Commit 78378cd62 for imagemagick.org
commit 78378cd623468760bee82a5930cb3011725916f8
Author: Dirk Lemstra <dirk@lemstra.org>
Date: Thu Aug 27 22:16:47 2026 +0200
Escape the labels to prevent code injection (GHSA-5rg6-j44q-q892)
diff --git a/coders/ps.c b/coders/ps.c
index 94befbc4e..02a90746c 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -1854,8 +1854,12 @@ static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image,
{
for (i=0; labels[i] != (char *) NULL; i++)
{
- (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",
- labels[i]);
+ char
+ *escape;
+
+ escape=EscapeParenthesis(labels[i]);
+ (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",escape);
+ escape=DestroyString(escape);
(void) WriteBlobString(image,buffer);
labels[i]=DestroyString(labels[i]);
}
diff --git a/coders/ps2.c b/coders/ps2.c
index 984fd528d..2d03d72d8 100644
--- a/coders/ps2.c
+++ b/coders/ps2.c
@@ -72,6 +72,7 @@
#include "MagickCore/timer-private.h"
#include "MagickCore/utility.h"
#include "coders/coders-private.h"
+#include "coders/ghostscript-private.h"
/*
Define declarations.
@@ -789,8 +790,12 @@ static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image,
{
for (i=0; labels[i] != (char *) NULL; i++)
{
- (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",
- labels[i]);
+ char
+ *escape;
+
+ escape=EscapeParenthesis(labels[i]);
+ (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",escape);
+ escape=DestroyString(escape);
(void) WriteBlobString(image,buffer);
labels[i]=DestroyString(labels[i]);
}
diff --git a/coders/ps3.c b/coders/ps3.c
index ad1aa0173..acc814f6e 100644
--- a/coders/ps3.c
+++ b/coders/ps3.c
@@ -76,6 +76,7 @@
#include "MagickCore/token.h"
#include "MagickCore/utility.h"
#include "coders/coders-private.h"
+#include "coders/ghostscript-private.h"
/*
Define declarations.
@@ -1292,20 +1293,25 @@ static MagickBooleanType WritePS3Image(const ImageInfo *image_info,Image *image,
{
for (i=0; labels[i] != (char *) NULL; i++)
{
+ char
+ *escape;
+
+ escape=EscapeParenthesis(labels[i]);
if (compression != NoCompression)
{
- for (j=0; labels[i][j] != '\0'; j++)
- (void) WriteBlobByte(image,(unsigned char) labels[i][j]);
+ for (j=0; escape[j] != '\0'; j++)
+ (void) WriteBlobByte(image,(unsigned char) escape[j]);
(void) WriteBlobByte(image,'\n');
}
else
{
(void) WriteBlobString(image,"<~");
Ascii85Initialize(image);
- for (j=0; labels[i][j] != '\0'; j++)
- Ascii85Encode(image,(unsigned char) labels[i][j]);
+ for (j=0; escape[j] != '\0'; j++)
+ Ascii85Encode(image,(unsigned char) escape[j]);
Ascii85Flush(image);
}
+ escape=DestroyString(escape);
labels[i]=DestroyString(labels[i]);
}
labels=(char **) RelinquishMagickMemory(labels);