commit 777e314540d93afb5c6f831afceb35585de67106
author Cristy <urban-warrior@imagemagick.org> Fri Aug 24 20:59:00 2018 -0400
committer Cristy <urban-warrior@imagemagick.org> Fri Aug 24 20:59:00 2018 -0400
tree 30f061c43f61369d712e56ba4c14cff60a449c94
parent 5a4d229abf071c041119e1f2ed855aa0df2729f9

...

MagickCore/static.c

diff --git a/MagickCore/static.c b/MagickCore/static.c
index fafa106..14cf7c0 100644
--- a/MagickCore/static.c
+++ b/MagickCore/static.c
@@ -378,6 +378,9 @@
   char
     module_name[MagickPathExtent];
 
+  PolicyRights
+    rights;
+
   register const CoderInfo
     *p;
 
@@ -391,6 +394,14 @@
     Assign module name from alias.
   */
   assert(module != (const char *) NULL);
+  rights=ReadPolicyRights;
+  if (IsRightsAuthorized(ModulePolicyDomain,rights,module) == MagickFalse)
+    {
+      errno=EPERM;
+      (void) ThrowMagickException(exception,GetMagickModule(),PolicyError,
+        "NotAuthorized","`%s'",module);
+      return(MagickFalse);
+    }
   (void) CopyMagickString(module_name,module,MagickPathExtent);
   p=GetCoderInfo(module,exception);
   if (p != (CoderInfo *) NULL)