[PATCH] Fix fillin_rpath

[Jakub Jelinek <jakub at redhat dot com>]

Hi!

If rpath element does not contain trailing slash, fillin_rpath can stomp on
memory. That's because it has added the trailing slash and cp + len can
either point after the end of allocated area of the rpath string, or at the
first character of the next rpath element. So we can terminate it with
non-NUL character or if we're out of luck segfault (efence helps here
greatly). Either this can solve it, or we could just allocate only len
characters for dirname and don't put the '\0' there at all (I think dirname
is used in dl-load only always as memory area of dirnamelen bytes).
Both variants attached, pick whichever you like more.

	Jakub
2000-12-08  Jakub Jelinek  <jakub@redhat.com>

	* elf/dl-load.c (fillin_rpath): Don't assume there is '\0' at
	cp + len.  Compute where from dirname.
	Reported by <jreiser@BitWagon.com>.

--- libc/elf/dl-load.c.jj	Wed Dec  6 17:06:09 2000
+++ libc/elf/dl-load.c	Fri Dec  8 16:16:58 2000
@@ -408,6 +408,7 @@ fillin_rpath (char *rpath, struct r_sear
 	  size_t cnt;
 	  enum r_dir_status init_val;
 	  size_t where_len = where ? strlen (where) + 1 : 0;
+	  char *dirname;
 
 	  /* It's a new directory.  Create an entry and add it.  */
 	  dirp = (struct r_search_path_elem *)
@@ -417,9 +418,11 @@ fillin_rpath (char *rpath, struct r_sear
 	    _dl_signal_error (ENOMEM, NULL,
 			      N_("cannot create cache for search path"));
 
-	  dirp->dirname = ((char *) dirp + sizeof (*dirp)
-			   + ncapstr * sizeof (enum r_dir_status));
-	  memcpy ((char *) dirp->dirname, cp, len + 1);
+	  dirname = (char *) dirp + sizeof (*dirp)
+		    + ncapstr * sizeof (enum r_dir_status);
+	  memcpy (dirname, cp, len);
+	  dirname[len] = '\0';
+	  dirp->dirname = dirname;
 	  dirp->dirnamelen = len;
 
 	  if (len > max_dirnamelen)
@@ -465,9 +468,7 @@ fillin_rpath (char *rpath, struct r_sear
 
 	  dirp->what = what;
 	  if (__builtin_expect (where != NULL, 1))
-	    dirp->where = memcpy ((char *) dirp + sizeof (*dirp) + len + 1
-				  + ncapstr * sizeof (enum r_dir_status),
-				  where, where_len);
+	    dirp->where = memcpy (dirname + len + 1, where, where_len);
 	  else
 	    dirp->where = NULL;
 
2000-12-08  Jakub Jelinek  <jakub@redhat.com>

	* elf/dl-load.c (fillin_rpath): Don't assume there is '\0' at
	cp + len.  Compute where from dirname.
	Reported by <jreiser@BitWagon.com>.

--- libc/elf/dl-load.c.jj	Wed Dec  6 17:06:09 2000
+++ libc/elf/dl-load.c	Fri Dec  8 16:35:41 2000
@@ -412,14 +412,14 @@ fillin_rpath (char *rpath, struct r_sear
 	  /* It's a new directory.  Create an entry and add it.  */
 	  dirp = (struct r_search_path_elem *)
 	    malloc (sizeof (*dirp) + ncapstr * sizeof (enum r_dir_status)
-		    + where_len + len + 1);
+		    + where_len + len);
 	  if (dirp == NULL)
 	    _dl_signal_error (ENOMEM, NULL,
 			      N_("cannot create cache for search path"));
 
-	  dirp->dirname = ((char *) dirp + sizeof (*dirp)
-			   + ncapstr * sizeof (enum r_dir_status));
-	  memcpy ((char *) dirp->dirname, cp, len + 1);
+	  dirp->dirname = (char *) dirp + sizeof (*dirp)
+			  + ncapstr * sizeof (enum r_dir_status);
+	  memcpy ((char *) dirp->dirname, cp, len);
 	  dirp->dirnamelen = len;
 
 	  if (len > max_dirnamelen)
@@ -465,8 +465,7 @@ fillin_rpath (char *rpath, struct r_sear
 
 	  dirp->what = what;
 	  if (__builtin_expect (where != NULL, 1))
-	    dirp->where = memcpy ((char *) dirp + sizeof (*dirp) + len + 1
-				  + ncapstr * sizeof (enum r_dir_status),
+	    dirp->where = memcpy ((char *) dirp->dirname + len,
 				  where, where_len);
 	  else
 	    dirp->where = NULL;