Mail Archives: cygwin/2011/12/01/19:12:52
--------------enig6C4018C9CD604F4284AB036F
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
On 12/01/2011 04:32 PM, Peter Brown wrote:
>>> Yes. Use the mkdir() function. That is, in fact, very similar to how =
it
>>> should be done in Visual Studio too.
I still say using mkdir() is the right solution - use a simple function,
rather than a call to system().
> This seems to work for me.
>=20
> int MySystem(char *s)
> {
> int answer;
> char syscmd[2048];
> sprintf(syscmd,"cmd /c bash -c 'umask 0077;%s'",s);
> answer =3D system( syscmd );
> return answer;
Ouch. A thousand times NOOOOO. DON'T DO THAT. You just made a HUGE
security hole. All I have to do is call:
MySystem("rm -rf /");
and I've nuked your system. Or, I could call MySystem(<string longer
than 2048 bytes>) and stack overflow you. Or any other number of flaws.
And even if those weren't issues, you ruined my quoting. I should be
able to do system("echo 'a b'") and get "a b" on stdout, but the way
you butchered quoting, my single quotes terminate the argument to cmd,
and completely hose things.
You DON'T want to use system() unless absolutely necessary, and then
only with proper quoting. And you don't want to use sprintf on
arbitrary input; stick to snprintf, or to asprintf. And seriously -
calling cmd /c just to call bash just to call commands that will be
interpreted by bash, when you could have just used commands interpreted
by bash to begin with? If system() isn't calling cygwin's /bin/sh, then
you aren't using cygwin properly. Don't make it worse by wrapping
system() to go through another two layers of quoting nightmares.
--=20
Eric Blake eblake AT redhat DOT com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
--------------enig6C4018C9CD604F4284AB036F
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Public key at http://people.redhat.com/eblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBCAAGBQJO2BffAAoJEKeha0olJ0NqmnwH/jCIBTkTC/Ru2bKTFK9Wp6DT
8VzUyVwavt1gPA+MtcDs62vMIFFEJfgxztY1WbDLnzYjnQqtvTibhRum73hYo5zi
4T0KtMRQBgAPuckA1MjIRk+G7p9Pp+/NOK43Wvgzfpresfp3s84rxrBX7TLpRd9f
w/5Q+ytXTR+XZsF2zwcLc5rnoF4AV3TvU/u+NClNlg3doqggLACiFN3H+NCYtJIi
EoEX3nQ1CyfTrx+YyAu1A9eSFqrBPb9ecNP1RnPTeXVTxBKGbaOrQl1KYqawADzw
oMuURicPQDo0qzrZTLE5zfjPYs/5ryQUVJuaCqYXbKlN9e2DwMlXrZkNKN2PW0A=
=aPnL
-----END PGP SIGNATURE-----
--------------enig6C4018C9CD604F4284AB036F--
- Raw text -