A ld.so bug

["H . J . Lu" <hjl at lucon dot org>]

# gcc d.c -ldl -D_GNU_SOURCE
# a.out
zsh: 5484 segmentation fault  ./a.out

The problem is _dl_signal_error is called with (xxx, NULL, xxx) in
quite a few places. But _dl_signal_error does strlen (objname) without
checking if objname is NULL.

BTW, there is anther problem. I don't think _dlerror_run can use
calloc for error reporting. I got a testcase with

void*
calloc(size_t n, size_t len)
{
        if (callocp == NULL) 
                callocp = (void *(*) (size_t, size_t)) dlsym (RTLD_NEXT,
"calloc
");

        printf("CALLOC %d %d --> %p\n", n, len, callocp);
        return (*callocp)(n, len);
}

void *
malloc(size_t len)
{
        if (mallocp == NULL)
                mallocp = (void *(*) (size_t)) dlsym (RTLD_NEXT, "malloc");

        printf("MALLOC %d (--> %p)\n", len, mallocp);
        return (*mallocp)(len);
}

void *
realloc(void* ptr, size_t len)
{
        if (reallocp == NULL)
                reallocp = (void *(*) (void*, size_t)) dlsym (RTLD_NEXT,
"reallo
c");

        printf("REALLOC %p %d (--> %p)\n", ptr, len, reallocp);
        return (*reallocp)(ptr, len);
}

ld.so went to an endless recursive call while trying to tell me

RTLD_NEXT used in code not dynamically loade



H.J.
----
#include <stdio.h>
#include <dlfcn.h>

int
main(void)
{
   void *p;

   p = (void *(*) (size_t)) dlsym (RTLD_NEXT, "foo");

   if (p == NULL)
     printf("%s\n", dlerror ());

  return 0;
}