Messages in this thread | | | Date | Tue, 2 Mar 2010 17:29:50 -0800 (PST) | From | Linus Torvalds <> | Subject | Re: [PATCH] kconfig: place git SHA1 in .config output if in SCM |
| |
On Tue, 2 Mar 2010, Paul E. McKenney wrote: > + env = getenv(SRCTREE); > + if (env) { > + sprintf(cmdline, > + "%s/scripts/setlocalversion %s 2> /dev/null", > + env, env); > + slv = popen(cmdline, "r");
I suspect this does various bad things if there are spaces or special characters in $SRCTREE.
It would be a lot safer to uses fork/execve rather than something that interprets a shell command line.
Of course, I didn't check that all our old users of SRCTREE are safe either, but at least docproc.c (the one I _did_ check) uses 'execvp()' and 'fopen()' that both take real filenames, not a shell string.
Linus
| |