[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Mar 2010 18:16:24 -0800
From: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org, zippel@...ux-m68k.org, mingo@...e.hu,
akpm@...ux-foundation.org, geert@...ux-m68k.org, elendil@...net.nl,
cloos@...loos.com
Subject: Re: [PATCH] kconfig: place git SHA1 in .config output if in SCM
On Tue, Mar 02, 2010 at 05:29:50PM -0800, Linus Torvalds wrote:
>
>
> On Tue, 2 Mar 2010, Paul E. McKenney wrote:
> > + env = getenv(SRCTREE);
> > + if (env) {
> > + sprintf(cmdline,
> > + "%s/scripts/setlocalversion %s 2> /dev/null",
> > + env, env);
> > + slv = popen(cmdline, "r");
>
> I suspect this does various bad things if there are spaces or special
> characters in $SRCTREE.
>
> It would be a lot safer to uses fork/execve rather than something
> that interprets a shell command line.
>
> Of course, I didn't check that all our old users of SRCTREE are safe
> either, but at least docproc.c (the one I _did_ check) uses 'execvp()' and
> 'fopen()' that both take real filenames, not a shell string.
Well, we certainly don't want or need bash's "$", "``", and other
interpretations in this case. I will update and send out a new patch.
Hmmm... It has been one good long time since I have used pipe(), dup2(),
exec*(), and friends. In happy contrast to last time, some of the man
pages now seem to have nice examples. ;-)
Thanx, Paul
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists