rmagick 7.1.4 → 7.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5c3f56f5b39c2f505f37875134e7af86904393036c531e6074f2796939f204c
-  data.tar.gz: 3bf4833ad9aa56f93e1d2426bd6c72b95c54e0c2c8dcd2c4248f62635bf7606e
+  metadata.gz: b0652dce5387352787bef0e59b1548a5c36b6f80a66b8ec9ab4c7f03828f5d0f
+  data.tar.gz: 6d286a5f5649816c5cf1f821969783fb6ebef9f5a81b4502719f498869f926f9
 SHA512:
-  metadata.gz: ff12f7c040309d906c8ba517cc4a10c472019c0b99d718f470f24b804021dd2a431b4fd876a59e0c18eb8acbb8edac0eb2e15b68826a8ba11779e62e5894a202
-  data.tar.gz: 06dfb967d7de90cdc6791dcbb2e9fc6b5ece9ccef12e53b3588ea96c09960e28cd938b9f982654ccd95c6f765cd65a1fae179e3c230d14f4548511d851f36de8
+  metadata.gz: 4ab4ce5e26eed8275df1cdc1130da0c5bb717fdca8f472c89b26a5aea37579a17e9bc4d9a34aa0c272a4b26242c03c2acbd9b690484b503ddfdf7220fc075cf2
+  data.tar.gz: c5ee3eddbed492432ae70f34680a3d9a768fec6ba33bd3c97eca98262f29fd81d2037f56f8e8018ee0afc0a43896ad7186ee5f779da559f9d14ccc05aa28c3cb

data/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project are documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## RMagick 7.1.5
+
+> [!IMPORTANT]
+> More strings that ImageMagick would read from a file now raise `ArgumentError`.
+>
+> `Montage#title=` and the `caption`, `comment` and `label` options, set through `Info#caption=`, `#comment=`, `#label=` or `Info#[]=`, now reject a value whose first non-blank character is `@`, as `Image#polaroid` has done since 7.1.4. ImageMagick read the file it named and put its contents into the montage or into the metadata of the image being read. These checks and the one in `Image#polaroid` also reject a `%[fx:@...]`, `%[hex:@...]` or `%[pixel:@...]` escape, which ImageMagick 7 reads from the named file as well, and their message now says the value "must not name a file with '@'".
+>
+> `Image#profile!` now accepts only the profile formats of ImageMagick's META coder (8BIM, APP1, EXIF, ICC, ICM, IPTC, XMP and their variants) and raises `ArgumentError` for any other name. It decoded the profile with the coder of whatever name it was given, so a profile named `msl` copied from an uploaded image ran as an MSL script.
+
+Breaking Changes
+
+* Accept only META profile formats in Image#profile! instead of decoding the profile with the coder of that name (#1873)
+* Reject a Montage#title beginning with '@' instead of reading that file (#1874)
+* Reject an Info#caption, #comment or #label value beginning with '@' instead of reading that file (#1875)
+* Also reject %[fx:@...], %[hex:@...] and %[pixel:@...] escapes where a value beginning with '@' is rejected (#1876)
+
+Bug Fixes
+
+* Fix stack buffer overflow in Image#inspect with a long format name (#1877)
+
 ## RMagick 7.1.4
 
 > [!IMPORTANT]

data/ext/RMagick/rmagick.h

@@ -1159,6 +1159,7 @@ extern VALUE  rm_no_freeze(VALUE) ATTRIBUTE_NORETURN;
 extern int    rm_strcasecmp(const char *, const char *);
 extern int    rm_strncasecmp(const char *, const char *, size_t);
 extern size_t rm_strnlen_s(const char *, size_t);
+extern bool   rm_has_file_reference(const char *);
 extern void   rm_check_ary_len(VALUE, long);
 extern VALUE  rm_check_ary_type(VALUE ary);
 extern Image *rm_check_destroyed(VALUE);

