Index: nautilus-burn-recorder.c
===================================================================
--- nautilus-burn-recorder.c	(revision 2052)
+++ nautilus-burn-recorder.c	(working copy)
@@ -1087,8 +1087,6 @@ nautilus_burn_recorder_write_growisofs (
 					GError                       **error)
 {
 	GPtrArray                 *argv;
-	char                      *speed_str = NULL;
-	char			  *dev_str;
 	NautilusBurnRecorderTrack *t;
 	int                        result;
 	char                      *filelist;
@@ -1115,7 +1113,7 @@ nautilus_burn_recorder_write_growisofs (
 
 	argv = g_ptr_array_new ();
 
-	g_ptr_array_add (argv, "growisofs");
+	g_ptr_array_add (argv, g_strdup ("growisofs"));
 	if (speed != 0) {
 		char	*current_locale = NULL;
 		float	 dvd_speed;
@@ -1126,54 +1124,54 @@ nautilus_burn_recorder_write_growisofs (
 		 * point for the speed, otherwise growisofs wouldn't understand. */
 		current_locale = setlocale (LC_NUMERIC, NULL);
 		setlocale (LC_NUMERIC, "C");
-
-		speed_str = g_strdup_printf ("-speed=%.1f", dvd_speed);
-
+		g_ptr_array_add (argv, g_strdup_printf ("-speed=%.1f", dvd_speed));
 		setlocale (LC_NUMERIC, current_locale);
-
-		g_ptr_array_add (argv, speed_str);
 	}
 
-	g_ptr_array_add (argv, "-dvd-compat");
+	g_ptr_array_add (argv, g_strdup ("-dvd-compat"));
 
 	/* Weird, innit? We tell growisofs we have a tty so it ignores
 	 * the fact that the DVD+ has an ISO fs already */
 	if (flags & NAUTILUS_BURN_RECORDER_WRITE_BLANK) {
-		g_ptr_array_add (argv, "-use-the-force-luke=tty");
+		g_ptr_array_add (argv, g_strdup ("-use-the-force-luke=tty"));
 	}
 
 	filelist = NULL;
 	if (t->type == NAUTILUS_BURN_RECORDER_TRACK_TYPE_GRAFT_LIST) {
 		filelist = create_temp_graft_file (t->contents.graft_list.entries);
 
-		g_ptr_array_add (argv, "-graft-points");
-		g_ptr_array_add (argv, "-path-list");
-		g_ptr_array_add (argv, filelist);
+		g_ptr_array_add (argv, g_strdup ("-graft-points"));
+		g_ptr_array_add (argv, g_strdup ("-path-list"));
+		g_ptr_array_add (argv, g_shell_quote (filelist));
 	}
 
-	g_ptr_array_add (argv, "-Z");
+	g_ptr_array_add (argv, g_strdup ("-Z"));
 
-	dev_str = NULL;
 	if (t->type == NAUTILUS_BURN_RECORDER_TRACK_TYPE_DATA) {
-		dev_str = g_strdup_printf ("%s=%s", nautilus_burn_drive_get_device (drive), t->contents.data.filename);
-		g_ptr_array_add (argv, dev_str);
+		char *tempn;
+		tempn = g_shell_quote (t->contents.data.filename);
+		g_ptr_array_add (argv,
+				 g_strdup_printf ("%s=%s",
+						  nautilus_burn_drive_get_device (drive),
+						  tempn));
+		g_free (tempn);
 	} else {
-		g_ptr_array_add (argv, (char *)nautilus_burn_drive_get_device (drive));
+		g_ptr_array_add (argv, g_strdup (nautilus_burn_drive_get_device (drive)));
 
 		/* mkisofs options */
 		if (ncb_mkisofs_supports_utf8 ()) {
-			g_ptr_array_add (argv, "-input-charset");
-			g_ptr_array_add (argv, "utf8");
+			g_ptr_array_add (argv, g_strdup ("-input-charset"));
+			g_ptr_array_add (argv, g_strdup ("utf8"));
 		}
 
