From 08bb8ed1c5d3100d1952d6d7be11e2d7b950acbd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Andriot?= <francois.andriot@free.fr>
Date: Sun, 14 Sep 2014 19:46:03 +0200
Subject: [PATCH] Fix security issue CVE-2009-3736 (cherry picked from commit
 7aeb4e9d71aeb59db6a2e40c271536fcff6b1e0e)

---
 ltdl.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/ltdl.c b/ltdl.c
index 1bf7a12..be6ce43 100644
--- a/ltdl.c
+++ b/ltdl.c
@@ -1459,9 +1459,10 @@ lt_dlexit ()
 }
 
 static int
-tryall_dlopen (handle, filename)
+tryall_dlopen (handle, filename, useloader)
      lt_dlhandle *handle;
      const char *filename;
+     const char *useloader;
 {
   lt_dlhandle	 cur;
   lt_dlloader   *loader;
@@ -1519,6 +1520,11 @@ tryall_dlopen (handle, filename)
 
   while (loader)
     {
+      if (useloader && strcmp(loader->loader_name, useloader))
+	{
+	  loader = loader->next;
+	  continue;
+	}
       lt_user_data data = loader->dlloader_data;
 
       cur->module = loader->module_open (data, filename);
@@ -1561,7 +1567,7 @@ find_module (handle, dir, libdir, dlname, old_name, installed)
   /* try to open the old library first; if it was dlpreopened,
      we want the preopened version of it, even if a dlopenable
      module is available */
-  if (old_name && tryall_dlopen(handle, old_name) == 0)
+  if (old_name && tryall_dlopen(handle, old_name, "dlpreload") == 0)
     {
       return 0;
     }
@@ -1584,7 +1590,7 @@ find_module (handle, dir, libdir, dlname, old_name, installed)
 	    }
 
 	  sprintf (filename, "%s/%s", libdir, dlname);
-	  error = (tryall_dlopen (handle, filename) != 0);
+	  error = (tryall_dlopen (handle, filename, NULL) != 0);
 	  LT_DLFREE (filename);
 
 	  if (!error)
@@ -1616,7 +1622,7 @@ find_module (handle, dir, libdir, dlname, old_name, installed)
 	  strcat(filename, objdir);
 	  strcat(filename, dlname);
 
-	  error = tryall_dlopen (handle, filename) != 0;
+	  error = tryall_dlopen (handle, filename, NULL) != 0;
 	  LT_DLFREE (filename);
 	  if (!error)
 	    {
@@ -1639,7 +1645,7 @@ find_module (handle, dir, libdir, dlname, old_name, installed)
 	  }
 	strcat(filename, dlname);
 
-	error = (tryall_dlopen (handle, filename) != 0);
+	error = (tryall_dlopen (handle, filename, NULL) != 0);
 	LT_DLFREE (filename);
 	if (!error)
 	  {
@@ -1754,7 +1760,7 @@ find_file (basename, search_path, pdir, handle)
       strcpy(filename+lendir, basename);
       if (handle)
 	{
-	  if (tryall_dlopen (handle, filename) == 0)
+	  if (tryall_dlopen (handle, filename, NULL) == 0)
 	    {
 	      result = (lt_ptr) handle;
 	      goto cleanup;
@@ -2068,7 +2074,7 @@ lt_dlopen (filename)
       /* lt_dlclose()ing yourself is very bad!  Disallow it.  */
       LT_DLSET_FLAG (handle, LT_DLRESIDENT_FLAG);
 
-      if (tryall_dlopen (&newhandle, 0) != 0)
+      if (tryall_dlopen (&newhandle, 0, NULL) != 0)
 	{
 	  LT_DLFREE (handle);
 	  return 0;
@@ -2373,7 +2379,7 @@ lt_dlopen (filename)
 #ifdef LTDL_SYSSEARCHPATH
 		      && !find_file (basename, sys_search_path, 0, &newhandle)
 #endif
-		   )) && tryall_dlopen (&newhandle, filename))
+		   )) && tryall_dlopen (&newhandle, filename, NULL))
 	{
 	  LT_DLFREE (handle);
 	  goto cleanup;