ImageMagick on armhf fails to read labels or captions from file

[ajfclark]

I have been having some issues getting captions to work with imagemagick on an armhf machine. As per http://www.imagemagick.org/Usage/text/# ... paragraphs I was trying to get the captions to read in from a file.

On my amd64 machine, the following works and prompts on stdin for the caption:

convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif

On the armhf machine, it doesn't even wait for stdin, it just exits and caption file just contains the @- as the caption.

Package version:
amd64 8:6.8.9.9-7+b2
armhf 8:6.8.9.9-5+deb8u2

Imagemagick reports:
amd64: Version: ImageMagick 6.8.9-9 Q16 x86_64 2016-04-08 http://www.imagemagick.org
armhf: Version: ImageMagick 6.8.9-9 Q16 arm 2016-05-16 http://www.imagemagick.org

Any ideas why the arm version doesn't appear to support reading from files with the @ notation?

[fmw42]

convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif

From where is the standard in coming?

Your policy.xml file may preclude your use of @. See the recent comments about enhanced security in the Developer section regarding the new fixes and policy.xml.

[snibgo]

On Windows, the construct "caption:@-" when there isn't a pipe will wait for keyboard entry, terminated by ctrl-Z. I don't know if that works on all platforms.

Reading from files should work on all platforms, I suppose.

[fmw42]

see
viewtopic.php?f=4&t=29588
viewtopic.php?f=4&t=26801

[ajfclark]

convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif

From where is the standard in coming?

The console.

Your policy.xml file may preclude your use of @. See the recent comments about enhanced security in the Developer section regarding the new fixes and policy.xml.

What's the default location for policy.xml?

[ajfclark]

On Windows, the construct "caption:@-" when there isn't a pipe will wait for keyboard entry, terminated by ctrl-Z. I don't know if that works on all platforms.

Reading from files should work on all platforms, I suppose.

This is exactly what I was expecting it to do, and it does do on one of my Linux machines, but not the other. Hence the question.

[fmw42]

What's the default location for policy.xml?

See http://www.imagemagick.org/script/resources.php

[ajfclark]

Your policy.xml file may preclude your use of @. See the recent comments about enhanced security in the Developer section regarding the new fixes and policy.xml.

Ok, so the policy.xml file is different on the two machines which might explain the reason convert isn't prompting for a string, however I can't seem to figure out the syntax to reenable @ reading. eg. I put the following in ~/.config/ImageMagick/policy.xml:

Code: Select all

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policymap [
<!ELEMENT policymap (policy)+>
<!ELEMENT policy (#PCDATA)>
<!ATTLIST policy domain (delegate|coder|filter|path|resource) #IMPLIED>
<!ATTLIST policy name CDATA #IMPLIED>
<!ATTLIST policy rights CDATA #IMPLIED>
<!ATTLIST policy pattern CDATA #IMPLIED>
<!ATTLIST policy value CDATA #IMPLIED>
]>
<policymap>
  <policy domain="path" rights="read" pattern="@*" />
</policymap>

And checked that convert was reading it:

Code: Select all

Path: /home/pi/.config/ImageMagick/policy.xml
  Policy: Path
    rights: Read 
    pattern: @*

Path: [built-in]
  Policy: Undefined
    rights: None 

Yet the convert command still doesn't read from STDIN when executed as follows:

Code: Select all

convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif

Nor does it return a useful error message such as "Permission denied reading from STDIN" or something.

I also tried replacing /etc/ImageMagic-6/policy.xml with a copy from the machine that operates as expected and get th same result, convert exits with no error messages and creates an image with a @- caption in it:

Code: Select all

$ convert -list policy

Path: /etc/ImageMagick-6/policy.xml
  Policy: undefined
    rights: None 

Path: [built-in]
  Policy: Undefined
    rights: None 
$ convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif
$

[ajfclark]

Ah-ha! It does allow reading from an actual file though, just not from STDIN or piped in data. This resolves my actual issue, but I'm interested why caption:@- doesn't work as expected.

Do I need a special policy entry to allow reading from STDIN?

[fmw42]

I am not sure you are getting the full policy. On my Mac:

Code: Select all

cat /usr/local/etc/ImageMagick-6/policy.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policymap [
<!ELEMENT policymap (policy)+>
<!ELEMENT policy (#PCDATA)>
<!ATTLIST policy domain (delegate|coder|filter|path|resource) #IMPLIED>
<!ATTLIST policy name CDATA #IMPLIED>
<!ATTLIST policy rights CDATA #IMPLIED>
<!ATTLIST policy pattern CDATA #IMPLIED>
<!ATTLIST policy value CDATA #IMPLIED>
]>
<!--
  Configure ImageMagick policies.

  Domains include system, delegate, coder, filter, path, or resource.

  Rights include none, read, write, and execute.  Use | to combine them,
  for example: "read | write" to permit read from, or write to, a path.

  Use a glob expression as a pattern.

  Suppose we do not want users to process MPEG video images:

    <policy domain="delegate" rights="none" pattern="mpeg:decode" />

  Here we do not want users reading images from HTTP:

    <policy domain="coder" rights="none" pattern="HTTP" />

  Lets prevent users from executing any image filters:

    <policy domain="filter" rights="none" pattern="*" />

  The /repository file system is restricted to read only.  We use a glob
  expression to match all paths that start with /repository:
  
    <policy domain="path" rights="read" pattern="/repository/*" />

  Let's prevent possible exploits by removing the right to use indirect reads.

