more security: don't start shell code from argv

diff --git a/miscutils/eject.c b/miscutils/eject.c
index 2643f36d571c2ac783575478d2379ae900c11c60..189f54510c52d7967f9647f600ea0d87a9ecdbae 100644 (file)
--- a/miscutils/eject.c
+++ b/miscutils/eject.c
@@ -43,7 +43,7 @@ extern int eject_main(int argc, char **argv)
        }
        if (ioctl(bb_xopen(device, (O_RDONLY | O_NONBLOCK)),
                                (flags ? CDROMCLOSETRAY : CDROMEJECT))) {
-               bb_perror_msg_and_die(device);
+               bb_perror_msg_and_die("%s", device);
        }
        return (EXIT_SUCCESS);
 }

diff --git a/util-linux/setarch.c b/util-linux/setarch.c
index 4a5853adc4b29841686a7442e4c2005fa7687a97..33588e4eeaf92d8c32f38924b343389e326b1c95 100644 (file)
--- a/util-linux/setarch.c
+++ b/util-linux/setarch.c
@@ -49,5 +49,5 @@ retry:
        execvp(argv[0], argv);
 
 failure:
-       bb_perror_msg_and_die(argv[0]);
+       bb_perror_msg_and_die("%s", argv[0]);
 }