[PATCH v2] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG

[Andreas Schwab]

Alex Dowad <alexinbeijing@gmail.com> writes:

> diff --git a/elf/rtld.c b/elf/rtld.c
> index 6dcbabc..e10293a 100644
> --- a/elf/rtld.c
> +++ b/elf/rtld.c
> @@ -2405,9 +2405,8 @@ process_dl_debug (const char *dl_debug)
>  	    {
>  	      /* Display a warning and skip everything until next
>  		 separator.  */
> -	      char *copy = strndupa (dl_debug, len);
>  	      _dl_error_printf ("\
> -warning: debug option `%s' unknown; try LD_DEBUG=help\n", copy);
> +warning: debug option `%.*s' unknown; try LD_DEBUG=help\n", len, dl_debug);

len is size_t, but .* expects int.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."