ports/70618: print/a2ps-* using "file -L %s" as shell argument --> dangerous to use it in world-writable directories

[Rudolf Polzer]

The following reply was made to PR ports/70618; it has been noted by GNATS.

From: Rudolf Polzer <polzer at informatik.uni-frankfurt.de>
To: freebsd-gnats-submit at FreeBSD.org
Cc:  
Subject: Re: ports/70618: print/a2ps-* using "file -L %s" as shell argument --> dangerous to use it in world-writable directories
Date: Wed, 18 Aug 2004 17:38:39 +0200

 The patch has a minor bug: in out-of-memory conditions, it attempts to free
 the empty string "". Perhaps one should better return NULL in this case
 and let the other function return NULL, too, that is, change
 
 +  if(!outp)
 +    return ""; /* perhaps one should do better error handling here */
 
 into
 
 +  if(!outp)
 +    return NULL;
 
 and
 
 +  filename = shell_escape(filename);
 
 into
 
 +  filename = shell_escape(filename);
 +  if(filename == NULL)
 +    return NULL;
 
 After that, IIRC
 
 @@ -144,11 +174,13 @@
 
 must be changed into
 
 @@ -144,11 +174,15 @@
 
 Then it should work even then.