Hi Matej, On Wed, 2026-09-09 at 23:49 +0200, Matej Smycka wrote: > handle_output_dir_module builds each module's output file as > "OUTDIR/NAME". For a core file NAME is the raw DT_SONAME reported by > libdwfl (dwfl_segment_report_module) with no basename applied, so a > DT_SONAME like "../../../path" makes eu-unstrip -a -m -d OUTDIR write > the reconstructed module image outside OUTDIR. Basename the name when > joining it, as -m already implies and as link_map.c and core-file.c do. > > * src/unstrip.c (handle_output_dir_module): Use xbasename on the > module name.
I am not sure if a relative path (or a slash in general) is really allowed in an soname. But technically you could create an (crafted) ELF file with it I guess. I am not sure it would actually be loaded, depends on whether ld.so allows it to. But it is a sane way to guard against someone doing something really silly. Applied as: https://sourceware.org/cgit/elfutils/commit/?id=4f5b7ac6bfc4 > Signed-off-by: Matej Smycka <[email protected]> > --- > src/unstrip.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/src/unstrip.c b/src/unstrip.c > index 5585b0e2..60f0916a 100644 > --- a/src/unstrip.c > +++ b/src/unstrip.c > @@ -2456,7 +2456,8 @@ handle_output_dir_module (const char *output_dir, > Dwfl_Module *mod, bool force, > if (file == NULL && ignore) > return; > > - char *output_file = xasprintf ("%s/%s", output_dir, modnames ? name : > file); > + char *output_file = xasprintf ("%s/%s", output_dir, > + modnames ? xbasename (name) : file); > > handle_dwfl_module (output_file, true, force, mod, all, ignore, relocate); >
