Commit 9e789499e for imagemagick.org
commit 9e789499e67dbf5c4ee9fe1b72690738c799ec73
Author: Cristy <urban-warrior@imagemagick.org>
Date: Sat Sep 12 09:11:55 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx
diff --git a/MagickWand/script-token.c b/MagickWand/script-token.c
index a92808320..0fb3ff4a9 100644
--- a/MagickWand/script-token.c
+++ b/MagickWand/script-token.c
@@ -223,15 +223,20 @@ WandExport ScriptTokenInfo *AcquireScriptTokenInfo(const char *filename)
token_info->opened=MagickFalse;
}
else if (LocaleNCompare(filename,"fd:",3) == 0 ) {
- token_info->stream=fdopen(StringToLong(filename+3),"r");
+ token_info->stream=fdopen(StringToLong(filename+3),"rb");
token_info->opened=MagickFalse;
}
else {
- token_info->stream=fopen_utf8(filename, "r");
+ int fd = open(filename,O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+ if (fd != -1)
+ token_info->stream=fdopen(fd,"r");
if (token_info->stream != (FILE *) NULL)
token_info->opened=MagickTrue;
+ else
+ fd=close_utf8(fd)-1;
}
- if ( token_info->stream != (FILE *) NULL )
+ if ((token_info->stream != (FILE *) NULL) &&
+ (IsPathAuthorized(ReadPolicyRights,filename) != MagickFalse))
token_info->opened=MagickTrue;
else
{