From owner-freebsd-bugs  Fri Jan 25 13:30:17 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 00E6137B41D
	for <freebsd-bugs@hub.freebsd.org>; Fri, 25 Jan 2002 13:30:02 -0800 (PST)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g0PLU1f33284;
	Fri, 25 Jan 2002 13:30:01 -0800 (PST)
	(envelope-from gnats)
Date: Fri, 25 Jan 2002 13:30:01 -0800 (PST)
Message-Id: <200201252130.g0PLU1f33284@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
Cc: 
From: Giorgos Keramidas <keramida@freebsd.org>
Subject: Re: misc/34270: man -k could be used to execute any command. (fwd)
Reply-To: Giorgos Keramidas <keramida@freebsd.org>
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org

The following reply was made to PR misc/34270; it has been noted by GNATS.

From: Giorgos Keramidas <keramida@freebsd.org>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: misc/34270: man -k could be used to execute any command. (fwd)
Date: Fri, 25 Jan 2002 23:29:04 +0200 (EET)

 Mike Makonnen wrote:
 
 >  > >Fix:
 >  > In do_apropos() in man/man.c, apropos name is only quoted with `"'.
 >  >
 >  >   sprintf (command, "%s \"%s\"", APROPOS, name);
 >  >
 >  > Any special characters for /bin/sh should be escaped with `\'.
 >
 >  I think the command should be single quoted instead of double quoted.
 
     $ pwd
     /c/0/gnu/usr.bin/man/man
     $ ./man -k "echo '; ls'"
     ng_echo(4)               - netgraph echo node type
     CVS             man             man.man         version.h
     Makefile        man.1           man.o
     glob.c          man.1.gz        manpath.o
     glob.o          man.c           ndir.h
 
 Other combinations of man -k arguments can cause all sorts of weird errors:
 
     $ ./man -k "echo \\'; ls\\'"
     Syntax error: Unterminated quoted string
     Error executing formatting or display command.
     system command exited with status 512
 
 -- 
 Giorgos Keramidas . . . . . . . . . keramida@{ceid.upatras.gr,freebsd.org}
 FreeBSD Documentation Project . . . http://www.freebsd.org/docproj/
 FreeBSD: The power to serve . . . . http://www.freebsd.org/
 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message