From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============1804933862256725384==" MIME-Version: 1.0 From: Mark Wielaard To: elfutils-devel@lists.fedorahosted.org Subject: [PATCH] libdwfl: Handle seeing CU EOF marker without any other (real) CU. Date: Mon, 05 Jan 2015 00:36:49 +0100 Message-ID: <1420414609-8655-1-git-send-email-mjw@redhat.com> --===============1804933862256725384== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing the CU EOF marker. In that case the *nextp pointer (first_cu) returned by intern_cu is -1. And less_layzy will immediately destroy the found CU node. So don't use the *found result after calling less_lazy. Found by afl-fuzz. Signed-off-by: Mark Wielaard --- libdwfl/ChangeLog | 6 ++++++ libdwfl/cu.c | 8 +++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index 6b51880..de785dc 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,3 +1,9 @@ +2015-01-04 Mark Wielaard + + * cu.c (intern_cu): Store result and return directly when finding + EOF marker. + (__libdwfl_nextcu): Check *nextp as returned by intern_cu isn't -1. + 2014-12-27 Mark Wielaard = * dwfl_module_getsrc.c (dwfl_module_getsrc): Never match a line that diff --git a/libdwfl/cu.c b/libdwfl/cu.c index 5ce531b..3ac341e 100644 --- a/libdwfl/cu.c +++ b/libdwfl/cu.c @@ -1,5 +1,5 @@ /* Keeping track of DWARF compilation units in libdwfl. - Copyright (C) 2005-2010 Red Hat, Inc. + Copyright (C) 2005-2010, 2015 Red Hat, Inc. This file is part of elfutils. = This file is free software; you can redistribute it and/or modify @@ -186,8 +186,9 @@ intern_cu (Dwfl_Module *mod, Dwarf_Off cuoff, struct dw= fl_cu **result) { /* This is the EOF marker. Now we have interned all the CUs. One increment in MOD->lazycu counts not having hit EOF yet. */ - *found =3D (void *) -1l; + *found =3D *result =3D (void *) -1; less_lazy (mod); + return DWFL_E_NOERROR; } else { @@ -275,7 +276,8 @@ __libdwfl_nextcu (Dwfl_Module *mod, struct dwfl_cu *las= tcu, if (result !=3D DWFL_E_NOERROR) return result; = - if ((*nextp)->next =3D=3D NULL && nextoff =3D=3D (Dwarf_Off) -1l) + if (*nextp !=3D (void *) -1 + && (*nextp)->next =3D=3D NULL && nextoff =3D=3D (Dwarf_Off) -1l) (*nextp)->next =3D (void *) -1l; } = -- = 1.8.3.1 --===============1804933862256725384==--