-		g_ptr_array_add (argv, "-r");
+		g_ptr_array_add (argv, g_strdup ("-r"));
 
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_JOLIET) {
-			g_ptr_array_add (argv, "-J");
+			g_ptr_array_add (argv, g_strdup ("-J"));
 		}
 
-		g_ptr_array_add (argv, "-V");
-		g_ptr_array_add (argv, (char *) t->contents.graft_list.label);
+		g_ptr_array_add (argv, g_strdup ("-V"));
+		g_ptr_array_add (argv, g_shell_quote (t->contents.graft_list.label));
 	}
 
 	g_ptr_array_add (argv, NULL);
@@ -1185,8 +1183,7 @@ nautilus_burn_recorder_write_growisofs (
 						     growisofs_stderr_line,
 						     error);
 
-	g_free (speed_str);
-	g_free (dev_str);
+	g_ptr_array_foreach (argv, (GFunc)g_free, NULL);
 	g_ptr_array_free (argv, TRUE);
 	argv = NULL;
 
@@ -1296,9 +1293,6 @@ nautilus_burn_recorder_write_cdrecord (N
 {
 	NautilusBurnRecorderTrack  *track;
 	GPtrArray                  *argv      = NULL;
-	char                       *speed_str = NULL;
-	char                       *dev_str   = NULL;
-	char                       *cue_str   = NULL;
 	GList                      *l;
 	NautilusBurnProcessLineFunc out_line_func;
 	NautilusBurnProcessLineFunc err_line_func;
@@ -1340,61 +1334,60 @@ nautilus_burn_recorder_write_cdrecord (N
 	 * cdrecord supports only integer numbers for the speed. */
 	 speed = (int) NAUTILUS_BURN_DRIVE_CD_SPEED (speed);
 
+	 argv = g_ptr_array_new ();
+
 	if (track->type ==  NAUTILUS_BURN_RECORDER_TRACK_TYPE_CUE) {
-		argv = g_ptr_array_new ();
-		g_ptr_array_add (argv, "cdrdao");
-		g_ptr_array_add (argv, "write");
-		g_ptr_array_add (argv, "--device");
-		g_ptr_array_add (argv, (char *)nautilus_burn_drive_get_device (drive));
-		g_ptr_array_add (argv, "--speed");
-		speed_str = g_strdup_printf ("%d", speed);
-		g_ptr_array_add (argv, speed_str);
+		g_ptr_array_add (argv, g_strdup ("cdrdao"));
+		g_ptr_array_add (argv, g_strdup ("write"));
+		g_ptr_array_add (argv, g_strdup ("--device"));
+		g_ptr_array_add (argv, g_strdup (nautilus_burn_drive_get_device (drive)));
+		g_ptr_array_add (argv, g_strdup ("--speed"));
+		g_ptr_array_add (argv, g_strdup_printf ("%d", speed));
 
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_DUMMY_WRITE) {
-			g_ptr_array_add (argv, "--simulate");
+			g_ptr_array_add (argv, g_strdup ("--simulate"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_EJECT) {
-			g_ptr_array_add (argv, "--eject");
+			g_ptr_array_add (argv, g_strdup ("--eject"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_OVERBURN) {
-			g_ptr_array_add (argv, "--overburn");
+			g_ptr_array_add (argv, g_strdup ("--overburn"));
 		}
-		g_ptr_array_add (argv, "-v");
-		g_ptr_array_add (argv, "2");
+		g_ptr_array_add (argv, g_strdup ("-v"));
+		g_ptr_array_add (argv, g_strdup ("2"));
 
