[bug #61424] [libgroff] directory traversal in .fp request

[G. Branden Robinson]

Follow-up Comment #5, bug #61424 (project groff):

[comment #4 comment #4:]
> The bug has been fixed, but in case someone else tries the example and is as
puzzled as I was:
> 
> [comment #0 original submission:]
> > Output:
> > 
> > 
> > $ nroff EXPERIMENTS/hello-dave.roff
> > EVIL
> > 
> 
> I could not for the life of me get this output from groff 1.22.4 given the
described setup (with paths altered to match my local system).  I was finally
able to replicate it by moving ~/bogusfont into ~/devascii/bogusfont, and
altering the pathname in hello-dave.roff to match.  Even though the full path
is in the .fp request, I still needed a dev* directory above bogusfont, and
its name had to match the current output device.  I'm mildly curious why it
worked for Branden without those constraints.
> 
> (Another curious constraint is that merely specifying a relative path
starting with ../ was insufficient to trigger the bug; the path had to
traverse all the way up to the root directory and back down for .fp to read
the file.)

That is indeed odd, because I still _can_ reproduce the
behavior shown, using the same setup, with Debian's groff 1.22.4
package (1.22.4-5, to be precise).

I can even get it to work using an absolute file name for the
input file from a far-away directory.


$ cd /tmp
$ nroff ~/src/GIT/groff/EXPERIMENTS/hello-dave.roff
EVIL
$ mv ~/bogusfont ~/src/GIT/groff/ATTIC/
$ nroff ~/src/GIT/groff/EXPERIMENTS/hello-dave.roff
WORD


As is shown above, the surprising output goes away if I move
the "bogus font" out of my home directory whence the `fp`
request is trying to load it.

Does this help at all?  One reason I characterize this defect as
"directory traversal" is that the input file causes the
formatter to read a font description file from a place that is
_not_ in the font path.


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61424>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/