--- mondo-2.2.2/src/common/libmondo-filelist.c	2007-02-14 10:09:25.000000000 +0100
+++ mondo-2.2.2m/src/common/libmondo-filelist.c	2007-02-20 11:21:14.000000000 +0100
@@ -11,6 +11,7 @@
 #include "mondostructures.h"
 #include "libmondo-filelist.h"
 #include "libmondo-string-EXT.h"
+#include "libmondo-string.h"
 #include "libmondo-files-EXT.h"
 #include "libmondo-fork-EXT.h"
 #include "newt-specific-EXT.h"
@@ -1712,7 +1713,7 @@
 	FILE *fin;
 	FILE *fout;
 	char *fname = NULL;
-	char *tmp;
+	char *tmp = NULL;
 	size_t len = 0;				// Scrub's patch doesn't work without that
 
 	mr_msg(5, "starting");
@@ -1735,6 +1736,7 @@
 			mr_free(fname);
 			fname = tmp;
 		}
+
 		while (strlen(fname) > 0 && fname[strlen(fname) - 1] < 32) {
 			fname[strlen(fname) - 1] = '\0';
 		}
@@ -1743,13 +1745,13 @@
 		found_node = find_string_at_node(filelist, fname);
 		if (found_node) {
 			if (found_node->selected) {
-				if (fname[0] == '/') {
+				if (fname[0] == '/') {				
 					mr_asprintf(&tmp, fname + 1);
 					mr_free(fname);
 					fname = tmp;
 				}
 				mr_msg(5, "Found '%s'", fname);
-				turn_wildcard_chars_into_literal_chars(tmp, fname);
+				tmp = mr_turn_wildcards_into_literals(fname);
 				fprintf(fout, "%s\n", tmp);
 				mr_free(tmp);
 				retval++;
--- mondo-2.2.2/src/mondorestore/mondo-rstr-tools.c	2007-02-10 00:38:20.000000000 +0100
+++ mondo-2.2.2m/src/mondorestore/mondo-rstr-tools.c	2007-02-20 10:40:08.000000000 +0100
@@ -866,7 +866,6 @@
 	malloc_string(old_isodir);
 	malloc_string(value);
 	malloc_string(tmp);
-//  assert_string_is_neither_NULL_nor_zerolength(cfg_file);
 	assert(bkpinfo != NULL);
 
 	if (!cfgf) {
@@ -1195,15 +1194,14 @@
 	struct s_node *filelist;
 
   /** add mallocs**/
-	char *command;
-	char *tmp;
+	char *command = NULL;
+	char *tmp = NULL;
 	int res = 0;
 	pid_t pid;
 
 	assert(bkpinfo != NULL);
-	malloc_string(command);
 	malloc_string(tmp);
-
+	getcwd(tmp, MAX_STR_LEN);
 	if (does_file_exist(g_filelist_full)
 		&& does_file_exist(g_biggielist_txt)) {
 		mr_msg(1, "%s exists", g_filelist_full);
@@ -1211,7 +1209,6 @@
 		mr_msg(2,
 				"Filelist and biggielist already recovered from media. Yay!");
 	} else {
-		getcwd(tmp, MAX_STR_LEN);
 		chdir(bkpinfo->tmpdir);
 		mr_msg(1, "chdir(%s)", bkpinfo->tmpdir);
 		log_to_screen("Extracting filelist and biggielist from media...");
@@ -1219,8 +1216,9 @@
 		unlink("/" FILELIST_FULL_STUB);
 		unlink("/tmp/i-want-my-lvm");
 		if (IS_THIS_A_STREAMING_BACKUP(bkpinfo->backup_media_type)) {
-			sprintf(command,
-					"tar -zxf %s %s %s %s %s %s",
+			mr_asprintf(&command,
+					"tar -b %ld -zxf %s %s %s %s %s %s",
+					bkpinfo->internal_tape_block_size,
 					bkpinfo->media_device,
 					MOUNTLIST_FNAME_STUB,
 					BIGGIELIST_TXT_STUB,
@@ -1228,6 +1226,7 @@
 					"tmp/i-want-my-lvm", MONDO_CFG_FILE_STUB);
 			mr_msg(1, "tarcommand = %s", command);
 			run_program_and_log_output(command, 1);
+			mr_free(command);
 		} else {
 			mr_msg(2,
 					"Calling insist_on_this_cd_number; bkpinfo->isodir=%s",
@@ -1235,7 +1234,7 @@
 			insist_on_this_cd_number(bkpinfo, 1);
 			mr_msg(2, "Back from iotcn");
 			run_program_and_log_output("mount", 1);
-			sprintf(command,
+			mr_asprintf(&command,
 					"tar -zxf %s/images/all.tar.gz %s %s %s %s %s",
 					MNT_CDROM,
 					MOUNTLIST_FNAME_STUB,
@@ -1245,6 +1244,7 @@
 
 			mr_msg(1, "tarcommand = %s", command);
 			run_program_and_log_output(command, 1);
+			mr_free(command);
 //    popup_and_OK("Press ENTER to continue");
 			if (!does_file_exist(BIGGIELIST_TXT_STUB)) {
 				fatal_error
@@ -1255,18 +1255,22 @@
 					("all.tar.gz did not include tmp/filelist.full.gz");
 			}
 		}
-		sprintf(command, "cp -f %s %s", MONDO_CFG_FILE_STUB,
+		mr_asprintf(&command, "cp -f %s %s", MONDO_CFG_FILE_STUB,
 				g_mondo_cfg_file);
 		run_program_and_log_output(command, FALSE);
+		mr_free(command);
 
