Fetch the repository succeeded.
This action will force synchronization from src-openEuler/ImageMagick, which will overwrite any changes that you have made since you forked the repository, and can not be recovered!!!
Synchronous operation will process in the background and will refresh the page when finishing processing. Please be patient.
From 7b0cce080345e5b7ef26d122f18809c93a19a80e Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 16 Nov 2020 18:17:31 +0000
Subject: [PATCH] fix shell injection vulnerability via the -authenticate
option
---
coders/pdf.c | 15 ++++++---------
magick/string.c | 8 +++++++-
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/coders/pdf.c b/coders/pdf.c
index 63eda5d81..074ba3f64 100644
--- a/coders/pdf.c
+++ b/coders/pdf.c
@@ -585,17 +585,14 @@ static Image *ReadPDFImage(const ImageInfo *image_info,ExceptionInfo *exception)
if (stop_on_error != MagickFalse)
(void) ConcatenateMagickString(options,"-dPDFSTOPONERROR ",MaxTextExtent);
option=GetImageOption(image_info,"authenticate");
- if (option != (char *) NULL)
+ if ((option != (char *) NULL) && (strpbrk(option,"&;<>|") == (char *) NULL))
{
char
- message[MagickPathExtent],
- *passphrase;
-
- passphrase=SanitizeString(option);
- (void) FormatLocaleString(message,MagickPathExtent,
- "\"-sPDFPassword=%s\" ",passphrase);
- passphrase=DestroyString(passphrase);
- (void) ConcatenateMagickString(options,message,MagickPathExtent);
+ passphrase[MagickPathExtent];
+
+ (void) FormatLocaleString(passphrase,MagickPathExtent,
+ "\"-sPDFPassword=%s\" ",option);
+ (void) ConcatenateMagickString(options,passphrase,MagickPathExtent);
}
read_info=CloneImageInfo(image_info);
*read_info->magick='\0';
diff --git a/magick/string.c b/magick/string.c
index c8ffa086f..7f6eebc3b 100644
--- a/magick/string.c
+++ b/magick/string.c
@@ -1604,9 +1604,15 @@ MagickExport char *SanitizeString(const char *source)
*p;
static char
+#if defined(MAGICKCORE_WINDOWS_SUPPORT)
whitelist[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 "
- "$-_.+!*'(),{}|\\^~[]`\"><#%;/?:@&=";
+ "$-_.+!;*(),{}|^~[]`\'><#%/?:@&=";
+#else
+ whitelist[] =
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 "
+ "$-_.+!;*(),{}|\\^~[]`\"><#%/?:@&=";
+#endif
sanitize_source=AcquireString(source);
p=sanitize_source;
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。