[PATCH] scripts: don't source auto.conf for LOCALVERSION

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



setlocalversion currently sources auto.conf to get a value for
CONFIG_LOCALVERSION. This interprets auto.conf as a bash script,
causing CONFIG_LOCALVERSION="`rm -rf --no-preserve-root /`" to
actually execute the command inside the backticks
when setlocalversion is called.
While the possibility of something like this happening is remote,
use sed to avoid potential harm from untrusted .config files.

Reported-by: Fox Wilson <foxwilson123@xxxxxxxxx>
Signed-off-by: Peter Foley <pefoley2@xxxxxxxxxxx>
---
 scripts/setlocalversion | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 63d91e2..5b00123 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -141,7 +141,7 @@ if $scm_only; then
 fi
 
 if test -e include/config/auto.conf; then
-	. include/config/auto.conf
+	CONFIG_LOCALVERSION=$(sed -n 's/CONFIG_LOCALVERSION="\(.*\)"/\1/p' include/config/auto.conf)
 else
 	echo "Error: kernelrelease not valid - run 'make prepare' to update it"
 	exit 1
-- 
2.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux&nblp;USB Development]     [Linux Media]     [Video for Linux]     [Linux Audio Users]     [Yosemite Secrets]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux