Bug#388277: grub: Error in wrapper could lead to incorrect results

[Frans Pop]

Package: grub
Version: 0.97-16.1
Severity: important
Tags: patch

In both wrappers, the regular script is currently called with '$*'. This 
will lead to incorrect results if parameters are quoted and contain 
whitespace.

Example that shows how parameters are seen by the called script:
$ ./wrapper -v --aaaa="This is a test" "Want to test"
|||-v|||
|||--aaaa=This|||
|||is|||
|||a|||
|||test|||
|||Want|||
|||to|||
|||test|||

If however the regular script is called with '"$@"' quoted parameters are 
passed correctly:
$ ./wrapper -v --aaaa="This is a test" "Want to test"
|||-v|||
|||--aaaa=This is a test|||
|||Want to test|||

(Using '"$*"' is also gives an incorrect result:
$ ./wrapper -v --aaaa="This is a test" "Want to test"
|||-v --aaaa=This is a test Want to test|||
)

Thus, in the wrapper for grub-install. please replace
   exec /usr/sbin/grub-install $*
with
   exec /usr/sbin/grub-install "$@"
And similar for update-grub.

Note that I realize quoted parameters are unlikely, but IMO it is better to 
have the wrappers do the right thing anyway. (And Colin agrees ;-)

Cheers,
FJP
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-grub-devel/attachments/20060919/8212aa4b/attachment.pgp