<feed xmlns='http://www.w3.org/2005/Atom'>
<title>glibc.git/elf/tst-rootdir.script, branch glibc-2.41</title>
<subtitle>Unnamed repository; edit this file 'description' to name the repository.
</subtitle>
<link rel='alternate' type='text/html' href='https://git.belthelziquor.com/glibc.git/'/>
<entry>
<title>elf: Add test for locating libraries in root dir (bug 30435)</title>
<updated>2023-05-25T15:10:54+00:00</updated>
<author>
<name>Qixing ksyx Xue</name>
<email>qixingxue@outlook.com</email>
</author>
<published>2023-05-25T15:10:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.belthelziquor.com/glibc.git/commit/?id=dbfc83bdcab941ce04200f97879f2a79fd0f2a0b'/>
<id>dbfc83bdcab941ce04200f97879f2a79fd0f2a0b</id>
<content type='text'>
When dlopen is being called, efforts have been made to improve
future lookup performance. This includes marking a search path
as non-existent using `stat`. However, if the root directory
is given as a search path, there exists a bug which erroneously
marks it as non-existing.

The bug is reproduced under the following sequence:

  1. dlopen is called to open a shared library, with at least:
     1) a dependency 'A.so' not directly under the '/' directory
        (e.g. /lib/A.so), and
     2) another dependency 'B.so' resides in '/'.
  2. for this bug to reproduce, 'A.so' should be searched *before* 'B.so'.
  3. it first tries to find 'A.so' in /, (e.g. /A.so):
     - this will (obviously) fail,
     - since it's the first time we have seen the '/' directory,
       its 'status' is 'unknown'.
  4. `buf[buflen - namelen - 1] = '\0'` is executed:
     - it intends to remove the leaf and its final slash,
     - because of the speciality of '/', its buflen == namelen + 1,
     - it erroneously clears the entire buffer.
  6. it then calls 'stat' with the empty buffer:
     - which will result in an error.
  7. so it marks '/' as 'nonexisting', future lookups will not consider
     this path.
  8. while /B.so *does* exist, failure to look it up in the '/'
     directory leads to a 'cannot open shared object file' error.

This patch fixes the bug by preventing 'buflen', an index to put '\0',
from being set to 0, so that the root '/' is always kept.
Relative search paths are always considered as 'existing' so this
wont be affected.

Writeup by Moody Liu &lt;mooodyhunter@outlook.com&gt;

Suggested-by: Carlos O'Donell &lt;carlos@redhat.com&gt;
Signed-off-by: Qixing ksyx Xue &lt;qixingxue@outlook.com&gt;
Reviewed-by: Siddhesh Poyarekar &lt;siddhesh@sourceware.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When dlopen is being called, efforts have been made to improve
future lookup performance. This includes marking a search path
as non-existent using `stat`. However, if the root directory
is given as a search path, there exists a bug which erroneously
marks it as non-existing.

The bug is reproduced under the following sequence:

  1. dlopen is called to open a shared library, with at least:
     1) a dependency 'A.so' not directly under the '/' directory
        (e.g. /lib/A.so), and
     2) another dependency 'B.so' resides in '/'.
  2. for this bug to reproduce, 'A.so' should be searched *before* 'B.so'.
  3. it first tries to find 'A.so' in /, (e.g. /A.so):
     - this will (obviously) fail,
     - since it's the first time we have seen the '/' directory,
       its 'status' is 'unknown'.
  4. `buf[buflen - namelen - 1] = '\0'` is executed:
     - it intends to remove the leaf and its final slash,
     - because of the speciality of '/', its buflen == namelen + 1,
     - it erroneously clears the entire buffer.
  6. it then calls 'stat' with the empty buffer:
     - which will result in an error.
  7. so it marks '/' as 'nonexisting', future lookups will not consider
     this path.
  8. while /B.so *does* exist, failure to look it up in the '/'
     directory leads to a 'cannot open shared object file' error.

This patch fixes the bug by preventing 'buflen', an index to put '\0',
from being set to 0, so that the root '/' is always kept.
Relative search paths are always considered as 'existing' so this
wont be affected.

Writeup by Moody Liu &lt;mooodyhunter@outlook.com&gt;

Suggested-by: Carlos O'Donell &lt;carlos@redhat.com&gt;
Signed-off-by: Qixing ksyx Xue &lt;qixingxue@outlook.com&gt;
Reviewed-by: Siddhesh Poyarekar &lt;siddhesh@sourceware.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
