Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200720145721.GA105966@fullerene.field.pennock-tech.net>
Date: Mon, 20 Jul 2020 10:57:21 -0400
From: Phil Pennock <oss-security-phil@...dhuis.org>
To: oss-security@...ts.openwall.com
Cc: Jeffrey Walton <noloader@...il.com>
Subject: Re: Perl 5.32.0 mishandling of rpath and runpath tokens

On 2020-07-20 at 04:33 -0400, Jeffrey Walton wrote:
> On Mon, Jul 20, 2020 at 4:21 AM Jeffrey Walton <noloader@...il.com> wrote:
> >     -Wl,-R,$ORIGIN/../lib -Wl,-R,$HOME/tmp/ok2delete/lib
> 
> My bad... It does not matter how this $ORIGIN token is quoted. Perl
> always expands it.

I've encountered this in build systems before, where the quoting is
inconsistent and apparently can result in different levels of dequoting
for a target depending upon how it was reached.

What I've used for building those has been to specify %ORIGIN instead of
$ORIGIN and then binary-edit the resulting binary to switch that % back
to a $.  All quoting issues disappear and all binary offsets are stable.
Just make sure the binary-edit step is before any binary signing. :)

At some point, it's also worth considering static linking.

-Phil

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.