From dec92bf703ae73b86a6599e74dfd80a1edd702fe Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 4 Sep 2023 08:23:44 -0400
Subject: [PATCH] some say BMP and TIFF images "web safe"

---
 MagickCore/module.c       | 1 +
 config/policy-websafe.xml | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/MagickCore/module.c b/MagickCore/module.c
index f53470d786..2566ed1f08 100644
--- a/MagickCore/module.c
+++ b/MagickCore/module.c
@@ -1259,6 +1259,7 @@ MagickPrivate MagickBooleanType OpenModule(const char *module,
   p=GetCoderInfo(module,exception);
   if (p != (CoderInfo *) NULL)
     (void) CopyMagickString(module_name,p->name,MagickPathExtent);
+  LocaleUpper(module_name);
   rights=(PolicyRights) (ReadPolicyRights | WritePolicyRights);
   if (IsRightsAuthorized(ModulePolicyDomain,rights,module_name) == MagickFalse)
     {
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index ca6c58c412..e267a5d881 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -91,7 +91,8 @@
   <!-- Deny all image modules and specifically exempt reading or writing
        web-safe image formats. -->
   <policy domain="module" rights="none" pattern="*" />
-  <policy domain="module" rights="read | write" pattern="{GIF,JPEG,MPC,PNG,WEBP}" />
+  <policy domain="module" rights="read | write" pattern="{BMP,GIF,JPEG,PNG,TIFF,WEBP}"/>
+  <policy domain="module" rights="read | write" pattern="{MPC}" stealth="true"/>
   <!-- This policy sets the number of times to replace content of certain
        memory buffers and temporary files before they are freed or deleted. -->
   <policy domain="system" name="shred" value="1"/>