Skip to content

Conversation

@staticfloat
Copy link
Member

Some users tried to pass a dlopen() handle into lbt_forward() which sadly works just fine, despite ccall() declaring its first argument as being a Cstring. I guess it's trivial to convert a Ptr{Cvoid} into a Cstring, so this just goes through.

To protect against this, restrict path to be an AbstractString.

X-ref: JuliaLinearAlgebra/libblastrampoline#102

Some users tried to pass a `dlopen()` handle into `lbt_forward()` which sadly works just fine, despite `ccall()` declaring its first argument as being a `Cstring`.  I guess it's trivial to convert a `Ptr{Cvoid}` into a `Cstring`, so this just goes through.

To protect against this, restrict `path` to be an `AbstractString`.
@ViralBShah ViralBShah added the backport 1.9 Change should be backported to release-1.9 label Feb 7, 2023
@staticfloat staticfloat merged commit 2c619b7 into master Feb 7, 2023
@staticfloat staticfloat deleted the sf/lbt_path_protection branch February 7, 2023 12:45
@KristofferC KristofferC mentioned this pull request Feb 20, 2023
50 tasks
@KristofferC KristofferC removed the backport 1.9 Change should be backported to release-1.9 label Mar 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants