gbranden pushed a commit to branch master
in repository groff.
commit 85e365b71ca8aef7d7e1808c42a73f72fdf1ff18
Author: Deri James <[email protected]>
AuthorDate: Wed Sep 23 17:58:44 2026 +0000
[pdfmom]: Fix Savannah #68687.
* src/utils/pdfmom/pdfmom.pl: Pass arguments from command line through
`Clean` subroutine.
(Clean): New subroutinze sanitizes command-line arguments to defeat
command injection vulnerability.
Fixes <https://savannah.gnu.org/bugs/?68687>. Problem appears to date
back to commit f2a501fff5, 2012-08-31, the initial check-in of the
pdfmom command script, which first shipped in groff 1.22.1. Thanks to
Pavol Sloboda for the report and a reproducer.
---
ChangeLog | 15 +++++++++++++++
src/utils/pdfmom/pdfmom.pl | 29 ++++++++++++++++++++---------
2 files changed, 35 insertions(+), 9 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 58f7d1ce9..2f6d16a52 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,18 @@
+2026-09-23 Deri James <[email protected]>
+
+ [pdfmom]: Fix Savannah #68687.
+
+ * src/utils/pdfmom/pdfmom.pl: Pass arguments from command line
+ through `Clean` subroutine.
+ (Clean): New subroutinze sanitizes command-line arguments to
+ defeat command injection vulnerability.
+
+ Fixes <https://savannah.gnu.org/bugs/?68687>. Problem appears
+ to date back to commit f2a501fff5, 2012-08-31, the initial
+ check-in of the pdfmom command script, which first shipped in
+ groff 1.22.1. Thanks to Pavol Sloboda for the report and a
+ reproducer.
+
2026-09-28 G. Branden Robinson <[email protected]>
[pdfmom]: Regression-test Savannah #68687.
diff --git a/src/utils/pdfmom/pdfmom.pl b/src/utils/pdfmom/pdfmom.pl
index afecc98e5..34964e508 100644
--- a/src/utils/pdfmom/pdfmom.pl
+++ b/src/utils/pdfmom/pdfmom.pl
@@ -79,9 +79,20 @@ sub autopsy
return $finding;
}
-while (my $c=shift)
+sub Clean
+{
+ my $c=shift;
+
+ if (defined($c))
+ {
+ $c=~s/'/'\\''/g;
+ }
+
+ return $c;
+}
+
+while (my $c=Clean(shift))
{
- $c=~s/(?<!\\)"/\\"/g;
if (substr($c,0,2) eq '-T')
{
@@ -91,7 +102,7 @@ while (my $c=shift)
}
else
{
- $dev=shift;
+ $dev=Clean(shift);
}
next;
}
@@ -99,12 +110,12 @@ while (my $c=shift)
{
if (length($c) > 2)
{
- $preconv.=" $c";
+ $preconv.=" '$c'";
}
else
{
- $preconv.=" $c";
- $preconv.=shift;
+ $preconv.=" '$c";
+ $preconv.=Clean(shift)."'";
}
next;
}
@@ -149,8 +160,8 @@ while (my $c=shift)
{
if (length($c) > 1)
{
- push(@cmd,"\"$c\"");
- push(@cmd,"'".(shift)."'") if length($c)==2 and
index('dDfFIKLmMnoPrwW',substr($c,-1)) >= 0;
+ push(@cmd,"'$c'");
+ push(@cmd,"'".Clean(shift)."'") if length($c)==2 and
index('dDfFIKLmMnoPrwW',substr($c,-1)) >= 0;
}
else
{
@@ -164,7 +175,7 @@ while (my $c=shift)
{
# Got a filename?
- push(@cmd,"\"$c\"");
+ push(@cmd,"'$c'");
$readstdin=0 if $readstdin == 1;
}
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
