[libtool 2.2.6] linking -static with uninstalled shared library generates invalid rpath

[Stanislav Brabec]

When linking a binary which contains -static in its LDFLAGS and the
library is linked against an uninstalled library which does not contain
-static in its LDFLAGS and configure was called with --disable-static,
libtool generates invalid command line that embeds RPATH to the
uninstalled shared library location.

It could be considered even as a security issue, as such binary may load
malicious library from a possibly world writable area.

Attachment shows an example, where the final linking expands to:

/bin/sh ./libtool --tag=CC   --mode=link gcc  -g -O2 -static  -o hallolib 
hallolib-hallolib.o ./libhallo/libhallo.la 
libtool: link: gcc -g -O2 -o hallolib hallolib-hallolib.o  
./libhallo/.libs/libhallo.so -Wl,-rpath 
-Wl,/home/sbrabec/libinvalid/libhallo/.libs

Guessing thet the correct line should be:
libtool: link: gcc -g -O2 -o .libs/hallolib hallolib-hallolib.o  
./libhallo/.libs/libhallo.so
and wrapper should be written

-- 
Best Regards / S pozdravem,

Stanislav Brabec
software developer
---------------------------------------------------------------------
SUSE LINUX, s. r. o.                          e-mail: address@hidden
Lihovarská 1060/12           tel: +420 284 028 966, +49 911 740538747
190 00 Praha 9                                  fax: +420 284 028 951
Czech Republic                                    http://www.suse.cz/

libinvalid.tar.bz2
Description: application/bzip-compressed-tar