From 3cd8ce3bce1e3d89b21caa0d3ad458193f5179ba Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Wed, 1 Jan 2020 16:29:34 -0800 Subject: treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. (See #67234, for example.) Fix this throughout the tree. Signed-off-by: Anders Kaseorg --- pkgs/development/compilers/halide/default.nix | 2 +- pkgs/development/compilers/llvm/4/llvm.nix | 2 +- pkgs/development/compilers/llvm/5/llvm.nix | 2 +- pkgs/development/compilers/llvm/6/llvm.nix | 2 +- pkgs/development/compilers/llvm/7/llvm.nix | 2 +- pkgs/development/compilers/llvm/8/llvm.nix | 2 +- pkgs/development/compilers/llvm/9/llvm.nix | 2 +- pkgs/development/compilers/mlton/20130715.nix | 2 +- pkgs/development/compilers/solc/default.nix | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) (limited to 'pkgs/development/compilers') diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix index 0b28b61a27b21..44c079af9263a 100644 --- a/pkgs/development/compilers/halide/default.nix +++ b/pkgs/development/compilers/halide/default.nix @@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation { # To handle the lack of 'local' RPATH; required, as they call one of # their built binaries requiring their libs, in the build process. preBuild = '' - export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH" + export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" ''; enableParallelBuilding = true; diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix index d5f640414861b..0d3ce1614ded1 100644 --- a/pkgs/development/compilers/llvm/4/llvm.nix +++ b/pkgs/development/compilers/llvm/4/llvm.nix @@ -143,7 +143,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = stdenv.lib.optionalString enableSharedLibraries '' diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix index cd26b7d17a92d..2ce17765d633a 100644 --- a/pkgs/development/compilers/llvm/5/llvm.nix +++ b/pkgs/development/compilers/llvm/5/llvm.nix @@ -119,7 +119,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix index 8faab6b94a925..80acd3fa2fe1c 100644 --- a/pkgs/development/compilers/llvm/6/llvm.nix +++ b/pkgs/development/compilers/llvm/6/llvm.nix @@ -120,7 +120,7 @@ stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix index 62be8bbedabee..d7fb1fe4b93f3 100644 --- a/pkgs/development/compilers/llvm/7/llvm.nix +++ b/pkgs/development/compilers/llvm/7/llvm.nix @@ -141,7 +141,7 @@ in stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix index 18946f5d640bf..a9c4a6b0ba25e 100644 --- a/pkgs/development/compilers/llvm/8/llvm.nix +++ b/pkgs/development/compilers/llvm/8/llvm.nix @@ -117,7 +117,7 @@ in stdenv.mkDerivation ({ ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix index c0e750dc31c0f..2cdc5a5fd0669 100644 --- a/pkgs/development/compilers/llvm/9/llvm.nix +++ b/pkgs/development/compilers/llvm/9/llvm.nix @@ -134,7 +134,7 @@ in stdenv.mkDerivation (rec { ''; preCheck = '' - export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib + export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib ''; postInstall = '' diff --git a/pkgs/development/compilers/mlton/20130715.nix b/pkgs/development/compilers/mlton/20130715.nix index 207ed8f29bc75..52bb0a0775cf1 100644 --- a/pkgs/development/compilers/mlton/20130715.nix +++ b/pkgs/development/compilers/mlton/20130715.nix @@ -77,7 +77,7 @@ stdenv.mkDerivation rec { chmod u+x $(pwd)/../${usr_prefix}/bin/mlton # So the builder runs the binary compiler with gmp. - export LD_LIBRARY_PATH=${gmp.out}/lib:$LD_LIBRARY_PATH + export LD_LIBRARY_PATH=${gmp.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH '' + stdenv.lib.optionalString stdenv.isLinux '' # Patch ELF interpreter. diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix index 23e6c64f3ffcb..0f71ed79e7ee3 100644 --- a/pkgs/development/compilers/solc/default.nix +++ b/pkgs/development/compilers/solc/default.nix @@ -49,7 +49,7 @@ stdenv.mkDerivation rec { checkPhase = '' while IFS= read -r -d ''' dir do - LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/$dir + LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir export LD_LIBRARY_PATH done < <(find . -type d -print0) -- cgit 1.4.1