Bug#53320: ppd-gs: shell scripting bugs in update-ppd and install-ppd

[dhd <dhd@eradicator.org>]

Package: ppd-gs
Version: 1.1-1.1
Severity: normal

There are many shell scripting errors in update-ppd and install-ppd.
update-ppd in particular basically doesn't work, particularly if you use ash
rather than bash as your shell (it is *not* legal to use 'trap' with no list
of signals in ash - use 'trap "foo" 0' instead).

Also tempfiles are being created in a rather insecure manner.

Finally I don't see why you write your own 'which' and 'dirname' since they
are part of required packages. Particularly when they don't work right (the
'set - $PATH' construct does not work in current bash or ash, in fact I
wonder if it ever did).

Here are some patches that should fix most of the problems:

--- update-ppd.orig	Wed Dec 22 19:51:58 1999
+++ update-ppd	Wed Dec 22 19:52:16 1999
@@ -4,22 +4,6 @@
 #
 # Yves Arrouye <Yves.Arrouye@marin.fdn.fr>, 1996
 
-which() {
-    prog=$1
-    save_ifs="$IFS"; IFS=:
-    set - ..:$PATH
-    for d
-    do
-	if [ -x $d/$prog ]
-	then
-	    echo $d/$prog
-	    break
-	fi
-    done
-    IFS="$save_ifs"
-    unset save_ifs prog
-}
-
 # Please 2>/dev/null your calls to the listppd function.
 
 listppd() {
@@ -52,8 +36,6 @@
 
 me=`basename $0`
 
-trap "rm -f /tmp/$me.$$.updt"
-
 usage() {
     >&2 echo usage: "$me [ -v, --verbose ] [ -i, --interactive ] [ --dontlocalize ] [ --iff-gs ] [ --iff-writable ] [ -a, --any-ppd ] [ -g, --gs-ppd ] [ -n, --nongs-ppd ] [ -b, --bg-update ] [ --signature sig ] [ -d, --destdir directory ] [ ppd-file ... ]"
     exit 1
@@ -249,7 +231,7 @@
     then
         echon "Locating installed PPD files... "
     fi
-    ppdfiles=`2>/dev/null listppd`
+    ppdfiles=`listppd 2>/dev/null`
     if [ ! -z "$interactive" ]
     then
 	echo done
@@ -292,6 +274,8 @@
 
 if [ ! -z "$ppdfiles" ]
 then
+    tempfile=`tempfile --prefix ppdgs --suffix .updt`
+    trap "rm -f $tempfile" 1 2 8 13 14 15
     if [ ! -z "$interactive" ]
     then
 	yorn y 'Would you like to adapt your PPD files to your installation?'
@@ -328,11 +312,12 @@
 	then
 	    if [ ! -z "$mail" ]
 	    then
+		trap "rm -f $tempfile" 0
 		errlogexpl="you will receive a mail if there are some errors
 during the update"
 	    else
 		errlogexpl="a log of errors occuring during the update will be
-available as \`/tmp/$me.$$.updt'."
+available as \`$tempfile'"
 	    fi
 	    yorn $background "The adaptation of the PPD files may take some time. Do you want it to be
 run in the backgound ($errlogexpl)?" 'Background update of PPD files?'
@@ -342,23 +327,21 @@
 	then
 	    (
 	  	install-ppd $iopts $gsopts $ppdfiles \
-	     	    >/dev/null 2>/tmp/$me.$$.updt;
-	     	if [ -s /tmp/$me.$$.updt ]
+	     	    >/dev/null 2>$tempfile
+	     	if [ -s $tempfile ]
 		then
 		    if [ ! -z "$mail" ]
 		    then
-		        cat <<EOM | $mail \
-			    -s 'Messages during PPD files adaptation' `whoami`
+		        $mail -s 'Messages during PPD files adaptation' `whoami` <<EOF
 The adaptation of your PPD files yielded the following messages:
 
-`cat /tmp/$me.$$.updt`
+`cat $tempfile`
 
 Hope these messages are clear enough...
 $signature
-EOM
+EOF
 		    fi
 		fi
-		rm -f /tmp/$me.$$.updt
 	    ) &
 	    if [ ! -z "$interactive" ]
 	    then


--- install-ppd.orig	Wed Dec 22 19:51:50 1999
+++ install-ppd	Wed Dec 22 19:57:09 1999
@@ -21,11 +21,11 @@
 
 me=`basename $0`
 
-sedscript=/tmp/$me.$$.sed
-psfile=/tmp/$me.$$.ps
-tmpdest=/tmp/$me.$$.tmp
+sedscript=`tempfile --prefix insgs --suffix .sed`
+psfile=`tempfile --prefix insgs --suffix .ps`
+tmpdest=`tempfile --prefix insgs --suffix .tmp`
 
-trap "rm -f $sedscript $psfile $tmpdest; >&2 echo Interrupted..."
+trap "rm -f $sedscript $psfile $tmpdest; >&2 echo Interrupted... " 1 2 8 13 14 15
 
 usage() {
     >&2 echo "usage: $me [ --dontlocalize ] [ --dontchange ] [ -l, --locales localespath ] [ -v, --verbose ] [ -p, --paper papersize ] [ -t, --testdir test-dir ] [ -d, --destdir install-dir ] ppd-file ..."
@@ -79,34 +79,6 @@
     usage
 fi
 
-#
-
-which() {
-    prog=$1
-    save_ifs="$IFS"; IFS=:
-    set - ..:$PATH
-    for d
-    do
-	if [ -f $d/$prog ]
-	then
-	    echo $d/$prog
-	    break
-	fi
-    done
-    IFS="$save_ifs"
-    unset save_ifs prog
-}
-
-dirname() {
-     _dir=`echo $1 | sed 's,/[^/]*$,,'`
-    if [ "$_dir" = "$1" ]
-    then
-	echo .
-    else
-	echo $_dir
-    fi
-}
-
 makeppddirs() {
     mkppddir=`which mkppddir`
  
@@ -264,7 +236,7 @@
 }
 
 
-papersize_gs=/tmp/$me.$$.ps
+papersize_gs=`tempfile --prefix=insps --suffix=.ps`
 
 gspapersize() {
     if [ ! -f $papersize_gs ]
@@ -926,4 +898,3 @@
 makeppddirs
 
 rm -f $sedscript $psfile $tmpdest
-



-- System Information
Debian Release: potato
Architecture: alpha
Kernel: Linux blood-axp.eradicator.org 2.2.14pre12 #1 Fri Dec 10 15:59:26 EST 1999 alpha