• 1.3.46 (October 29, 2025)
• 1.3.45 (August 27, 2024)
• 1.3.44 (August 18, 2024)

1.3.46 (October 29, 2025)

Special Issues:

• GraphicsMagick needs some additional productive volunteers. For several years now, the burden has entirely been on me (Bob Friesenhahn). I have been sheparding the project for 23 years already (and contributed to ImageMagick and GraphicsMagick combined for 29 years already). Volunteers are needed to add/improve new/existing file format support, and to assure correct operation on all targets. Donations are requested in order to purchase a new computer to run Windows 11.

Security Fixes:

• MSL: Use libxml2's SAX handlers for the MVG XML-based scripting implementation. This removes a lot of archaic cruft which might suffer from security issues.
• JP2: Fix Jasper max_samples calculation to avoid DOS due to huge image dimensions.
• JXL: Apply image dimension resource limits. Fix heap buffer write overflow while reading image.
• SVG: Use libxml2's SAX handlers for the SVG renderer. This removes a lot of archaic cruft which might suffer from security issues.
• WPG: Assure that the palette buffer is allocated and the current size (SourceForge bug #750).
• ColorFloodfillImage(): For floodfill, return an error if a clip-mask is present. The problem is that the algorithm may not converge if a clip-mask is present.
• ThumbnailImage(): Prevent a divide by zero crash.

Bug fixes:

• BMP: Assure that the opacity channel is initialized, even if the image is indicated to be opaque. This avoids issues with code which assumes that the opacity channel is always initialized.
• BRAILLE: Eliminate a Clang scan-build gripe regarding access off the end of an array.
• JPEG: Since GraphicsMagick 1.3.43, CMYK JPEG has been writing inverted. This bug is now fixed.
• JPEG: Enforce that JPEG is written as RGB unless a different colorspace was specified.
• PNG8: It is decided that PNG8 does indeed mean indexed-color with 8-bit sample depth and only binary transparency is supported. With this objective, the PNG8 writer is re-implemented, including attempting to produce reasonable output when the original image can not be represented completely due to too many colors, or complex opacity. There is still much work to be done to produce optimum output given complex/messy images.
• MNG: Validate that Validate that MNG width or height is non-zero.
• TclMagick: The TclMagick build uses the latest TEA tcl.m4 macros, while modernizing the Automake and Autoconf files. Many defects in the C code are corrected. The libttkcommon "shim" library, previously used to allow TkMagick to work, is completely eliminated. The names of installed shared objects now match the names generated by the TEA tcl.m4 module. The TclMagick tests are integrated into the build via 'make check' and 'make test'. Even 'make distcheck' works now.
• HEIF: Only apply Exif orientation if ignore-transformations is true since HEIF native transformations will handle orientation otherwise.
• HEIF: Use primary image for HEIC even when it has multiple images.
• Hull transform: Fix a arithemetic overflow regression added on October 21, 2023.
• JXL: Free profile memory if JxlDecoderSetBoxBuffer() fails.
• Magick++ 'analyze' demo: Request "Analyze" rather than "analyze". It is not clear how this was working before.
• TIFF: EXPERIMENTAL_EXIF_TAGS is enabled by default again since all known security issues have been addressed. Use CPPFLAGS=-DEXPERIMENTAL_EXIF_TAGS=0 to disable it.
• TIFF: Only handle EXIF and GPS IFDs once in order to avoid infinite recursion.
• TIFF: Do not transfer image-dependent TIFFTAG_TRANSFERFUNCTION and TIFFTAG_COLORMAP tags.
• XPM: Eliminate a Clang scan-build gripe about use of a "garbage value".
• GetImageBoundingBox(): If image rows or columns is zero, then return default bounds.
• TransformImage(), and -crop: Sove the problem "-crop does not generate tiles when used with a percentage"
• DrawImage(): Fix derefrence of a NULL pointer as well as shoring up error handling related to DrawPatternPath().

