[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1609270954220.18003@freddy.simplesystems.org>
Date: Tue, 27 Sep 2016 09:56:58 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick identify "d:" hangs
On Tue, 27 Sep 2016, Jakub Wilk wrote:
> * Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>, 2016-09-27, 08:48:
>> From my own investigations, I used
>>
>> identify -debug all "d:"
>>
>> and see that a temporary file is reported to be created and then the
>> program hangs which no apparent CPU usage.
>
> strace tells me that it waits for input on stdin.
> This is a simpler way to make it "hang":
>
> identify -
This is what I expected was happening. The main thing to investigate
is if the "ImageTragick" patches distributions are using do protect
against this possible issue as well.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
