File: Handle-escapes-in-job-input.patch

package info (click to toggle)
cron 3.0pl1-197
  • links: PTS, VCS
  • area: main
  • in suites: trixie
  • size: 3,816 kB
  • sloc: ansic: 54,879; xml: 1,600; perl: 733; sh: 463; makefile: 446; python: 43
file content (58 lines) | stat: -rw-r--r-- 1,566 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
From: Christian Kastner <ckk@kvr.at>
Date: Tue, 22 Dec 2015 22:14:53 +0100
Subject: Handle escapes in job input

Certain escape sequences are not handled correctly. Fix supplied by Topi
Miettinen, with OpenBSD indicated as the original source of it.

Bug-Debian: https://bugs.debian.org/8499
Forwarded: no
Last-Update: 2015-12-22
---
 do_command.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/do_command.c b/do_command.c
index f18f670..73362a6 100644
--- a/do_command.c
+++ b/do_command.c
@@ -123,13 +123,21 @@ child_process(e, u)
 	 * command, and subsequent characters are the additional input to
 	 * the command.  Subsequent %'s will be transformed into newlines,
 	 * but that happens later.
+	 *
+	 * If there are escaped %'s, remove the escape character.
 	 */
 	/*local*/{
 		register int escaped = FALSE;
 		register int ch;
+		register char *p;
 
-		for (input_data = e->cmd;  ch = *input_data;  input_data++) {
+		for (input_data = p = e->cmd; (ch = *input_data);
+		    input_data++, p++) {
+			if (p != input_data)
+				*p = ch;
 			if (escaped) {
+				if (ch == '%' || ch == '\\')
+					*--p = ch;
 				escaped = FALSE;
 				continue;
 			}
@@ -142,6 +150,7 @@ child_process(e, u)
 				break;
 			}
 		}
+		*p = '\0';
 	}
 
 	/* fork again, this time so we can exec the user's command.
@@ -298,7 +307,7 @@ child_process(e, u)
 		 *	%  -> \n
 		 *	\x -> \x	for all x != %
 		 */
-		while (ch = *input_data++) {
+		while ((ch = *input_data++) != '\0') {
 			if (escaped) {
 				if (ch != '%')
 					putc('\\', out);