gbranden pushed a commit to branch master
in repository groff.
commit 08a0aa4a05ef55d3a8f008c7ce09d7eb76eff7cf
Author: G. Branden Robinson <[email protected]>
AuthorDate: Tue Sep 22 22:33:02 2026 -0500
[mm]: Fix Savannah #68689.
* contrib/mm/mmroff.pl: In main loop, drop use of `eval` in favor of a
simpler hash assignment, preventing a shell command injection
vulnerability in mmroff(1) when a malicious input file inserts a
specially crafted comment line into the standard output or error
streams of the first groff(1) pass this command performs.
Problem appears to date back to commit e092fba451, 2000-02-06, the
initial check-in of the "mmroff.pl" script, which first shipped in groff
1.16. Thanks to Pavol Sloboda for the report and a reproducer, and to
Ingo Schwarze for help preparing a fix.
---
contrib/mm/ChangeLog | 15 +++++++++++++++
contrib/mm/mmroff.pl | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/contrib/mm/ChangeLog b/contrib/mm/ChangeLog
index 59df6116d..bd25c0d40 100644
--- a/contrib/mm/ChangeLog
+++ b/contrib/mm/ChangeLog
@@ -1,3 +1,18 @@
+2026-09-22 G. Branden Robinson <[email protected]>
+
+ Fix Savannah #68689.
+
+ * mmroff.pl: In main loop, drop use of `eval` in favor of a
+ simpler hash assignment, preventing a shell command injection
+ vulnerability in mmroff(1) when a malicious input file inserts a
+ specially crafted comment line into the standard output or error
+ streams of the first groff(1) pass this command performs.
+
+ Problem appears to date back to commit e092fba451, 2000-02-06,
+ the initial check-in of the "mmroff.pl" script, which first
+ shipped in groff 1.16. Thanks to Pavol Sloboda for the report
+ and a reproducer, and to Ingo Schwarze for help preparing a fix.
+
2026-09-22 G. Branden Robinson <[email protected]>
Regression-test Savannah #68689.
diff --git a/contrib/mm/mmroff.pl b/contrib/mm/mmroff.pl
index 93f253c1d..8494e23b1 100644
--- a/contrib/mm/mmroff.pl
+++ b/contrib/mm/mmroff.pl
@@ -132,7 +132,7 @@ while(<MACRO>) {
next;
}
if (m#^\.\\" PIC (\w+)\s+(\S+)#) {
- eval "\$cur{'$1'} = '$2'";
+ $cur{"$1"} = '$2';
next;
}
s#\\ \\ $##;
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
