summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorPeter Breitenlohner <peb@mppmu.mpg.de>2009-11-12 09:54:24 +0000
committerPeter Breitenlohner <peb@mppmu.mpg.de>2009-11-12 09:54:24 +0000
commitf15a77f41fb15327e9a6d4a06ac6466ede97973a (patch)
tree7917554079f12240eca07d34877888c03a44a004 /Build
parent053401b7265bb24584b0e2534f67dc9be0ccbc4c (diff)
detect badly quoted shell escapes
git-svn-id: svn://tug.org/texlive/trunk@15993 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/web2c/ChangeLog2
-rw-r--r--Build/source/texk/web2c/alephdir/ChangeLog2
-rw-r--r--Build/source/texk/web2c/lib/ChangeLog7
-rw-r--r--Build/source/texk/web2c/lib/texmfmp.c8
4 files changed, 13 insertions, 6 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index 6c4f7e6548e..7cdec44e851 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -13,7 +13,7 @@
* cpascal.h: Add kpse_{in,out}_name_ok().
* bibtex.ch: Check for legitimate output file names.
- From Akira Kakuto <kakuto@fuk.kindai.ac.jp>
+ From Akira Kakuto <kakuto@fuk.kindai.ac.jp>.
Also check for legitimate input file names.
* mf.ch, tex.ch: Use kpse_{in,out}_name_ok(), now in Kpathsea,
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog
index e8ae9ad705b..b149d685082 100644
--- a/Build/source/texk/web2c/alephdir/ChangeLog
+++ b/Build/source/texk/web2c/alephdir/ChangeLog
@@ -2,7 +2,7 @@
* com16bit.ch: Check for allowed filename before opening the
output file. Better diagnostic when input file not found.
- From Akira Kakuto <kakuto@fuk.kindai.ac.jp>
+ From Akira Kakuto <kakuto@fuk.kindai.ac.jp>.
2009-10-24 Peter Breitenlohner <peb@mppmu.mpg.de>
diff --git a/Build/source/texk/web2c/lib/ChangeLog b/Build/source/texk/web2c/lib/ChangeLog
index f2662df6dda..86b52f64282 100644
--- a/Build/source/texk/web2c/lib/ChangeLog
+++ b/Build/source/texk/web2c/lib/ChangeLog
@@ -1,3 +1,10 @@
+2009-11-12 Peter Breitenlohner <peb@mppmu.mpg.de>
+
+ * texmfmp.c (shell_cmd_is_allowed): Check for invalid single
+ quote also within quoted arguments.
+ Reported by Akira Kakuto <kakuto@fuk.kindai.ac.jp>,
+ diagnosed by Manuel P\'egouri\'e-Gonnard <mpg@elzevir.fr>.
+
2009-10-24 Peter Breitenlohner <peb@mppmu.mpg.de>
* texmfmp.c (openinnameok, openoutnameok): Moved to Kpathsea
diff --git a/Build/source/texk/web2c/lib/texmfmp.c b/Build/source/texk/web2c/lib/texmfmp.c
index 063cdfcc621..22d12235fe6 100644
--- a/Build/source/texk/web2c/lib/texmfmp.c
+++ b/Build/source/texk/web2c/lib/texmfmp.c
@@ -330,7 +330,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
pre = 1;
while (*s) {
/* Quotation given by a user. " should always be used; we
- transform it below. On Unix, if ' is used, simply immediately
+ transform it below. If ' is used, simply immediately
return a quotation error. */
if (*s == '\'') {
return -1;
@@ -343,7 +343,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
example:
--format="other text files" becomes
'--format=''other text files' (Unix)
- "--format=""other test files" (Windows) */
+ "--format=""other text files" (Windows) */
if (pre == 0)
*d++ = QUOTE;
@@ -354,8 +354,8 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
s++;
while (*s != '"') {
- /* Closing quotation mark is missing */
- if (*s == '\0')
+ /* Illegal use of ', or closing quotation mark is missing */
+ if (*s == '\'' || *s == '\0')
return -1;
#ifdef WIN32
if (char_needs_quote (*s))