Commit 43bc96e5b for imagemagick.org

commit 43bc96e5b7489125ef92a99ad06a0e19862326df
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Thu Nov 12 09:29:12 2026 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6r6f-x5h8-fw8h

diff --git a/MagickCore/image.c b/MagickCore/image.c
index 991955e27..de2f9b744 100644
--- a/MagickCore/image.c
+++ b/MagickCore/image.c
@@ -82,6 +82,7 @@
 #include "MagickCore/option.h"
 #include "MagickCore/paint.h"
 #include "MagickCore/pixel-accessor.h"
+#include "MagickCore/policy.h"
 #include "MagickCore/profile.h"
 #include "MagickCore/property.h"
 #include "MagickCore/quantize.h"
@@ -1697,45 +1698,6 @@ static inline MagickBooleanType IsValidFormatSpecifier(const char *start,
   return(MagickFalse);
 }

-static void SanitizeFilenameProperty(const char *source,char *destination,
-  const size_t destination_size)
-{
-  char
-    *p;
-
-  const char
-    *q;
-
-  if (source == (const char *) NULL)
-    {
-      if (destination_size > 0)
-        destination[0]='\0';
-      return;
-    }
-  p=destination;
-  for (q=source; *q != '\0' && (size_t) (p-destination) < (destination_size-1); q++)
-  {
-    if ((*q == '/') || (*q == '\\') || (*q == ':'))
-      *p++='_';
-    else
-      if ((*q == '.') && (*(q+1) == '.') && ((*(q+2) == '/') ||
-          (*(q+2) == '\\') || (*(q+2) == '\0')))
-        {
-          if ((size_t) (p-destination) < (destination_size-2))
-            {
-              *p++='_';
-              *p++='_';
-            }
-          else
-            *p++='_';
-          q++;
-        }
-      else
-        *p++=(*q);
-  }
-  *p='\0';
-}
-
 MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
   Image *image,const char *format,int value,char *filename,
   ExceptionInfo *exception)
@@ -1750,8 +1712,10 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,

   assert(format != (const char *) NULL);
   assert(filename != (char *) NULL);
-  literal=(char *) GetImageRegistry(StringRegistryType,"filename:literal",
-    exception);
+  literal=GetPolicyValue("system:filename:literal");
+  if (literal == (char *) NULL)
+    literal=(char *) GetImageRegistry(StringRegistryType,"filename:literal",
+      exception);
   if (IsStringTrue(literal) != MagickFalse)
     {
       if (literal != (char *) NULL)
@@ -1826,9 +1790,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
       }
     if (*cursor == '[')
       {
-        char
-          sanitized_option[MagickPathExtent];
-
         const char
           *end = strchr(cursor,']'),
           *option = (const char *) NULL;
@@ -1855,9 +1816,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
           option=GetImageOption(image_info,pattern);
         if (option == (const char *) NULL)
           continue;
-        SanitizeFilenameProperty(option,sanitized_option,
-          sizeof(sanitized_option));
-        option=sanitized_option;
         option_length=strlen(option);
         if ((p-filename+(ssize_t) option_length) >= MagickPathExtent)
           return(0);
diff --git a/config/policy-limited.xml b/config/policy-limited.xml
index 5452f647d..2cf5490ed 100644
--- a/config/policy-limited.xml
+++ b/config/policy-limited.xml
@@ -138,4 +138,7 @@
   <policy domain="system" name="max-profile-size" value="16MiB"/>
   <policy domain="system" name="max-profile-count" value="16"/>

+  <!-- Treat filenames with percent signs (%) as plain text rather than
+       formatting placeholders. -->
+  <policy domain="system" name="filename:literal" value="true"/>
 </policymap>
diff --git a/config/policy-open.xml b/config/policy-open.xml
index 0e33fdf4c..b8c9a6f4f 100644
--- a/config/policy-open.xml
+++ b/config/policy-open.xml
@@ -218,4 +218,7 @@
              rights="none"
              pattern="substitute-entities"/> -->

+  <!-- Treat filenames with percent signs (%) as plain text rather than
+       formatting placeholders. -->
+  <!-- <policy domain="system" name="filename:literal" value="true"/> -->
 </policymap>
diff --git a/config/policy-secure.xml b/config/policy-secure.xml
index b0ba40ee4..79ef597c3 100644
--- a/config/policy-secure.xml
+++ b/config/policy-secure.xml
@@ -142,4 +142,7 @@
   <policy domain="system" name="symlink"
           rights="none" pattern="follow"/>

+  <!-- Treat filenames with percent signs (%) as plain text rather than
+       formatting placeholders. -->
+  <policy domain="system" name="filename:literal" value="true"/>
 </policymap>
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index 4e7ee48f3..f5c4a00dd 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -133,4 +133,7 @@
   <policy domain="module" rights="none" pattern="{MSL,URL,VIDEO}"/>
   <policy domain="coder" rights="write" pattern="{MVG,PDF,PS,SVG,TXT,XPS}"/>

+  <!-- Treat filenames with percent signs (%) as plain text rather than
+       formatting placeholders. -->
+  <policy domain="system" name="filename:literal" value="true"/>
 </policymap>