Re: [oS-EN] Image magick refuses to convert a true jpg file

On 2026-06-16 17:09, Andrei Borzenkov wrote:
> 16.06.2026 15:14, Simon Lees wrote:
> ...
>
>>>
>>> Should I open a bug report?
>>>
>>> I am using the default policy of Leap 16.0
>>
>> I believe this is the intended behavior, imagemagick in Leap comes from
>> SLES where having a very safe policy by default and allowing admins to
>> open it up as needed is most certainly the desired behavior.
>>
>
> The default SUSE policy includes
>
> <policy domain="path" rights="none" pattern="*../*"/>
>
> After ImageMagick-CVE-2026-25965.patch ImageMagick applies policy 
> check to the result of the realpath() which eliminates /../. So, this 
> condition actually looks redundant and blocks legitimate paths.
>
> Besides, in the OP example there is *no* possible illegal traversal 
> because filenames that ImageMagick opens do *not* contain any ../ 
> characters and ImageMagick opens them as openat(AT_FDCWD, ...).
>
One of the directories in the path has "..." in its name. Renaming makes 
the command work. That is surely a bug.


~/Photos/Para compartir con...>

I have renamed as:

cer@Laicolasse:~/Photos/Para compartir con…/>

single UTF char.


> If it is the desired behavior, I wonder what should happen to be 
> designated as a bug.


-- 
Cheers / Saludos,
                
		Carlos E. R.

   (from openSUSE 16.0 (Laicolasse))