[pacman-dev] [PATCH] makepkg: fix unguarded use of printf

Eli Schwartz eschwartz at archlinux.org
Thu Jan 10 05:54:33 UTC 2019


paths can contain printf-unsafe chars, and printf -v is not somehow immune to this

Signed-off-by: Eli Schwartz <eschwartz at archlinux.org>
---
 scripts/makepkg.sh.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index 56642b11..a040d384 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -1142,7 +1142,7 @@ fi
 
 # canonicalize paths and provide defaults if anything is still undefined
 for var in PKGDEST SRCDEST SRCPKGDEST LOGDEST BUILDDIR; do
-	printf -v "$var" "$(canonicalize_path "${!var:-$startdir}")"
+	printf -v "$var" '%s' "$(canonicalize_path "${!var:-$startdir}")"
 done
 unset var
 PACKAGER=${PACKAGER:-"Unknown Packager"}
-- 
2.20.1


More information about the pacman-dev mailing list