Changeset 2461Tweet

Timestamp:

Jun 20, 2008, 8:05:13 AM (15 years ago)

Author:

Sam Hocevar

Message:

• Avoid a potential shared library attack by never looking for libzzuf in the current directory.

File:

• zzuf/trunk/src/zzuf.c (modified) (2 diffs)

zzuf/trunk/src/zzuf.c

@@ -918 +918 @@
     HANDLE pid;
     void *epaddr;
-#endif
     int ret;
+#endif
 
 #if defined HAVE_FORK
@@ -971 +971 @@
 
 #if defined HAVE_FORK
-    /* Meaningless but makes sure there is space for everything */
+    /* Make sure there is space for everything we might do. */
     libpath = malloc(len + strlen(LIBDIR "/.libs/" FILENAME EXTRAINFO) + 1);
     strcpy(libpath, opts->oldargv[0]);
 
-    /* Replace "/path/binaryname" with "/path/.libs/libzzuf.$(EXT)"
-     *     and "binaryname" with ".libs/libzzuf.$(EXT)"
-     * Write the result in libpath. */
+    /* If the binary name contains a '/', we look for a libzzuf in the
+     * same directory. Otherwise, we only look into the system directory
+     * to avoid shared library attacks. Write the result in libpath. */
     tmp = strrchr(libpath, '/');
-    strcpy(tmp ? tmp + 1 : libpath, ".libs/" FILENAME);
-
-    ret = access(libpath, R_OK);
-    if(ret < 0)
+    if(tmp)
+    {
+        strcpy(tmp + 1, ".libs/" FILENAME);
+        if(access(libpath, R_OK) < 0)
+            strcpy(libpath, LIBDIR "/" FILENAME);
+    }
+    else
         strcpy(libpath, LIBDIR "/" FILENAME);