notgne2/tuxpaint-pencil-sharpener
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't crash on un-wordexp()'able arguments!

Browse source 
We run shell expansion on configuration arguments,
e.g. `printcommand`, but it would crash if the config
file's input was not quoted, e.g.

  printcommand=pstopdf - - > $HOME/print.pdf

Now echo'ing an error to stderr and moving on.
Be sure to quote, e.g.

  printcommand="pstopdf - - > $HOME/print.pdf"
This commit is contained in:
Bill Kendrick 2023-06-03 14:10:13 -07:00
parent 0e359a1fba
commit fe33acc716
2 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/CHANGES.txt
View file

@ -94,6 +94,12 @@ https://tuxpaint.org/
data beyond the end of the data (copied from the original PNG).
Bill Kendrick <bill@newbreedsoftware.com>
* Shell expansion (via wordexp()) of configuration options containing
spaces (e.g., `printcommand=ps2pdf - - > $HOME/print.pdf`) would
fail & cause a crash. It now shows an error and recommends adding
quotes. (e.g., `printcommand="ps2pdf - - > $HOME/print.pdf"`)
Bill Kendrick <bill@newbreedsoftware.com>
* Localization Updates:
---------------------
* Russian translaton

17
src/tuxpaint.c
View file

@ -22,7 +22,7 @@
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
(See COPYING.txt)
June 14, 2002 - June 1, 2023
June 14, 2002 - June 3, 2023
*/
#include "platform.h"
@ -19648,6 +19648,8 @@ void do_print(void)
else
pcmd = printcommand;
DEBUG_PRINTF("printcmd: %s\n", printcommand);
pi = popen(pcmd, "w");
if (pi == NULL)
@ -27752,8 +27754,17 @@ static void parse_file_options(struct cfginfo *restrict tmpcfg, const char *file
wordexp_t result;
wordexp(arg, &result, 0);
arg = strdup(result.we_wordv[0]);
wordfree(&result);
if (result.we_wordv != NULL)
{
DEBUG_PRINTF("wordexp result.we_wordv of `%s` was `%s`\n", str, result.we_wordv[0]);
arg = strdup(result.we_wordv[0]);
wordfree(&result);
}
else
{
fprintf(stderr, "Shell expansion of `%s` failed! (You probably need to wrap it in quotes (\")!)\n", str);
continue;
}
#endif
#endif