summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDivyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>2025-12-12 20:29:46 +0530
committerGyorgy Sarvari <skandigraun@gmail.com>2025-12-12 22:06:55 +0100
commit3a86962b263bb5ba4a7719854bfde87404e83f34 (patch)
treecce86f94c3ffc721e05cf7c741de4121270ecd8d
parenta137e1075054e9c52b037bad1b5557c7618e3371 (diff)
downloadmeta-openembedded-3a86962b263bb5ba4a7719854bfde87404e83f34.tar.gz
ImageMagick: Fix CVE-2025-55298
Backport the fix for CVE-2025-55298 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5] [https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895] Add below patch to fix 0010-ImageMagick-Fix-CVE-2025-55298-1.patch 0010-ImageMagick-Fix-CVE-2025-55298-2.patch Add below support patch to fix 0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch 0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch 0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Diffstat
-rw-r--r--meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch48
-rw-r--r--meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch205
-rw-r--r--meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch103
-rw-r--r--meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-1.patch71
-rw-r--r--meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-2.patch274
-rw-r--r--meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb5
6 files changed, 706 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
new file mode 100644
index 0000000000..9e95b294e3
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
@@ -0,0 +1,48 @@
1From 93bcbd44f4771227a9e637f69ddabb60e0e33b18 Mon Sep 17 00:00:00 2001
2From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
3Date: Tue, 11 Nov 2025 14:34:12 +0530
4Subject: [PATCH 10/18] ImageMagick: Add support patch 1 to fix CVE-2025-55298
5
6Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/83caf59fce695fea0c5878e9f0d0b65e662cae66]
7
8Comment: Refreshed hunk to match latest kirkstone
9
10Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
11---
12 MagickCore/image.c | 8 +++++---
13 1 file changed, 5 insertions(+), 3 deletions(-)
14
15diff --git a/MagickCore/image.c b/MagickCore/image.c
16index 346285165..f64e83645 100644
17--- a/MagickCore/image.c
18+++ b/MagickCore/image.c
19@@ -1640,21 +1640,23 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
20 char
21 *q;
22
23+ const char
24+ *p;
25+
26 int
27 c;
28
29 MagickBooleanType
30 canonical;
31
32- const char
33- *p;
34-
35 ssize_t
36 offset;
37
38 canonical=MagickFalse;
39 offset=0;
40 (void) CopyMagickString(filename,format,MagickPathExtent);
41+ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
42+ return(strlen(filename));
43 for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
44 {
45 q=(char *) p+1;
46--
472.34.1
48
diff --git a/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
new file mode 100644
index 0000000000..a51bc1994b
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
@@ -0,0 +1,205 @@
1From 18f573cbd4767d9b51b23cde5b58945ae4e57243 Mon Sep 17 00:00:00 2001
2From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
3Date: Tue, 11 Nov 2025 21:53:10 +0530
4Subject: [PATCH 11/18] ImageMagick: Add support patch-2 to fix CVE-2025-55298
5
6Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/82550750ec8f79393b381c3ed349dd495bbab8a7]
7
8Comment: Refreshed hunk to match latest kirkstone
9
10Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
11---
12 MagickCore/image.c | 134 +++++++++++++++++++--------------------------
13 1 file changed, 55 insertions(+), 79 deletions(-)
14
15diff --git a/MagickCore/image.c b/MagickCore/image.c
16index f64e83645..cd4de6df9 100644
17--- a/MagickCore/image.c
18+++ b/MagickCore/image.c
19@@ -1638,34 +1638,41 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
20 ExceptionInfo *exception)
21 {
22 char
23- *q;
24+ *p = filename,
25+ pattern[MagickPathExtent];
26
27 const char
28- *p;
29-
30- int
31- c;
32-
33- MagickBooleanType
34- canonical;
35-
36- ssize_t
37- offset;
38+ *cursor = format;
39
40- canonical=MagickFalse;
41- offset=0;
42+ /*
43+ Start with a copy of the format string.
