[PATCH v2] elf: Check for empty tokens before dynamic string token expansion [BZ #22625]

[Dmitry V. Levin]

On Tue, Dec 19, 2017 at 11:59:45AM +0100, Andreas Schwab wrote:
> On Dez 18 2017, Aurelien Jarno <aurelien@aurel32.net> wrote:
> 
> > @@ -433,22 +443,33 @@ fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
> >  {
> >    char *cp;
> >    size_t nelems = 0;
> > -  char *to_free;
> >  
> >    while ((cp = __strsep (&rpath, sep)) != NULL)
> >      {
> >        struct r_search_path_elem *dirp;
> > -
> > -      to_free = cp = expand_dynamic_string_token (l, cp, 1);
> > -
> > -      size_t len = strlen (cp);
> > +      char *to_free = NULL;
> > +      size_t len;
> >  
> >        /* `strsep' can pass an empty string.  This has to be
> >  	 interpreted as `use the current directory'. */
> > -      if (len == 0)
> > +      if (*cp == '\0')
> >  	{
> >  	  static const char curwd[] = "./";
> >  	  cp = (char *) curwd;
> > +	  len = 0;
> > +	}
> 
> I wonder why we need curwd at all.  Nothing below this reads past
> cp[len] anyway.

Yes, I think `cp' could be left unchanged; the code below may access cp[0],
so it cannot be set to NULL, though.

The code could be simplified further, e.g.

      size_t len = 0;

      if (*cp != '\0')
	{
	  to_free = cp = expand_dynamic_string_token (l, cp, 1);
	  ...
	}


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20171219/206a2c99/attachment.sig>