data/ext/RMagick/rmimage.cpp

@@ -2900,6 +2900,35 @@ Image_color_histogram(VALUE self)
 }
 
 
+/**
+ * Return true if the format is one handled by ImageMagick's META coder. set_profile
+ * decodes the profile with the coder of that name, so any other format would run an
+ * unrelated decoder (MSL, MVG, SVG, ...) on the profile bytes.
+ *
+ * No Ruby usage (internal function)
+ *
+ * @param format the format name
+ * @return true if the format is a META profile format, otherwise false
+ */
+static bool
+is_meta_profile_format(const char *format)
+{
+    static const char *meta_formats[] = {
+        "8BIM", "8BIMTEXT", "8BIMWTEXT", "APP1", "APP1JPEG", "EXIF",
+        "ICC", "ICM", "IPTC", "IPTCTEXT", "IPTCWTEXT", "XMP"
+    };
+
+    for (size_t i = 0; i < sizeof(meta_formats) / sizeof(meta_formats[0]); i++)
+    {
+        if (rm_strcasecmp(format, meta_formats[i]) == 0)
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+
 /**
  * Store all the profiles in the profile in the target image. Called from
  * Image_color_profile_eq and Image_iptc_profile_eq.
@@ -2927,10 +2956,17 @@ set_profile(VALUE self, const char *name, VALUE profile)
 
     profile_blob = rm_str2cstr(&profile, &profile_length);
 
+    // Reject the name before GetMagickInfo(), which loads the coder module it names
+    // ("*" loads all of them).
+    if (!is_meta_profile_format(name))
+    {
+        rb_raise(rb_eArgError, "unknown name: %s", name);
+    }
+
     exception = AcquireExceptionInfo();
     m = GetMagickInfo(name, exception);
     CHECK_EXCEPTION();
-    if (!m)
+    if (!m || !is_meta_profile_format(m->name))
     {
         DestroyExceptionInfo(exception);
         rb_raise(rb_eArgError, "unknown name: %s", name);
@@ -8305,6 +8341,42 @@ Image_import_pixels(int argc, VALUE *argv, VALUE self)
 }
 
 
+/**
+ * Append formatted text to the buffer used by build_inspect_string.
+ *
+ * No Ruby usage (internal function)
+ *
+ * Notes:
+ *   - vsnprintf returns the length of the untruncated text, so only the bytes
+ *     that actually fit are counted. The returned offset never exceeds len-1,
+ *     so once the buffer is full later appends add nothing to it.
+ *
+ * @param buffer buffer for the output string
+ * @param len length of buffer
+ * @param x # bytes used in buffer, at most len-1
+ * @param format printf-style format string
+ * @return the new # bytes used in buffer, at most len-1
+ * @see build_inspect_string
+ */
+static int
+append_inspect_string(char *buffer, size_t len, int x, const char *format, ...)
+{
+    va_list args;
+    int n;
+
+    va_start(args, format);
+    n = vsnprintf(buffer+x, len-x, format, args);
+    va_end(args);
+
+    if (n > 0)
+    {
+        x += (int)min((size_t)n, len-1-x);
+    }
+
+    return x;
+}
+
+
 /**
  * Override Object#inspect - return a string description of the image.
  *
@@ -8328,56 +8400,56 @@ build_inspect_string(Image *image, char *buffer, size_t len)
     // Print magick filename if different from current filename.
     if (*image->magick_filename != '\0' && strcmp(image->magick_filename, image->filename) != 0)
     {
-        x += snprintf(buffer+x, len-x, "%.1024s=>", image->magick_filename);
+        x = append_inspect_string(buffer, len, x, "%.1024s=>", image->magick_filename);
     }
     // Print current filename.
-    x += snprintf(buffer+x, len-x, "%.1024s", image->filename);
+    x = append_inspect_string(buffer, len, x, "%.1024s", image->filename);
     // Print scene number.
     if ((GetPreviousImageInList(image) != NULL) && (GetNextImageInList(image) != NULL) && image->scene > 0)
     {
-        x += snprintf(buffer+x, len-x, "[%" RMIuSIZE "]", image->scene);
+        x = append_inspect_string(buffer, len, x, "[%" RMIuSIZE "]", image->scene);
     }
     // Print format
-    x += snprintf(buffer+x, len-x, " %s ", image->magick);
+    x = append_inspect_string(buffer, len, x, " %s ", image->magick);
 
