GNOME Bugzilla – Bug 782952
Using grep in Games do not work with a filename --ignore-case
Last modified: 2017-05-22 13:31:02 UTC
While discussing on irc, it was found that gnome Games is running grep with a set of parameters, one being the filename. While I do not know if there is possibility of reading someone else file this way (but cannot exclude it), that mean that someone creating a file "--ignore-case" with the right mime types would make gnome games freeze, since Games would run "grep foo --ignore-case", and gnu grep do not stop handling options after the text have been provided. I didn't found any code exec path, so I didn't request a CVE. Here is a patch (untested) that should prevent the issue in the future.
Created attachment 352352 [details] [review] Fix option injection
Review of attachment 352352 [details] [review]: LGTM, thanks.