Re: libltdl is inefficient and a security hazard

[Bob Friesenhahn]

> From OS-X Leopard manual page for dlopen():

     When path doesn't contain a slash character (i.e. it is just a leaf
     name), dlopen() searches the following the following until it finds
     a compatible Mach-O file: $LD_LIBRARY_PATH, $DYLD_LIBRARY_PATH, cur-
     rent working directory, $DYLD_FALLBACK_LIBRARY_PATH.

and this is why searching for bare "module.a" checks the current 
directory.

Here is evidence that there is an easy exploit:

scrappy:~% ./ltdlopentest /Users/bfriesen/src/graphics/test-progs/mymodule.la
plugin opened successfully!
scrappy:~% ls -l mymodule.a
lrwxr-xr-x  1 bfriesen  bfriesen  59 Nov  5 17:39 mymodule.a@ -> 
/usr/local/lib/GraphicsMagick-1.4/modules-Q16/coders/sun.so
scrappy:~% ./ltdlopentest /Users/bfriesen/src/graphics/test-progs/mymodule.la
plugin opened successfully!

Bob
--
Bob Friesenhahn
address@hidden, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/