44+ */
45 (void) CopyMagickString(filename,format,MagickPathExtent);
46 if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
47 return(strlen(filename));
48- for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
49+ while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
50 {
51- q=(char *) p+1;
52- if (*q == '%')
53+ const char
54+ *q = cursor;
55+
56+ ssize_t
57+ offset = (ssize_t) (cursor-format);
58+
59+ cursor++; /* move past '%' */
60+ if (*cursor == '%')
61 {
62- p++;
63+ /*
64+ Escaped %%.
65+ */
66+ cursor++;
67 continue;
68 }
69- switch (*q)
70+ /*
71+ Skip padding digits like %03d.
72+ */
73+ if (*cursor == '0')
74+ (void) strtol(cursor,(char **) &cursor,10);
75+ switch (*cursor)
76 {
77 case 'd':
78 case 'o':
79@@ -1674,93 +1681,62 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
80 ssize_t
81 count;
82
83- q++;
84- c=(*q);
85- *q='\0';
86- count=FormatLocaleString(filename+(p-format-offset),(size_t)
87- (MagickPathExtent-(p-format-offset)),p,value);
88- if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
89+ count=FormatLocaleString(pattern,sizeof(pattern),q,value);
90+ if ((count <= 0) || (count >= MagickPathExtent))
91 return(0);
92- offset+=(ssize_t) ((q-p)-count);
93- *q=c;
94- (void) ConcatenateMagickString(filename,q,MagickPathExtent);
95- canonical=MagickTrue;
96- if (*(q-1) != '%')
97- break;
98- p++;
99+ if ((offset+count) >= MagickPathExtent)
100+ return(0);
101+ (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
102+ offset));
103+ cursor++;
104 break;
105 }
106 case '[':
107 {
108- char
109- pattern[MagickPathExtent];
110-
111 const char
112- *option;
113+ *end = strchr(cursor,']'),
114+ *option = (const char *) NULL;
115
116- char
117- *r;
118-
119- ssize_t
120- i;
121-
122- ssize_t
123- depth;
124+ size_t
125+ extent = (size_t) (end-cursor);
126
127 /*
128- Image option.
129+ Handle %[key:value];
130 */
131- if (strchr(p,']') == (char *) NULL)
132+ if (end == (const char *) NULL)
133 break;
134- depth=1;
135- r=q+1;
136- for (i=0; (i < (MagickPathExtent-1L)) && (*r != '\0'); i++)
137- {
138- if (*r == '[')
139- depth++;
140- if (*r == ']')
141- depth--;
142- if (depth <= 0)
143- break;
144- pattern[i]=(*r++);
145- }
146- pattern[i]='\0';
147- if (LocaleNCompare(pattern,"filename:",9) != 0)
148+ if (extent >= sizeof(pattern))
149 break;
150- option=(const char *) NULL;
151+ (void) CopyMagickString(pattern,cursor,extent);
152+ pattern[extent]='\0';
153 if (image != (Image *) NULL)
154 option=GetImageProperty(image,pattern,exception);
155- if ((option == (const char *) NULL) && (image != (Image *) NULL))
156+ if ((option == (const char *) NULL) && (image != (Image *)NULL))
157 option=GetImageArtifact(image,pattern);
158 if ((option == (const char *) NULL) &&
159 (image_info != (ImageInfo *) NULL))
160 option=GetImageOption(image_info,pattern);
161 if (option == (const char *) NULL)
162 break;
163- q--;
164- c=(*q);
165- *q='\0';
166- (void) CopyMagickString(filename+(p-format-offset),option,(size_t)
167- (MagickPathExtent-(p-format-offset)));
168- offset+=strlen(pattern)-strlen(option)+3;
169- *q=c;
170- (void) ConcatenateMagickString(filename,r+1,MagickPathExtent);
171- canonical=MagickTrue;
172- if (*(q-1) != '%')
173- break;
174- p++;
175+ (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
176+ offset));
177+ cursor=end+1;
178 break;
179 }
180 default:
181 break;
182 }
183 }
184- if (canonical == MagickFalse)
185- (void) CopyMagickString(filename,format,MagickPathExtent);
186- else
187- for (q=filename; *q != '\0'; q++)
188- if ((*q == '%') && (*(q+1) == '%'))
189- (void) CopyMagickString(q,q+1,(size_t) (MagickPathExtent-(q-filename)));
190+ for (p=filename; *p != '\0'; )
191+ {
192+ /*
193+ Replace "%%" with "%".
