Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

torch-activate: Never add the current directory to LD_LIBRARY_PATH #228

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

andersk
Copy link

@andersk andersk commented Jun 9, 2017

The dynamic loader parses a : at the end of LD_LIBRARY_PATH as a separator delimiting the empty string on its right, which is interpreted as the current directory. This can cause all kinds of hard-to-debug breakage and may be a security vulnerability in certain contexts. See:

https://joshumax.github.io/general/2017/06/08/how-torch-broke-ls.html

Correct this using the ${parameter:+word} syntax, which works in all POSIX shells:

http://pubs.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02

The dynamic loader parses a : at the end of LD_LIBRARY_PATH as a
separator delimiting the empty string on its right, which is
interpreted as the current directory.  This can cause all kinds of
hard-to-debug breakage and may be a security vulnerability in certain
contexts.  See:

https://joshumax.github.io/general/2017/06/08/how-torch-broke-ls.html

Correct this using the ${parameter:+word} syntax, which works in all
POSIX shells:

http://pubs.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02

Signed-off-by: Anders Kaseorg <[email protected]>
@joshumax
Copy link

joshumax commented Jun 9, 2017

This looks like a much more compliant patch than the one I was going to send in a PR!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants