diff -up ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717 ImageMagick-6.7.8-9/config/delegates.xml.in
--- ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717 2012-06-26 14:23:25.000000000 +0200
+++ ImageMagick-6.7.8-9/config/delegates.xml.in 2016-05-05 13:52:30.751570145 +0200
@@ -85,11 +85,11 @@
<delegate decode="hpgl" command="if [ -e @HPGLDecodeDelegate@ -o -e /usr/bin/@HPGLDecodeDelegate@ ]; then @HPGLDecodeDelegate@ -q -m eps -f `basename "%o"` "%i"; mv -f `basename "%o"` "%o"; else echo "You need to install hp2xx to use HPGL files with ImageMagick."; exit 1; fi"/>
<delegate decode="htm" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>
<delegate decode="html" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>
- <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%M""/>
+ <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%F""/>
<delegate decode="ilbm" command=""@ILBMDecodeDelegate@" "%i" > "%o""/>
<delegate decode="man" command=""@MANDelegate@" -man -Tps "%i" > "%o""/>
<delegate decode="mpeg:decode" command=""@MPEGDecodeDelegate@" -v -1 -i "%i" -vframes %S -vcodec pam -an -f rawvideo -y "%u.pam" 2> "%Z""/>
- <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%M%%d.jpg" "%u.%m" 2> "%Z""/>
+ <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%F%%d.jpg" "%u.%m" 2> "%Z""/>
<delegate decode="sid" command=""@MrSIDDecodeDelegate@" -if sid -i "%i" -of tif -o "%o" > "%u""/>
<delegate decode="pcl:color" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>
<delegate decode="pcl:cmyk" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>
@@ -109,11 +109,11 @@
<delegate decode="rgba" encode="rle" mode="encode" command=""@RLEEncodeDelegate@" -o "%o" -v "%i""/>
<delegate decode="scan" command=""@SCANDecodeDelegate@" -d "%i" > "%o""/>
<delegate decode="scanx" command=""@SCANDecodeDelegate@" > "%o""/>
- <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/>
+ <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] "ephemeral:%i""/>
<delegate decode="shtml" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/>
<delegate decode="svg" command=""@RSVGDecodeDelegate@" -o "%o" "%i""/>
<delegate decode="txt" encode="ps" mode="bi" command=""@TXTDelegate@" -o "%o" "%i""/>
- <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/>
+ <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] "ephemeral:%i""/>
<delegate decode="wmf" command=""@WMFDecodeDelegate@" -o "%o" "%i""/>
<delegate decode="xps:color" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>
<delegate decode="xps:cmyk" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/>
diff -up ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717 ImageMagick-6.7.8-9/config/policy.xml
--- ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717 2012-03-03 02:18:13.000000000 +0100
+++ ImageMagick-6.7.8-9/config/policy.xml 2016-05-05 14:08:15.249092848 +0200
@@ -35,6 +35,10 @@
<policy domain="path" rights="read" pattern="/repository/*" />
+ Let's prevent possible exploits by removing the right to use indirect reads.
+
+ <policy domain="path" rights="none" pattern="@*" />
+
Any large image is cached to disk rather than memory:
<policy domain="resource" name="area" value="1GB"/>
@@ -55,4 +59,14 @@
<!-- <policy domain="resource" name="thread" value="4"/> -->
<!-- <policy domain="resource" name="throttle" value="0"/> -->
<!-- <policy domain="resource" name="time" value="3600"/> -->
+ <policy domain="coder" rights="none" pattern="EPHEMERAL" />
+ <policy domain="coder" rights="none" pattern="HTTPS" />
+ <policy domain="coder" rights="none" pattern="HTTP" />
+ <policy domain="coder" rights="none" pattern="URL" />
+ <policy domain="coder" rights="none" pattern="FTP" />
+ <policy domain="coder" rights="none" pattern="MVG" />
+ <policy domain="coder" rights="none" pattern="MSL" />
+ <policy domain="coder" rights="none" pattern="TEXT" />
+ <policy domain="coder" rights="none" pattern="LABEL" />
+ <policy domain="path" rights="none" pattern="@*" />
</policymap>
diff -up ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717 ImageMagick-6.7.8-9/magick/property.c
--- ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717 2012-08-10 13:08:37.000000000 +0200
+++ ImageMagick-6.7.8-9/magick/property.c 2016-05-05 13:52:30.752570145 +0200
@@ -66,6 +66,7 @@
#include "magick/monitor.h"
#include "magick/montage.h"
#include "magick/option.h"
+#include "magick/policy.h"
#include "magick/profile.h"
#include "magick/property.h"
#include "magick/quantum.h"
@@ -2357,6 +2358,29 @@ static const char *GetMagickPropertyLett
CommandOptionToMnemonic(MagickDisposeOptions,(ssize_t) image->dispose));
break;
}
+ case 'F':
+ {
+ const char
+ *q;
+
+ register char
+ *p;
+
+ static char
+ whitelist[] =
+ "^-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+ "+&@#/%?=~_|!:,.;()";
+
+ /*
+ * Magick filename (sanitized) - filename given incl. coder & read mods.
+ * */
+ (void) CopyMagickString(value,image->magick_filename,MaxTextExtent);
+ p=value;
+ q=value+strlen(value);
+ for (p+=strspn(p,whitelist); p != q; p+=strspn(p,whitelist))
+ *p='_';
+ break;
+ }
case 'G': /* Image size as geometry = "%wx%h" */
{
(void) FormatLocaleString(value,MaxTextExtent,"%.20gx%.20g",(double)
@@ -2943,16 +2967,23 @@ MagickExport char *InterpretImagePropert
if ((embed_text == (const char *) NULL) || (*embed_text == '\0'))
return((char *) NULL);
p=embed_text;
+ while ((isspace((int) ((unsigned char) *p)) != 0) && (*p != '\0'))
+ p++;
+ if (*p == '\0')
+ return(ConstantString(""));
+
+ if ((*p == '@') && (IsPathAccessible(p+1) != MagickFalse))
+ {
+ /* handle a '@' replace string from file */
+ if (IsRightsAuthorized(PathPolicyDomain,ReadPolicyRights,p) == MagickFalse)
+ {
+ errno=EPERM;
+ (void) ThrowMagickException(&image->exception,GetMagickModule(),
+ PolicyError,"NotAuthorized","`%s'",p);
+ return(ConstantString(""));
+ }
- /* handle a '@' replace string from file */
- if (*p == '@') {
- p++;
- if (*p != '-' && (IsPathAccessible(p) == MagickFalse) ) {
- (void) ThrowMagickException(&image->exception,GetMagickModule(),
- OptionError,"UnableToAccessPath","%s",p);
- return((char *) NULL);
- }
- return(FileToString(p,~0,&image->exception));
+ return(FileToString(p+1,~0,&image->exception));
}
/*