a171a84
diff -Nurad netatalk-2.0.3.orig/etc/papd/lp.c netatalk-2.0.3/etc/papd/lp.c
a171a84
--- netatalk-2.0.3.orig/etc/papd/lp.c	2009-01-28 17:04:36.000000000 +0100
a171a84
+++ netatalk-2.0.3/etc/papd/lp.c	2009-01-28 17:05:01.000000000 +0100
a171a84
@@ -212,10 +212,54 @@
a171a84
 
a171a84
 #define is_var(a, b) (strncmp((a), (b), 2) == 0)
a171a84
 
a171a84
+static size_t quote(char *dest, char *src, const size_t bsize, size_t len) {
a171a84
+	size_t used = 0;
a171a84
+
a171a84
+	while (len && used < bsize ) {
a171a84
+		switch (*src) {
a171a84
+			case '$':
a171a84
+			case '\\':
a171a84
+			case '"':
a171a84
+			case ';':
a171a84
+			case '&':
a171a84
+			case '(':
a171a84
+			case ')':
a171a84
+			case ' ':
a171a84
+			case '*':
a171a84
+			case '#':
a171a84
+			case '|':
a171a84
+			case '>':
a171a84
+			case '<':
a171a84
+			case '[':
a171a84
+			case ']':
a171a84
+			case '{':
a171a84
+			case '}':
a171a84
+			case '^':
a171a84
+			case '?':
a171a84
+			case '~':
a171a84
+			case '`':
a171a84
+			case '\x0A':
a171a84
+			case '\xFF':
a171a84
+				if (used + 2 > bsize )
a171a84
+					return used;
a171a84
+				*dest = '\\';
a171a84
+				dest++;
a171a84
+				used++;
a171a84
+				break;
a171a84
+		}
a171a84
+		*dest = *src;
a171a84
+		src++;
a171a84
+		dest++;
a171a84
+		len--;
a171a84
+		used++;
a171a84
+	}
a171a84
+	return used;
a171a84
+}
a171a84
+
a171a84
 static char* pipexlate(char *src)
a171a84
 {
a171a84
     char *p, *q, *dest; 
a171a84
-    static char destbuf[MAXPATHLEN];
a171a84
+    static char destbuf[MAXPATHLEN + 1];
a171a84
     size_t destlen = MAXPATHLEN;
a171a84
     int len = 0;
a171a84
    
a171a84
@@ -224,13 +268,16 @@
a171a84
     if (!src)
a171a84
 	return NULL;
a171a84
 
a171a84
-    strncpy(dest, src, MAXPATHLEN);
a171a84
-    if ((p = strchr(src, '%')) == NULL) /* nothing to do */
a171a84
+    memset(dest, 0, sizeof(destbuf));
a171a84
+    if ((p = strchr(src, '%')) == NULL) { /* nothing to do */
a171a84
+        strncpy(dest, src, sizeof(dest) - 1);
a171a84
         return destbuf;
a171a84
+    }
a171a84
 
a171a84
     /* first part of the path. just forward to the next variable. */
a171a84
     len = MIN((size_t)(p - src), destlen);
a171a84
     if (len > 0) {
a171a84
+        strncpy(dest, src, len);
a171a84
         destlen -= len;
a171a84
         dest += len;
a171a84
     }
a171a84
@@ -246,17 +293,20 @@
a171a84
             q =  lp.lp_created_for;
a171a84
         } else if (is_var(p, "%%")) {
a171a84
             q = "%";
a171a84
-        } else
a171a84
-            q = p;
a171a84
+        }
a171a84
 
a171a84
         /* copy the stuff over. if we don't understand something that we
a171a84
          * should, just skip it over. */
a171a84
         if (q) {
a171a84
-            len = MIN(p == q ? 2 : strlen(q), destlen);
a171a84
+            len = MIN(strlen(q), destlen);
a171a84
+            len = quote(dest, q, destlen, len);
a171a84
+        }
a171a84
+        else {
a171a84
+            len = MIN(2, destlen);
a171a84
             strncpy(dest, q, len);
a171a84
-            dest += len;
a171a84
-            destlen -= len;
a171a84
         }
a171a84
+        dest += len;
a171a84
+        destlen -= len;
a171a84
 
a171a84
         /* stuff up to next $ */
a171a84
         src = p + 2;