 SwSxPxo72QV1v0ItgRoxCKABLsfBmFfJiPhkFKP9d/0/8A1LC6/NKO90kZzh4XrELCMrERWX
 2v/cZo5NStx9dlkdlXX33D0rIb+d5ODCLBb/g3RmBDGge9PLZs3nfdfnitrN1X2ung9wvI6h
 xhjtX2jlLCOMH4lvKepWEYBcCb2dsUe5nfngPQWksGT1oGpVpJvf1dDFKDSdqr9FjQe76G4b
 FOKESYgsTGcArXSGkmY8kgzs3PBHdWhMGyRL3QC5dJ5SxSaYktFj2V2FH02k4U4GQaj2MH6O
 B4lvnZLvwe+80YKkaphLFHnX33apRu0Zzt8U5WZIBdMr2Qgrw/UPcGY8uNvDnRd95ylohaKL
 z/TbABJAGcVH02cUgm/Zv/0vICGqrXeXbnbTbOGe7iFpO1AWu3dwIL1itIg5DWdMMiTeHNvX
 JhZkgJOW250H8PBlnABUSsSwmj2VfXD8RG69nci8Zvq9PXwRBmp4pCABrwUNs9grgy3j6nGP
 emNgi10Mh5fzZwBwjnP0rdVjztww2l+MiKgF7gNr3uHd5jrwvpRCRJBPnwoYc9J9L4nmA5WN
 sPczNTv2etkj/A7Tl1CSFrql9qBYtcFLmb7M0nIThXuVvzONXjAxMf5Zrm5QLtbgbBPthG+j
 j2cFlfqIjWJkzS6HwDqK+xHizuXeQBPoIzoOAg4EnDtFZi1D3/zeM8ylzA9xqc4w2/HJXJJe
 yYpaFtD9/WV/WtR0PB2GmgH6WFqIO7CnDyWp+CKLpcNreAtBT97muUc5241rtkdpCgWQfV0n
 G3VtdFjpBehifSI0T4hVwBB4jdT2NDS4R0kY/yAsMAdHy2M9UAK9mqdDEtMoMBqB9qpvLpfr
 7qH3KuhNC1L+JTT5sQRAI7TMs3POSgtPASvBCTdB00CVjGmMifYnUM48rna/y+Oo5MnsJWqn
 4EBR7gdU0coEegeTEN/E5QDOMslB2981+TC1YhRuDzj83yzDI1bpsyVD67KR6+2cXDA0P8fP
 VMJ2e+qdNhLcNeiggo7Nx8gwszLAxaCBIwV5Hc4N0lt/QMTuhCSV0UL1ljgRxm352VbVfukx
 EZvzBB9cOIg6HHm7gV/LVPMoiws2EI2g8/oiiyVYVuTZO+xW51bETLuulR5KZ79TwtvJQSvg
 UxpMivFTLNNnvNhc25skgrVpZpIH7ZSV6pBKBMXwPiWYb0v3zE+4m2/wlRb4OLeFZZ4vA8ra
 oK36XVb1A9kKtkvKu2YJaZEyERRmrPbviKs0bNUokdWLEIM/WWOPS8Q7RVUbv98fnPup7Eqs
 l/KgTZIdWkSWuB/p+Iwrhp7IOeRyS/8lbROeSXTf6SSKb2Uv2/YmIuGWFQ1gwkzrXIdqL5w3
 Z12LBHBU0E00KDXEA8GOM2ELhtaOtZT+naWdyGTt+7A2rpyJIqwEabvV+DE58N2ygq0WR0kG
 YgB9JFLBp63zETRNtvqNpYByA4x/0LsP1qIC7JOYh3Bw1Jl64mviZRw24daPDQUB25wZD626
 rjgrQgvmPOfXd0ybyRSTs4eO3kxQsH/hz9BsiEKEmysyuxAglvnjXe0tmHKATL7ddYmePqEe
 UYmQrleGB078rOqkhjQ6ZrTICf9L9sw5LcnBssdvJmKDLVTV7Yv6i80fqFcRme2SCjICtG4I
 N73cYZ+NbTJ
IronPort-Data: A9a23:JbxMkqmJFetx4HK4uma1UEXo5gwOJ0RdPkR7XQ2eYbSJt1+Wr1Gzt
 xIcUW/Uaf2JYjf8fI90YI6/905UsZXVyYJqHARl+CxkRC0UpcefCYvHJBz7ZnLMIsCaExw4s
