[PATCH] libdwfl: Handle seeing CU EOF marker without any other (real) CU.

[PATCH] libdwfl: Handle seeing CU EOF marker without any other (real) CU.

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 2085 bytes --]

intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing
the CU EOF marker. In that case the *nextp pointer (first_cu) returned by
intern_cu is -1. And less_layzy will immediately destroy the found CU node.
So don't use the *found result after calling less_lazy.

Found by afl-fuzz.

Signed-off-by: Mark Wielaard <mjw@redhat.com>
---
 libdwfl/ChangeLog | 6 ++++++
 libdwfl/cu.c      | 8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog
index 6b51880..de785dc 100644
--- a/libdwfl/ChangeLog
+++ b/libdwfl/ChangeLog
@@ -1,3 +1,9 @@
+2015-01-04  Mark Wielaard  <mjw@redhat.com>
+
+	* cu.c (intern_cu): Store result and return directly when finding
+	EOF marker.
+	(__libdwfl_nextcu): Check *nextp as returned by intern_cu isn't -1.
+
 2014-12-27  Mark Wielaard  <mjw@redhat.com>
 
 	* dwfl_module_getsrc.c (dwfl_module_getsrc): Never match a line that
diff --git a/libdwfl/cu.c b/libdwfl/cu.c
index 5ce531b..3ac341e 100644
--- a/libdwfl/cu.c
+++ b/libdwfl/cu.c
@@ -1,5 +1,5 @@
 /* Keeping track of DWARF compilation units in libdwfl.
-   Copyright (C) 2005-2010 Red Hat, Inc.
+   Copyright (C) 2005-2010, 2015 Red Hat, Inc.
    This file is part of elfutils.
 
    This file is free software; you can redistribute it and/or modify
@@ -186,8 +186,9 @@ intern_cu (Dwfl_Module *mod, Dwarf_Off cuoff, struct dwfl_cu **result)
 	{
 	  /* This is the EOF marker.  Now we have interned all the CUs.
 	     One increment in MOD->lazycu counts not having hit EOF yet.  */
-	  *found = (void *) -1l;
+	  *found = *result = (void *) -1;
 	  less_lazy (mod);
+	  return DWFL_E_NOERROR;
 	}
       else
 	{
@@ -275,7 +276,8 @@ __libdwfl_nextcu (Dwfl_Module *mod, struct dwfl_cu *lastcu,
       if (result != DWFL_E_NOERROR)
 	return result;
 
-      if ((*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
+      if (*nextp != (void *) -1
+	  && (*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
 	(*nextp)->next = (void *) -1l;
     }
 
-- 
1.8.3.1

Re: [PATCH] libdwfl: Handle seeing CU EOF marker without any other (real) CU.

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 458 bytes --]

On Mon, 2015-01-05 at 00:36 +0100, Mark Wielaard wrote:
> intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing
> the CU EOF marker. In that case the *nextp pointer (first_cu) returned by
> intern_cu is -1. And less_layzy will immediately destroy the found CU node.
> So don't use the *found result after calling less_lazy.
> 
> Found by afl-fuzz.
> 
> Signed-off-by: Mark Wielaard <mjw@redhat.com>

I pushed this to master.