Return-Path: <SRS0=msbQ=LO=lists.osgeo.org=tiff-bounces@osgeo.org>
Delivered-To: filtered@awaresystems.be
Received: from mx2.pub.mailpod8-cph3.one.com ([10.27.38.12])
	by mailstorage22.cst.mailpod8-cph3.one.com with LMTP
	id IE10BbdjFWZEXAAAwT5NuQ
	(envelope-from <SRS0=msbQ=LO=lists.osgeo.org=tiff-bounces@osgeo.org>)
	for <filtered@awaresystems.be>; Tue, 09 Apr 2024 15:50:15 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=custmx.one.com; s=20201015;
	h=sender:content-transfer-encoding:content-type:reply-to:from:list-subscribe:
	 list-help:list-post:list-unsubscribe:list-id:subject:to:message-id:date:
	 mime-version:x-halone-refid:x-halone-sa:from:x-halone-sa:x-halone-refid;
	bh=oK+PX2Lkj0W/bhQq8x0NnAxQyRcS9ynDuAhJmLj44X4=;
	b=s2Bm555NIyJFglEPbDG1FprnIOSszMZ76zSZhJsyh+r8LrMqryOS3t9nFZRuCHMo889hLpYrGdZTc
	 NE6YGw6khg8tga5jIV7xZM7i5VY8AuolHdcWjUr9PHAlcdpjZoPlBlwRn451mXCp8eFpxEuyj/BYTN
	 2BCQYzkznZj3ePnL5kx/ms7JVDgUfiVaZy6zA0ZShdzRU7d2X0ZwLUwCmBTK0m2MyI+zKqjT8FNI6x
	 U+PB0LzfEGt7PEd9/2d630097am7KHeTW0AikDw1bzSCEOdChonow4qTlqj3JNXzVhKZAVCoEQWyS/
	 Xiz2FAE897gRC6yj2A51FeYLJO8wQaA==
X-HalOne-SA: -1
X-HalOne-RefID: 155866::1712677814-E6A12217-DD122D6E/0/0
Authentication-Results: mx2.pub.mailpod8-cph3.one.com;
	spf=pass smtp.mailfrom=osgeo.org smtp.remote-ip=140.211.15.3;
	dmarc=pass header.from=lists.osgeo.org;
X-HalOne-ID: d9cec2d4-f688-11ee-862b-98039b05783e
Received: from lists.osgeo.org (osgeo6.osgeo.osuosl.org [140.211.15.3])
	by mx2.pub.mailpod8-cph3.one.com (Halon) with ESMTP
	id d9cec2d4-f688-11ee-862b-98039b05783e;
	Tue, 09 Apr 2024 15:50:14 +0000 (UTC)
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id A37DE61424E7;
	Tue,  9 Apr 2024 08:50:10 -0700 (PDT)
Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com
 [209.85.208.170])
 by lists.osgeo.org (Postfix) with ESMTPS id DC4A16146819
 for <tiff@lists.osgeo.org>; Tue,  9 Apr 2024 08:50:08 -0700 (PDT)
Received: by mail-lj1-f170.google.com with SMTP id
 38308e7fff4ca-2d8a2cbe1baso12054421fa.0
 for <tiff@lists.osgeo.org>; Tue, 09 Apr 2024 08:50:08 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1712677807; x=1713282607;
 h=to:subject:message-id:date:from:mime-version:x-gm-message-state
 :from:to:cc:subject:date:message-id:reply-to;
 bh=gXkiG+lC8Pv8f3jhjhFEIDI3jyPUT08pXIDHJEvNW/c=;
 b=cnHm9unf9YmqCOn76PWAUutO9fIw3bLt6b9UT0GY6Q6bgQ1UbLpOkdsaI7giM/oyRA
 bZghAIq6VHUrPXVXWEi0WgwAL3Q5cnrIwc5tKbvwJqMAk21xV9L1Vsrtz4/qcUP2Z+Xk
 bTTrKhj6x6AQCZDE57YoXhPphQDxEuFTSFP4PRzEDwmWxtJbQ2R6IYHLuZT8/d6cbTjd
 Lt3ciOfNz4rcl2Gw6y71j/VYSC9nLWhcESjsrT1yComLmAiH4m2tAEpxpL4jM0A7RHg5
 rBXcFvArpI3yfkClAa4xuuUWBTXrutoV8Eqg6OsQwQQuy6j99NacJfflcI583zP0G2Jx
 aovw==
X-Gm-Message-State: AOJu0YwiTAmZn4YfcuZkZxVod6n6nZNVVpg9wbRl8d4s1ooyrn0Qk30/
 EzB9KC7CuR/XlUmfR6CsUqSS+Aa3znEYZe39LlgEhezjMQbj0x9N+SwvxwO2rWArejZMFQXH0L9
 6KUxgnqKiQ6k41gIcj24nhRA8xxfxaYQulvdLOARt3auxJ28Tl/0=
X-Google-Smtp-Source: AGHT+IHRX7VDCKBrvdU5fWKkPugIbeD8e9RLdYe0Ad5xV0y73mqlcvuFc7JEj7kg/QYojSYtYq3LHX9S7BIyaYmekjA=
X-Received: by 2002:a2e:2245:0:b0:2d8:781c:7ba1 with SMTP id
 i66-20020a2e2245000000b002d8781c7ba1mr146380lji.7.1712677806619; Tue, 09 Apr
 2024 08:50:06 -0700 (PDT)
MIME-Version: 1.0
Date: Tue, 9 Apr 2024 17:49:54 +0200
Message-ID: <CAHNiRk02CfCde_-nOEyVy=fkh0P46j1f3o+ajGWOPmsVwVULxQ@mail.gmail.com>
To: tiff@lists.osgeo.org
Subject: [Tiff] www.libtiff.org is restored
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
From: Michael Vetter via Tiff <tiff@lists.osgeo.org>
Reply-To: Michael Vetter <mvetter@suse.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>

