summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPiotr Strzelczyk <piotr@eps.gda.pl>2009-10-27 00:55:36 +0000
committerPiotr Strzelczyk <piotr@eps.gda.pl>2009-10-27 00:55:36 +0000
commite0410112578481cb269b41c754d21cacfe166d44 (patch)
treed6abcc624649e681d56adc0006426e090c1e883a
parent09ae40456087bb2dbf9771bfb7c1a450c6fc9c2f (diff)
use F:\Software\tcmdle\tcmdle\TCC.EXE for calling batch files to prevent attacks through writing ./cmd.exe
git-svn-id: svn://tug.org/texlive/trunk@15896 c570f23f-e606-0410-a88d-b1316a301751
-rwxr-xr-xBuild/source/texk/texlive/runscript.dllbin4608 -> 4608 bytes
-rw-r--r--Build/source/texk/texlive/runscript_dll.c9
-rwxr-xr-xMaster/bin/win32/runscript.dllbin4608 -> 4608 bytes
3 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/texk/texlive/runscript.dll b/Build/source/texk/texlive/runscript.dll
index a46d3977d6d..d1932abc224 100755
--- a/Build/source/texk/texlive/runscript.dll
+++ b/Build/source/texk/texlive/runscript.dll
Binary files differ
diff --git a/Build/source/texk/texlive/runscript_dll.c b/Build/source/texk/texlive/runscript_dll.c
index b961f03714b..bda2370e2e0 100644
--- a/Build/source/texk/texlive/runscript_dll.c
+++ b/Build/source/texk/texlive/runscript_dll.c
@@ -102,7 +102,14 @@ PROGRAM_FOUND:
if ( !cmdline[0] ) {
// batch file has to be executed through the call command in order to propagate its exit code
- strcpy(cmdline, "cmd.exe /c call \"");
+ // command interpreter is taken from the COMSPEC variable
+ // to prevent attacks through writing ./cmd.exe
+ cmdline[0] = '"';
+ if ( !GetEnvironmentVariableA("COMSPEC", &cmdline[1], MAX_PATH) ) {
+ fprintf(stderr, "runscript: failed to read COMSPEC variable\n");
+ return -1;
+ }
+ strcat(cmdline, "\" /c call \"");
strcat(cmdline, path);
strcat(cmdline, "\" ");
}
diff --git a/Master/bin/win32/runscript.dll b/Master/bin/win32/runscript.dll
index a46d3977d6d..d1932abc224 100755
--- a/Master/bin/win32/runscript.dll
+++ b/Master/bin/win32/runscript.dll
Binary files differ