[lld] [LLD] [COFF] Don't look up relative paths to parent directories in the search paths (PR #67858)

[Martin Storsjö via llvm-commits]

https://github.com/mstorsjo created https://github.com/llvm/llvm-project/pull/67858

In b6c2f100c23bb715edbec57a4894f1ae551cd1d4, we allowed looking up relative paths within the search directories. This was done with the intention to allow resolving paths like <triple>/clang_rt.builtins.lib within a base search directory. However we shouldn't try to look up e.g. a path like ../../../../lib/libLLVMSupport.a in the search paths. In some cases, this could actually lead to accidental matches, for a file other than the one that was intended.

This should fix one aspect of #67779.

>From 63cd2f177885d4cedd193832f547a8eaeeb629a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin at martin.st>
Date: Sat, 30 Sep 2023 00:14:34 +0300
Subject: [PATCH] [LLD] [COFF] Don't look up relative paths to parent
 directories in the search paths

In b6c2f100c23bb715edbec57a4894f1ae551cd1d4, we allowed looking
up relative paths within the search directories. This was done with
the intention to allow resolving paths like <triple>/clang_rt.builtins.lib
within a base search directory. However we shouldn't try to look
up e.g. a path like ../../../../lib/libLLVMSupport.a in the search
paths. In some cases, this could actually lead to accidental
matches, for a file other than the one that was intended.

This should fix one aspect of #67779.
---
 lld/COFF/Driver.cpp                      | 5 ++++-
 lld/test/COFF/relative_search_paths.test | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lld/COFF/Driver.cpp b/lld/COFF/Driver.cpp
index 61a04a74aa60278..c95ac626780a0cd 100644
--- a/lld/COFF/Driver.cpp
+++ b/lld/COFF/Driver.cpp
@@ -483,7 +483,10 @@ StringRef LinkerDriver::findFile(StringRef filename) {
     return filename;
   };
 
-  if (sys::path::is_absolute(filename))
+  bool hasParentDir = filename.starts_with("../") ||
+                      filename.starts_with("..\\") ||
+                      filename.contains("/../") || filename.contains("\\..\\");
+  if (sys::path::is_absolute(filename) || hasParentDir)
     return getFilename(filename);
   bool hasExt = filename.contains('.');
   for (StringRef dir : searchPaths) {
diff --git a/lld/test/COFF/relative_search_paths.test b/lld/test/COFF/relative_search_paths.test
index 8c89e9aa0c66827..488e4c2dfd5761b 100644
--- a/lld/test/COFF/relative_search_paths.test
+++ b/lld/test/COFF/relative_search_paths.test
@@ -2,3 +2,7 @@ We should be able to find libraries with relative search paths.
 # RUN: mkdir -p %t.dir/relative/path
 # RUN: cp %p/Inputs/std64.lib %t.dir/relative/path
 # RUN: lld-link %p/Inputs/hello64.obj /libpath:%t.dir relative/path/std64.lib /entry:main
+
+Check that we don't resolve file names like ../std64.lib relative to a libpath.
+# RUN: cp %p/Inputs/std64.lib %t.dir
+# RUN: not lld-link %p/Inputs/hello64.obj /libpath:%t.dir/relative ../std64.lib /entry:main