     // Print magick columnsXrows if different from current.
     if (image->magick_columns != 0 || image->magick_rows != 0)
     {
         if (image->magick_columns != image->columns || image->magick_rows != image->rows)
         {
-            x += snprintf(buffer+x, len-x, "%" RMIuSIZE "x%" RMIuSIZE "=>", image->magick_columns, image->magick_rows);
+            x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "x%" RMIuSIZE "=>", image->magick_columns, image->magick_rows);
         }
     }
 
-    x += snprintf(buffer+x, len-x, "%" RMIuSIZE "x%" RMIuSIZE " ", image->columns, image->rows);
+    x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "x%" RMIuSIZE " ", image->columns, image->rows);
 
     // Print current columnsXrows
     if (   image->page.width != 0 || image->page.height != 0
            || image->page.x != 0     || image->page.y != 0)
     {
-        x += snprintf(buffer+x, len-x, "%" RMIuSIZE "x%" RMIuSIZE "+%" RMIdSIZE "+%" RMIdSIZE " ",
-                      image->page.width, image->page.height,
-                      image->page.x, image->page.y);
+        x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "x%" RMIuSIZE "+%" RMIdSIZE "+%" RMIdSIZE " ",
+                                  image->page.width, image->page.height,
+                                  image->page.x, image->page.y);
     }
 
     if (image->storage_class == DirectClass)
     {
-        x += snprintf(buffer+x, len-x, "DirectClass ");
+        x = append_inspect_string(buffer, len, x, "DirectClass ");
         if (image->total_colors != 0)
         {
             if (image->total_colors >= (unsigned long)(1 << 24))
             {
-                x += snprintf(buffer+x, len-x, "%" RMIuSIZE "mc ", image->total_colors/1024/1024);
+                x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "mc ", image->total_colors/1024/1024);
             }
             else
             {
                 if (image->total_colors >= (unsigned long)(1 << 16))
                 {
-                    x += snprintf(buffer+x, len-x, "%" RMIuSIZE "kc ", image->total_colors/1024);
+                    x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "kc ", image->total_colors/1024);
                 }
                 else
                 {
-                    x += snprintf(buffer+x, len-x, "%" RMIuSIZE "c ", image->total_colors);
+                    x = append_inspect_string(buffer, len, x, "%" RMIuSIZE "c ", image->total_colors);
                 }
             }
         }
@@ -8388,39 +8460,39 @@ build_inspect_string(Image *image, char *buffer, size_t len)
         // building with GM. GM defines that field as an unsigned int.
         if (image->total_colors <= image->colors)
         {
-            x += snprintf(buffer+x, len-x, "PseudoClass %ldc ", (long) image->colors);
+            x = append_inspect_string(buffer, len, x, "PseudoClass %ldc ", (long) image->colors);
         }
         else
         {
-            x += snprintf(buffer+x, len-x, "PseudoClass %" RMIuSIZE "=>%" RMIuSIZE "c ", image->total_colors, image->colors);
+            x = append_inspect_string(buffer, len, x, "PseudoClass %" RMIuSIZE "=>%" RMIuSIZE "c ", image->total_colors, image->colors);
             if (image->error.mean_error_per_pixel != 0.0)
             {
-                x += snprintf(buffer+x, len-x, "%ld/%.6f/%.6fdb ",
-                              (long) (image->error.mean_error_per_pixel+0.5),
-                              image->error.normalized_mean_error,
-                              image->error.normalized_maximum_error);
+                x = append_inspect_string(buffer, len, x, "%ld/%.6f/%.6fdb ",
+                                          (long) (image->error.mean_error_per_pixel+0.5),
+                                          image->error.normalized_mean_error,
+                                          image->error.normalized_maximum_error);
             }
         }
     }
 