194+ */
195+ if ((*p == '%') && (*(p+1) == '%'))
196+ (void) memmove(p,p+1,strlen(p)); /* shift left */
197+ else
198+ p++;
199+ }
200 return(strlen(filename));
201 }
202
203--
2042.34.1
205
diff --git a/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
new file mode 100644
index 0000000000..2f4e019132
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
@@ -0,0 +1,103 @@
1From abc0b89e166c993ff766d3ff62b6d2be82f478f3 Mon Sep 17 00:00:00 2001
2From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
3Date: Wed, 12 Nov 2025 11:35:37 +0530
4Subject: [PATCH 12/18] ImageMagick: Add support patch-3 to fix CVE-2025-55298
5
6Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/6c7c8d5866b9c0ce6cc76a741e05b9482716101e]
7
8Comment: Refreshed hunk to match latest kirkstone
9
10Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
11---
12 MagickCore/image.c | 31 +++++++++++++++++++++----------
13 1 file changed, 21 insertions(+), 10 deletions(-)
14
15diff --git a/MagickCore/image.c b/MagickCore/image.c
16index cd4de6df9..1acf8edbd 100644
17--- a/MagickCore/image.c
18+++ b/MagickCore/image.c
19@@ -1647,6 +1647,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
20 /*
21 Start with a copy of the format string.
22 */
23+ assert(format != (const char *) NULL);
24+ assert(filename != (char *) NULL);
25 (void) CopyMagickString(filename,format,MagickPathExtent);
26 if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
27 return(strlen(filename));
28@@ -1670,7 +1672,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
29 /*
30 Skip padding digits like %03d.
31 */
32- if (*cursor == '0')
33+ if (isdigit((int) ((unsigned char) *cursor)) != 0)
34 (void) strtol(cursor,(char **) &cursor,10);
35 switch (*cursor)
36 {
37@@ -1682,9 +1684,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
38 count;
39
40 count=FormatLocaleString(pattern,sizeof(pattern),q,value);
41- if ((count <= 0) || (count >= MagickPathExtent))
42- return(0);
43- if ((offset+count) >= MagickPathExtent)
44+ if ((count <= 0) || (count >= MagickPathExtent) ||
45+ ((offset+count) >= MagickPathExtent))
46 return(0);
47 (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
48 offset));
49@@ -1698,7 +1699,9 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
50 *option = (const char *) NULL;
51
52 size_t
53- extent = (size_t) (end-cursor);
54+ extent = (size_t) (end-cursor-1),
55+ option_length,
56+ tail_length;
57
58 /*
59 Handle %[key:value];
60@@ -1707,19 +1710,27 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
61 break;
62 if (extent >= sizeof(pattern))
63 break;
64- (void) CopyMagickString(pattern,cursor,extent);
65+ (void) CopyMagickString(pattern,cursor+1,extent+1);
66 pattern[extent]='\0';
67 if (image != (Image *) NULL)
68- option=GetImageProperty(image,pattern,exception);
69- if ((option == (const char *) NULL) && (image != (Image *)NULL))
70- option=GetImageArtifact(image,pattern);
71+ {
72+ option=GetImageProperty(image,pattern,exception);
73+ if (option == (const char *) NULL)
74+ option=GetImageArtifact(image,pattern);
75+ }
76 if ((option == (const char *) NULL) &&
77 (image_info != (ImageInfo *) NULL))
78 option=GetImageOption(image_info,pattern);
79 if (option == (const char *) NULL)
80 break;
81+ option_length=strlen(option);
82+ tail_length=strlen(end+1);
83+ if ((offset+option_length+tail_length+1) > MagickPathExtent)
84+ return(0);
85 (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
86 offset));
87+ (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
88+ MagickPathExtent-offset-option_length-tail_length-1));
89 cursor=end+1;
90 break;
