[PATCH] Improve DST handling (Bug 23102, Bug 21942, Bug 18018, Bug, 23259, CVE-2011-0536 ).

[Florian Weimer]

On 06/06/2018 10:18 PM, Carlos O'Donell wrote:
> +/* Process INPUT for DSTs and store in RESULT using the information from
> +   link map L to resolve the DSTs.  The value of START must equal the
> +   start of the parent string if INPUT is a substring sequence being
> +   parsed with path separators e.g. $ORIGIN:$PLATFORM.  */
>   char *
> -_dl_dst_substitute (struct link_map *l, const char *name, char *result)
> +_dl_dst_substitute (struct link_map *l, const char *start,
> +		    const char *input, char *result)

The comment should describe the storage requirements for RESULT.

I'm a bit worried about this:

	  else if (len != 0)
	    {
	      /* We cannot use this path element, the value of the
		 replacement is unknown.  */
	      check_for_trusted = false;
	      wp = last_elem;
	      break;
	    }

Does this really do the right thing for $ORIGIN/../$LIB:/foo/$ORIGIN?  I 
would have expected a trusted path check for the first component in this 
case.

Thanks,
Florian