- regarding http://securitytracker.com/alerts/2004/Dec/1012475.html sec. patch

Changed files:
    a2ps-CAN-2004-1170.patch -> 1.1

diff --git a/a2ps-CAN-2004-1170.patch b/a2ps-CAN-2004-1170.patch
new file mode 100644 (file)
index 0000000..20971d5
--- /dev/null
+++ b/a2ps-CAN-2004-1170.patch
@@ -0,0 +1,58 @@
+diff -urN a2ps-4.13.orig/src/select.c a2ps-4.13/src/select.c
+--- a2ps-4.13.orig/src/select.c        2004-12-13 14:32:29.582879216 +0100
++++ a2ps-4.13/src/select.c     2004-12-13 14:33:42.773752512 +0100
+@@ -131,6 +131,36 @@
+   return 1;
+ }
+ \f
++/* escapes the name of a file so that the shell groks it in 'single' q.marks. 
++   The resulting pointer has to be free()ed when not longer used. */
++char *
++shell_escape(const char *fn)
++{
++  size_t len = 0;
++  const char *inp;
++  char *retval, *outp;
++
++  for(inp = fn; *inp; ++inp)
++    switch(*inp)
++    {
++      case '\'': len += 4; break;
++      default:   len += 1; break;
++    }
++
++  outp = retval = malloc(len + 1);
++  if(!outp)
++    return NULL; /* perhaps one should do better error handling here */
++  for(inp = fn; *inp; ++inp)
++    switch(*inp)
++    {
++      case '\'': *outp++ = '\''; *outp++ = '\\'; *outp++ = '\'', *outp++ = '\''; break;
++      default:   *outp++ = *inp; break;
++    }
++  *outp = 0;
++
++  return retval;
++}
++\f
+ /* What says file about the type of a file (result is malloc'd).  NULL
+   if could not be run.  */
+ 
+@@ -144,11 +174,15 @@
+   if (IS_EMPTY (job->file_command))
+     return NULL;
+ 
++  filename = shell_escape(filename);
++  if(filename == NULL)
++    return NULL;
+   /* Call file(1) with the correct option */
+-  command = ALLOCA (char, (2
++  command = ALLOCA (char, (4
+                          + strlen (job->file_command)
+                          + ustrlen (filename)));
+-  sprintf (command, "%s %s", job->file_command, (const char *) filename);
++  sprintf (command, "%s '%s'", job->file_command, (const char *) filename);
++  free(filename);
+   message (msg_tool, (stderr, "Reading pipe: `%s'\n", command));
+   file_out = popen (command, "r");
+