libdwfl: Handle seeing CU EOF marker without any other (real) CU.

intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing
the CU EOF marker. In that case the *nextp pointer (first_cu) returned by
intern_cu is -1. And less_layzy will immediately destroy the found CU node.
So don't use the *found result after calling less_lazy.

Found by afl-fuzz.

Signed-off-by: Mark Wielaard <mjw@redhat.com>

diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog
index 69e59a6fc73e1902d91e0c08d12180e73ad58630..4dda62af3bd46b40365412774c37dfc7fc520644 100644 (file)
--- a/libdwfl/ChangeLog
+++ b/libdwfl/ChangeLog
@@ -1,3 +1,9 @@
+2015-01-04  Mark Wielaard  <mjw@redhat.com>
+
+       * cu.c (intern_cu): Store result and return directly when finding
+       EOF marker.
+       (__libdwfl_nextcu): Check *nextp as returned by intern_cu isn't -1.
+
 2014-12-19  Mark Wielaard  <mjw@redhat.com>
 
        * dwfl_module_getdwarf.c (find_symtab): Always try find_dynsym last.

diff --git a/libdwfl/cu.c b/libdwfl/cu.c
index 5ce531bd9dd30f708ebe23ee16c5333c31f52223..3ac341e4aa91c3275d59443557c99011497e0e01 100644 (file)
--- a/libdwfl/cu.c
+++ b/libdwfl/cu.c
@@ -1,5 +1,5 @@
 /* Keeping track of DWARF compilation units in libdwfl.
-   Copyright (C) 2005-2010 Red Hat, Inc.
+   Copyright (C) 2005-2010, 2015 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -186,8 +186,9 @@ intern_cu (Dwfl_Module *mod, Dwarf_Off cuoff, struct dwfl_cu **result)
        {
          /* This is the EOF marker.  Now we have interned all the CUs.
             One increment in MOD->lazycu counts not having hit EOF yet.  */
-         *found = (void *) -1l;
+         *found = *result = (void *) -1;
          less_lazy (mod);
+         return DWFL_E_NOERROR;
        }
       else
        {
@@ -275,7 +276,8 @@ __libdwfl_nextcu (Dwfl_Module *mod, struct dwfl_cu *lastcu,
       if (result != DWFL_E_NOERROR)
        return result;
 
-      if ((*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
+      if (*nextp != (void *) -1
+         && (*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
        (*nextp)->next = (void *) -1l;
     }