From e0410112578481cb269b41c754d21cacfe166d44 Mon Sep 17 00:00:00 2001 From: Piotr Strzelczyk Date: Tue, 27 Oct 2009 00:55:36 +0000 Subject: use F:\Software\tcmdle\tcmdle\TCC.EXE for calling batch files to prevent attacks through writing ./cmd.exe git-svn-id: svn://tug.org/texlive/trunk@15896 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/texlive/runscript.dll | Bin 4608 -> 4608 bytes Build/source/texk/texlive/runscript_dll.c | 9 ++++++++- 2 files changed, 8 insertions(+), 1 deletion(-) (limited to 'Build') diff --git a/Build/source/texk/texlive/runscript.dll b/Build/source/texk/texlive/runscript.dll index a46d3977d6d..d1932abc224 100755 Binary files a/Build/source/texk/texlive/runscript.dll and b/Build/source/texk/texlive/runscript.dll differ diff --git a/Build/source/texk/texlive/runscript_dll.c b/Build/source/texk/texlive/runscript_dll.c index b961f03714b..bda2370e2e0 100644 --- a/Build/source/texk/texlive/runscript_dll.c +++ b/Build/source/texk/texlive/runscript_dll.c @@ -102,7 +102,14 @@ PROGRAM_FOUND: if ( !cmdline[0] ) { // batch file has to be executed through the call command in order to propagate its exit code - strcpy(cmdline, "cmd.exe /c call \""); + // command interpreter is taken from the COMSPEC variable + // to prevent attacks through writing ./cmd.exe + cmdline[0] = '"'; + if ( !GetEnvironmentVariableA("COMSPEC", &cmdline[1], MAX_PATH) ) { + fprintf(stderr, "runscript: failed to read COMSPEC variable\n"); + return -1; + } + strcat(cmdline, "\" /c call \""); strcat(cmdline, path); strcat(cmdline, "\" "); } -- cgit v1.2.3