https://savannah.gnu.org/bugs/?23922 From 6f3684710a0f832533191f8657a57bc2fbba90ba Mon Sep 17 00:00:00 2001 From: eliz Date: Sat, 7 May 2011 08:29:13 +0000 Subject: [PATCH] job.c (construct_command_argv_internal): Don't assume shellflags is always non-NULL. Escape-protect characters special to the shell when copying the value of SHELL into new_line. Fixes Savannah bug #23922. --- ChangeLog | 7 +++++++ job.c | 23 ++++++++++++++++------- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/job.c b/job.c index 67b402d..c2ce84d 100644 --- a/job.c +++ b/job.c @@ -2844,12 +2844,12 @@ construct_command_argv_internal (char *line, char **restp, char *shell, unsigned int shell_len = strlen (shell); unsigned int line_len = strlen (line); - unsigned int sflags_len = strlen (shellflags); + unsigned int sflags_len = shellflags ? strlen (shellflags) : 0; char *command_ptr = NULL; /* used for batch_mode_shell mode */ char *new_line; # ifdef __EMX__ /* is this necessary? */ - if (!unixy_shell) + if (!unixy_shell && shellflags) shellflags[0] = '/'; /* "/c" */ # endif @@ -2911,19 +2911,28 @@ construct_command_argv_internal (char *line, char **restp, char *shell, new_argv = xmalloc (4 * sizeof (char *)); new_argv[0] = xstrdup(shell); - new_argv[1] = xstrdup(shellflags); + new_argv[1] = xstrdup(shellflags ? shellflags : ""); new_argv[2] = line; new_argv[3] = NULL; return new_argv; } - new_line = alloca (shell_len + 1 + sflags_len + 1 + new_line = alloca ((shell_len*2) + 1 + sflags_len + 1 + (line_len*2) + 1); ap = new_line; - memcpy (ap, shell, shell_len); - ap += shell_len; + /* Copy SHELL, escaping any characters special to the shell. If + we don't escape them, construct_command_argv_internal will + recursively call itself ad nauseam, or until stack overflow, + whichever happens first. */ + for (p = shell; *p != '\0'; ++p) + { + if (strchr (sh_chars, *p) != 0) + *(ap++) = '\\'; + *(ap++) = *p; + } *(ap++) = ' '; - memcpy (ap, shellflags, sflags_len); + if (shellflags) + memcpy (ap, shellflags, sflags_len); ap += sflags_len; *(ap++) = ' '; command_ptr = ap; -- 1.7.12