Re: A problem with "convert" - security related

From	Paul <nospam@needed.invalid>
Newsgroups	alt.os.linux, alt.os.linux.ubuntu
Subject	Re: A problem with "convert" - security related
Date	2018-11-10 00:15 -0500
Organization	A noiseless patient Spider
Message-ID	<ps5ph2$fpf$1@dont-email.me> (permalink)
References	<ps5g64$dqn$1@gioia.aioe.org>

Cross-posted to 2 groups.

Show all headers | View raw

Paulo da Silva wrote:
> Hello.
> 
> Some times (not too frequently) I need to use a command like
> convert *.png foo.pdf.
> 
> This converts a bunch of images into a pdf book.
> 
> Last time I tried it, I got an error:
> convert-im6.q16: not authorized `foo.pdf' @
> error/constitute.c/WriteImage/1037.
> 
> I could see that this has to do with "restrictions" in the file
> /etc/ImageMagick-6/policy.xml
> 
> Some line there seems to prevent writing to pdf files!
> (I am aware that I can comment that line).
> 
> I just temporarily removed that file and successfully executed the command.
> 
> What is the related security problem?
> After all this is a read/write command!
> 
> BTW, in which risks do I incur just removing the file?
> 
> Thanks
> Paulo

Go down to line 1037.

https://github.com/ImageMagick/ImageMagick/blob/master/MagickCore/constitute.c

      char filename[MagickPathExtent];

My guess is, there's something wrong with the path for
the output and how you're specifying it.

How about

    convert "*.png" foo.pdf

in an attempt to fool it into having two arguments
on the command line.

Or even re-formulate the command and try again.
Say I have three PNG files. Try this

    convert 1.png 2.png 3.png foo.pdf

and see what error is returned.

You might want to try

    convert -h
    convert --help
    ...

the usual help formulations, then check how
you're supposed to use the command. In some cases,
you might be using documentation for a different version
and they changed something.

I would contemplate a more complicated theory, once
you've checked the obvious.

Like, make it do any command and be successful, as a start.
And work your way up from there. You could, for example,
run convert then pipe it to some other command, to "display"
the result. In an attempt to avoid the filename issue, whatever
it is.

    Paul

Thread

A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-10 02:35 +0000
  Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 00:15 -0500
  Re: A problem with "convert" - security related stepore <linshine@here.now> - 2018-11-10 00:34 -0800
    Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 07:32 -0500
    Re: A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-10 17:19 +0000
      Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 17:03 -0500
        Re: A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-11 02:45 +0000
          Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 23:26 -0500
            Re: A problem with "convert" - security related "Carlos E. R." <robin_listas@es.invalid> - 2018-11-12 14:17 +0100
              Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-12 09:21 -0500
                Re: A problem with "convert" - security related "Carlos E. R." <robin_listas@es.invalid> - 2018-11-12 17:09 +0100

csiph-web