haampie / libtree

ldd as a tree

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Properly execute tools (like `chrpath`) witth `execve`instead of `system`

cipriancraciun opened this issue · comments

At the moment, when invoking chrpath or strip, the tool seems to be using popen, which underneath just calls system with a command as a string.

chrpath_cmd << chrpath_path << " -c -r \"" << rpath << "\" " << deploy_path;

Unfortunately that command is not properly escapend, since if a library happens to include a quote, it basically allows "shell injection".

Moreover the deploy_path doesn't seem to be quoted at all.

(Granted, it is very unlikely that a library contains "strange" characters, like say libunsafe"; rm -Rf .;.so, however a tool should be safe regardless.)

Yeah, this is how it's supposed to go. If someone doesn't already pick this up, I'll try to get to it soon.