From b4ee93a0a6435f8ed98a7d18a3af4d7bd5bb592a Mon Sep 17 00:00:00 2001 From: Piotr Strzelczyk Date: Wed, 28 Oct 2009 01:34:13 +0000 Subject: search cmd.exe on PATH instead of COMSPEC git-svn-id: svn://tug.org/texlive/trunk@15897 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/texlive/runscript.dll | Bin 4608 -> 5120 bytes Build/source/texk/texlive/runscript_dll.c | 19 +++++++++++++++---- 2 files changed, 15 insertions(+), 4 deletions(-) (limited to 'Build') diff --git a/Build/source/texk/texlive/runscript.dll b/Build/source/texk/texlive/runscript.dll index d1932abc224..9262bd27cff 100755 Binary files a/Build/source/texk/texlive/runscript.dll and b/Build/source/texk/texlive/runscript.dll differ diff --git a/Build/source/texk/texlive/runscript_dll.c b/Build/source/texk/texlive/runscript_dll.c index bda2370e2e0..ed399a9e0b2 100644 --- a/Build/source/texk/texlive/runscript_dll.c +++ b/Build/source/texk/texlive/runscript_dll.c @@ -44,6 +44,7 @@ static char dirname[MAX_PATH]; static char basename[MAX_PATH]; static char progname[MAX_PATH]; static char cmdline[MAX_CMD]; +char *envpath; __declspec(dllexport) int dllrunscript( int argc, char *argv[] ) { int i; @@ -102,11 +103,21 @@ PROGRAM_FOUND: if ( !cmdline[0] ) { // batch file has to be executed through the call command in order to propagate its exit code - // command interpreter is taken from the COMSPEC variable - // to prevent attacks through writing ./cmd.exe + // cmd.exe is searched for only on PATH to prevent attacks through writing ./cmd.exe + envpath = (char *) getenv("PATH"); + if ( !envpath ) { + fprintf(stderr, "runscript: failed to read PATH variable\n"); + return -1; + } cmdline[0] = '"'; - if ( !GetEnvironmentVariableA("COMSPEC", &cmdline[1], MAX_PATH) ) { - fprintf(stderr, "runscript: failed to read COMSPEC variable\n"); + if ( !SearchPathA( envpath, /* Address of search path */ + "cmd.exe", /* Address of filename */ + NULL, /* Address of extension */ + MAX_PATH, /* Size of destination buffer */ + &cmdline[1], /* Address of destination buffer */ + NULL) /* File part of the full path */ + ) { + fprintf(stderr, "runscript: cmd.exe not found on PATH\n"); return -1; } strcat(cmdline, "\" /c call \""); -- cgit v1.2.3