3.19.22

FreeImage 3.19.22

Security fixes for IFF PBM decoding, improved 32-bit compatibility, and installable Linux packages.

• Fix an IFF PBM RLE heap buffer overflow by checking scanline bounds for literal and repeated pixels. (#156, #161)
• Prevent malformed PBM files from hanging the decoder. Reject truncated commands and payloads, and stop decoding at the declared BODY boundary. These robustness/DoS fixes are separate from the heap overflow fix. (#162)
• Add 12 PBM regression tests, including malformed inputs and byte-for-byte checks for valid images, with GCC AddressSanitizer coverage.
• Fix OpenJPH SSE compilation on 32-bit GCC and add MinGW i686 static/shared CI coverage. (#155)
• Fix public-header type redefinition conflicts with MSVC 2013 and newer. (#159)
• Set CMake shared-library VERSION and SOVERSION properties. (#157)
• Add Arch Linux, Debian 13, and Ubuntu 24.04 packages, with system codec dependencies and pkg-config/CMake installation checks. (#160)
• Numeric release tags now build and attach Linux packages, a source archive, an Arch recipe, and SHA-256 checksums to the GitHub release.

Bundled codec versions are unchanged from 3.19.21.

What's Changed

• Set version properties for FreeImage target by @oold in #157
• Update compatibility checks for MSVC integer types in FreeImage.h by @oold in #159
• Fix OpenJPH SIMD on 32-bit GCC and add MinGW32 CI by @danoli3 in #155
• Add installable Linux packages and clean-container package tests by @danoli3 in #160
• fix heap overflow in IFF PBM RLE decompression by @areofyl in #161
• Harden PBM RLE short reads and no-op termination by @danoli3 in #162
• FreeImage 3.19.22 by @danoli3 in #163

New Contributors

• @oold made their first contribution in #157
• @areofyl made their first contribution in #161

Full Changelog: 3.19.21...3.19.22