Messages in this thread | | | Date | Tue, 2 Mar 2010 18:16:24 -0800 | From | "Paul E. McKenney" <> | Subject | Re: [PATCH] kconfig: place git SHA1 in .config output if in SCM |
| |
On Tue, Mar 02, 2010 at 05:29:50PM -0800, Linus Torvalds wrote: > > > On Tue, 2 Mar 2010, Paul E. McKenney wrote: > > + env = getenv(SRCTREE); > > + if (env) { > > + sprintf(cmdline, > > + "%s/scripts/setlocalversion %s 2> /dev/null", > > + env, env); > > + slv = popen(cmdline, "r"); > > I suspect this does various bad things if there are spaces or special > characters in $SRCTREE. > > It would be a lot safer to uses fork/execve rather than something > that interprets a shell command line. > > Of course, I didn't check that all our old users of SRCTREE are safe > either, but at least docproc.c (the one I _did_ check) uses 'execvp()' and > 'fopen()' that both take real filenames, not a shell string.
Well, we certainly don't want or need bash's "$", "``", and other interpretations in this case. I will update and send out a new patch.
Hmmm... It has been one good long time since I have used pipe(), dup2(), exec*(), and friends. In happy contrast to last time, some of the man pages now seem to have nice examples. ;-)
Thanx, Paul
| |