detect badly quoted shell escapes

git-svn-id: svn://tug.org/texlive/trunk@15993 c570f23f-e606-0410-a88d-b1316a301751

4 files changed, 13 insertions, 6 deletions

diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index 6c4f7e6548e..7cdec44e851 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -13,7 +13,7 @@
 	* cpascal.h: Add kpse_{in,out}_name_ok().
 
 	* bibtex.ch: Check for legitimate output file names.
-	From  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+	From  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>.
 	Also check for legitimate input file names.
 
 	* mf.ch, tex.ch: Use kpse_{in,out}_name_ok(), now in Kpathsea,
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog
index e8ae9ad705b..b149d685082 100644
--- a/Build/source/texk/web2c/alephdir/ChangeLog
+++ b/Build/source/texk/web2c/alephdir/ChangeLog
@@ -2,7 +2,7 @@
 
 	* com16bit.ch: Check for allowed filename before opening the
 	output file. Better diagnostic when input file not found.
-	From  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+	From  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>.
 
 2009-10-24  Peter Breitenlohner  <peb@mppmu.mpg.de>
 
diff --git a/Build/source/texk/web2c/lib/ChangeLog b/Build/source/texk/web2c/lib/ChangeLog
index f2662df6dda..86b52f64282 100644
--- a/Build/source/texk/web2c/lib/ChangeLog
+++ b/Build/source/texk/web2c/lib/ChangeLog
@@ -1,3 +1,10 @@
+2009-11-12  Peter Breitenlohner  <peb@mppmu.mpg.de>
+
+	* texmfmp.c (shell_cmd_is_allowed): Check for invalid single
+	quote also within quoted arguments.
+	Reported by Akira Kakuto <kakuto@fuk.kindai.ac.jp>,
+	diagnosed by Manuel P\'egouri\'e-Gonnard <mpg@elzevir.fr>.
+
 2009-10-24  Peter Breitenlohner  <peb@mppmu.mpg.de>
 
 	* texmfmp.c (openinnameok, openoutnameok): Moved to Kpathsea
diff --git a/Build/source/texk/web2c/lib/texmfmp.c b/Build/source/texk/web2c/lib/texmfmp.c
index 063cdfcc621..22d12235fe6 100644
--- a/Build/source/texk/web2c/lib/texmfmp.c
+++ b/Build/source/texk/web2c/lib/texmfmp.c
@@ -330,7 +330,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
     pre = 1;
     while (*s) {
       /* Quotation given by a user.  " should always be used; we
-         transform it below.  On Unix, if ' is used, simply immediately
+         transform it below.  If ' is used, simply immediately
          return a quotation error.  */
       if (*s == '\'') {
         return -1;
@@ -343,7 +343,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
            example:
            --format="other text files" becomes
            '--format=''other text files' (Unix)
-           "--format=""other test files" (Windows) */
+           "--format=""other text files" (Windows) */
 
         if (pre == 0)
           *d++ = QUOTE;
@@ -354,8 +354,8 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
         s++;
 
         while (*s != '"') {
-          /* Closing quotation mark is missing */
-          if (*s == '\0')
+          /* Illegal use of ', or closing quotation mark is missing */
+          if (*s == '\'' || *s == '\0')
             return -1;
 #ifdef WIN32
           if (char_needs_quote (*s))