More secure way of obtaining command interpreter.

Instead of relying on the COMSPEC environment variable,
what we can do is assume that the program is called "cmd.exe",
and then look for it in the directory reported by the
GetSystemDirectoryA Win32 function in kernel32.dll.

* winsup/cygwin/path.h (get_cmd_exe_path): New function declared.

* winsup/cygwin/spawn.cc (av::setup): Use get_cmd_exe_path
instead of getenv("COMSPEC").
(cmd_exe_path): New static variable.
(init_cmd_exe_path): New static function.
(get_cmd_exe_path): New function.

* winsup/cygwin/syscalls.cc (system, getusershell, popen): Use
get_cmd_exe_path instead of getenv("COMSPEC").

3 files changed, 30 insertions, 4 deletions

diff --git a/winsup/cygwin/path.h b/winsup/cygwin/path.h
index 469d6076d..4618600aa 100644
--- a/winsup/cygwin/path.h
+++ b/winsup/cygwin/path.h
@@ -453,3 +453,4 @@ int normalize_posix_path (const char *, char *, char *&);
 PUNICODE_STRING __reg3 get_nt_native_path (const char *, UNICODE_STRING&, bool);
 
 int __reg3 symlink_worker (const char *, const char *, bool);
+const char *get_cmd_exe_path();
diff --git a/winsup/cygwin/spawn.cc b/winsup/cygwin/spawn.cc
index 7ea2fca1c..fe9a15742 100644
--- a/winsup/cygwin/spawn.cc
+++ b/winsup/cygwin/spawn.cc
@@ -13,7 +13,9 @@ details. */
 #include <sys/wait.h>
 #include <wchar.h>
 #include <ctype.h>
+#include <stdio.h>
 #include <sys/cygwin.h>
+#include <pthread.h>
 #include "cygerrno.h"
 #include "security.h"
 #include "sigproc.h"
@@ -1166,7 +1168,7 @@ av::setup (const char *prog_arg, path_conv& real_path, const char *ext,
 	      }
 	    if (ascii_strcasematch (ext, ".com"))
 	      break;
-	    if ((pgm = getenv("COMSPEC")) == NULL) {
+	    if ((pgm = const_cast<char *>(get_cmd_exe_path())) == NULL) {
 	      set_errno (EOPNOTSUPP);
 	      return -1;
 	    }
@@ -1201,3 +1203,26 @@ err:
   __seterrno ();
   return -1;
 }
+
+static const char *cmd_exe_path = NULL;
+
+static void init_cmd_exe_path(void)
+{
+  char sysdir[NT_MAX_PATH];
+  char cmdname[] = "cmd.exe";
+  unsigned int nchars;
+
+  if ((nchars = GetSystemDirectoryA(sysdir, sizeof sysdir)) < sizeof sysdir) {
+    unsigned int total = nchars + 1 + sizeof cmdname + 1;
+    char *path = static_cast<char *>(cmalloc_abort(HEAP_STR, total));
+    snprintf(path, total, "%s\\%s", sysdir, cmdname);
+    cmd_exe_path = path;
+  }
+}
+
+const char *get_cmd_exe_path()
+{
+  static pthread_once_t cmd_exe_once = PTHREAD_ONCE_INIT;
+  pthread_once (&cmd_exe_once, init_cmd_exe_path);
+  return cmd_exe_path;
+}
diff --git a/winsup/cygwin/syscalls.cc b/winsup/cygwin/syscalls.cc
index 53b3714b4..a543aeb38 100644
--- a/winsup/cygwin/syscalls.cc
+++ b/winsup/cygwin/syscalls.cc
@@ -2617,7 +2617,7 @@ system (const char *cmdstring)
 
   int res = -1;
   const char* command[4];
-  const char *cmdexe = getenv("COMSPEC");
+  const char *cmdexe = get_cmd_exe_path();
 
   if (cmdexe == NULL)
     return res;
@@ -4157,7 +4157,7 @@ extern "C" char *
 getusershell ()
 {
   if (shell_index == 0) {
-    char *cmdexe = getenv("COMSPEC");
+    char *cmdexe = const_cast<char *>(get_cmd_exe_path());
     if (cmdexe != NULL) {
       shell_index = 1;
       return cmdexe;
@@ -4202,7 +4202,7 @@ popen (const char *command, const char *in_type)
   const char *type = in_type;
   char fdopen_flags[3] = "\0\0";
   int pipe_flags = 0;
-  const char *cmdexe = getenv("COMSPEC");
+  const char *cmdexe = get_cmd_exe_path();
 
 #define rw	fdopen_flags[0]
 #define bintext	fdopen_flags[1]