[PATCH] elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)

[Florian Weimer]

* Adhemerval Zanella Netto:

>> I think under the current rules, these two bugs do not need separate in
>> CVE assignment even though they are very different in nature.  They were
>> introduced in the same commit, and as your patch shows, it's not really
>> possible to fix them separately.

> Indeed expand_dynamic_string_token uses buffer without a NULL terminator,
> and it does seems a security issue. I will reserve a CVE for this one and 
> user for a v2.

Thanks.  I still think the bug you set out to patch originally is the
more significant vulnerability.

We can discuss it with Carlos and Siddhesh once they return.

Florian