[MLB] Linux fails test 'mdemo-exec.test' with Segmentation fault!

[Robert Boehne]

On Linux (Redhat 6.2) one of the test cases
(the second execution of mdemo-exec.test) is failing with
the current CVS version of libtool.  The problems is a segmentation
fault coming from ltdl.c in the function lt_dlexit.  The following 
debugging session shows that when on line 1117, the pointer 'cur'
is incremented to the next structure, it's value becomes 0, then
it is accessed in LT_DLIS_RESIDENT (cur), which results in
a segmentation fault.
  I assume that all that needs to be done to fix this is to add a check
for a zero value after the 'cur = cur->next' statement.  Attached is
a patch that does just that.  Here is a ChangeLog entry:

2000-12-18  Robert Boehne  <address@hidden>

        * libltdl/ltdl.c (lt_dlexit): Test for a null value in 'cur'
        before accessing it.

This patch fixes the error, but as I'm not familiar with the code in
libltdl, I would like someone who is to really examine this.

Thanks,

Robert


icarus::/boreas/libtool/tests (154)% gdb ../mdemo/mdemo 
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i386-redhat-linux"...Warning:
/tmp_mnt/boreas/libtool/tests/@: No such file or directory.

(gdb) run ../mdemo/foo1.la ../mdemo/libfoo2.la
Starting program: /tmp_mnt/boreas/libtool/tests/../mdemo/mdemo
../mdemo/foo1.la ../mdemo/libfoo2.la
Welcome to GNU libtool mdemo!
** This is foolib 1 **
hello returned: 57616
hello is ok!
cos (0.0) = 1
foo1 is ok!
** This is foolib 2 **
hello returned: 57616
hello is ok!
sin (0.0) = 0
foo2 is ok!
myfunc returned: 57616
myfunc is ok!

Program received signal SIGSEGV, Segmentation fault.
lt_dlexit () at ltdl.c:1118
1118                  if (!LT_DLIS_RESIDENT (cur) && tmp->info.ref_count <= 
level)
(gdb) where
#0  lt_dlexit () at ltdl.c:1118
#1  0x80492bf in main (argc=3, argv=0xbffff734) at main.c:173
#2  0x400379cb in __libc_start_main (main=0x8049218 <main>, argc=3,
argv=0xbffff734, init=0x8048d24 <_init>, fini=0x804b87c <_fini>,
rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffff72c)
    at ../sysdeps/generic/libc-start.c:92
(gdb) print cur
$1 = 0x0
(gdb) print tmp
$2 = 0x804d278
(gdb) print tmp->next
$3 = (struct lt_dlhandle_struct *) 0x0
(gdb) print handles
$4 = 0x804d278
(gdb) print initialized
$5 = 0

-- 
Robert Boehne             Software Engineer
Ricardo Software   Chicago Technical Center
TEL: (630)789-0003 x. 238
FAX: (630)789-0127
email:  address@hidden

Index: ltdl.c
===================================================================
RCS file: /home/cvs/libtool/libltdl/ltdl.c,v
retrieving revision 1.82.2.11
diff -u -r1.82.2.11 ltdl.c
--- ltdl.c      2000/12/16 03:19:09     1.82.2.11
+++ ltdl.c      2000/12/18 20:29:32
@@ -1115,7 +1115,7 @@
            {
              lt_dlhandle tmp = cur;
              cur = cur->next;
-             if (!LT_DLIS_RESIDENT (cur) && tmp->info.ref_count <= level)
+             if (cur && !LT_DLIS_RESIDENT (cur) && tmp->info.ref_count <= 
level)
                {
                  if (lt_dlclose (tmp))
                    {