From 226804980651bb4eb5f3ba3b9d7e992f2eda4710 Mon Sep 17 00:00:00 2001 From: Cristy Date: Thu, 19 Nov 2020 20:50:44 +0000 Subject: [PATCH] fix shell injection vulnerability via the -authenticate option --- coders/pdf.c | 46 ++++++++++++++++++++++++++++++++++------- config/delegates.xml.in | 4 ++-- 2 files changed, 42 insertions(+), 9 deletions(-) diff --git a/coders/pdf.c b/coders/pdf.c index d5ed56596..31efd06e5 100644 --- a/coders/pdf.c +++ b/coders/pdf.c @@ -368,6 +368,36 @@ static inline void CleanupPDFInfo(PDFInfo *pdf_info) pdf_info->profile=DestroyStringInfo(pdf_info->profile); } +static char *SanitizeDelegateString(const char *source) +{ + char + *sanitize_source; + + const char + *q; + + register char + *p; + + static char +#if defined(MAGICKCORE_WINDOWS_SUPPORT) + whitelist[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 " + "$-_.+!;*(),{}|^~[]`\'><#%/?:@&="; +#else + whitelist[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 " + "$-_.+!;*(),{}|\\^~[]`\"><#%/?:@&="; +#endif + + sanitize_source=AcquireString(source); + p=sanitize_source; + q=sanitize_source+strlen(sanitize_source); + for (p+=strspn(p,whitelist); p != q; p+=strspn(p,whitelist)) + *p='_'; + return(sanitize_source); +} + static Image *ReadPDFImage(const ImageInfo *image_info,ExceptionInfo *exception) { char @@ -585,14 +615,16 @@ static Image *ReadPDFImage(const ImageInfo *image_info,ExceptionInfo *exception) if (stop_on_error != MagickFalse) (void) ConcatenateMagickString(options,"-dPDFSTOPONERROR ",MaxTextExtent); option=GetImageOption(image_info,"authenticate"); - if ((option != (char *) NULL) && - (strpbrk(option,"&;<>|\"'") == (char *) NULL)) + if (option != (char *) NULL) { char - passphrase[MagickPathExtent]; + passphrase[MagickPathExtent], + *sanitize_passphrase; + sanitize_passphrase=SanitizeDelegateString(option); (void) FormatLocaleString(passphrase,MagickPathExtent, - "\"-sPDFPassword=%s\" ",option); + "'-sPDFPassword=%s' ",sanitize_passphrase); + sanitize_passphrase=DestroyString(sanitize_passphrase); (void) ConcatenateMagickString(options,passphrase,MagickPathExtent); } read_info=CloneImageInfo(image_info); diff --git a/config/delegates.xml.in b/config/delegates.xml.in index d93387ac1..4fc3acc3f 100644 --- a/config/delegates.xml.in +++ b/config/delegates.xml.in @@ -89,8 +89,8 @@ - - + +