[Bug dynamic-link/22627] $ORIGIN in $LD_LIBRARY_PATH is substituted twice

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22627

--- Comment #5 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.24/master has been updated
       via  f24c345bf5486cc8d659f7a17463adcae402ec8e (commit)
       via  248475457e40d44b12f1f69c889765bba4571add (commit)
      from  c5b38f2ecec6facf818e3c50ad014be05b52c179 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f24c345bf5486cc8d659f7a17463adcae402ec8e

commit f24c345bf5486cc8d659f7a17463adcae402ec8e
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Sat Dec 30 10:54:23 2017 +0100

    elf: Check for empty tokens before dynamic string token expansion [BZ
#22625]

    The fillin_rpath function in elf/dl-load.c loops over each RPATH or
    RUNPATH tokens and interprets empty tokens as the current directory
    ("./"). In practice the check for empty token is done *after* the
    dynamic string token expansion. The expansion process can return an
    empty string for the $ORIGIN token if __libc_enable_secure is set
    or if the path of the binary can not be determined (/proc not mounted).

    Fix that by moving the check for empty tokens before the dynamic string
    token expansion. In addition, check for NULL pointer or empty strings
    return by expand_dynamic_string_token.

    The above changes highlighted a bug in decompose_rpath, an empty array
    is represented by the first element being NULL at the fillin_rpath
    level, but by using a -1 pointer in decompose_rpath and other functions.

    Changelog:
        [BZ #22625]
        * elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic
        string token expansion. Check for NULL pointer or empty string possibly
        returned by expand_dynamic_string_token.
        (decompose_rpath): Check for empty path after dynamic string
        token expansion.
    (cherry picked from commit 3e3c904daef69b8bf7d5cc07f793c9f07c3553ef)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=248475457e40d44b12f1f69c889765bba4571add

commit 248475457e40d44b12f1f69c889765bba4571add
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Sun Dec 17 23:49:46 2017 +0000

    elf: do not substitute dst in $LD_LIBRARY_PATH twice [BZ #22627]

    Starting with commit
    glibc-2.18.90-470-g2a939a7e6d81f109d49306bc2e10b4ac9ceed8f9 that
    introduced substitution of dynamic string tokens in fillin_rpath,
    _dl_init_paths invokes _dl_dst_substitute for $LD_LIBRARY_PATH twice:
    the first time it's called directly, the second time the result
    is passed on to fillin_rpath which calls expand_dynamic_string_token
    which in turn calls _dl_dst_substitute, leading to the following
    behaviour:

    $ mkdir -p /tmp/'$ORIGIN' && cd /tmp/'$ORIGIN' &&
      echo 'int main(){}' |gcc -xc - &&
      strace -qq -E LD_LIBRARY_PATH='$ORIGIN' -e /open ./a.out
    open("/tmp//tmp/$ORIGIN/tls/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1
ENOENT (No such file or directory)
    open("/tmp//tmp/$ORIGIN/tls/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No
such file or directory)
    open("/tmp//tmp/$ORIGIN/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT
(No such file or directory)
    open("/tmp//tmp/$ORIGIN/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No
such file or directory)
    open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
    open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3

    Fix this by removing the direct _dl_dst_substitute invocation.

    * elf/dl-load.c (_dl_init_paths): Remove _dl_dst_substitute preparatory
    code and invocation.

    (cherry picked from commit bb195224acc14724e9fc2dbaa8d0b20b72ace79b)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog     |   16 +++++++++++++
 NEWS          |    4 +++
 elf/dl-load.c |   69 ++++++++++++++++++++++++++++-----------------------------
 3 files changed, 54 insertions(+), 35 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.