handle library paths better (ignore empty path components, etc.)

[musl] / src / ldso / dynlink.c

diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index 8ade073..472e389 100644 (file)
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -48,6 +48,7 @@ struct dso
 };
 
 static struct dso *head, *tail, *libc;
+static char *env_path, *sys_path;
 
 #define AUX_CNT 15
 #define DYN_CNT 34
@@ -122,7 +123,7 @@ static void do_relocs(unsigned char *base, size_t *rel, size_t rel_size, size_t
 
 static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dynp)
 {
-       size_t buf[896/sizeof(size_t)];
+       Ehdr buf[(896+sizeof(Ehdr))/sizeof(Ehdr)];
        size_t phsize;
        size_t addr_min=SIZE_MAX, addr_max=0, map_len;
        size_t this_min, this_max;
@@ -136,11 +137,11 @@ static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dy
 
        ssize_t l = read(fd, buf, sizeof buf);
        if (l<sizeof *eh) return 0;
-       eh = (void *)buf;
+       eh = buf;
        phsize = eh->e_phentsize * eh->e_phnum;
        if (phsize + sizeof *eh > l) return 0;
        if (eh->e_phoff + phsize > l) {
-               l = pread(fd, buf+sizeof *eh, phsize, eh->e_phoff);
+               l = pread(fd, buf+1, phsize, eh->e_phoff);
                if (l != phsize) return 0;
                eh->e_phoff = sizeof *eh;
        }
@@ -204,6 +205,22 @@ static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dy
        return map;
 }
 
+static int path_open(const char *name, const char *search)
+{
+       char buf[2*NAME_MAX+2];
+       const char *s=search, *z;
+       int l, fd;
+       for (;;) {
+               while (*s==':') s++;
+               if (!*s) return -1;
+               z = strchr(s, ':');
+               l = z ? z-s : strlen(s);
+               snprintf(buf, sizeof buf, "%.*s/%s", l, s, name);
+               if ((fd = open(buf, O_RDONLY))>=0) return fd;
+               s += l;
+       }
+}
+
 static struct dso *load_library(const char *name)
 {
        unsigned char *base, *map;
@@ -241,14 +258,20 @@ static struct dso *load_library(const char *name)
        if (name[0] == '/') {
                fd = open(name, O_RDONLY);
        } else {
-               static const char path[] = "/lib/\0/usr/local/lib/\0/usr/lib/\0";
-               const char *s;
-               char buf[NAME_MAX+32];
                if (strlen(name) > NAME_MAX || strchr(name, '/')) return 0;
-               for (s=path; *s; s+=strlen(s)+1) {
-                       strcpy(buf, s);
-                       strcat(buf, name);
-                       if ((fd = open(buf, O_RDONLY))>=0) break;
+               fd = -1;
+               if (env_path) fd = path_open(name, env_path);
+               if (fd < 0) {
+                       if (!sys_path) {
+                               FILE *f = fopen(ETC_LDSO_PATH, "r");
+                               if (f) {
+                                       if (getline(&sys_path, (size_t[1]){0}, f) > 0)
+                                               sys_path[strlen(sys_path)-1]=0;
+                                       fclose(f);
+                               }
+                       }
+                       if (sys_path) fd = path_open(name, sys_path);
+                       else fd = path_open(name, "/lib:/usr/local/lib:/usr/lib");
                }
        }
        if (fd < 0) return 0;
@@ -317,6 +340,17 @@ static void reloc_all(struct dso *p)
                        2, p->syms, p->strings, p);
                do_relocs(p->base, (void *)(p->base+dyn[DT_RELA]), dyn[DT_RELASZ],
                        3, p->syms, p->strings, p);
+               p->relocated = 1;
+       }
+}
+
+static void free_all(struct dso *p)
+{
+       struct dso *n;
+       while (p) {
+               n = p->next;
+               if (p->map) free(p);
+               p = n;
        }
 }
 
@@ -330,11 +364,19 @@ void *__dynlink(int argc, char **argv, size_t *got)
        struct dso lib, app;
 
        /* Find aux vector just past environ[] */
-       for (i=argc+1; argv[i]; i++);
+       for (i=argc+1; argv[i]; i++)
+               if (!memcmp(argv[i], "LD_LIBRARY_PATH=", 16))
+                       env_path = argv[i]+16;
        auxv = (void *)(argv+i+1);
 
        decode_vec(auxv, aux, AUX_CNT);
 
+       /* Only trust user/env if kernel says we're not suid/sgid */
+       if ((aux[0]&0x7800)!=0x7800 || aux[AT_UID]!=aux[AT_EUID]
+         || aux[AT_GID]!=aux[AT_EGID]) {
+               env_path = 0;
+       }
+
        /* Relocate ldso's DYNAMIC pointer and load vector */
        decode_vec((void *)(got[0] += aux[AT_BASE]), lib_dyn, DYN_CNT);
 
@@ -380,6 +422,9 @@ void *__dynlink(int argc, char **argv, size_t *got)
 
        reloc_all(head);
 
+       free_all(head);
+       free(sys_path);
+
        errno = 0;
        return (void *)aux[AT_ENTRY];
 }