From 1b5507f188dd0cd76099348c5f151a8ba61a812d Mon Sep 17 00:00:00 2001 From: maminjie Date: Sat, 19 Sep 2020 16:39:22 +0800 Subject: [PATCH] fix CVE-2019-12921 the text filename component potentially allows to read arbitrary files via TranslateTextEx for SVG refers to https://build.opensuse.org/request/show/788214 --- magick/render.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/magick/render.c b/magick/render.c index 3caf603..75bbe2f 100644 --- a/magick/render.c +++ b/magick/render.c @@ -2360,11 +2360,16 @@ DrawImage(Image *image,const DrawInfo *draw_info) if (*draw_info->primitive == '\0') return(MagickFail); (void) LogMagickEvent(RenderEvent,GetMagickModule(),"begin draw-image"); - if (*draw_info->primitive != '@') - primitive=AllocateString(draw_info->primitive); - else + /* + Read primitive from file if supplied primitive starts with '@' and + we are not already drawing. + */ + if ((*draw_info->primitive == '@') && + (DrawImageGetCurrentRecurseLevel(image) == 1)) primitive=(char *) FileToBlob(draw_info->primitive+1,&length,&image->exception); + else + primitive=AllocateString(draw_info->primitive); if (primitive == (char *) NULL) return(MagickFail); primitive_extent=strlen(primitive); -- 2.23.0