gbranden pushed a commit to branch master
in repository groff.
commit cbed1f24d169267a8981afee7b44692b8d7ce92d
Author: G. Branden Robinson <[email protected]>
AuthorDate: Wed Sep 23 12:41:47 2026 -0500
[grohtml]: Fix Savannah #68688 (2/2).
* src/preproc/html/pre-html.cpp (imageList::createImage): Fix command
injection vulnerability by rejecting shell-significant syntax
characters in raster image file names.
Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem appears
to date back to commit a0fae9edb7, 2001-01-07, the initial check-in of
the pre-grohtml preprocessor, which first shipped in groff 1.17.
Thanks to Pavol Sloboda for the report and a reproducer.
---
ChangeLog | 12 ++++++++++++
src/preproc/html/pre-html.cpp | 17 +++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index f2693c656..18334679b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2026-09-23 G. Branden Robinson <[email protected]>
+
+ * src/preproc/html/pre-html.cpp (imageList::createImage): Fix
+ command injection vulnerability by rejecting shell-significant
+ syntax characters in raster image file names.
+
+ Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem
+ appears to date back to commit a0fae9edb7, 2001-01-07, the
+ initial check-in of the pre-grohtml preprocessor, which first
+ shipped in groff 1.17. Thanks to Pavol Sloboda for the report
+ and a reproducer.
+
2026-09-23 G. Branden Robinson <[email protected]>
* src/roff/troff/input.cpp (do_suppress): Reject `\O5` output
diff --git a/src/preproc/html/pre-html.cpp b/src/preproc/html/pre-html.cpp
index d55f29c26..79934db0d 100644
--- a/src/preproc/html/pre-html.cpp
+++ b/src/preproc/html/pre-html.cpp
@@ -1061,6 +1061,23 @@ void imageList::createImage(imageItem *i)
" of page %d\n", program_name, i->pageNo);
fflush(stderr);
}
+ for (const char *p = i->imageName; *p != '\0'; p++) {
+ if (strchr(";&|*?~<>^()[]{}'$`\"\\#", *p) != 0 /* nullptr */) {
+ // XXX: This branch should not normally be reachable; troff
+ // should have already discarded any "O5" escape sequence
+ // containing these injection-suggestive characters. The only
+ // way to get here should be to somehow intercept and alter
+ // the data stream in the pipeline constructed by
+ // `char_buffer::run_output_filter()`. Since that's a
+ // relatively tall order, we should be able to get by here
+ // with assert(3), retaining `fatal()` for `NDEBUG` builds.
+ char q = '\'';
+ if ('\'' == *p)
+ q = '\"';
+ fatal("unsafe shell character %1%2%3"
+ " in raster image file name", q, *p, q);
+ }
+ }
const char *s = make_string("pamcut%s %d %d %d %d < %s "
"| pnmcrop%s " PNMTOOLS_QUIET
"| pnmtopng%s " PNMTOOLS_QUIET " %s"
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