 ZkSMoHNJ5pkHiaF+k79Y7PshEcg6azZHbCU5Mwom8xSbVY6F3h+00s98wIdqtQ16TRsK1rV4
 bsem+WGZBn/nWQc3ls8s8qrsAlosOn5pAQWt1k/YeEjlFLFnhH5NrpGTU2KBya+E9k88tKSH
 b6Zl+nlpj+Bpn/BN/v8+lrFWh1VKlLtFVXW4pZmc/DKqgRPoCU0zpE6OJI0AauAo2zU9zzZ4
 IwlWa2YEW/FDIWV8Ague0Mw/xVFAEFz0OOvzU6X6JLMkBKcKiWEL8JGVynaNaVAkgp+7PonG
 fYwcFjhZTja7w66LS7SpkCBSa3PIeGyVL7ztE2MwhnTEc02Z4/uRpnnu+1A+iYsm/gTTNb3M
 p9xhTpHNHwsYjVLO0wLE9Q5h+ilgT/4aTIwRFC9/PZvpTKKlUoojf62WDbWUoTiqcF9pXyj/
 jfA+WijV05BYdie0iaetHW3ieLI2yThV9cOFbO2s/RtnVuYy3c7DwYZWFz9puO24qK7c4wBd
 xVLqnd//cDe8mT3FP7MUxjg40K1ow8xYOsLMcQf1yCCn/+8DwGxQzJsoiR6QNcmrs4tAzgr0
 FOEm9rgAxR0s6yTRG7b/Lr8kN+pES8OImIFO2kDVgQI5J/ku5w0lRaJScxseEKosuDI9fjL6
 2jihEADa3871JFbiM1XUHie695wjvAljzLZ5zk7mkqh7xhlf8iifIOl7h7c9/kowEOxUAyap
 HZd8ySBxL5mMH1PvHXlrCYx8HWB4O2KPTqahkRgd3Xk3yr44GatJOi8/xknTHqE8a84lfvBZ
 E7IpRgX44RcMXzsarV4C2505wLG0oC4fenYujvoghair3S/mMJrPM2jWKJI413QrQ==
IronPort-HdrOrdr: A9a23:2tw4uqy+JoMBw83m2Mb7KrPw4L1zdoMgy1knxilNoG9uEvBw9v
 re4sjzuiWatN8uYgBQpTntAtjkfZqYz+8Q3WE+VY3SIDUOklHYV72L1OPZskDd88eXzJ8j6U
 4YSdkFNDSSNzZHZKTBjDVQSOxQuOVvmZrA7Yy1okuFDzsaCZ2IwD0JejpzeXcGIzWua6BJd6
 Z0qvAnm9JgEU5nCPhSiRE+LpH+m+E=
X-IronPort-Anti-Spam-Filtered: true
X-MGA-submission: =?us-ascii?q?MDFFPopilOebLDXCcLaveUsDLTWBzv4YOMvv6A?=
 =?us-ascii?q?y4ggdnD5IXwt4D80RWIXb4dLuJCLh/k3llZLCv8vTYHKqfBtTrhDQTfj?=
 =?us-ascii?q?Rcp0tVFm7v5JmehJ6bcnxoqY9QiHobZKKX0Gg=3D?=
Received: from osgeo6.osgeo.osuosl.org (HELO lists.osgeo.org) ([140.211.15.3])
  by mx201.skynet.be with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Apr 2023 14:59:35 +0200
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id 5DED26126C0F;
	Tue,  4 Apr 2023 05:59:07 -0700 (PDT)
Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net
 [217.70.183.197])
 by lists.osgeo.org (Postfix) with ESMTPS id C0FF26126C09
 for <tiff@lists.osgeo.org>; Tue,  4 Apr 2023 05:59:05 -0700 (PDT)
