diff options
| -rwxr-xr-x | Build/source/texk/texlive/runscript.dll | bin | 4608 -> 4608 bytes | |||
| -rw-r--r-- | Build/source/texk/texlive/runscript_dll.c | 9 | ||||
| -rwxr-xr-x | Master/bin/win32/runscript.dll | bin | 4608 -> 4608 bytes |
3 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/texk/texlive/runscript.dll b/Build/source/texk/texlive/runscript.dll Binary files differindex a46d3977d6d..d1932abc224 100755 --- a/Build/source/texk/texlive/runscript.dll +++ b/Build/source/texk/texlive/runscript.dll diff --git a/Build/source/texk/texlive/runscript_dll.c b/Build/source/texk/texlive/runscript_dll.c index b961f03714b..bda2370e2e0 100644 --- a/Build/source/texk/texlive/runscript_dll.c +++ b/Build/source/texk/texlive/runscript_dll.c @@ -102,7 +102,14 @@ PROGRAM_FOUND: if ( !cmdline[0] ) { // batch file has to be executed through the call command in order to propagate its exit code - strcpy(cmdline, "cmd.exe /c call \""); + // command interpreter is taken from the COMSPEC variable + // to prevent attacks through writing ./cmd.exe + cmdline[0] = '"'; + if ( !GetEnvironmentVariableA("COMSPEC", &cmdline[1], MAX_PATH) ) { + fprintf(stderr, "runscript: failed to read COMSPEC variable\n"); + return -1; + } + strcat(cmdline, "\" /c call \""); strcat(cmdline, path); strcat(cmdline, "\" "); } diff --git a/Master/bin/win32/runscript.dll b/Master/bin/win32/runscript.dll Binary files differindex a46d3977d6d..d1932abc224 100755 --- a/Master/bin/win32/runscript.dll +++ b/Master/bin/win32/runscript.dll |