91 }
92@@ -1733,7 +1744,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
93 Replace "%%" with "%".
94 */
95 if ((*p == '%') && (*(p+1) == '%'))
96- (void) memmove(p,p+1,strlen(p)); /* shift left */
97+ (void) memmove(p,p+1,strlen(p+1)+1); /* shift left */
98 else
99 p++;
100 }
101--
1022.34.1
103
diff --git a/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-1.patch b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-1.patch
new file mode 100644
index 0000000000..95dda55623
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-1.patch
@@ -0,0 +1,71 @@
1From 62f97a69edb936544604e669de25e4bf2a9e2f06 Mon Sep 17 00:00:00 2001
2From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
3Date: Wed, 12 Nov 2025 11:52:00 +0530
4Subject: [PATCH 13/18] ImageMagick: Fix CVE-2025-55298
5
6CVE: CVE-2025-55298
7
8This CVE fixed in two parts, this commit includes the first fix.
9
10Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895]
11
12Comment: Refreshed hunk to match latest kirkstone
13
14Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
15---
16 MagickCore/image.c | 32 ++++++++++++++++++++++++++++++++
17 1 file changed, 32 insertions(+)
18
19diff --git a/MagickCore/image.c b/MagickCore/image.c
20index 1acf8edbd..7a52236d8 100644
21--- a/MagickCore/image.c
22+++ b/MagickCore/image.c
23@@ -1633,6 +1633,31 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
24 % o exception: return any errors or warnings in this structure.
25 %
26 */
27+
28+static inline MagickBooleanType PercentNInvalidOperation(char *filename)
29+{
30+ MagickBooleanType
31+ match = MagickFalse;
32+
33+ size_t
34+ length = strlen(filename);
35+
36+ ssize_t
37+ i;
38+
39+ for (i=0; i < (ssize_t) length-1; i++)
40+ {
41+ if ((filename[i] == '%') &&
42+ ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
43+ {
44+ filename[i]='?';
45+ filename[i+1]='\?';
46+ match=MagickTrue;
47+ }
48+ }
49+ return(match);
50+}
51+
52 MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
53 Image *image,const char *format,int value,char *filename,
54 ExceptionInfo *exception)
55@@ -1652,6 +1677,13 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
56 (void) CopyMagickString(filename,format,MagickPathExtent);
57 if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
58 return(strlen(filename));
59+ if (PercentNInvalidOperation(filename) != MagickFalse)
60+ {
61+ errno=EPERM;
62+ (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
63+ "InvalidArgument","`%s'",filename);
64+ return(0);
65+ }
66 while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
67 {
68 const char
69--
702.34.1
71
diff --git a/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-2.patch b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-2.patch
new file mode 100644
index 0000000000..c9cbf95c4d
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/files/0010-ImageMagick-Fix-CVE-2025-55298-2.patch
@@ -0,0 +1,274 @@
1From b7e445241e43e3e919667d7244ccb99573cf951a Mon Sep 17 00:00:00 2001
2From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
3Date: Wed, 12 Nov 2025 13:05:40 +0530
4Subject: [PATCH 14/18] ImageMagick: Fix CVE-2025-55298
5
6CVE: CVE-2025-55298
7
8This CVE fixed in two parts, this commit includes the second fix.
9
10Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5]
11
12Comment: Refreshed hunk to match latest kirkstone
13
14Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
15---
16 MagickCore/image.c | 183 ++++++++++++++++++++++++---------------------
17 1 file changed, 96 insertions(+), 87 deletions(-)
18
19diff --git a/MagickCore/image.c b/MagickCore/image.c
20index 7a52236d8..3e6fdd114 100644
21--- a/MagickCore/image.c
22+++ b/MagickCore/image.c
23@@ -1619,7 +1619,7 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
24 %
25 % A description of each parameter follows.
26 %
27-% o image_info: the image info..
28+% o image_info: the image info.
29 %
30 % o image: the image.
