[PATCH] ld.so: Reject overly long LD_PRELOAD path elements

[Andreas Schwab]

On Jun 19 2017, fweimer@redhat.com (Florian Weimer) wrote:

> +unsigned int
> +handle_ld_preload (const char *preloadlist, struct link_map *main_map)
> +{
> +  unsigned int npreloads = 0;
> +  const char *p = preloadlist;
> +  char fname[PATH_MAX];
> +
> +  while (*p != '\0')
> +    {
> +      /* Split preload list at space/colon.  */
> +      size_t len = strcspn (p, " :");
> +      if (len > 0 && len < PATH_MAX)
> +	{
> +	  memcpy (fname, p, len);
> +	  fname[len] = '\0';
> +	}
> +      else
> +	fname[0] = '\0';
> +
> +      /* Skip over the substring and the following delimiter.  */
> +      p += len;
> +      if (*p == ' ' || *p == ':')

If you use *p != '\0' you don't have to repeat the list of delimiters.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."