Bug 252338

Summary:	media-sound/brutefir creates files with DT_AUXILIARY set to PIC
Product:	Gentoo Linux	Reporter:	Diego Elio Pettenò (RETIRED) <flameeyes>
Component:	New packages	Assignee:	Gentoo Sound Team <sound>
Status:	RESOLVED FIXED
Severity:	normal	CC:	security
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2008-12-24 01:34:38 UTC

This will make the ld.so loader to look for a file called PIC, which might be a security issue.

The problem is that it passes -fPIC to the linker, and it does not use gcc as frontend, it uses ld directly. The problem is that -f on ld that produces a DT_AUXILIARY rather than causing any PIC code production.

Comment 1 Samuli Suominen (RETIRED) gentoo-dev

2009-06-01 20:19:02 UTC

I just added new version of brutefir to tree, version 1.0k and tried to make it use "gcc" as LD but failed miserabely.

Be my few minute teacher? ;-)

Comment 2 Samuli Suominen (RETIRED) gentoo-dev

2009-06-21 02:52:03 UTC

(In reply to comment #1)
> Be my few minute teacher? ;-)

Fixed it in 1.0k-r1, please review the patch in files/

Thanks for reporting