> Now "http://www.libtiff.org/" leads to the latest libtiff HTML pages, and the same server/directory which already provides "http://www.simplesystems.org/libtiff/".

With some differences though.

The biggest probably being that http://www.libtiff.org advertises a
version 4.6.0t with all the tools restored. If I see it right it
doesn't fix all the CVEs in those tools though.

I believe this can be quite confusing to potential users of tiff.
Wouldn't it have been better to first fix the CVEs and then create a
new release? Or at least add a note/warning?

Especially after the situation with `xz` people are more cautious of
what sources they take.

Having a kind of fork (https://gitlab.com/faxguy/libtiff-tools meaning
libtiff + tools restored) on a website called http://libtiff.org/
(which sounds quite official) that are shipped in a tarball with
almost the same name (plus a  tiny `t`) is suboptimal in my opinion.

The 4.6.0t changelog (http://libtiff.org/releases/v4.6.0t.html)
doesn't give much insight either with entries like:
> Fix some issues in library found through fuzzing.
> Prevent some out-of-memory attacks.

It would be good to have the links to the corresponding issues there.
Or the CVE names, if applicable.
Some of these can be found in https://gitlab.com/faxguy/libtiff-tools.
But people need to really look for them. It is rather obscure for
people quickly checking the site. And they most likely will not
understand what is fixed and what is vulnerable compared to 4.6.0.

It would also be great if fixed issues could be linked from the
original bugreport in the main upstream repo though I didn't check if
this was maybe done in some cases. I think I saw Lee Howard comment on
some of the issues but am not sure if it were all.

> Unfortunately, the demoted tools do not only use tiffconf.h. Some of them rely heavily on libtiff internals. It wouldn't be a simple process to separate the tools from the rest of libtiff.

My colleague Fridrich took a quick look at it and created a POC:
https://github.com/fridrich/tiff-tools

He copied the few strictly necessary internal macros/prototypes from
tiffiop.h into tiff_tools_internal.h. Now only fax2tiff cannot work
with the opaque TIFF (struct tiff) type. Maybe some getters and
setters exposing the necessary members could be implemented.

Maybe this helps the people who would like to bring the tools back and
want to take the route of creating a separate tools package.
_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tiff