31 %
32@@ -1634,28 +1634,38 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
33 %
34 */
35
36-static inline MagickBooleanType PercentNInvalidOperation(char *filename)
37+static inline MagickBooleanType IsValidFormatSpecifier(const char *start,
38+ const char *end)
39 {
40- MagickBooleanType
41- match = MagickFalse;
42-
43+ char
44+ specifier = end[-1];
45 size_t
46- length = strlen(filename);
47+ length = end-start;
48
49- ssize_t
50- i;
51+ /*
52+ Is this a valid format specifier?
53+ */
54+ if ((specifier != 'd') && (specifier != 'x') && (specifier != 'o'))
55+ return(MagickFalse);
56+ if ((length == 1) && (*start == specifier))
57+ return(MagickTrue);
58+ if (length >= 2)
59+ {
60+ size_t
61+ i = 0;
62
63- for (i=0; i < (ssize_t) length-1; i++)
64- {
65- if ((filename[i] == '%') &&
66- ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
67- {
68- filename[i]='?';
69- filename[i+1]='\?';
70- match=MagickTrue;
71- }
72- }
73- return(match);
74+ if (*start == '0')
75+ {
76+ if ((length >= 3) && (start[1] == '0'))
77+ return(MagickFalse);
78+ i=1;
79+ }
80+ for ( ; i < (length-1); i++)
81+ if (isdigit((int) ((unsigned char) start[i])) == 0)
82+ return(MagickFalse);
83+ return(MagickTrue);
84+ }
85+ return(MagickFalse);
86 }
87
88 MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
89@@ -1669,82 +1679,89 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
90 const char
91 *cursor = format;
92
93- /*
94- Start with a copy of the format string.
95- */
96 assert(format != (const char *) NULL);
97 assert(filename != (char *) NULL);
98- (void) CopyMagickString(filename,format,MagickPathExtent);
99 if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
100- return(strlen(filename));
101- if (PercentNInvalidOperation(filename) != MagickFalse)
102 {
103- errno=EPERM;
104- (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
105- "InvalidArgument","`%s'",filename);
106- return(0);
107+ (void) CopyMagickString(filename,format,MagickPathExtent);
108+ return(strlen(filename));
109 }
110- while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
111+ while ((*cursor != '\0') && ((p-filename) < ((ssize_t) MagickPathExtent-1)))
112 {
113 const char
114- *q = cursor;
115+ *specifier_start,
116+ *start;
117
118- ssize_t
119- offset = (ssize_t) (cursor-format);
120-
121- cursor++; /* move past '%' */
122+ if (*cursor != '%')
123+ {
124+ *p++=(*cursor++);
125+ continue;
126+ }
127+ start=cursor++; /* Skip '%' */
128 if (*cursor == '%')
129 {
130- /*
131- Escaped %%.
132- */
133+ *p++='%';
134 cursor++;
135 continue;
136 }
137- /*
138- Skip padding digits like %03d.
139- */
140- if (isdigit((int) ((unsigned char) *cursor)) != 0)
141- (void) strtol(cursor,(char **) &cursor,10);
142- switch (*cursor)
143- {
144- case 'd':
145- case 'o':
146- case 'x':
147+ specifier_start=cursor;
148+ while (isdigit((int) ((unsigned char) *cursor)) != 0)
149+ cursor++;
150+ if ((*cursor == 'd') || (*cursor == 'o') || (*cursor == 'x'))
151 {
152- ssize_t
153- count;
154+ const char
155+ *specifier_end = cursor+1;
156
157- count=FormatLocaleString(pattern,sizeof(pattern),q,value);
158- if ((count <= 0) || (count >= MagickPathExtent) ||
159- ((offset+count) >= MagickPathExtent))
160- return(0);
161- (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
162- offset));
163- cursor++;
164- break;
165+ if (IsValidFormatSpecifier(specifier_start,specifier_end) != MagickFalse)
166+ {
167+ char
168+ format_specifier[MagickPathExtent];
169+
170+ size_t
171+ length = cursor-specifier_start;
172+
173+ ssize_t
174+ count;
175+
176+ (void) snprintf(format_specifier,sizeof(format_specifier),
177+ "%%%.*s%c",(int) length,specifier_start,*cursor);
178+ count=FormatLocaleString(pattern,sizeof(pattern),format_specifier,
179+ value);
180+ if ((count <= 0) || ((p-filename+count) >= MagickPathExtent))
181+ return(0);
182+ (void) CopyMagickString(p,pattern,MagickPathExtent-(p-filename));
183+ p+=strlen(pattern);
184+ cursor++;
185+ continue;
186+ }
187+ else
188+ {
189+ /*
190+ Invalid specifier — treat as literal.
