[banshee/stable-1.8] Fix insecure LD_LIBRARY_PATH (bnc#642505)
- From: Aaron Bockover <abock src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [banshee/stable-1.8] Fix insecure LD_LIBRARY_PATH (bnc#642505)
- Date: Wed, 20 Oct 2010 16:36:14 +0000 (UTC)
commit 835c37e99196303195c88932169b73e975115e52
Author: Aaron Bockover <abockover novell com>
Date: Wed Oct 20 12:22:40 2010 -0400
Fix insecure LD_LIBRARY_PATH (bnc#642505)
A vulnerability existed where if LD_LIBRARY_PATH were set but empty, a
trailing : as a path separator would still be appended to the path,
exposing an insecure/invalid search path. GST_PLUGINS_PATH was similarly
vulnerable.
Using :+: instead of +: prevents this as ${X:+:$X} returns X iff X is
set and not empty whereas ${X+:$X} returns X iff X is set (it may be
empty).
src/Clients/Booter/banshee-1.linux.in | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/Clients/Booter/banshee-1.linux.in b/src/Clients/Booter/banshee-1.linux.in
index 9009797..11e8ccd 100644
--- a/src/Clients/Booter/banshee-1.linux.in
+++ b/src/Clients/Booter/banshee-1.linux.in
@@ -7,8 +7,8 @@ MONO_EXE="@expanded_libdir@/@PACKAGE@/$exec_asm"
BANSHEE_EXEC_NAME=$(basename $0)
BANSHEE_CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/banshee-1"
-export LD_LIBRARY_PATH= expanded_libdir@/@PACKAGE@:@expanded_libdir@/@PACKAGE@/Extensions:@expanded_libdir@/@PACKAGE@/Backends:@expanded_libdir ${LD_LIBRARY_PATH+:$LD_LIBRARY_PATH}
-export GST_PLUGIN_PATH= expanded_libdir@/@PACKAGE@/gstreamer-0.10${GST_PLUGIN_PATH+:$GST_PLUGIN_PATH}
+export LD_LIBRARY_PATH= expanded_libdir@/@PACKAGE@:@expanded_libdir@/@PACKAGE@/Extensions:@expanded_libdir@/@PACKAGE@/Backends:@expanded_libdir ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}
+export GST_PLUGIN_PATH= expanded_libdir@/@PACKAGE@/gstreamer-0.10${GST_PLUGIN_PATH:+:$GST_PLUGIN_PATH}
if [ $BANSHEE_EXEC_NAME = "muinshee" ]; then
BANSHEE_CLIENT="Muinshee"
export MONO_PATH= expanded_libdir@/@PACKAGE@/Extensions
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]