[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Mar 2010 17:29:50 -0800 (PST)
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
cc: linux-kernel@...r.kernel.org, zippel@...ux-m68k.org, mingo@...e.hu,
akpm@...ux-foundation.org, geert@...ux-m68k.org, elendil@...net.nl,
cloos@...loos.com
Subject: Re: [PATCH] kconfig: place git SHA1 in .config output if in SCM
On Tue, 2 Mar 2010, Paul E. McKenney wrote:
> + env = getenv(SRCTREE);
> + if (env) {
> + sprintf(cmdline,
> + "%s/scripts/setlocalversion %s 2> /dev/null",
> + env, env);
> + slv = popen(cmdline, "r");
I suspect this does various bad things if there are spaces or special
characters in $SRCTREE.
It would be a lot safer to uses fork/execve rather than something
that interprets a shell command line.
Of course, I didn't check that all our old users of SRCTREE are safe
either, but at least docproc.c (the one I _did_ check) uses 'execvp()' and
'fopen()' that both take real filenames, not a shell string.
Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists