gEDA-cvs: pcb.git: branch: master updated (e97a3932e65e936d87f2eb59e3453a9ff4976501)

[git@xxxxxxxxxx]

The branch, master has been updated
       via  e97a3932e65e936d87f2eb59e3453a9ff4976501 (commit)
      from  c0ec7462facd046414734ebd0a65917f67ddcf74 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


=========
 Summary
=========

 src/action.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)


=================
 Commit Messages
=================

commit e97a3932e65e936d87f2eb59e3453a9ff4976501
Author: DJ Delorie <dj@xxxxxxxxxxx>
Commit: DJ Delorie <dj@xxxxxxxxxxx>

    Fix command-injection bug in Import()
    
    Use "--" before the list of schematics, to prevent the src list
    from containing other gnetlist options (or arbitrary guile code)

:100644 100644 d8e631f... 5acd3fd... M	src/action.c

=========
 Changes
=========

commit e97a3932e65e936d87f2eb59e3453a9ff4976501
Author: DJ Delorie <dj@xxxxxxxxxxx>
Commit: DJ Delorie <dj@xxxxxxxxxxx>

    Fix command-injection bug in Import()
    
    Use "--" before the list of schematics, to prevent the src list
    from containing other gnetlist options (or arbitrary guile code)

diff --git a/src/action.c b/src/action.c
index d8e631f..5acd3fd 100644
--- a/src/action.c
+++ b/src/action.c
@@ -7782,20 +7782,21 @@ ActionImport (int argc, char **argv, int x, int y)
 	return 1;
       }
 
-      cmd = (char **) malloc ((6 + nsources) * sizeof (char *));
+      cmd = (char **) malloc ((7 + nsources) * sizeof (char *));
       cmd[0] =  Settings.GnetlistProgram;
       cmd[1] = "-g";
       cmd[2] = "pcbfwd";
       cmd[3] = "-o";
       cmd[4] = tmpfile;
+      cmd[5] = "--";
       for (i=0; i<nsources; i++)
-	cmd[5+i] = sources[i];
-      cmd[5+nsources] = NULL;
+	cmd[6+i] = sources[i];
+      cmd[6+nsources] = NULL;
 
 #ifdef DEBUG
       printf("ActionImport:  ===========  About to run gnetlist  ============\n");
-      printf("%s %s %s %s %s %s ...\n", 
-	     cmd[0], cmd[1], cmd[2], cmd[3], cmd[4], cmd[5]);
+      printf("%s %s %s %s %s %s %s ...\n", 
+	     cmd[0], cmd[1], cmd[2], cmd[3], cmd[4], cmd[5], cmd[6]);
 #endif
 
       if (pcb_spawnvp (cmd))




_______________________________________________
geda-cvs mailing list
geda-cvs@xxxxxxxxxxxxxx
http://www.seul.org/cgi-bin/mailman/listinfo/geda-cvs