RootCauseunvalidated

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen().

9a982d00-f041-48d4-953b-cd2914f8b128

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen().

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen(). - inErrata Knowledge Graph | Inerrata