[Bug dynamic-link/23102] Incorrect parsing of multiple consecutive $variable patterns in runpath entries (e.g. $ORIGIN$ORIGIN)

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23102

--- Comment #4 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Carlos O'Donell from comment #3)
> (In reply to Dmitry V. Levin from comment #2)
> > A token in $var form is substituted only if it ends the string or is
> > followed by '/'. A token in {var} form does not have this limitation.
> > 
> > I suggest documenting this behavior rather than changing it.
> 
> The official specification of the gABI says:
> http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#shobj_dependencies
> ~~~
> Within a string provided by dynamic array entries with the DT_NEEDED or
> DT_RUNPATH tags and in pathnames passed as parameters to the dlopen()
> routine, a dollar sign ($) introduces a substitution sequence. This sequence
> consists of the dollar sign immediately followed by either the longest name
> sequence or a name contained within left and right braces ({) and (}). A
> name is a sequence of bytes that start with either a letter or an underscore
> followed by zero or more letters, digits or underscores. If a dollar sign is
> not immediately followed by a name or a brace-enclosed name, the behavior of
> the dynamic linker is unspecified. ~~~
> 
> Which seems to allow $ORIGIN$ORIGIN to me?

I have a fix for this which passes test1 and test3.

The problem with ignorning $VAR that doesn't end the string or end with '/' is
that it leave unsubstituted DSTs in the lookup paths which later have to
cleaned up for security purposes.

To fix this bug I rewrote is_dst() to follow the ELF gABI rules. It wasn't a
difficult fix, but it also requires the fix for bug 23259.

-- 
You are receiving this mail because:
You are on the CC list for the bug.