forked from qt-creator/qt-creator
fix security hole: don't add an empty element to LD_LIBRARY_PATH
if LD_LIBRARY_PATH was empty, the wrapper script would add the empty element to the path. > The trailing colon is treated by ld.so as another item on the list, > and empty items are treated as '.' (CWD). Therefore, if a user > executes qtcreator from a directory where there's a library that would > have normally been loaded from the standard library paths the local > library would be loaded instead. > This has the potential effect of arbitrary code execution. Reviewed-by: thiago Task-number: CVE-2010-3374
This commit is contained in:
@@ -31,6 +31,6 @@ fi
|
||||
|
||||
bindir=`dirname "$me"`
|
||||
libdir=`cd "${bindir}/../lib" ; pwd`
|
||||
LD_LIBRARY_PATH="${libdir}/qtcreator:${LD_LIBRARY_PATH}"
|
||||
LD_LIBRARY_PATH="${libdir}/qtcreator${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
|
||||
export LD_LIBRARY_PATH
|
||||
exec "${bindir}/qtcreator.bin" ${1+"$@"}
|
||||
|
Reference in New Issue
Block a user