1
0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-09 06:51:44 +00:00
freebsd-ports/print/a2ps-letter/files/patch-select.c
Dirk Meyer 1657de8a03 - Security Fix
Possible execution of shell commands as local user
PR:		70618
Submitted by:	Rudolf Polzer
2004-08-21 10:22:16 +00:00

58 lines
1.5 KiB
C
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

--- src/select.c.orig Thu Dec 16 02:04:56 1999
+++ src/select.c Sat Aug 21 12:05:31 2004
@@ -131,6 +131,36 @@
return 1;
}
+/* escapes the name of a file so that the shell groks it in 'single' q.marks.
+ The resulting pointer has to be free()ed when not longer used. */
+char *
+shell_escape(const char *fn)
+{
+ size_t len = 0;
+ const char *inp;
+ char *retval, *outp;
+
+ for(inp = fn; *inp; ++inp)
+ switch(*inp)
+ {
+ case '\'': len += 4; break;
+ default: len += 1; break;
+ }
+
+ outp = retval = malloc(len + 1);
+ if(!outp)
+ return NULL; /* perhaps one should do better error handling here */
+ for(inp = fn; *inp; ++inp)
+ switch(*inp)
+ {
+ case '\'': *outp++ = '\''; *outp++ = '\\'; *outp++ = '\'', *outp++ = '\''; break;
+ default: *outp++ = *inp; break;
+ }
+ *outp = 0;
+
+ return retval;
+}
+
/* What says file about the type of a file (result is malloc'd). NULL
if could not be run. */
@@ -144,11 +174,15 @@
if (IS_EMPTY (job->file_command))
return NULL;
+ filename = shell_escape(filename);
+ if(filename == NULL)
+ return NULL;
/* Call file(1) with the correct option */
- command = ALLOCA (char, (2
+ command = ALLOCA (char, (4
+ strlen (job->file_command)
+ ustrlen (filename)));
- sprintf (command, "%s %s", job->file_command, (const char *) filename);
+ sprintf (command, "%s '%s'", job->file_command, (const char *) filename);
+ free(filename);
message (msg_tool, (stderr, "Reading pipe: `%s'\n", command));
file_out = popen (command, "r");