[PATCH] Fix fillin_rpath

Jakub Jelinek jakub@redhat.com
Fri Dec 8 07:30:00 GMT 2000


Hi!

If rpath element does not contain trailing slash, fillin_rpath can stomp on
memory. That's because it has added the trailing slash and cp + len can
either point after the end of allocated area of the rpath string, or at the
first character of the next rpath element. So we can terminate it with
non-NUL character or if we're out of luck segfault (efence helps here
greatly). Either this can solve it, or we could just allocate only len
characters for dirname and don't put the '\0' there at all (I think dirname
is used in dl-load only always as memory area of dirnamelen bytes).
Both variants attached, pick whichever you like more.

	Jakub


More information about the Libc-hacker mailing list