    <policy domain="path" rights="none" pattern="@*" />

  Any large image is cached to disk rather than memory:

    <policy domain="resource" name="area" value="1GB"/>

  Define arguments for the memory, map, area, width, height, and disk resources
  with SI prefixes (.e.g 100MB).  In addition, resource policies are maximums
  for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
  exceeds policy maximum so memory limit is 1GB).
-->
<policymap>
  <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
  <!-- <policy domain="resource" name="memory" value="2GiB"/> -->
  <!-- <policy domain="resource" name="map" value="4GiB"/> -->
  <!-- <policy domain="resource" name="width" value="10MP"/> -->
  <!-- <policy domain="resource" name="height" value="10MP"/> -->
  <!-- <policy domain="resource" name="area" value="1GB"/> -->
  <!-- <policy domain="resource" name="disk" value="16EB"/> -->
  <!-- <policy domain="resource" name="file" value="768"/> -->
  <!-- <policy domain="resource" name="thread" value="4"/> -->
  <!-- <policy domain="resource" name="throttle" value="0"/> -->
  <!-- <policy domain="resource" name="time" value="3600"/> -->
  <!-- <policy domain="system" name="precision" value="6"/> -->
  <!-- <policy domain="coder" rights="none" pattern="HTTPS" /> -->
  <!-- <policy domain="path" rights="none" pattern="@*" /> -->
  <policy domain="cache" name="shared-secret" value="passphrase"/>
</policymap>

CORRECTION:

Add

<policy domain="path" rights="read|write" pattern="@*" />

Note, I am not sure if "|write" is needed?

see http://www.imagemagick.org/source/policy.xml

[snibgo]

I suspect (though I could be wrong) that "-" from the keyboard is an operating system facility, not an IM facility. I think IM sees "-" and asks the O/S for input from stdin. The O/S then resolves that into a pipe or the keyboard or whatever.

Fred: in XML, <!-- ... --> denote comments, which should be ignored.

[ajfclark]

I suspect (though I could be wrong) that "-" from the keyboard is an operating system facility, not an IM facility. I think IM sees "-" and asks the O/S for input from stdin. The O/S then resolves that into a pipe or the keyboard or whatever.

Fred: in XML, <!-- ... --> denote comments, which should be ignored.

So, if it works on one linux machine it should work on another, right?

on my amd64 machine, when I execute this:

Code: Select all

aclark@corydoras:~$ echo "This is the caption" | convert -background lightblue -fill blue -pointsize 12 -size 320x caption:@- caption_file.gif

The caption appears in the file.

on my armhf machine, when I execute the same command, I get a file with a caption of "@-".

Both machines return the same policy:

Code: Select all

aclark@corydoras:~$ convert -list policy

Path: /etc/ImageMagick-6/policy.xml
  Policy: undefined
    rights: None 

Path: [built-in]
  Policy: Undefined
    rights: None
aclark@corydoras:~$ convert -version
Version: ImageMagick 6.8.9-9 Q16 x86_64 2016-04-08 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2014 ImageMagick Studio LLC
Features: DPC Modules OpenMP
Delegates: bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr ltdl lzma openexr pangocairo png tiff wmf x xml zlib

Code: Select all

pi@raspberrypi:~ $ convert -list policy

Path: /etc/ImageMagick-6/policy.xml
  Policy: undefined
    rights: None 

Path: [built-in]
  Policy: Undefined
    rights: None 
pi@raspberrypi:~ $ convert -version 
Version: ImageMagick 6.8.9-9 Q16 arm 2016-05-16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2014 ImageMagick Studio LLC
Features: DPC Modules OpenMP
Delegates: bzlib cairo djvu fftw fontconfig freetype jbig jng jpeg lcms lqr ltdl lzma openexr pangocairo png rsvg tiff wmf x xml zlib

Should they not have the same behaviour?

[fmw42]

Path: /etc/ImageMagick-6/policy.xml
Policy: undefined
rights: None

This is strange. Perhaps your policy.xml is in another of the possible locations I mentioned earlier as listed in the link.

What do you get from

Code: Select all

convert -list resource

I get

Code: Select all

Resource limits:
  Width: 214.7MP
  Height: 214.7MP
  Area: 4.295GP
  Memory: 2GiB
  Map: 4GiB
  Disk: unlimited
  File: 192
  Thread: 2
  Throttle: 0
  Time: unlimited

So there is a non-empty policy.xml.

If the policies are the same, then I would expect the behavior to be the same.

Do they both work using @filename.txt?

If so, then snibgo may be correct. It would then be a system issue, not Imagemagick.

[ajfclark]

amd64:

Code: Select all

aclark@corydoras:~$ convert -list resource
  File       Area     Memory        Map       Disk   Thread  Throttle       Time
--------------------------------------------------------------------------------
 49152   7.8779GB  3.6684GiB  7.3369GiB  unlimited        4         0  unlimited
aclark@corydoras:~$

armhf:

Code: Select all

pi@raspberrypi:~ $ convert -list resource
  File       Area     Memory        Map       Disk   Thread  Throttle       Time
--------------------------------------------------------------------------------
 49152   1.9416GB   925.8MiB  1.8083GiB  unlimited        4         0  unlimited
pi@raspberrypi:~ $ 

[fmw42]

convert -list policy

Path: /etc/ImageMagick-6/policy.xml
Policy: Unrecognized
rights: None

This is just telling you where your policy.xml file reside, not what is in it. What do you get from

cat /etc/ImageMagick-6/policy.xml

And did you remove the policy.xml file you created at ~/.config/ImageMagick/policy.xml?

Do both systems work with the command from a text file, e.g. using @filename.txt rather than from a pipe to standard in?

If so, then snibgo may be correct. It would then be a system issue, not Imagemagick.