Subject: bug#73737: configure error at "checking dynamic linker characteristics"

From: Bruno Haible <[email-masked]>
Date: Tue, 15 Oct 2024 22:03:33 +0200

Ileana Dumitrescu wrote:
> This bug should be resolved with a patch submitted on Savannah:
> https://savannah.gnu.org/patch/index.php?10481

While this patch is an improvement — it avoids an error message
if $multilib was unset or empty or started with a '-' character —
it still is not the full fix. Namely, it does word splitting.
When I set
  export multilib='yes and no'
then run configure, I see an error message:

  checking dynamic linker characteristics... ../configure: line 11854: test: too many arguments

Really, word splitting should be avoided on unstrusted inputs [1].
Here is a patch that does so.

[1] https://stackoverflow.com/questions/3811345/

diff --git a/m4/libtool.m4 b/m4/libtool.m4
index d8a0a728..dcd6adae 100644
--- a/m4/libtool.m4
+++ b/m4/libtool.m4
@@ -2584,7 +2584,7 @@ cygwin* | mingw* | windows* | pw32* | cegcc*)
     # If user builds GCC with multilib enabled,
     # it should just install on $(libdir)
     # not on $(libdir)/../bin or 32 bits dlls would override 64 bit ones.
-    if test xyes = x$multilib; then
+    if test xyes = x"$multilib"; then
       postinstall_cmds='base_file=`basename \$file`~
         dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~
         dldir=$destdir/`dirname \$dlpath`~