AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-14 23:30:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

(_dl_dst_count): Fix possible endless loop.

Browse Source 
(_dl_dst_substitute): Likewise.
This commit is contained in:
Ulrich Drepper 2002-02-02 09:28:24 +00:00
parent 688ea1c3e0
commit 3a5482ffc5
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
elf/dl-load.c
View File

@ -190,7 +190,7 @@ _dl_dst_count (const char *name, int is_path)
do
{
size_t len = 1;
size_t len;
/* $ORIGIN is not expanded for SUID/GUID programs (except if it
is $ORIGIN alone) and it must always appear first in path.
@ -198,9 +198,10 @@ _dl_dst_count (const char *name, int is_path)
Note that it is no bug that the string in the second and
fourth `strncmp' call is longer than the sequence which is
actually tested. */
if ((len = is_dst (start, name + 1, "{ORIGIN}", 8, is_path,
++name;
if ((len = is_dst (start, name, "{ORIGIN}", 8, is_path,
__libc_enable_secure)) != 0
|| ((len = is_dst (start, name + 1, "{PLATFORM}", 10, is_path, 0))
|| ((len = is_dst (start, name, "{PLATFORM}", 10, is_path, 0))
!= 0))
++cnt;
@ -230,15 +231,16 @@ _dl_dst_substitute (struct link_map *l, const char *name, char *result,
if (__builtin_expect (*name == '$', 0))
{
const char *repl = NULL;
size_t len = 1;
size_t len;
/* Note that it is no bug that the string in the second and
fourth `strncmp' call is longer than the sequence which
is actually tested. */
if ((len = is_dst (start, name + 1, "{ORIGIN}", 8, is_path,
++name;
if ((len = is_dst (start, name, "{ORIGIN}", 8, is_path,
__libc_enable_secure)) != 0)
repl = l->l_origin;
else if ((len = is_dst (start, name + 1, "{PLATFORM}", 10, is_path,
else if ((len = is_dst (start, name, "{PLATFORM}", 10, is_path,
0)) != 0)
repl = _dl_platform;
@ -258,7 +260,7 @@ _dl_dst_substitute (struct link_map *l, const char *name, char *result,
}
else
/* No DST we recognize. */
*wp++ = *name++;
*wp++ = '$';
}
else
{