diff -up ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717 ImageMagick-6.7.8-9/config/delegates.xml.in

--- ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717	2012-06-26 14:23:25.000000000 +0200

+++ ImageMagick-6.7.8-9/config/delegates.xml.in	2016-05-05 13:52:30.751570145 +0200

@@ -85,11 +85,11 @@

   <delegate decode="hpgl" command="if [ -e @HPGLDecodeDelegate@ -o -e /usr/bin/@HPGLDecodeDelegate@ ]; then     @HPGLDecodeDelegate@ -q -m eps -f `basename "%o"` "%i";     mv -f `basename "%o"` "%o";   else     echo "You need to install hp2xx to use HPGL files with ImageMagick.";     exit 1;   fi"/>

   <delegate decode="htm" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>

   <delegate decode="html" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>

-  <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%M""/>

+  <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%F""/>

   <delegate decode="ilbm" command=""@ILBMDecodeDelegate@" "%i" > "%o""/>

   <delegate decode="man" command=""@MANDelegate@" -man -Tps "%i" > "%o""/>

   <delegate decode="mpeg:decode" command=""@MPEGDecodeDelegate@" -v -1 -i "%i" -vframes %S -vcodec pam -an -f rawvideo -y "%u.pam" 2> "%Z""/>

-  <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%M%%d.jpg" "%u.%m" 2> "%Z""/>

+  <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%F%%d.jpg" "%u.%m" 2> "%Z""/>

   <delegate decode="sid" command=""@MrSIDDecodeDelegate@" -if sid -i "%i" -of tif -o "%o" > "%u""/>

   <delegate decode="pcl:color" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>

   <delegate decode="pcl:cmyk" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>

@@ -109,11 +109,11 @@

   <delegate decode="rgba" encode="rle" mode="encode" command=""@RLEEncodeDelegate@" -o "%o" -v "%i""/>

   <delegate decode="scan" command=""@SCANDecodeDelegate@" -d "%i" > "%o""/>

   <delegate decode="scanx" command=""@SCANDecodeDelegate@" > "%o""/>

-  <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/>

+  <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] "ephemeral:%i""/>

   <delegate decode="shtml" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>

   <delegate decode="svg" command=""@RSVGDecodeDelegate@" -o "%o" "%i""/>

   <delegate decode="txt" encode="ps" mode="bi" command=""@TXTDelegate@" -o "%o" "%i""/>

-  <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/>

+  <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] "ephemeral:%i""/>

   <delegate decode="wmf" command=""@WMFDecodeDelegate@" -o "%o" "%i""/>

   <delegate decode="xps:color" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>

   <delegate decode="xps:cmyk" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>

diff -up ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717 ImageMagick-6.7.8-9/config/policy.xml

--- ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717	2012-03-03 02:18:13.000000000 +0100

+++ ImageMagick-6.7.8-9/config/policy.xml	2016-05-05 14:08:15.249092848 +0200

@@ -35,6 +35,10 @@

     <policy domain="path" rights="read" pattern="/repository/*" />

+  Let's prevent possible exploits by removing the right to use indirect reads.

+ 

+    <policy domain="path" rights="none" pattern="@*" /> 

+

   Any large image is cached to disk rather than memory:

     <policy domain="resource" name="area" value="1GB"/>

@@ -55,4 +59,14 @@

+  <policy domain="coder" rights="none" pattern="EPHEMERAL" />

+  <policy domain="coder" rights="none" pattern="HTTPS" />

+  <policy domain="coder" rights="none" pattern="HTTP" />

+  <policy domain="coder" rights="none" pattern="URL" />

+  <policy domain="coder" rights="none" pattern="FTP" />

+  <policy domain="coder" rights="none" pattern="MVG" />

+  <policy domain="coder" rights="none" pattern="MSL" />

+  <policy domain="coder" rights="none" pattern="TEXT" />

+  <policy domain="coder" rights="none" pattern="LABEL" />

+  <policy domain="path" rights="none" pattern="@*" />

 </policymap>

diff -up ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717 ImageMagick-6.7.8-9/magick/property.c

--- ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717	2012-08-10 13:08:37.000000000 +0200

+++ ImageMagick-6.7.8-9/magick/property.c	2016-05-05 13:52:30.752570145 +0200

@@ -66,6 +66,7 @@

 #include "magick/monitor.h"

 #include "magick/montage.h"

 #include "magick/option.h"

+#include "magick/policy.h"

 #include "magick/profile.h"

 #include "magick/property.h"

 #include "magick/quantum.h"

@@ -2357,6 +2358,29 @@ static const char *GetMagickPropertyLett

         CommandOptionToMnemonic(MagickDisposeOptions,(ssize_t) image->dispose));

       break;

     }

+    case 'F':

+    {

+      const char

+        *q;

+

+      register char

+        *p;

+

+      static char

+        whitelist[] =

+        "^-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"

+        "+&@#/%?=~_|!:,.;()";

+

+      /*

+       *         Magick filename (sanitized) - filename given incl. coder & read mods.

+       *                 */

+      (void) CopyMagickString(value,image->magick_filename,MaxTextExtent);

+      p=value;

+      q=value+strlen(value);

+      for (p+=strspn(p,whitelist); p != q; p+=strspn(p,whitelist))

+        *p='_';

+      break;

+    }

     case 'G': /* Image size as geometry = "%wx%h" */

     {

       (void) FormatLocaleString(value,MaxTextExtent,"%.20gx%.20g",(double)

@@ -2943,16 +2967,23 @@ MagickExport char *InterpretImagePropert

   if ((embed_text == (const char *) NULL) || (*embed_text == '\0'))

     return((char *) NULL);

   p=embed_text;

+  while ((isspace((int) ((unsigned char) *p)) != 0) && (*p != '\0'))

+    p++;

+  if (*p == '\0')

+    return(ConstantString(""));

+

+  if ((*p == '@') && (IsPathAccessible(p+1) != MagickFalse)) 

+  {

+    /* handle a '@' replace string from file */

+    if (IsRightsAuthorized(PathPolicyDomain,ReadPolicyRights,p) == MagickFalse)

+    {

+      errno=EPERM;

+      (void) ThrowMagickException(&image->exception,GetMagickModule(),

+          PolicyError,"NotAuthorized","`%s'",p);

+      return(ConstantString(""));

+    }

-  /* handle a '@' replace string from file */

-  if (*p == '@') {

-     p++;

-     if (*p != '-' && (IsPathAccessible(p) == MagickFalse) ) {

-       (void) ThrowMagickException(&image->exception,GetMagickModule(),

-           OptionError,"UnableToAccessPath","%s",p);

-       return((char *) NULL);

-     }

-     return(FileToString(p,~0,&image->exception));

+     return(FileToString(p+1,~0,&image->exception));

   }

   /*