Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Sep 2016 17:15:53 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: Tavis Ormandy <taviso@...gle.com>
cc: oss-security@...ts.openwall.com
Subject: Re: ImageMagick identify "d:" hangs

On Wed, 28 Sep 2016, Tavis Ormandy wrote:
>
> (/etc/passwd) /dumpname load 256 string filenameforall
> $ convert test.gif png:test.png
> <creates a file called test.png containing first line of /etc/passwd>
>
> Also seems to work with gm convert.

It is good that you did not single out just one using program.

This issue seems to afflict any program which invokes Ghostscript in 
general and not just *Magick.  However, 'convert' does offer to write 
a rendered result to an output file.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.