Received: (Authenticated sender: even.rouault@spatialys.com)
 by mail.gandi.net (Postfix) with ESMTPSA id 821631C000C;
 Tue,  4 Apr 2023 12:59:03 +0000 (UTC)
Message-ID: <b64e8ae9-c333-8d31-341b-639dba9e8b2a@spatialys.com>
Date: Tue, 4 Apr 2023 14:59:02 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.9.0
Content-Language: en-US
To: Sulau <sulau@freenet.de>, tiff@lists.osgeo.org
References: <!&!AAAAAAAAAAAYAAAAAAAAAEUNXr1cc6FEs82BI4LfFJfCgAAAEAAAAHKGa8/Y1VNHvzvtkXRHBI0BAAAAAA==@freenet.de>
From: Even Rouault <even.rouault@spatialys.com>
In-Reply-To: <!&!AAAAAAAAAAAYAAAAAAAAAEUNXr1cc6FEs82BI4LfFJfCgAAAEAAAAHKGa8/Y1VNHvzvtkXRHBI0BAAAAAA==@freenet.de>
Subject: Re: [Tiff] Remove TIFFCROP from LibTiff + tiff2ps & tiff2pdf ?
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1422048356301663913=="
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>
X-VadeSecure-Score: 0
X-VadeSecure-Verdict: clean
X-VadeSecure-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrvdeiledgheelucetufdote
 ggodetrfdotffvucfrrhhofhhilhgvmecurfftqfgikffofgfunecuuegrihhlohhuthemuceftdd
 unecunecujfgurhepkfffgggfvfhfhfgjufhpjefjudeftdgtvghssehmtderredtfeejnecuhfhr
 ohhmpefgvhgvnhcutfhouhgruhhlthcuoegvvhgvnhdrrhhouhgruhhlthesshhprghtihgrlhihs
 hdrtghomheqnecuggftrfgrthhtvghrnhephedtleefleffjedvkedtvddtieeitdelhfeiteekje
 dtffekheeiudejjeegtdehnecuffhomhgrihhnpehoshhgvghordhorhhgpdhsphgrthhirghlhih
 srdgtohhmnecukfhppedugedtrddvuddurdduhedrfedpvddujedrjedtrddukeefrdduleejnecu
 vehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepudegtddrvdduuddrudehrdefp
 dhmrghilhhfrhhomhepufftufdtpehnnhguvdepjeefpehlihhsthhsrdhoshhgvghordhorhhgpe
 htihhffhdqsghouhhntggvshesohhsghgvohdrohhrghdpnhgspghrtghpthhtohepuddprhgtphh
 tthhopegthhhrihhsrdhlihhnuggvlhgrrghnsehskhihnhgvthdrsggvpdhmohguvgepshhmthhp
 pdhgvghtqdgfrhhlkfhnshhighhhth