New Features:

• Support the newer Artifex urw-base35-fonts. Both OpenType and Postscript Type 1 fonts are supported. This is in response to to Debian bug 1019717 "Display of an SVG file broken due to gsfonts transition", https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019717.
• Support XML predefined entities when reading delegates.mgk so that it may be expressed in valid XML.
• Header Magic: When identifying files via their header, there is now a magic description field to indicate the sub-format used.
• Header Magic: Include a format description in the output of 'gm convert -list magic'.
• TIFF: Add support for libtiff 4.5 TIFFWarningExtR() and TIFFErrorExtR() in order to provide an error handling context per TIFF handle. This improves concurrency and thread safety when multiple libraries are using libtiff within the same process.
• EXIF attribute decoding is now updated to support Exif Version 3.0.
• EXIF validation is added, based on the expected EXIF tag format and expected number of components. Quite a lot of testing was done to discover (and allow) minor deviations from the specification. The validation is done to detect and prevent the reproduction of incorherent "garble".
• HEIF (HEIC, AVIF, etc.), rewrite the Re-write the HEIF reader (AVIF, HEIC, etc.) to be based on heif_image_get_plane_readonly2(). With the re-write comes support for deep images, as well as returning YCbCr and monochrome images. Use '-define heif:preserve-colorspace=true' to return the image in its original colorspace. Defines are provided to support all currently existing security limits.

API Updates:

• Magick++: Added InitializeMagickSentinel helper class, which performs the function of InitializeMagick() and invokes DestroyMagick() when an object created based on it goes out of scope. The Magick++ demos and tests are updated to use this class.
• Wand: MagickSetImagePixels(), If update image has matte, then promote canvas image to have matte. Support composing individual channels 'R', 'G', 'B', 'A', 'O', 'T', 'C', 'M', 'Y', 'K'.

Behavior Changes:

• Magick++: Support for automatic cleanup via a 'MagickCleanUp' static object is removed due to race conditions with static destruction in other libraries.
• SetImageAttribute(): No longer translate format requests for special format characters (e.g. "%m:%f %wx%h") in attribute text. Any code which was relying on this should use TranslateText() to perform the translations prior to calling SetImageAttribute().

Build Changes:

• The build now requires a C'99 compatible compiler (inttypes.h, stdint.h, and printf 'j', 'z', and 't' formatters). This means that (absent additional porting efforts) Solaris 10 U8 (released in October 2009) may be the oldest system supported. C'89 is obviously from 1989 and although I was glad to hear that systems from the mid'90s were still able to compile and use recent GraphicsMagick, adding the C'99 requirement is part of an effort to simplify GraphicsMagick configuration requirements. Libraries that GraphicsMagick optionally uses had already adopted a C'99 or C'11 (2011) requirement.
• The Autoconf-based configure script is significantly re-written so that it takes advantage of everything learned via pkg-config, but continues to be able to function if pkg-config data is not available. In particular, the primary library name (e.g. '-lpng16d') produced by pkg-config data is deduced, and used, if available. The configuration summary at the end now includes a listing of all of the direct dependencies required to link with each delegate library. Static library based builds (as used in the oss-fuzz builds) require that all of the dependencies are listed and so they produce a larger dependency summary than when shared libraries are used.
• Use Autoconf 2.72 and require Autoconf 2.71 (or later).
• Use Automake 1.17.
• Update Libtool to version 2.5.4.
• Test and demo programs are added to Coverity analysis. This necessitated fixing test/demo code to use "secure" buffer handling.
• Build the software differently for the oss-fuzz build so that features not useful, or harmful to, oss-fuzz testing are removed. This is indicated when FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined.
• The oss-fuzz build script (fuzzing/oss-fuzz-build.sh) is subtantially updated to build a fully-featured libheif, with a set of common libraries it depends on. In fact, all of the dependencies (except for some rarely-used libtiff dependencies) are now included.

Windows Delegate Updates/Additions:

• libwmf: Update/import https://github.com/caolanm/libwmf files (v0.2.13+) up to commit ec63c9b as of 1/14/25. This is a leap forward of 24 years!

1.3.45 (August 27, 2024)

Special Issues:

• GraphicsMagick needs some additional productive volunteers. For several years now, the burden has entirely been on me (Bob Friesenhahn). I have been sheparding the project for 22 years already (and contributed to ImageMagick and GraphicsMagick combined for 28 years already). Volunteers are needed to add/improve new/existing file format support, and to assure correct operation on all targets.

Security Fixes:

• None

Bug fixes:

• Fix off-by-one bug added by the 1.3.44 release to the sub-image specification parser, and which resulted in one less page being returned than expected (SourceForge bug #746 Off-by-one-error when converting PDF with multiple pages).

New Features:

• None

API Updates:

• None

Behavior Changes:

• None

Build Changes:

• None

1.3.44 (August 18, 2024)

Special Issues:

• GraphicsMagick needs some additional productive volunteers. For several years now, the burden has entirely been on me (Bob Friesenhahn). I have been sheparding the project for 22 years already (and contributed to ImageMagick and GraphicsMagick combined for 28 years already). Volunteers are needed to add/improve new/existing file format support, and to assure correct operation on all targets.

