hi, great project!
I found a vulnerability that seems to exist. Due to lack of proper validation of .bdf filename, this vulnerability allows to inject arbitrary commands and execute them.
bImport -> FVImportBDF -> _SFImportBDF -> system(buf)
static BDFFont *_SFImportBDF(SplineFont *sf, char *filename,int ispk, int toback, EncMap *map) {
int i;
char *pt, *temp=NULL;
char buf[1500];
BDFFont *ret;
pt = strrchr(filename,'.');
i = -1;
if ( pt!=NULL ) for ( i=0; compressors[i].ext!=NULL; ++i )
if ( strcmp(compressors[i].ext,pt+1)==0 )
break;
if ( i==-1 || compressors[i].ext==NULL ) i=-1;
else {
sprintf( buf, "%s %s", compressors[i].decomp, filename );
if ( system(buf)==0 )
*pt='\0';
else {
hi, great project!
I found a vulnerability that seems to exist. Due to lack of proper validation of .bdf filename, this vulnerability allows to inject arbitrary commands and execute them.
bImport -> FVImportBDF -> _SFImportBDF -> system(buf)