[Bug 1646485] Re: security update regression in 'convert' tool when creating an image containing a text label

[tyrun demeg]

Marc, that would be amazing; I'm on deadline by the end of the month to
wrap up a migration of some legacy code and Imagemagick is one of those
requirements (the others being older versions of PHP/Apache), thus why
I'm on Ubuntu 14.04.

The current workaround I have is to set up a small Ubuntu 16.04 box that
has a version of ImageMagick that works and utilize NFS to get it back
to the main box; it's hacky, but it's the only thing I could come up
without having to try to get everything else working on 16.04.

If you could get this patch released today I may not have to go that
route, either way it's much appreciated, thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to imagemagick in Ubuntu.
https://bugs.launchpad.net/bugs/1646485

Title:
  security update regression in 'convert' tool when creating an image
  containing a text label

Status in imagemagick package in Ubuntu:
  Invalid
Status in imagemagick source package in Precise:
  Confirmed
Status in imagemagick source package in Trusty:
  Confirmed

Bug description:
  Running the following command doesn't work anymore:

     convert -background transparent -fill black -pointsize 32
  label:test out.png

  when libmagickcore4-8:6.6.9.7-5ubuntu3.6 is installed.

  It fails with the following error:

  convert: missing an image filename `out.png' @
  error/convert.c/ConvertImageCommand/3011.

  and exits with status 1.

  It works fine when I downgrade libmagickcore4 to 8:6.6.9.7-5ubuntu3.5.
  The image is created, and the exit status is 0.

  It seems like the security patches in 8:6.6.9.7-5ubuntu3.6 broke this
  behavior.

  ProblemType: Bug
  DistroRelease: Ubuntu 12.04
  Package: libmagickcore4 8:6.6.9.7-5ubuntu3.6
  ProcVersionSignature: Ubuntu 3.13.0-39.66~precise1-generic 3.13.11.8
  Uname: Linux 3.13.0-39-generic x86_64
  ApportVersion: 2.0.1-0ubuntu17.13
  Architecture: amd64
  Date: Thu Dec  1 05:02:54 2016
  InstallationMedia: Ubuntu 12.04.5 LTS "Precise Pangolin" - Release amd64 (20140807.1)
  MarkForUpload: True
  ProcEnviron:
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  SourcePackage: imagemagick
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1646485/+subscriptions