Merge branch 'jt/config-quote-cr' into maint-2.43

This merges in the fix for CVE-2025-48384.

* jt/config-quote-cr:
  config: quote values containing CR character

Signed-off-by: Taylor Blau <me@ttaylorr.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/config.c b/config.c
index 9ff6ae1cb9..629981451d 100644
--- a/config.c
+++ b/config.c
@@ -2999,7 +2999,7 @@ static ssize_t write_pair(int fd, const char *key, const char *value,
 	if (value[0] == ' ')
 		quote = "\"";
 	for (i = 0; value[i]; i++)
-		if (value[i] == ';' || value[i] == '#')
+		if (value[i] == ';' || value[i] == '#' || value[i] == '\r')
 			quote = "\"";
 	if (i && value[i - 1] == ' ')
 		quote = "\"";