     // Print bit depth
     quantum_depth = GetImageQuantumDepth(image, MagickTrue);
-    x += snprintf(buffer+x, len-x, "%lu-bit", quantum_depth);
+    x = append_inspect_string(buffer, len, x, "%lu-bit", quantum_depth);
 
     // Print blob info if appropriate.
     if (GetBlobSize(image) != 0)
     {
         if (GetBlobSize(image) >= (1 << 24))
         {
-            x += snprintf(buffer+x, len-x, " %lumb", (unsigned long) (GetBlobSize(image)/1024/1024));
+            x = append_inspect_string(buffer, len, x, " %lumb", (unsigned long) (GetBlobSize(image)/1024/1024));
         }
         else if (GetBlobSize(image) >= 1024)
         {
-            x += snprintf(buffer+x, len-x, " %lukb", (unsigned long) (GetBlobSize(image)/1024));
+            x = append_inspect_string(buffer, len, x, " %lukb", (unsigned long) (GetBlobSize(image)/1024));
         }
         else
         {
-            x += snprintf(buffer+x, len-x, " %lub", (unsigned long) GetBlobSize(image));
+            x = append_inspect_string(buffer, len, x, " %lub", (unsigned long) GetBlobSize(image));
         }
     }
 
@@ -8440,7 +8512,7 @@ build_inspect_string(Image *image, char *buffer, size_t len)
         }
     }
 
-    assert(x < (int)(len-1));
+    assert(x < (int)len);
     buffer[x] = '\0';
 
     return;
@@ -10868,8 +10940,9 @@ Image_pixel_interpolation_method_eq(VALUE self, VALUE method)
 
 /**
  * Produce an image that looks like a Polaroid instant picture. If the image has a "Caption"
- * property, the value is used as a caption. A caption whose first non-blank character is '@'
- * is rejected because ImageMagick reads the caption from the file it names.
+ * property, the value is used as a caption. A caption whose first non-blank character is '@',
+ * or that contains a %[fx:@...], %[hex:@...] or %[pixel:@...] escape, is rejected because
+ * ImageMagick reads the file it names.
  *
  * The following annotate attributes control the label rendering:
  * align, decorate, density, encoding, fill, font, font_family, font_stretch, font_style,
@@ -10890,7 +10963,7 @@ Image_pixel_interpolation_method_eq(VALUE self, VALUE method)
  *   @yieldparam opt [Magick::Image::PolaroidOptions]
  *
  * @return [Magick::Image] a new image
- * @raise [ArgumentError] if the "Caption" property begins with '@'
+ * @raise [ArgumentError] if the "Caption" property names a file with '@'
  */
 VALUE
 Image_polaroid(int argc, VALUE *argv, VALUE self)
@@ -10928,20 +11001,11 @@ Image_polaroid(int argc, VALUE *argv, VALUE self)
 #else
     caption = GetImageProperty(clone, "Caption");
 #endif
-    if (caption)
+    if (caption && rm_has_file_reference(caption))
     {
-        const char *p = caption;
-
-        while (isspace((int) ((unsigned char) *p)))
-        {
-            p++;
-        }
-        if (*p == '@')
-        {
-            DestroyImage(clone);
-            DestroyExceptionInfo(exception);
-            rb_raise(rb_eArgError, "the Caption property must not begin with '@'");
-        }
+        DestroyImage(clone);
+        DestroyExceptionInfo(exception);
+        rb_raise(rb_eArgError, "the Caption property must not name a file with '@'");
     }
 
 #if defined(IMAGEMAGICK_7)
@@ -11045,11 +11109,13 @@ Image_preview(VALUE self, VALUE preview)
 
