commit 97f13188c9fbafeaab89146996b3cce1f4952b5e
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Tue Dec 19 21:06:23 2017 +0000

    elf: remove redundant code from _dl_dst_substitute
    
    There are just two users of _dl_dst_substitute: one is expand_dst that
    sets is_path argument to 0, another one is expand_dynamic_string_token.
    The latter function also has just two users: one is _dl_map_object that
    sets is_path argument to 0, another one is fillin_rpath that sets
    is_path argument to 1 and name argument contains no ':'.
    
    In any case (is_path && name[i] == ':') is always false and all code
    depending on it can be safely removed.
    
    * elf/dl-load.c (_dl_dst_substitute): Remove checks that is_path
    is set and name contains ':', and all code depending on these checks.

Index: glibc-2.17-c758a686/elf/dl-load.c
===================================================================
--- glibc-2.17-c758a686.orig/elf/dl-load.c
+++ glibc-2.17-c758a686/elf/dl-load.c
@@ -349,13 +349,7 @@ _dl_dst_substitute (struct link_map *l,
 	      /* We cannot use this path element, the value of the
 		 replacement is unknown.  */
 	      wp = last_elem;
-	      name += len;
-	      while (*name != '\0' && (!is_path || *name != ':'))
-		++name;
-	      /* Also skip following colon if this is the first rpath
-		 element, but keep an empty element at the end.  */
-	      if (wp == result && is_path && *name == ':' && name[1] != '\0')
-		++name;
+	      break;
 	    }
 	  else
 	    /* No DST we recognize.  */
@@ -364,19 +358,6 @@ _dl_dst_substitute (struct link_map *l,
       else
 	{
 	  *wp++ = *name++;
-	  if (is_path && *name == ':')
-	    {
-	      /* In SUID/SGID programs, after $ORIGIN expansion the
-		 normalized path must be rooted in one of the trusted
-		 directories.  */
-	      if (__builtin_expect (check_for_trusted, false)
-		  && !is_trusted_path_normalize (last_elem, wp - last_elem))
-		wp = last_elem;
-	      else
-		last_elem = wp;
-
-	      check_for_trusted = false;
-	    }
 	}
     }
   while (*name != '\0');