Re: FreeCOM example bug: command.c / executes everything

Arkady V.Belousov wrote:

>X-Comment-To: Eric Auer
>
>Hi!
>
>13-=EE=CF=D1-2002 21:06 [email protected] (Eric Auer) wrote to fd-dev@to=
pica.com:
>
>EA> I just noticed a very old bug still to exist.
>EA> In command.c of the most recent FreeCOM:
>EA>   if (stricmp(strrchr(fullname, '.'), ".bat") =3D=3D 0)
>EA>   {
>EA>     dprintf(("[BATCH: %s %s]\n", fullname, rest));
>EA>     batch(fullname, first, rest);
>EA>   }
>EA>   else
>EA>     /* exec the program */
>EA> ... no tests at all if it is called .com or .exe ! ...
>EA>     result =3D exec(fullname, rest, 0);
>EA> ...
>EA> So if you accidentally tab-complete on program.txt and then hit enter,=

>EA> a nice juicy crash will hit you back.
>
>1. MS command.com runs only files with extension .bat, .com and .exe.
>
This is exactly what he's saying. This bug would allow files with OTHER=20
extensions to be executed (there's no checking other than for a .bat=20
extension, so a .txt file could be erroneously executed!).

>2. You may verify that file is real .EXE by  checking sugnature, but you
>   can't distinguish files with forma of .COM, .BAT or any other format.
>3. Distinguishing between .COM and .EXE _formats_ (not extensions!)
>   performed by kernel, shell should only filter out files with .BAT (and
>   .BTM for 4DOS/NDOS) extension.
>
The shell should also filter out any files that don't have one of those=20
3 extensions.