 /**
  * Set the image profile. If "profile" is nil, deletes the profile. Otherwise "profile" must be a
- * string containing the specified profile.
+ * string containing the specified profile, and "name" must be one of the profile formats of
+ * ImageMagick's META coder (8BIM, APP1, EXIF, ICC, ICM, IPTC, XMP and their variants).
  *
  * @param name [String, nil] The profile name, or "*" to represent all the profiles in the image.
  * @param profile [String] The profile value, or nil to cause the profile to be removed.
  * @return [Magick::Image] self
+ * @raise [ArgumentError] if "profile" is not nil and "name" is not a META profile format
  */
 VALUE
 Image_profile_bang(VALUE self, VALUE name, VALUE profile)

data/ext/RMagick/rminfo.cpp

@@ -47,6 +47,25 @@ get_option(VALUE self, const char *key)
     return Qnil;
 }
 
+/**
+ * Raise ArgumentError if the option is one that ReadImage runs through
+ * InterpretImageProperties() and the value would make it read the file it names.
+ *
+ * No Ruby usage (internal function)
+ *
+ * @param key the option key
+ * @param value the value
+ */
+static void
+check_interpreted_option(const char *key, const char *value)
+{
+    if ((rm_strcasecmp(key, "caption") == 0 || rm_strcasecmp(key, "comment") == 0 || rm_strcasecmp(key, "label") == 0)
+        && rm_has_file_reference(value))
+    {
+        rb_raise(rb_eArgError, "the %s option must not name a file with '@'", key);
+    }
+}
+
 /**
  * Set the specified option to this value. If the value is nil just unset any
  * current value.
@@ -74,6 +93,7 @@ set_option(VALUE self, const char *key, VALUE string)
         char *value;
 
         value = StringValueCStr(string);
+        check_interpreted_option(key, value);
         SetImageOption(info, key, value);
     }
     return string;
@@ -306,6 +326,9 @@ Info_aref(int argc, VALUE *argv, VALUE self)
  *
  * - Essentially the same function as {Info#define} but paired with {Info#[]}
  * - If the value is nil it is equivalent to {Info#undefine}.
+ * - A value whose first non-blank character is '@', or that contains a %[fx:@...], %[hex:@...] or
+ *   %[pixel:@...] escape, is rejected for the "caption", "comment" and "label" keys because
+ *   ImageMagick reads the file it names.
  *
  * @overload []=(format, key)
  *   @param format [String] An image format name such as "ps" or "tiff".
@@ -315,6 +338,7 @@ Info_aref(int argc, VALUE *argv, VALUE self)
  *   @param key [String] A string that identifies the option.
  *
  * @return [Magick::Image::Info] self
+ * @raise [ArgumentError] if the "caption", "comment" or "label" value names a file with '@'
  * @see #[]
  * @see #define
  * @see #undefine
@@ -368,6 +392,7 @@ Info_aset(int argc, VALUE *argv, VALUE self)
         /* Allow any argument that supports to_s */
         value = rb_String(value);
         value_p = StringValueCStr(value);
+        check_interpreted_option(ckey, value_p);
 
         okay = SetImageOption(info, ckey, value_p);
         if (!okay)
@@ -552,10 +577,13 @@ Info_caption(VALUE self)
 
 
 /**
- * Assigns a caption to an image.
+ * Assigns a caption to an image. A caption whose first non-blank character is '@', or that
+ * contains a %[fx:@...], %[hex:@...] or %[pixel:@...] escape, is rejected because ImageMagick
+ * reads the file it names.
  *
  * @param caption [String] the caption
  * @return [String] the given value
+ * @raise [ArgumentError] if the caption names a file with '@'
  */
 VALUE
 Info_caption_eq(VALUE self, VALUE caption)
@@ -637,10 +665,13 @@ VALUE Info_comment(VALUE self)
 }
 
 /**
- * Set the comment
+ * Set the comment. A comment whose first non-blank character is '@', or that contains a
+ * %[fx:@...], %[hex:@...] or %[pixel:@...] escape, is rejected because ImageMagick reads the
+ * file it names.
  *
  * @param string [String] the comment
  * @return [String] the given comment
+ * @raise [ArgumentError] if the comment names a file with '@'
  */
 VALUE Info_comment_eq(VALUE self, VALUE string)
 {
@@ -1529,10 +1560,13 @@ VALUE Info_label(VALUE self)
 }
 