-		sprintf(command, "cp -f %s/%s %s", bkpinfo->tmpdir,
+		mr_asprintf(&command, "cp -f %s/%s %s", bkpinfo->tmpdir,
 				BIGGIELIST_TXT_STUB, g_biggielist_txt);
 		mr_msg(1, "command = %s", command);
 		paranoid_system(command);
-		sprintf(command, "ln -sf %s/%s %s", bkpinfo->tmpdir,
+		mr_free(command);
+
+		mr_asprintf(&command, "ln -sf %s/%s %s", bkpinfo->tmpdir,
 				FILELIST_FULL_STUB, g_filelist_full);
 		mr_msg(1, "command = %s", command);
 		paranoid_system(command);
+		mr_free(command);
 	}
 
 	if (am_I_in_disaster_recovery_mode()
@@ -1274,9 +1278,10 @@
 		ask_me_yes_or_no("Do you want to retrieve the mountlist as well?"))
 	{
 //      sprintf(command, "cp -f tmp/mountlist.txt /tmp");
-		sprintf(command, "ln -sf %s/%s /tmp", MOUNTLIST_FNAME_STUB,
+		mr_asprintf(&command, "ln -sf %s/%s /tmp", MOUNTLIST_FNAME_STUB,
 				bkpinfo->tmpdir);
 		paranoid_system(command);
+		mr_free(command);
 	}
 
 	chdir(tmp);
@@ -1299,19 +1304,21 @@
 	case 0:
 		log_to_screen("Pre-processing filelist");
 		if (!does_file_exist(g_biggielist_txt)) {
-			sprintf(command, "> %s", g_biggielist_txt);
+			mr_asprintf(&command, "echo -n > %s", g_biggielist_txt);
 			paranoid_system(command);
+			mr_free(command);
 		}
-		sprintf(command, "grep -E '^/dev/.*' %s > %s",
+		mr_asprintf(&command, "grep -E '^/dev/.*' %s > %s",
 				g_biggielist_txt, g_filelist_imagedevs);
 		paranoid_system(command);
+		mr_free(command);
 		exit(0);
 		break;
 
 	default:
 		open_evalcall_form("Pre-processing filelist");
 		while (!waitpid(pid, (int *) 0, WNOHANG)) {
-			usleep(100000);
+			usleep(10000);
 			update_evalcall_form(0);
 		}
 	}
@@ -1336,6 +1343,7 @@
 	if (res) {
 		mr_msg(2, "User hit 'cancel'. Freeing filelist and aborting.");
 		free_filelist(filelist);
+		mr_free(tmp);
 		return (NULL);
 	}
 	ask_about_these_imagedevs(g_filelist_imagedevs, g_imagedevs_restthese);
@@ -1352,7 +1360,6 @@
 									  TRUE);
 	}
 
-	mr_free(command);
 	mr_free(tmp);
 	return (filelist);
 }
@@ -1373,8 +1380,8 @@
  */
 int backup_crucial_file(char *path_root, char *filename)
 {
-	char *tmp;
-	char *command;
+	char *tmp = NULL;
+	char *command = NULL;
 	int res;
 
 	malloc_string(tmp);
--- mondo-2.2.2/src/common/libmondo-string.c	2007-02-14 10:09:25.000000000 +0100
+++ mondo-2.2.2m/src/common/libmondo-string.c	2007-02-20 11:30:15.000000000 +0100
@@ -113,6 +113,26 @@
 }
 
 
+/* A more secure one, which allocates the computed buffer */
+inline char *mr_turn_wildcards_into_literals(const char *sin)
+{
+	const char *p;
+	char *q, *result;
+	int count = 0;
+
+	for (p = sin; *p != '\0'; p++) {
+		if (strchr("[]*?", *p))
+		  count++;
+	}
+	result = (char*) mr_malloc(strlen(sin) + 1 + count);
+	for (p = sin, q = result; *p != '\0'; *(q++) = *(p++)) {
+		if (strchr("[]*?", *p)) {
+			*(q++) = '\\';
+		}
+	}
+	*q = *p;					// for the final '\0'
+	return result;
+}
 
 
 inline void turn_wildcard_chars_into_literal_chars(char *sout, char *sin)
--- mondo-2.2.2/src/common/libmondo-string.h	2006-09-25 13:07:16.000000000 +0200
+++ mondo-2.2.2m/src/common/libmondo-string.h	2007-02-20 11:19:26.000000000 +0100
@@ -2,6 +2,9 @@
  * $Id: libmondo-string.h 831 2006-09-25 11:07:16Z andree $
  */
 
+#ifndef LIBMONDO_STRING_H
+# define LIBMONDO_STRING_H
+
 char *build_partition_name(char *partition, const char *drive, int partno);
 void center_string(char *in_out, int width);
 char *commarize(char *);
@@ -33,3 +36,6 @@
 char *percent_media_full_comment(struct s_bkpinfo *bkpinfo);
 char *media_descriptor_string(t_bkptype);
 inline void turn_wildcard_chars_into_literal_chars(char *out, char *in);
+inline char *mr_turn_wildcards_into_literals(const char *sin);
+
+#endif /* LIBMONDO_STRING_H */
