Re: [PATCH 1/2] Custom low-level merge driver support.
- From
Johannes Sixt <j.sixt@eudaptics.com>
- Date
- Apr 18, 2007, 10:36 UTC
- Message-ID
- <4625F4AD.5CDDC502@eudaptics.com>
- In-Reply-To
- <1176888062865-git-send-email-junkio@cox.net>
Junio C Hamano wrote:
Show 8 quoted lines
> + interpolate(cmdbuf, sizeof(cmdbuf), cmd, table, 3); > + > + memset(&child, 0, sizeof(child)); > + child.argv = args; > + args[0] = "sh"; > + args[1] = "-c"; > + args[2] = cmdbuf; > + args[3] = NULL;
If I read the code correctly, there does not happen any shell quoting anywhere; hence, this shell invocation is dangerous.
-- Hannes