Security Fixes:

• GraphicsMagick is participating in Google's oss-fuzz project since February 4 2018 due to the contributions and assistance of Alex Gaynor and Paul Kehrer. The issues list is available at https://bugs.chromium.org/p/oss-fuzz/issues/list under search term "graphicsmagick". Issues are available for anyone to view and duplicate if they have been in "Verified" status for 30 days, or if they have been in "New" status for 90 days. Please consult the GraphicsMagick ChangeLog file, Mercurial repository commit log, and the oss-fuzz issues list for details.
• GraphicsMagick has been participating in Synopsys's Coverity program for free software projects since 2015. There has been a continuing objective to keep outstanding defects at 0, or very close to 0. Information about the Coverity status may be found at https://scan.coverity.com/projects/graphicsmagick.
• TIFF: Fixed multiple heap and stack buffer overflows (directed by the source EXIF profile) while writing EXIF into the native TIFF IFD.
• FITS: Fix problem that the FITS reader could return invalid image frames with rows or columns set to zero. Other code in the library crashes, or even asserts, if invalid image frames with rows or columns set to zero are returned.
• Coverity fixes: Various fixes for Coverity issues raised after the update to version 2023.12.2.
• Clang Analyzer (scan-build) fixes: Various fixes for new issues discovered by Clang Analyzer.

Bug fixes:

• configure.ac: Fix a shell syntax error.
• GCC 14: Eliminate some new warnings which appeared while in -Wall mode.
• JPEG: FormatJPEGSamplingFactors() now properly handles the number of samples for each colorspace.
• JXL: Additional validations of color channel and alpha channel depth.
• TGA: Fix issues discovered by Coverity.
• TGA: Fix writing TGA with opacity values in palette.
• TGA: Default orientation is (again) TopLeftOrientation.
• TIFF: Verify that TIFFTAG_BITSPERSAMPLE is within a rational range.
• TXT: Eliminate use of an uninitialized-value in GetColorTuple().
• XML: Improve detection of if the deprecated HTTP and FTP protocols are supported by libxml2.

New Features:

• Add support for reading the pre-rendered image from the Open Raster ("ORA") format. Actual rendering of Open Raster is not supported.
• Add support for Dune HD AAI Image (aka Auburn Animation Image) image format ("AAI").
• Add support for a --version option, which produces GNU style summary version output.
• Identify output now indicates if the image is opaque.
• WebP: Add support for '-define webp:exact=true' to preserve exact RGB values under transparent areas while writing WebP format. Enable this automatically when lossless is enabled. If lossless is enabled, this option may be used to disable exact mode.
• PerlMagick: Add AccessDefinition(), AddDefinition(), AddDefinitions(), and RemoveDefinitions() methods to supporting adding, updating, removing definitions.

API Updates:

• Magick++/STL.h: The deprecated std::unary_function is no longer used given C++'11 or later. Continued use of it caused too many issues due to an abundance of warnings.
• Wand API PixelSetQuantumColor(): The color argument is now a const pointer.

Behavior Changes:

• The graphical progress indication in the X11 sub-apps 'animate' and 'display' is disabled due to discovering a tremendous performance impact while rendering text under Ubuntu 22.04 LTS. The underlying cause of the performance impact is not yet known. A text-based progress output to the program's console is available via -monitor.

Windows Delegate Updates/Additions:

• Zip support is obtained from existing zlib contrib/minizip source code.

Build Changes:

• Libzip is now supported in the build in order to support the ORA format. Please note that this library often depends on a large crypto library such as OpenSSL, although crypto is not required to read the ORA format.
• The VisualMagick build is modified to use existing minizip source files to support the ORA format.
• fuzzing/oss-fuzz-build.sh: Continued improvements to the oss-fuzz build script, which builds almost all 3rd party libraries that GraphicsMagick depends on.
• Improve the build for Mingw-w64. Remove mention from the documentation regarding the original MinGW (for which the build still works) given that the project seems to be defunct and unusable.
• FPX: Support building with libfpx ("FlashPIX") again. FlashPIX is not recommended for any production work due to libfpx having a defective API, bad behavior, and many implementation issues (especially memory leaks).

Behavior Changes:

• MagickMaxFileSystemBlockSize: Place an arbitrary limit (4,194,304 bytes) on maximum filesystem block size.