Skip to content

Releases: Roughsketch/imagesize

Fix HEIC image parsing

31 Jul 17:41
Compare
Choose a tag to compare

This release fixes an issue with HEIC image parsing where the dimensions returned would be a sub-image or thumbnail and not the larger image. In order to fix this, the library will now read all spacial tags and pick the largest one as the size to return. On top of this, it now also looks for a rotation tag and will swap the width and height if the image should be rotated 90 or 270 degrees.

Fix multiplication overflow crash

12 Jul 18:26
Compare
Choose a tag to compare

I've been meaning to try out fuzzing for a while, but unfortunately I only tried it after v0.8.2 was released. Running cargo fuzz found a multiplication crash in under 10 seconds, which was very impressive and also kind of frustrating due to the recent release. This crash should not be an issue in release mode, but this does make it so debug mode does not crash anymore.

The crash involved a crafted or corrupted TIFF payload where a tag's count entry was set to a very large number. This number was eventually multiplied and converted to a usize, but since the multiplication happened as a u32, it was possible to overflow by setting the count to something like 0xFFFFFFFF. The variable is now converted to a usize after being read, so this type of overflow should not be possible anymore.

Fix JPEG parsing issues

11 Jul 22:20
Compare
Choose a tag to compare

This release fixes two major issues with JPEG parsing which would cause a valid JPEG to return an error.

Issue one (#9) was that JPEGs that happened to have their image dimension marker be preceded by FF would be skipped (e.g., FF FF C0).

Issue two was that JPEGs where the image dimension tag was directly preceded by another tag would be skipped. (e.g., FF E1 FF C0)