 /**
- * Set the label.
+ * Set the label. A label whose first non-blank character is '@', or that contains a
+ * %[fx:@...], %[hex:@...] or %[pixel:@...] escape, is rejected because ImageMagick reads the
+ * file it names.
  *
  * @param string [String] the label
  * @return [String] the given label
+ * @raise [ArgumentError] if the label names a file with '@'
  */
 VALUE Info_label_eq(VALUE self, VALUE string)
 {

data/ext/RMagick/rmmontage.cpp

@@ -442,18 +442,29 @@ Montage_tile_eq(VALUE self, VALUE tile_arg)
 
 
 /**
- * Set title value.
+ * Set title value. A title whose first non-blank character is '@', or that contains a
+ * %[fx:@...], %[hex:@...] or %[pixel:@...] escape, is rejected because ImageMagick reads the
+ * file it names.
  *
  * @param title [String] the title
  * @return [String] the given title
+ * @raise [ArgumentError] if the title names a file with '@'
  */
 VALUE
 Montage_title_eq(VALUE self, VALUE title)
 {
     Montage *montage;
+    const char *title_cstr;
 
     TypedData_Get_Struct(self, Montage, &rm_montage_data_type, montage);
-    magick_clone_string(&montage->info->title, StringValueCStr(title));
+    title_cstr = StringValueCStr(title);
+
+    if (rm_has_file_reference(title_cstr))
+    {
+        rb_raise(rb_eArgError, "the title must not name a file with '@'");
+    }
+
+    magick_clone_string(&montage->info->title, title_cstr);
     return title;
 }
 

data/ext/RMagick/rmutil.cpp

@@ -221,6 +221,50 @@ rm_strnlen_s(const char *str, size_t strsz)
 }
 
 
+/**
+ * Return true if InterpretImageProperties() would read a file the string names, that is, if its
+ * first non-blank character is '@', or if it contains a %[fx:...], %[hex:...] or %[pixel:...]
+ * escape whose expression begins with '@'.
+ *
+ * ImageMagick 7 reads such an expression from the file it names, with no blank skipped before
+ * the '@'. It also interprets a %[...] inside an fx expression, even after "%%" since '%' is the
+ * modulo operator there, so every "%[" in the string is checked. The prefixes are compared with
+ * LocaleNCompare() as ImageMagick does. ImageMagick 6 does not read these expressions, but the
+ * check is the same for both.
+ *
+ * No Ruby usage (internal function)
+ *
+ * @param str the string
+ * @return true if the string names a file to read, otherwise false
+ */
+bool
+rm_has_file_reference(const char *str)
+{
+    const char *p;
+
+    p = str;
+    while (isspace((int) ((unsigned char) *p)))
+    {
+        p++;
+    }
+    if (*p == '@')
+    {
+        return true;
+    }
+
+    for (p = strstr(str, "%["); p != NULL; p = strstr(p + 2, "%["))
+    {
+        if (LocaleNCompare(p + 2, "fx:@", 4) == 0
+            || LocaleNCompare(p + 2, "hex:@", 5) == 0
+            || LocaleNCompare(p + 2, "pixel:@", 7) == 0)
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+
 /**
  * Raise exception if array too short.
  *

data/lib/rmagick/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Magick
-  VERSION = '7.1.4'
+  VERSION = '7.1.5'
   MIN_RUBY_VERSION = '3.2.0'
   MIN_IM6_VERSION = '6.9.0'
   MIN_IM7_VERSION = '7.1.0'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rmagick
 version: !ruby/object:Gem::Version
-  version: 7.1.4
+  version: 7.1.5
 platform: ruby
 authors:
 - Tim Hunter
@@ -143,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick 6.9.0+ (for ImageMagick 6) or 7.1.0+ (for ImageMagick 7)
-rubygems_version: 4.0.18
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ruby binding to ImageMagick
 test_files: []