This is a multi-part message in MIME format.
--===============1422048356301663913==
Content-Type: multipart/alternative;
 boundary="------------ABmngS59nSTE8Tq5YeHC0jfy"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------ABmngS59nSTE8Tq5YeHC0jfy
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi,

I admire Su's tenacity in trying to fix tiffcrop issues over the past 
years, and I certainly share his point of view. The vast majority of 
recent libtiff related CVEs in recent years are not in libtiff itself, 
but in its utilities. Personally I don't care about libtiff utilities 
(perhaps except tiffinfo and tiffdump for debugging purposes), just the lib.

I guess tiffcrop could receive the same treatment as a few past 
utilities that have been migrated to archive/tools/ where only the 
source code is there without any build system support.

tiff2ps and tiff2pdf seem to be also good candidates for moving into 
archive as they have a number of reported security related issues and a 
significant code size. Their functionality is (at least mostly) covered 
by the convert utility of ImageMagick.

Even

Le 03/04/2023 à 22:50, Sulau a écrit :
>
> Dear all
>
> I have been trying to fix the constant CVE issues at tiffcrop for 
> several years.
>
> Today I can say "fixing is not possible".
>
> The endless combinable parameters and the grown implementation of the 
> working buffer allocation for input, intermediate results and output 
> make maintenance nearly impossible.
>
> Also the code often (partially) does something different than I would 
> expect based on the parameter description. This is then often visible 
> in the resulting image, which looks different than what the very brief 
> parameter description would suggest.
>
> With this in mind, I would recommend removing tiffcrop from the 
> LibTiff library to avoid endless CVE and buffer overrun issues that 
> are not really part of LibTiff.
>
> Regards
>
> Su
>
>
> _______________________________________________
> Tiff mailing list
> Tiff@lists.osgeo.org
> https://lists.osgeo.org/mailman/listinfo/tiff

-- 
http://www.spatialys.com
My software is free, but my time generally not.

--------------ABmngS59nSTE8Tq5YeHC0jfy
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi,</p>
    <p>I admire Su's tenacity in trying to fix tiffcrop issues over the
      past years, and I certainly share his point of view. The vast
      majority of recent libtiff related CVEs in recent years are not in
      libtiff itself, but in its utilities. Personally I don't care
      about libtiff utilities (perhaps except tiffinfo and tiffdump for
      debugging purposes), just the lib.<br>
    </p>
    <p>I guess tiffcrop could receive the same treatment as a few past
      utilities that have been migrated to archive/tools/ where only the
      source code is there without any build system support. <br>
    </p>
    <p>tiff2ps and tiff2pdf seem to be also good candidates for moving
      into archive as they have a number of reported security related
      issues and a significant code size. Their functionality is (at
      least mostly) covered by the convert utility of ImageMagick.</p>
    <p>Even<br>
    </p>
    <div class="moz-cite-prefix">Le 03/04/2023 à 22:50, Sulau a écrit :<br>
    </div>
    <blockquote type="cite"
cite="mid:!&amp;!AAAAAAAAAAAYAAAAAAAAAEUNXr1cc6FEs82BI4LfFJfCgAAAEAAAAHKGa8%2FY1VNHvzvtkXRHBI0BAAAAAA==@freenet.de">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator" content="Microsoft Word 15 (filtered
        medium)">
      <style>@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-fareast-language:EN-US;}a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}span.E-MailFormatvorlage17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;
	mso-fareast-language:EN-US;}div.WordSection1
	{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
      <div class="WordSection1">
        <p class="MsoNormal">Dear all<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal"><span lang="EN-GB">I have been trying to
            fix the constant CVE issues at tiffcrop for several years. <o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">Today I can say "fixing
            is not possible". <o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">The endless combinable
            parameters and the grown implementation of the working
            buffer allocation for input, intermediate results and output
            make maintenance nearly impossible.<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">Also the code often
            (partially) does something different than I would expect
            based on the parameter description. This is then often
            visible in the resulting image, which looks different than
            what the very brief parameter description would suggest.<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">With this in mind, I
            would recommend removing tiffcrop from the LibTiff library
            to avoid endless CVE and buffer overrun issues that are not
            really part of LibTiff.<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">Regards<o:p></o:p></span></p>
        <p class="MsoNormal"><span lang="EN-GB">Su<o:p></o:p></span></p>
      </div>
      <br>
      <fieldset class="moz-mime-attachment-header"></fieldset>
      <pre class="moz-quote-pre" wrap="">_______________________________________________
Tiff mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Tiff@lists.osgeo.org">Tiff@lists.osgeo.org</a>
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/tiff">https://lists.osgeo.org/mailman/listinfo/tiff</a>
</pre>
    </blockquote>
    <pre class="moz-signature" cols="72">-- 
<a class="moz-txt-link-freetext" href="http://www.spatialys.com">http://www.spatialys.com</a>
My software is free, but my time generally not.</pre>
  </body>
</html>

--------------ABmngS59nSTE8Tq5YeHC0jfy--

--===============1422048356301663913==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tiff

--===============1422048356301663913==--
