Blame SOURCES/gegl-CVE-2021-45463.patch

dab8dc
From bfce470f0f2f37968862129d5038b35429f2909b Mon Sep 17 00:00:00 2001
dab8dc
From: =?UTF-8?q?=C3=98yvind=20Kol=C3=A5s?= <pippin@gimp.org>
dab8dc
Date: Thu, 16 Dec 2021 00:10:24 +0100
dab8dc
Subject: [PATCH] magick-load: use more robust g_spawn_async() instead of
dab8dc
 system()
dab8dc
dab8dc
This fixes issue #298 by avoiding the shell parsing being invoked at
dab8dc
all, this less brittle than any forms of escaping characters, while
dab8dc
retaining the ability to address all existing files.
dab8dc
---
dab8dc
 operations/common/magick-load.c | 12 +++++++-----
dab8dc
 1 file changed, 7 insertions(+), 5 deletions(-)
dab8dc
dab8dc
diff --git a/operations/common/magick-load.c b/operations/common/magick-load.c
dab8dc
index e2055b2e9..595169115 100644
dab8dc
--- a/operations/common/magick-load.c
dab8dc
+++ b/operations/common/magick-load.c
dab8dc
@@ -41,20 +41,23 @@ load_cache (GeglProperties *op_magick_load)
dab8dc
   if (!op_magick_load->user_data)
dab8dc
     {
dab8dc
       gchar    *filename;
dab8dc
-      gchar    *cmd;
dab8dc
       GeglNode *graph, *sink, *loader;
dab8dc
       GeglBuffer *newbuf = NULL;
dab8dc
 
dab8dc
       /* ImageMagick backed fallback FIXME: make this robust.
dab8dc
        * maybe use pipes in a manner similar to the raw loader,
dab8dc
        * or at least use a properly unique filename  */
dab8dc
+      char     *argv[4]  = {"convert", NULL, NULL, NULL};
dab8dc
 
dab8dc
       filename = g_build_filename (g_get_tmp_dir (), "gegl-magick.png", NULL);
dab8dc
-      cmd = g_strdup_printf ("convert \"%s\"'[0]' \"%s\"",
dab8dc
-                             op_magick_load->path, filename);
dab8dc
-      if (system (cmd) == -1)
dab8dc
+
dab8dc
+      argv[1] = g_strdup_printf ("%s[0]", op_magick_load->path);
dab8dc
+      argv[2] = filename;
dab8dc
+      if (!g_spawn_sync (NULL, argv, NULL, G_SPAWN_DEFAULT, 
dab8dc
+                         NULL, NULL, NULL, NULL, NULL, NULL))
dab8dc
         g_warning ("Error executing ImageMagick convert program");
dab8dc
 
dab8dc
+      g_free (argv[1]);
dab8dc
 
dab8dc
       graph = gegl_node_new ();
dab8dc
       sink = gegl_node_new_child (graph,
dab8dc
@@ -67,7 +70,6 @@ load_cache (GeglProperties *op_magick_load)
dab8dc
       gegl_node_process (sink);
dab8dc
       op_magick_load->user_data = (gpointer) newbuf;
dab8dc
       g_object_unref (graph);
dab8dc
-      g_free (cmd);
dab8dc
       g_free (filename);
dab8dc
     }
dab8dc
 }
dab8dc
-- 
dab8dc
GitLab
dab8dc
dab8dc
dab8dc
diff -urNp a/tools/exp_combine.cpp b/tools/exp_combine.cpp
dab8dc
--- a/tools/exp_combine.cpp	2022-01-10 15:03:42.765909209 +0100
dab8dc
+++ b/tools/exp_combine.cpp	2022-01-10 15:04:16.864158424 +0100
dab8dc
@@ -8,8 +8,7 @@
dab8dc
 
dab8dc
 #include <iostream>
dab8dc
 
dab8dc
-#include <exiv2/image.hpp>
dab8dc
-#include <exiv2/exif.hpp>
dab8dc
+#include <exiv2/exiv2.hpp>
dab8dc
 
dab8dc
 using namespace std;
dab8dc