diff options
author | Anders Kaseorg <andersk@mit.edu> | 2020-01-01 16:29:34 -0800 |
---|---|---|
committer | Frederik Rietdijk <freddyrietdijk@fridh.nl> | 2020-01-15 09:47:03 +0100 |
commit | 3cd8ce3bce1e3d89b21caa0d3ad458193f5179ba (patch) | |
tree | 7a1f1889004dce271903d69dce5c1f5a2cf92b07 /pkgs/development/compilers | |
parent | 2e5051e2235f93829f0d6531ace21e87f2a486a4 (diff) |
treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH
Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. (See #67234, for example.) Fix this throughout the tree. Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Diffstat (limited to 'pkgs/development/compilers')
-rw-r--r-- | pkgs/development/compilers/halide/default.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/4/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/5/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/6/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/7/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/8/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/llvm/9/llvm.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/mlton/20130715.nix | 2 | ||||
-rw-r--r-- | pkgs/development/compilers/solc/default.nix | 2 |
9 files changed, 9 insertions, 9 deletions
diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix index 0b28b61a27b21..44c079af9263a 100644 --- a/pkgs/development/compilers/halide/default.nix +++ b/pkgs/development/compilers/halide/default.nix @@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation { # To handle the lack of 'local' RPATH; required, as they call one of # their built binaries requiring their libs, in the build process. preBuild = '' - export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH" + export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" ''; enableParallelBuilding = true; diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix index d5f640414861b..0d3ce1614ded1 100644 --- a/pkgs/development/compilers/llvm/4/llvm.nix +++ b/pkgs/development/compilers/llvm/4/llvm.nix @@ -143,7 +143,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = stdenv.lib.optionalString enableSharedLibraries '' diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix index cd26b7d17a92d..2ce17765d633a 100644 --- a/pkgs/development/compilers/llvm/5/llvm.nix +++ b/pkgs/development/compilers/llvm/5/llvm.nix @@ -119,7 +119,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix index 8faab6b94a925..80acd3fa2fe1c 100644 --- a/pkgs/development/compilers/llvm/6/llvm.nix +++ b/pkgs/development/compilers/llvm/6/llvm.nix @@ -120,7 +120,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix index 62be8bbedabee..d7fb1fe4b93f3 100644 --- a/pkgs/development/compilers/llvm/7/llvm.nix +++ b/pkgs/development/compilers/llvm/7/llvm.nix @@ -141,7 +141,7 @@ in stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix index 18946f5d640bf..a9c4a6b0ba25e 100644 --- a/pkgs/development/compilers/llvm/8/llvm.nix +++ b/pkgs/development/compilers/llvm/8/llvm.nix @@ -117,7 +117,7 @@ in stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix index c0e750dc31c0f..2cdc5a5fd0669 100644 --- a/pkgs/development/compilers/llvm/9/llvm.nix +++ b/pkgs/development/compilers/llvm/9/llvm.nix @@ -134,7 +134,7 @@ in stdenv.mkDerivation (rec { ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/mlton/20130715.nix b/pkgs/development/compilers/mlton/20130715.nix index 207ed8f29bc75..52bb0a0775cf1 100644 --- a/pkgs/development/compilers/mlton/20130715.nix +++ b/pkgs/development/compilers/mlton/20130715.nix @@ -77,7 +77,7 @@ stdenv.mkDerivation rec { chmod u+x $(pwd)/../${usr_prefix}/bin/mlton # So the builder runs the binary compiler with gmp. - export LD_LIBRARY_PATH=${gmp.out}/lib:$LD_LIBRARY_PATH + export LD_LIBRARY_PATH=${gmp.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH '' + stdenv.lib.optionalString stdenv.isLinux '' # Patch ELF interpreter. diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix index 23e6c64f3ffcb..0f71ed79e7ee3 100644 --- a/pkgs/development/compilers/solc/default.nix +++ b/pkgs/development/compilers/solc/default.nix @@ -49,7 +49,7 @@ stdenv.mkDerivation rec { checkPhase = '' while IFS= read -r -d ''' dir do - LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/$dir + LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir export LD_LIBRARY_PATH done < <(find . -type d -print0) |