This bug is https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140815 originally. The new sanity checks prevent using file names that start with a "/" which along with other checks wouldn't let you use libXpm to write files that aren't in or beneath the process's current working directory. Not exactly what you want if you use it e.g. from the GIMP's xpm load/save plugin. Altogether, these checks seem to me to have the intention of working around missing similar checks in calling applications (just a rough guess) but in this instance I think it's obvious that the fixes have to be done in the applications themselves to avoid regressions.
Created attachment 1407 [details] [review] Patch to remove extraneous test
Please make sure this gets applied to 6.8 stable branch also.
Created attachment 1454 [details] [review] xpm-sec9.diff Unfortunately 1407 was not sufficient for me. You need this one as well. :-(
Hello Nils, yes you are absolutely right. These checks should be part of the application not the library.
This is handled by the patch in #1920 commited to the trunk.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.