You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

33 lines
1.0 KiB

  1. From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17 00:00:00 2001
  2. From: Andreas Gruenbacher <agruen@gnu.org>
  3. Date: Fri, 6 Apr 2018 19:36:15 +0200
  4. Subject: Invoke ed directly instead of using the shell
  5. * src/pch.c (do_ed_script): Invoke ed directly instead of using a shell
  6. command to avoid quoting vulnerabilities.
  7. ---
  8. src/pch.c | 6 ++----
  9. 1 file changed, 2 insertions(+), 4 deletions(-)
  10. --- a/src/pch.c
  11. +++ b/src/pch.c
  12. @@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char c
  13. *outname_needs_removal = true;
  14. copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
  15. }
  16. - sprintf (buf, "%s %s%s", editor_program,
  17. - verbosity == VERBOSE ? "" : "- ",
  18. - outname);
  19. fflush (stdout);
  20. pid = fork();
  21. @@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char c
  22. else if (pid == 0)
  23. {
  24. dup2 (tmpfd, 0);
  25. - execl ("/bin/sh", "sh", "-c", buf, (char *) 0);
  26. + assert (outname[0] != '!' && outname[0] != '-');
  27. + execlp (editor_program, editor_program, "-", outname, (char *) NULL);
  28. _exit (2);
  29. }
  30. else