summaryrefslogtreecommitdiff
path: root/Build/source/texk/web2c/lib
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/texk/web2c/lib')
-rw-r--r--Build/source/texk/web2c/lib/ChangeLog7
-rw-r--r--Build/source/texk/web2c/lib/texmfmp.c8
2 files changed, 11 insertions, 4 deletions
diff --git a/Build/source/texk/web2c/lib/ChangeLog b/Build/source/texk/web2c/lib/ChangeLog
index f2662df6dda..86b52f64282 100644
--- a/Build/source/texk/web2c/lib/ChangeLog
+++ b/Build/source/texk/web2c/lib/ChangeLog
@@ -1,3 +1,10 @@
+2009-11-12 Peter Breitenlohner <peb@mppmu.mpg.de>
+
+ * texmfmp.c (shell_cmd_is_allowed): Check for invalid single
+ quote also within quoted arguments.
+ Reported by Akira Kakuto <kakuto@fuk.kindai.ac.jp>,
+ diagnosed by Manuel P\'egouri\'e-Gonnard <mpg@elzevir.fr>.
+
2009-10-24 Peter Breitenlohner <peb@mppmu.mpg.de>
* texmfmp.c (openinnameok, openoutnameok): Moved to Kpathsea
diff --git a/Build/source/texk/web2c/lib/texmfmp.c b/Build/source/texk/web2c/lib/texmfmp.c
index 063cdfcc621..22d12235fe6 100644
--- a/Build/source/texk/web2c/lib/texmfmp.c
+++ b/Build/source/texk/web2c/lib/texmfmp.c
@@ -330,7 +330,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
pre = 1;
while (*s) {
/* Quotation given by a user. " should always be used; we
- transform it below. On Unix, if ' is used, simply immediately
+ transform it below. If ' is used, simply immediately
return a quotation error. */
if (*s == '\'') {
return -1;
@@ -343,7 +343,7 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
example:
--format="other text files" becomes
'--format=''other text files' (Unix)
- "--format=""other test files" (Windows) */
+ "--format=""other text files" (Windows) */
if (pre == 0)
*d++ = QUOTE;
@@ -354,8 +354,8 @@ shell_cmd_is_allowed (const char *cmd, char **safecmd, char **cmdname)
s++;
while (*s != '"') {
- /* Closing quotation mark is missing */
- if (*s == '\0')
+ /* Illegal use of ', or closing quotation mark is missing */
+ if (*s == '\'' || *s == '\0')
return -1;
#ifdef WIN32
if (char_needs_quote (*s))