Blame SOURCES/gegl-CVE-2021-45463.patch

ed854b
From bfce470f0f2f37968862129d5038b35429f2909b Mon Sep 17 00:00:00 2001
ed854b
From: =?UTF-8?q?=C3=98yvind=20Kol=C3=A5s?= <pippin@gimp.org>
ed854b
Date: Thu, 16 Dec 2021 00:10:24 +0100
ed854b
Subject: [PATCH] magick-load: use more robust g_spawn_async() instead of
ed854b
 system()
ed854b
ed854b
This fixes issue #298 by avoiding the shell parsing being invoked at
ed854b
all, this less brittle than any forms of escaping characters, while
ed854b
retaining the ability to address all existing files.
ed854b
---
ed854b
 operations/common/magick-load.c | 12 +++++++-----
ed854b
 1 file changed, 7 insertions(+), 5 deletions(-)
ed854b
ed854b
diff --git a/operations/common/magick-load.c b/operations/common/magick-load.c
ed854b
index e2055b2e9..595169115 100644
ed854b
--- a/operations/common/magick-load.c
ed854b
+++ b/operations/common/magick-load.c
ed854b
@@ -41,20 +41,23 @@ load_cache (GeglProperties *op_magick_load)
ed854b
   if (!op_magick_load->user_data)
ed854b
     {
ed854b
       gchar    *filename;
ed854b
-      gchar    *cmd;
ed854b
       GeglNode *graph, *sink, *loader;
ed854b
       GeglBuffer *newbuf = NULL;
ed854b
 
ed854b
       /* ImageMagick backed fallback FIXME: make this robust.
ed854b
        * maybe use pipes in a manner similar to the raw loader,
ed854b
        * or at least use a properly unique filename  */
ed854b
+      char     *argv[4]  = {"convert", NULL, NULL, NULL};
ed854b
 
ed854b
       filename = g_build_filename (g_get_tmp_dir (), "gegl-magick.png", NULL);
ed854b
-      cmd = g_strdup_printf ("convert \"%s\"'[0]' \"%s\"",
ed854b
-                             op_magick_load->path, filename);
ed854b
-      if (system (cmd) == -1)
ed854b
+
ed854b
+      argv[1] = g_strdup_printf ("%s[0]", op_magick_load->path);
ed854b
+      argv[2] = filename;
ed854b
+      if (!g_spawn_sync (NULL, argv, NULL, G_SPAWN_DEFAULT, 
ed854b
+                         NULL, NULL, NULL, NULL, NULL, NULL))
ed854b
         g_warning ("Error executing ImageMagick convert program");
ed854b
 
ed854b
+      g_free (argv[1]);
ed854b
 
ed854b
       graph = gegl_node_new ();
ed854b
       sink = gegl_node_new_child (graph,
ed854b
@@ -67,7 +70,6 @@ load_cache (GeglProperties *op_magick_load)
ed854b
       gegl_node_process (sink);
ed854b
       op_magick_load->user_data = (gpointer) newbuf;
ed854b
       g_object_unref (graph);
ed854b
-      g_free (cmd);
ed854b
       g_free (filename);
ed854b
     }
ed854b
 }
ed854b
-- 
ed854b
GitLab
ed854b
ed854b
ed854b
diff -urNp a/tools/exp_combine.cpp b/tools/exp_combine.cpp
ed854b
--- a/tools/exp_combine.cpp	2022-01-10 15:03:42.765909209 +0100
ed854b
+++ b/tools/exp_combine.cpp	2022-01-10 15:04:16.864158424 +0100
ed854b
@@ -8,8 +8,7 @@
ed854b
 
ed854b
 #include <iostream>
ed854b
 
ed854b
-#include <exiv2/image.hpp>
ed854b
-#include <exiv2/exif.hpp>
ed854b
+#include <exiv2/exiv2.hpp>
ed854b
 
ed854b
 using namespace std;
ed854b