191+ */
192+ cursor=start;
193+ *p++=(*cursor++);
194+ continue;
195+ }
196 }
197- case '[':
198+ if (*cursor == '[')
199 {
200 const char
201 *end = strchr(cursor,']'),
202 *option = (const char *) NULL;
203
204 size_t
205- extent = (size_t) (end-cursor-1),
206- option_length,
207- tail_length;
208+ extent,
209+ option_length;
210
211- /*
212- Handle %[key:value];
213- */
214 if (end == (const char *) NULL)
215- break;
216+ continue;
217+ extent=(size_t) (end-cursor-1);
218 if (extent >= sizeof(pattern))
219- break;
220+ continue;
221 (void) CopyMagickString(pattern,cursor+1,extent+1);
222 pattern[extent]='\0';
223- if (image != (Image *) NULL)
224+ if (image != NULL)
225 {
226 option=GetImageProperty(image,pattern,exception);
227 if (option == (const char *) NULL)
228@@ -1754,32 +1771,24 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
229 (image_info != (ImageInfo *) NULL))
230 option=GetImageOption(image_info,pattern);
231 if (option == (const char *) NULL)
232- break;
233+ continue;
234 option_length=strlen(option);
235- tail_length=strlen(end+1);
236- if ((offset+option_length+tail_length+1) > MagickPathExtent)
237+ if ((p-filename+option_length) >= MagickPathExtent)
238 return(0);
239- (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
240- offset));
241- (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
242- MagickPathExtent-offset-option_length-tail_length-1));
243+ (void) CopyMagickString(p,option,MagickPathExtent-(p-filename));
244+ p+=option_length;
245 cursor=end+1;
246- break;
247+ continue;
248 }
249- default:
250- break;
251- }
252- }
253- for (p=filename; *p != '\0'; )
254- {
255 /*
256- Replace "%%" with "%".
257+ Invalid or unsupported specifier — treat as literal.
258 */
259- if ((*p == '%') && (*(p+1) == '%'))
260- (void) memmove(p,p+1,strlen(p+1)+1); /* shift left */
261- else
262- p++;
263+ cursor=start;
264+ if ((p-filename+1) >= MagickPathExtent)
265+ return(0);
266+ *p++=(*cursor++);
267 }
268+ *p='\0';
269 return(strlen(filename));
270 }
271
272--
2732.34.1
274
diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
index 2cc67bd51b..586f4418af 100644
--- a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
+++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
@@ -36,6 +36,11 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
36 file://0007-ImageMagick-Fix-CVE-2025-57803.patch \ 36 file://0007-ImageMagick-Fix-CVE-2025-57803.patch \
37 file://0008-ImageMagick-Fix-CVE-2025-57807.patch \ 37 file://0008-ImageMagick-Fix-CVE-2025-57807.patch \
38 file://0009-ImageMagick-Fix-CVE-2025-55154.patch \ 38 file://0009-ImageMagick-Fix-CVE-2025-55154.patch \
39 file://0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch \
40 file://0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch \
41 file://0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch \
42 file://0010-ImageMagick-Fix-CVE-2025-55298-1.patch \
43 file://0010-ImageMagick-Fix-CVE-2025-55298-2.patch \
39" 44"
40 45
41SRCREV = "35b4991eb0939a327f3489988c366e21068b0178" 46SRCREV = "35b4991eb0939a327f3489988c366e21068b0178"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-12 17:38:51 +0000