[PATCH][BZ #10253] Fix breaking of RPATH when $ORIGIN contains colons.

[OndÅej BÃlka <neleai at seznam dot cz>]

Hi,

This bug also had patch in bugzilla which Siddhesh asked send to
libc-alpha but I did not found it.

Idea here is to defer expansion of $ORIGIN after tokenization.

Original patch contained several mistakes that I fixed. One was that if
copy was empty then static "./" was assigned to it and then freed.

	[BZ #10253]
	* elf/dl-load.c (fillin_rpath): Add linkmap parameter and expand path.
	(decompose_rpath): Defer expansion to fillin_rpath.
	(_dl_init_paths): Pass linkmap to fillin_rpath.

diff --git a/elf/dl-load.c b/elf/dl-load.c
index 24f0e4a..86f58b9 100644
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -481,14 +481,19 @@ static size_t max_dirnamelen;
 
 static struct r_search_path_elem **
 fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
-	      int check_trusted, const char *what, const char *where)
+	      int check_trusted, const char *what, const char *where,
+              struct link_map *l)
 {
   char *cp;
   size_t nelems = 0;
 
+  char *to_free;
   while ((cp = __strsep (&rpath, sep)) != NULL)
     {
       struct r_search_path_elem *dirp;
+
+      to_free = cp = expand_dynamic_string_token(l, cp);
+
       size_t len = strlen (cp);
 
       /* `strsep' can pass an empty string.  This has to be
@@ -509,8 +514,10 @@ fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
 
       /* Make sure we don't use untrusted directories if we run SUID.  */
       if (__builtin_expect (check_trusted, 0) && !is_trusted_path (cp, len))
-	continue;
-
+        {
+	  free (to_free);
+	  continue;
+        }
       /* See if this directory is already known.  */
       for (dirp = GL(dl_all_dirs); dirp != NULL; dirp = dirp->next)
 	if (dirp->dirnamelen == len && memcmp (cp, dirp->dirname, len) == 0)
@@ -570,6 +577,7 @@ fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
 	  /* Put it in the result array.  */
 	  result[nelems++] = dirp;
 	}
+      free (to_free);
     }
 
   /* Terminate the array.  */
@@ -627,7 +635,7 @@ decompose_rpath (struct r_search_path_struct *sps,
 
   /* Make a writable copy.  At the same time expand possible dynamic
      string tokens.  */
-  copy = expand_dynamic_string_token (l, rpath, 1);
+  copy = local_strdup(rpath);
   if (copy == NULL)
     {
       errstring = N_("cannot create RUNPATH/RPATH copy");
@@ -660,7 +668,7 @@ decompose_rpath (struct r_search_path_struct *sps,
       _dl_signal_error (ENOMEM, NULL, NULL, errstring);
     }
 
-  fillin_rpath (copy, result, ":", 0, what, where);
+  fillin_rpath (copy, result, ":", 0, what, where, l);
 
   /* Free the copied RPATH string.  `fillin_rpath' make own copies if
      necessary.  */
@@ -865,7 +873,12 @@ _dl_init_paths (const char *llp)
 
       (void) fillin_rpath (llp_tmp, env_path_list.dirs, ":;",
 			   INTUSE(__libc_enable_secure), "LD_LIBRARY_PATH",
-			   NULL);
+			   NULL,
+#ifdef SHARED
+                           l);
+#else
+                           NULL);
+#endif
 
       if (env_path_list.dirs[0] == NULL)
 	{