[PATCH v3] elf: Check for empty tokens before dynamic string token expansion [BZ #22625]

[Dmitry V. Levin]

On Wed, Dec 20, 2017 at 09:23:59PM +0100, Aurelien Jarno wrote:
> The fillin_rpath function in elf/dl-load.c loops over each RPATH or
> RUNPATH tokens and interprets empty tokens as the current directory
> ("./"). In practice the check for empty token is done *after* the
> dynamic string token expansion. The expansion process can return an
> empty string for the $ORIGIN token if __libc_enable_secure is set
> or if the path of the binary can not be determined (/proc not mounted).
> 
> Fix that by moving the check for empty tokens before the dynamic string
> token expansion. In addition, check for NULL pointer or empty strings
> return by expand_dynamic_string_token.
> 
> The above changes highlighted a bug in decompose_rpath, an empty array
> is represented by the first element being NULL at the fillin_rpath
> level, but by using a -1 pointer in decompose_rpath and other functions.
> 
> Changelog:
> 	[BZ #22625]
> 	* elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic
> 	string token expansion. Check for NULL pointer or empty string possibly
> 	returned by expand_dynamic_string_token.
> 	(decompose_rpath): Check for empty path after dynamic string
> 	token expansion.
> ---
>  ChangeLog     | 10 ++++++++++
>  NEWS          |  4 ++++
>  elf/dl-load.c | 35 ++++++++++++++++++++++++++---------
>  3 files changed, 40 insertions(+), 9 deletions(-)
[...]
> -      /* `strsep' can pass an empty string.  This has to be
> -	 interpreted as `use the current directory'. */
> -      if (len == 0)
> -	{
> -	  static const char curwd[] = "./";
> -	  cp = (char *) curwd;
> +         /* Compute the length after dynamic string token expansion and
> +            ignore empty paths.  */
> +         len = strlen (cp);
> +         if (len == 0)
> +           {
> +             free (to_free);
> +             continue;
> +           }

The leading 8+ spaces are not replaced by tabs in these newly added lines.
As other lines in this file seem to use tabs, it might be a good idea
to follow the same style.

Besides that, the change is fine.


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20171220/d1ea5b6a/attachment.sig>