From f435e8724ade942148d065a4b898a0ed0c42c368 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 4 Jun 2016 13:14:31 -0400
Subject: [PATCH] Deny indirect reads by policy

---
 MagickCore/property.c |  2 --
 config/policy.xml     |  1 +
 configure             | 20 +-------------------
 configure.ac          | 12 ------------
 4 files changed, 2 insertions(+), 33 deletions(-)

diff --git a/MagickCore/property.c b/MagickCore/property.c
index 69be1c950..082ae7ea3 100644
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -3313,7 +3313,6 @@ RestoreMSCWarning
     p++;
   if (*p == '\0')
     return(ConstantString(""));
-#if defined(MAGICKCORE_INDIRECT_READS_SUPPORT)
   if ((*p == '@') && (IsPathAccessible(p+1) != MagickFalse))
     {
       /*
@@ -3330,7 +3329,6 @@ RestoreMSCWarning
       if (interpret_text != (char *) NULL)
         return(interpret_text);
     }
-#endif
   /*
     Translate any embedded format characters.
   */
diff --git a/config/policy.xml b/config/policy.xml
index 29d8a0b8b..762de15c9 100644
--- a/config/policy.xml
+++ b/config/policy.xml
@@ -65,5 +65,6 @@
   <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> -->
   <!-- <policy domain="path" rights="none" pattern="@*" /> -->
   <!-- <policy domain="path" rights="none" pattern="|*" /> -->
+  <policy domain="path" rights="none" pattern="@*"/>  <!-- indirect reads not permitted -->
   <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/>
 </policymap>
diff --git a/configure b/configure
index fd4fb6704..3bbb39811 100755
--- a/configure
+++ b/configure
@@ -1168,7 +1168,6 @@ enable_cipher
 enable_zero_configuration
 enable_hdri
 enable_pipes
-enable_indirect_reads
 enable_assert
 enable_maintainer_mode
 enable_hugepages
@@ -1938,7 +1937,6 @@ Optional Features:
   --enable-hdri           accurately represent the wide range of intensity
                           levels found in real scenes
   --enable-pipes          enable pipes (|) in filenames
-  --enable-indirect-reads enable indirect reads (@) in filenames
   --disable-assert        disable assert() statements in build
   --enable-maintainer-mode
                           enable make rules and dependencies not useful (and
@@ -4519,7 +4517,7 @@ MAGICK_PATCHLEVEL_VERSION=10
 
 MAGICK_VERSION=7.0.1-10
 
-MAGICK_GIT_REVISION=18357:3cf86f2:20160603
+MAGICK_GIT_REVISION=18365:83bceaa:20160604
 
 
 # Substitute library versioning
@@ -23842,22 +23840,6 @@ $as_echo "#define PIPES_SUPPORT 1" >>confdefs.h
     MAGICK_FEATURES="Pipes $MAGICK_FEATURES"
 fi
 
-# Enable indirect reads (@) in filenames.
-# Check whether --enable-indirect-reads was given.
-if test "${enable_indirect_reads+set}" = set; then :
-  enableval=$enable_indirect_reads; enable_indirect_reads=$enableval
-else
-  enable_indirect_reads='no'
-fi
-
-
-if test "$enable_indirect-reads" = 'yes'; then
-
-$as_echo "#define INDIRECT_READS_SUPPORT 1" >>confdefs.h
-
-    MAGICK_FEATURES="IndirectReads $MAGICK_FEATURES"
-fi
-
 # Build a version of ImageMagick with assert statements.
 # Check whether --enable-assert was given.
 if test "${enable_assert+set}" = set; then :
diff --git a/configure.ac b/configure.ac
index 795f41a7e..bf4236185 100644
--- a/configure.ac
+++ b/configure.ac
@@ -696,18 +696,6 @@ if test "$enable_pipes" = 'yes'; then
     MAGICK_FEATURES="Pipes $MAGICK_FEATURES"
 fi
 
-# Enable indirect reads (@) in filenames.
-AC_ARG_ENABLE([indirect-reads],
-    [AC_HELP_STRING([--enable-indirect-reads],
-                    [enable indirect reads (@) in filenames])],
-    [enable_indirect_reads=$enableval],
-    [enable_indirect_reads='no'])
-
-if test "$enable_indirect-reads" = 'yes'; then
-    AC_DEFINE(INDIRECT_READS_SUPPORT,1,[enable indirect reads (@) in filenames])
-    MAGICK_FEATURES="IndirectReads $MAGICK_FEATURES"
-fi
-
 # Build a version of ImageMagick with assert statements.
 AC_ARG_ENABLE([assert],
     [AC_HELP_STRING([--disable-assert],
-- 
2.40.0