oss-security - Re: Breaking the links: Exploiting the linker

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101215104531.0b6bb05e@redhat.com>
Date: Wed, 15 Dec 2010 10:45:31 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Breaking the links: Exploiting the linker

On Wed, 15 Dec 2010 02:14:20 +0000 Tim Brown wrote:

> In the interests of a thorough peer review I'd be curious what people
> think of the following paper I've been working on Linux and POSIX
> linkers:
> 
> http://www.nth-dimension.org.uk/downloads.php?id=77

Any specific reason for recommending:

  LD_LIBRARY_PATH="${LD_LIBRARY_PATH:-/path/to/app/lib}"

as a fix for:

  LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/path/to/app/lib

issue in 1.3.2?  It does not do the same thing the right way:

$ LD_LIBRARY_PATH= ; LD_LIBRARY_PATH=${LD_LIBRARY_PATH:-/path/to/app} ; echo $LD_LIBRARY_PATH
/path/to/app

$ LD_LIBRARY_PATH=/foo ; LD_LIBRARY_PATH=${LD_LIBRARY_PATH:-/path/to/app} ; echo $LD_LIBRARY_PATH
/foo

Maybe you want to suggest something like this instead:

  LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}/path/to/app

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.