summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xBuild/source/texk/texlive/runscript.dllbin4608 -> 4608 bytes
-rw-r--r--Build/source/texk/texlive/runscript_dll.c9
-rwxr-xr-xMaster/bin/win32/runscript.dllbin4608 -> 4608 bytes
3 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/texk/texlive/runscript.dll b/Build/source/texk/texlive/runscript.dll
index a46d3977d6d..d1932abc224 100755
--- a/Build/source/texk/texlive/runscript.dll
+++ b/Build/source/texk/texlive/runscript.dll
Binary files differ
diff --git a/Build/source/texk/texlive/runscript_dll.c b/Build/source/texk/texlive/runscript_dll.c
index b961f03714b..bda2370e2e0 100644
--- a/Build/source/texk/texlive/runscript_dll.c
+++ b/Build/source/texk/texlive/runscript_dll.c
@@ -102,7 +102,14 @@ PROGRAM_FOUND:
if ( !cmdline[0] ) {
// batch file has to be executed through the call command in order to propagate its exit code
- strcpy(cmdline, "cmd.exe /c call \"");
+ // command interpreter is taken from the COMSPEC variable
+ // to prevent attacks through writing ./cmd.exe
+ cmdline[0] = '"';
+ if ( !GetEnvironmentVariableA("COMSPEC", &cmdline[1], MAX_PATH) ) {
+ fprintf(stderr, "runscript: failed to read COMSPEC variable\n");
+ return -1;
+ }
+ strcat(cmdline, "\" /c call \"");
strcat(cmdline, path);
strcat(cmdline, "\" ");
}
diff --git a/Master/bin/win32/runscript.dll b/Master/bin/win32/runscript.dll
index a46d3977d6d..d1932abc224 100755
--- a/Master/bin/win32/runscript.dll
+++ b/Master/bin/win32/runscript.dll
Binary files differ