-		g_ptr_array_add (argv, track->contents.cue.filename);
+		g_ptr_array_add (argv, g_shell_quote (track->contents.cue.filename));
 		g_ptr_array_add (argv, NULL);
 
 		out_line_func = NULL;
 		err_line_func = cdrdao_stderr_line;
 	} else {
-		argv = g_ptr_array_new ();
-		g_ptr_array_add (argv, "cdrecord");
+		g_ptr_array_add (argv, g_strdup ("cdrecord"));
 
-		g_ptr_array_add (argv, "fs=16m");
+		g_ptr_array_add (argv, g_strdup ("fs=16m"));
 
-		speed_str = g_strdup_printf ("speed=%d", speed);
 		if (speed != 0) {
-			g_ptr_array_add (argv, speed_str);
+			g_ptr_array_add (argv, g_strdup_printf ("speed=%d", speed));
 		}
-		dev_str = g_strdup_printf ("dev=%s", nautilus_burn_drive_get_device (drive));
-		g_ptr_array_add (argv, dev_str);
+
+		g_ptr_array_add (argv, g_strdup_printf ("dev=%s", nautilus_burn_drive_get_device (drive)));
+
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_DUMMY_WRITE) {
-			g_ptr_array_add (argv, "-dummy");
+			g_ptr_array_add (argv, g_strdup ("-dummy"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_EJECT) {
-			g_ptr_array_add (argv, "-eject");
+			g_ptr_array_add (argv, g_strdup ("-eject"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_DISC_AT_ONCE) {
-			g_ptr_array_add (argv, "-dao");
+			g_ptr_array_add (argv, g_strdup ("-dao"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_OVERBURN) {
-			g_ptr_array_add (argv, "-overburn");
+			g_ptr_array_add (argv, g_strdup ("-overburn"));
 		}
 		if (flags & NAUTILUS_BURN_RECORDER_WRITE_BURNPROOF) {
-			g_ptr_array_add (argv, "driveropts=burnfree");
+			g_ptr_array_add (argv, g_strdup ("driveropts=burnfree"));
 		}
-		g_ptr_array_add (argv, "-v");
+		g_ptr_array_add (argv, g_strdup ("-v"));
 
 		l = tracks;
 		while (l != NULL && l->data != NULL) {
@@ -1403,15 +1396,15 @@ nautilus_burn_recorder_write_cdrecord (N
 
 			switch (track->type) {
 			case NAUTILUS_BURN_RECORDER_TRACK_TYPE_DATA:
-				g_ptr_array_add (argv, "-data");
-				g_ptr_array_add (argv, "-nopad");
-				g_ptr_array_add (argv, track->contents.data.filename);
+				g_ptr_array_add (argv, g_strdup ("-data"));
+				g_ptr_array_add (argv, g_strdup ("-nopad"));
+				g_ptr_array_add (argv, g_shell_quote (track->contents.data.filename));
 				break;
 			case NAUTILUS_BURN_RECORDER_TRACK_TYPE_AUDIO:
-				g_ptr_array_add (argv, "-copy");
-				g_ptr_array_add (argv, "-audio");
-				g_ptr_array_add (argv, "-pad");
-				g_ptr_array_add (argv, track->contents.audio.filename);
+				g_ptr_array_add (argv, g_strdup ("-copy"));
+				g_ptr_array_add (argv, g_strdup ("-audio"));
+				g_ptr_array_add (argv, g_strdup ("-pad"));
+				g_ptr_array_add (argv, g_shell_quote (track->contents.audio.filename));
 				/* TODO: handle CD-TEXT somehow */
 				break;
 			case NAUTILUS_BURN_RECORDER_TRACK_TYPE_CUE:
@@ -1444,9 +1437,7 @@ nautilus_burn_recorder_write_cdrecord (N
 		}
 	}
 
-	g_free (cue_str);
-	g_free (speed_str);
-	g_free (dev_str);
+	g_ptr_array_foreach (argv, (GFunc)g_free, NULL);
 	g_ptr_array_free (argv, TRUE);
 	argv = NULL;
 
