From: Xu Panda <xu.panda@zte.com.cn>

Not using absolute path when invoking which can lead to serious security
issues.

Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Xu Panda <xu.panda@zte.com.cn>
---
 scripts/extract_xc3028.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
index e1c9af25a595..c9ddcba07550 100755
--- a/scripts/extract_xc3028.pl
+++ b/scripts/extract_xc3028.pl
@@ -29,7 +29,7 @@ sub verify ($$)
        my ($filename, $hash) = @_;
        my ($testhash);

-       if (system("which md5sum > /dev/null 2>&1")) {
+       if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
                die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
        }

-- 
2.15.2

On Thu, Sep 22, 2022 at 10:26:25AM +0000, cgel.zte@gmail.com wrote:
> From: Xu Panda <xu.panda@zte.com.cn>

Hey Xu Panda,
I accidentally found this patch while looking for your RISC-V one on
lore.

You've not CC'ed any maintainers so I am not sure who you expect to pick
this patch up, but seeing as Greg has NACKed the patch you sent to the
RISC-V list [0] earlier doing the same thing I figure it is a moot
point... maybe engaging with maintainers rather than sending more
patches would be a more successful strategy for you here :(

Either way, you'll likely have to resend this with a maintainer CCed for
someone to be able to apply your patch once you've resolved the email
issues.

Thanks,
Conor.

0 - https://lore.kernel.org/all/Yyw24J7YFVtxsnJ7@kroah.com/
> 
> Not using absolute path when invoking which can lead to serious security
> issues.
> 
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Signed-off-by: Xu Panda <xu.panda@zte.com.cn>
> ---
>  scripts/extract_xc3028.pl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
> index e1c9af25a595..c9ddcba07550 100755
> --- a/scripts/extract_xc3028.pl
> +++ b/scripts/extract_xc3028.pl
> @@ -29,7 +29,7 @@ sub verify ($$)
>         my ($filename, $hash) = @_;
>         my ($testhash);
> 
> -       if (system("which md5sum > /dev/null 2>&1")) {
> +       if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
>                 die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
>         }
> 
> -- 
> 2.15.2
>