gbranden pushed a commit to branch master
in repository groff.
commit aabb9a5b704f24f3ee847e003023d2f950b59b77
Author: G. Branden Robinson <[email protected]>
AuthorDate: Sun Oct 11 14:26:33 2026 -0500
ChangeLog{.124,}: Migrate 1.24.2 entries.
These fixes properly belong to the 1.24.2 ChangeLog, even if 2 of the 3
bugfixes saw minor corrections post that release. See the bug logs for
details.
https://savannah.gnu.org/bugs/?68688
https://savannah.gnu.org/bugs/?68689
---
ChangeLog | 59 -----------------------------------------------------------
ChangeLog.124 | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 58 insertions(+), 60 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 18334679b..2d59f5964 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,62 +1,3 @@
-2026-09-23 G. Branden Robinson <[email protected]>
-
- * src/preproc/html/pre-html.cpp (imageList::createImage): Fix
- command injection vulnerability by rejecting shell-significant
- syntax characters in raster image file names.
-
- Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem
- appears to date back to commit a0fae9edb7, 2001-01-07, the
- initial check-in of the pre-grohtml preprocessor, which first
- shipped in groff 1.17. Thanks to Pavol Sloboda for the report
- and a reproducer.
-
-2026-09-23 G. Branden Robinson <[email protected]>
-
- * src/roff/troff/input.cpp (do_suppress): Reject `\O5` output
- suppression escape sequence if it contains shell-unsafe
- characters in the file name portion of its argument, to advise
- user of limitation of pre-grohtml(1) preprocessor.
-
- Fixes <https://savannah.gnu.org/bugs/?68688> (1/2). While
- blindly passing shell-unsafe characters via the `\O5` escape
- sequence is not _itself_ an avenue for command injection, the
- only _consumer_ of such escape sequences is the pre-grohtml
- preprocessor (which is vulnerable), so performing strict input
- validation here makes sense.
-
-2026-09-28 G. Branden Robinson <[email protected]>
-
- [pre-grohtml]: Regression-test Savannah #68688.
-
- * src/preproc/html/tests/does-not-defeat-safer-mode.sh: Do it.
- * src/preproc/html/html.am (pre_grohtml_TESTS): Run test.
- (TESTS, EXTRA_DIST): Wire `pre_grohtml_TESTS` into Automake test
- harness and ship this and any future pre-grohtml test scripts.
-
-2026-09-23 Deri James <[email protected]>
-
- [pdfmom]: Fix Savannah #68687.
-
- * src/utils/pdfmom/pdfmom.pl: Pass arguments from command line
- through `Clean` subroutine.
- (Clean): New subroutinze sanitizes command-line arguments to
- defeat command injection vulnerability.
-
- Fixes <https://savannah.gnu.org/bugs/?68687>. Problem appears
- to date back to commit f2a501fff5, 2012-08-31, the initial
- check-in of the pdfmom command script, which first shipped in
- groff 1.22.1. Thanks to Pavol Sloboda for the report and a
- reproducer.
-
-2026-09-28 G. Branden Robinson <[email protected]>
-
- [pdfmom]: Regression-test Savannah #68687.
-
- * src/utils/pdfmom/tests/sanitizes-arguments.sh: Do it.
- * src/utils/pdfmom/pdfmom.am (pdfmom_TESTS): Run test.
- (TESTS, EXTRA_DIST): Wire `pdfmom_TESTS` into Automake test
- harness and ship this and any future pdfmom test scripts.
-
2026-08-06 Bruno Haible <[email protected]>
* doc/doc.am ($(DOC_LINE_LAYOUT_EPS)): Remove the %%CreationDate
diff --git a/ChangeLog.124 b/ChangeLog.124
index 0c05d0fe0..71bdc3149 100644
--- a/ChangeLog.124
+++ b/ChangeLog.124
@@ -1,7 +1,64 @@
Version 1.24.2 released 2026-09-28
==================================
-[bug fixes for Savannah #68687, #68688, #68689 not yet merged on master]
+2026-09-23 G. Branden Robinson <[email protected]>
+
+ * src/preproc/html/pre-html.cpp (imageList::createImage): Fix
+ command injection vulnerability by rejecting shell-significant
+ syntax characters in raster image file names.
+
+ Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem
+ appears to date back to commit a0fae9edb7, 2001-01-07, the
+ initial check-in of the pre-grohtml preprocessor, which first
+ shipped in groff 1.17. Thanks to Pavol Sloboda for the report
+ and a reproducer.
+
+2026-09-23 G. Branden Robinson <[email protected]>
+
+ * src/roff/troff/input.cpp (do_suppress): Reject `\O5` output
+ suppression escape sequence if it contains shell-unsafe
+ characters in the file name portion of its argument, to advise
+ user of limitation of pre-grohtml(1) preprocessor.
+
+ Fixes <https://savannah.gnu.org/bugs/?68688> (1/2). While
+ blindly passing shell-unsafe characters via the `\O5` escape
+ sequence is not _itself_ an avenue for command injection, the
+ only _consumer_ of such escape sequences is the pre-grohtml
+ preprocessor (which is vulnerable), so performing strict input
+ validation here makes sense.
+
+2026-09-28 G. Branden Robinson <[email protected]>
+
+ [pre-grohtml]: Regression-test Savannah #68688.
+
+ * src/preproc/html/tests/does-not-defeat-safer-mode.sh: Do it.
+ * src/preproc/html/html.am (pre_grohtml_TESTS): Run test.
+ (TESTS, EXTRA_DIST): Wire `pre_grohtml_TESTS` into Automake test
+ harness and ship this and any future pre-grohtml test scripts.
+
+2026-09-23 Deri James <[email protected]>
+
+ [pdfmom]: Fix Savannah #68687.
+
+ * src/utils/pdfmom/pdfmom.pl: Pass arguments from command line
+ through `Clean` subroutine.
+ (Clean): New subroutinze sanitizes command-line arguments to
+ defeat command injection vulnerability.
+
+ Fixes <https://savannah.gnu.org/bugs/?68687>. Problem appears
+ to date back to commit f2a501fff5, 2012-08-31, the initial
+ check-in of the pdfmom command script, which first shipped in
+ groff 1.22.1. Thanks to Pavol Sloboda for the report and a
+ reproducer.
+
+2026-09-28 G. Branden Robinson <[email protected]>
+
+ [pdfmom]: Regression-test Savannah #68687.
+
+ * src/utils/pdfmom/tests/sanitizes-arguments.sh: Do it.
+ * src/utils/pdfmom/pdfmom.am (pdfmom_TESTS): Run test.
+ (TESTS, EXTRA_DIST): Wire `pdfmom_TESTS` into Automake test
+ harness and ship this and any future pdfmom test scripts.
Version 1.24.1 released 2026-03-14
==================================
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
