Update of bug #68768 (group groff):
Status: Duplicate => Fixed
Privacy: Private => Public
Open/Closed: Open => Closed
Planned Release: None => 1.25.0
_______________________________________________________
Follow-up Comment #3:
This defect is now fixed on _groff_'s "master" branch.
commit cbed1f24d169267a8981afee7b44692b8d7ce92d
Author: G. Branden Robinson <[email protected]>
AuthorDate: Wed Sep 23 12:41:47 2026 -0500
Commit: G. Branden Robinson <[email protected]>
CommitDate: Sun Oct 11 13:43:31 2026 -0500
[grohtml]: Fix Savannah #68688 (2/2).
* src/preproc/html/pre-html.cpp (imageList::createImage): Fix command
injection vulnerability by rejecting shell-significant syntax
characters in raster image file names.
Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem appears
to date back to commit a0fae9edb7, 2001-01-07, the initial check-in of
the pre-grohtml preprocessor, which first shipped in groff 1.17.
Thanks to Pavol Sloboda for the report and a reproducer.
diff --git a/src/preproc/html/pre-html.cpp b/src/preproc/html/pre-html.cpp
index d55f29c26..79934db0d 100644
--- a/src/preproc/html/pre-html.cpp
+++ b/src/preproc/html/pre-html.cpp
@@ -1061,6 +1061,23 @@ void imageList::createImage(imageItem *i)
" of page %d\n", program_name, i->pageNo);
fflush(stderr);
}
+ for (const char *p = i->imageName; *p != '\0'; p++) {
+ if (strchr(";&|*?~<>^()[]{}'$`\"\\#", *p) != 0 /* nullptr */) {
+ // XXX: This branch should not normally be reachable; troff
+ // should have already discarded any "O5" escape sequence
+ // containing these injection-suggestive characters. The only
+ // way to get here should be to somehow intercept and alter
+ // the data stream in the pipeline constructed by
+ // `char_buffer::run_output_filter()`. Since that's a
+ // relatively tall order, we should be able to get by here
+ // with assert(3), retaining `fatal()` for `NDEBUG` builds.
+ char q = '\'';
+ if ('\'' == *p)
+ q = '\"';
+ fatal("unsafe shell character %1%2%3"
+ " in raster image file name", q, *p, q);
+ }
+ }
const char *s = make_string("pamcut%s %d %d %d %d < %s "
"| pnmcrop%s " PNMTOOLS_QUIET
"| pnmtopng%s " PNMTOOLS_QUIET " %s"
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68768>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
