r573: * dh_md5sums: note that it's used by debsums. Closes: #181521

   * Make addsubstvars() escape the value of the variable before passing it to
     the shell. Closes: #178524
   * Fixed escape_shell()'s escaping of a few things.

1 files changed, 2 insertions, 2 deletions

diff --git a/Debian/Debhelper/Dh_Lib.pm b/Debian/Debhelper/Dh_Lib.pm
index c9910bad..41b7a634 100644
--- a/Debian/Debhelper/Dh_Lib.pm
+++ b/Debian/Debhelper/Dh_Lib.pm
@@ -117,7 +117,7 @@ sub escape_shell {
 			# This does make -V"foo bar" turn into "-Vfoo bar",
 			# but that will be parsed identically by the shell
 			# anyway..
-			$word=~s/([\n`\$"\\])/\$1/g;
+			$word=~s/([\n`\$"\\])/\\$1/g;
 			push @ret, "\"$word\"";
 		}
 		else {
@@ -439,7 +439,7 @@ sub addsubstvar {
 	}
 
 	if (length $line) {
-		 complex_doit("(grep -s -v ${substvar} $substvarfile; echo '${substvar}=$line') > $substvarfile.new");
+		 complex_doit("(grep -s -v ${substvar} $substvarfile; echo ".escape_shell("${substvar}=$line").") > $substvarfile.new");
 		 doit("mv", "$substvarfile.new", $substvarfile);
 	}
 	else {