dont printf arguments given by user for security sanity

diff --git a/coreutils/watch.c b/coreutils/watch.c
index 9da591b483bc8b21f54c530d2affe0b75486f010..9e0c54c7ff1adccc268037700a6c88a677c8fc62 100644 (file)
--- a/coreutils/watch.c
+++ b/coreutils/watch.c
@@ -100,7 +100,7 @@ int watch_main(int argc, char **argv)
                        //child
                        dup2(old_stdout, STDOUT_FILENO);
                        execvp(*watched_argv, watched_argv);
-                       bb_perror_msg_and_die(*watched_argv);
+                       bb_perror_msg_and_die("%s", *watched_argv);
                } else {
                        bb_perror_msg_and_die("vfork");
                }

diff --git a/miscutils/mountpoint.c b/miscutils/mountpoint.c
index 38c654c6d15c2fbc9dcc542b5621b8420f1a9bb3..1248dc011867d09484c7acc584c1f0166cb1eb83 100644 (file)
--- a/miscutils/mountpoint.c
+++ b/miscutils/mountpoint.c
@@ -64,7 +64,7 @@ int mountpoint_main(int argc, char **argv)
                        }
                }
                if (!(opt & OPT_q))
-                       bb_perror_msg(arg);
+                       bb_perror_msg("%s", arg);
                return EXIT_FAILURE;
        }
 }

diff --git a/miscutils/setsid.c b/miscutils/setsid.c
index 8061896f5da25e2f9258bbc07148346c9a0ace93..39be54621c1ae1adc9834c46409067836055e6dd 100644 (file)
--- a/miscutils/setsid.c
+++ b/miscutils/setsid.c
@@ -41,6 +41,6 @@ setsid_main(int argc, char *argv[]) {
 
        execvp(argv[1], argv + 1);
 
-       bb_perror_msg_and_die(argv[1]);
+       bb_perror_msg_and_die("%s", argv[1]);
 
 }

diff --git a/util-linux/fdformat.c b/util-linux/fdformat.c
index e7dd943bb9ecd5f19f8b780a84e0cc410e9600e1..5772e13090fcd1a5aec1fa25180de86a7012caef 100644 (file)
--- a/util-linux/fdformat.c
+++ b/util-linux/fdformat.c
@@ -85,7 +85,7 @@ int fdformat_main(int argc,char **argv)
 
        /* R_OK is needed for verifying */
        if (stat(*argv,&st) < 0 || access(*argv,W_OK | R_OK ) < 0) {
-               bb_perror_msg_and_die(*argv);
+               bb_perror_msg_and_die("%s",*argv);
        }
        if (!S_ISBLK(st.st_mode)) {
                bb_error_msg_and_die("%s: not a block device",*argv);