libdwfl: Handle seeing CU EOF marker without any other (real) CU.
intern_cu (and __libdwfl_nextcu) didn't correctly handle immediately seeing
the CU EOF marker. In that case the *nextp pointer (first_cu) returned by
intern_cu is -1. And less_layzy will immediately destroy the found CU node.
So don't use the *found result after calling less_lazy.
Found by afl-fuzz.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
diff --git a/libdwfl/cu.c b/libdwfl/cu.c
index 5ce531b..3ac341e 100644
--- a/libdwfl/cu.c
+++ b/libdwfl/cu.c
@@ -1,5 +1,5 @@
/* Keeping track of DWARF compilation units in libdwfl.
- Copyright (C) 2005-2010 Red Hat, Inc.
+ Copyright (C) 2005-2010, 2015 Red Hat, Inc.
This file is part of elfutils.
This file is free software; you can redistribute it and/or modify
@@ -186,8 +186,9 @@
{
/* This is the EOF marker. Now we have interned all the CUs.
One increment in MOD->lazycu counts not having hit EOF yet. */
- *found = (void *) -1l;
+ *found = *result = (void *) -1;
less_lazy (mod);
+ return DWFL_E_NOERROR;
}
else
{
@@ -275,7 +276,8 @@
if (result != DWFL_E_NOERROR)
return result;
- if ((*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
+ if (*nextp != (void *) -1
+ && (*nextp)->next == NULL && nextoff == (Dwarf_Off) -1l)
(*nextp)->next = (void *) -1l;
}