Commit 3c00715c authored by Oswald Buddenhagen's avatar Oswald Buddenhagen

fix security hole: don't add an empty element to LD_LIBRARY_PATH

if LD_LIBRARY_PATH was empty, the wrapper script would add the empty
element to the path.

> The trailing colon is treated by ld.so as another item on the list,
> and empty items are treated as '.' (CWD). Therefore, if a user
> executes qtcreator from a directory where there's a library that would
> have normally been loaded from the standard library paths the local
> library would be loaded instead.
> This has the potential effect of arbitrary code execution.

Reviewed-by: thiago
Task-number: CVE-2010-3374
parent 245f8652
......@@ -31,6 +31,6 @@ fi
bindir=`dirname "$me"`
libdir=`cd "${bindir}/../lib" ; pwd`
LD_LIBRARY_PATH="${libdir}/qtcreator:${LD_LIBRARY_PATH}"
LD_LIBRARY_PATH="${libdir}/qtcreator${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
export LD_LIBRARY_PATH
exec "${bindir}/qtcreator.bin" ${1+"$@"}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment