Apply patch from Debian Security Team for CAN-2004-1184.

[enscript.git] / src / main.c

diff --git a/src/main.c b/src/main.c
index 5dc857f..48c42fb 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -6,22 +6,20 @@
  */
 
 /*
- * This file is part of GNU enscript.
+ * This file is part of GNU Enscript.
  *
- * This program is free software; you can redistribute it and/or modify
+ * Enscript is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2, or (at your option)
- * any later version.
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
  *
- * This program is distributed in the hope that it will be useful,
+ * Enscript is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; see the file COPYING.  If not, write to
- * the Free Software Foundation, 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * along with Enscript.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "gsint.h"
@@ -1129,10 +1127,10 @@ _("library directory.")));
     }
 
   /* Site config. */
-  (void) read_config (SYSCONFDIR, "enscriptsite.cfg");
+  read_config (SYSCONFDIR, "enscriptsite.cfg");
 
   /* Personal config. */
-  (void) read_config (passwd->pw_dir, ".enscriptrc");
+  read_config (cp, ".enscriptrc");
 
   /*
    * Options.
@@ -1546,9 +1544,13 @@ name             width\theight\tllx\tlly\turx\tury\n\
       buffer_append (&cmd, intbuf);
       buffer_append (&cmd, " ");
 
-      buffer_append (&cmd, "-Ddocument_title=\"");
-      buffer_append (&cmd, title);
-      buffer_append (&cmd, "\" ");
+      buffer_append (&cmd, "-Ddocument_title=\'");
+      if ((cp = shell_escape (title)) != NULL)
+       {
+         buffer_append (&cmd, cp);
+         free (cp);
+       }
+      buffer_append (&cmd, "\' ");
 
       buffer_append (&cmd, "-Dtoc=");
       buffer_append (&cmd, toc ? "1" : "0");
@@ -1565,8 +1567,14 @@ name             width\theight\tllx\tlly\turx\tury\n\
       /* Append input files. */
       for (i = optind; i < argc; i++)
        {
-         buffer_append (&cmd, " ");
-         buffer_append (&cmd, argv[i]);
+         char *cp;
+         if ((cp = shell_escape (argv[i])) != NULL)
+           {
+             buffer_append (&cmd, " \'");
+             buffer_append (&cmd, cp);
+             buffer_append (&cmd, "\'");
+             free (cp);
+           }
        }
 
       /* And do the job. */
@@ -1627,7 +1635,7 @@ name             width\theight\tllx\tlly\turx\tury\n\
                                 buffer_ptr (opts), buffer_len (opts));
            }
 
-         buffer_append (&buffer, " \"%s\"");
+         buffer_append (&buffer, " \'%s\'");
 
          input_filter = buffer_copy (&buffer);
          input_filter_stdin = "-";