diff options
| author | Mark Wielaard <mjw@redhat.com> | 2015-01-05 00:12:53 +0100 |
|---|---|---|
| committer | Mark Wielaard <mjw@redhat.com> | 2015-01-15 14:23:20 +0100 |
| commit | 975a37d11d1a14229ada9293fac88a493bf83cfa (patch) | |
| tree | 417c91f9944231730dddb14e56518709c2442811 | |
| parent | 43e924ee0bb01576cb30a7069ad9183e55b1093b (diff) | |
| download | elfutils-975a37d11d1a14229ada9293fac88a493bf83cfa.tar.gz | |
libdwfl: Handle seeing CU EOF marker without any other (real) CU.
intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing
the CU EOF marker. In that case the *nextp pointer (first_cu) returned by
intern_cu is -1. And less_layzy will immediately destroy the found CU node.
So don't use the *found result after calling less_lazy.
Found by afl-fuzz.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
| -rw-r--r-- | libdwfl/ChangeLog | 6 | ||||
| -rw-r--r-- | libdwfl/cu.c | 8 |
2 files changed, 11 insertions, 3 deletions
diff --git a/libdwfl/ChangeLog b/libdwfl/ChangeLog index 69e59a6f..4dda62af 100644 --- a/libdwfl/ChangeLog +++ b/libdwfl/ChangeLog @@ -1,3 +1,9 @@ +2015-01-04 Mark Wielaard <mjw@redhat.com> + + * cu.c (intern_cu): Store result and return directly when finding + EOF marker. + (__libdwfl_nextcu): Check *nextp as returned by intern_cu isn't -1. + 2014-12-19 Mark Wielaard <mjw@redhat.com> * dwfl_module_getdwarf.c (find_symtab): Always try find_dynsym last. diff --git a/libdwfl/cu.c b/libdwfl/cu.c index 5ce531bd..3ac341e4 100644 --- a/libdwfl/cu.c +++ b/libdwfl/cu.c @@ -1,5 +1,5 @@ /* Keeping track of DWARF compilation units in libdwfl. - Copyright (C) 2005-2010 Red Hat, Inc. + Copyright (C) 2005-2010, 2015 Red Hat, Inc. This file is part of elfutils. This file is free software; you can redistribute it and/or modify @@ -186,8 +186,9 @@ intern_cu (Dwfl_Module *mod, Dwarf_Off cuoff, struct dwfl_cu **result) { /* This is the EOF marker. Now we have interned all the CUs. One increment in MOD->lazycu counts not having hit EOF yet. */ - *found = (void *) -1l; + *found = *result = (void *) -1; less_lazy (mod); + return DWFL_E_NOERROR; } else { @@ -275,7 +276,8 @@ __libdwfl_nextcu (Dwfl_Module *mod, struct dwfl_cu *lastcu, if (result != DWFL_E_NOERROR) return result; - if ((*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l) + if (*nextp != (void *) -1 + && (*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l) (*nextp)->next = (void *) -1l; } |