[PATCH] unstrip: Basename core module name when building -d output path

[Mark Wielaard]

Hi Matej,

On Wed, 2026-09-09 at 23:49 +0200, Matej Smycka wrote:
> handle_output_dir_module builds each module's output file as
> "OUTDIR/NAME".  For a core file NAME is the raw DT_SONAME reported by
> libdwfl (dwfl_segment_report_module) with no basename applied, so a
> DT_SONAME like "../../../path" makes eu-unstrip -a -m -d OUTDIR write
> the reconstructed module image outside OUTDIR.  Basename the name when
> joining it, as -m already implies and as link_map.c and core-file.c do.
> 
> 	* src/unstrip.c (handle_output_dir_module): Use xbasename on the
> 	module name.

I am not sure if a relative path (or a slash in general) is really
allowed in an soname. But technically you could create an (crafted) ELF
file with it I guess. I am not sure it would actually be loaded,
depends on whether ld.so allows it to. But it is a sane way to guard
against someone doing something really silly.

Applied as:
https://sourceware.org/cgit/elfutils/commit/?id=4f5b7ac6bfc4

> Signed-off-by: Matej Smycka <matejsmycka@gmail.com>
> ---
>  src/unstrip.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/src/unstrip.c b/src/unstrip.c
> index 5585b0e2..60f0916a 100644
> --- a/src/unstrip.c
> +++ b/src/unstrip.c
> @@ -2456,7 +2456,8 @@ handle_output_dir_module (const char *output_dir, Dwfl_Module *mod, bool force,
>    if (file == NULL && ignore)
>      return;
>  
> -  char *output_file = xasprintf ("%s/%s", output_dir, modnames ? name : file);
> +  char *output_file = xasprintf ("%s/%s", output_dir,
> +				 modnames ? xbasename (name) : file);
>  
>    handle_dwfl_module (output_file, true, force, mod, all, ignore, relocate);
>