[patch] Dangling Pointer in libltdl

[Dave Brolley]

Hi,

The attached patch fixes a problem with a dangling pointer in lt_dlexit 
withing libltdl. The problem is that lt_dlclose  is recursively called 
(via unload_deplibs) in order to close dependent libraries. One of these 
might be (and was for me!) the one pointed to by 'cur'.

The patch makes sure that the handle pointed to by 'cur' still exists in 
the linked list pointed to by 'handles' and, if it doesn't, resets it.

This patch is against the latest CVS sources of the libtool project as 
of today.

Dave

2007-01-17  Dave Brolley  <address@hidden>

        * libltdl/ltdl.c (lt_dlexit): After each call to lt_dlclose, make sure
        that the handle pointed to by 'cur' still exists.

Index: libltdl/ltdl.c
===================================================================
RCS file: /sources/libtool/libtool/libltdl/ltdl.c,v
retrieving revision 1.245
diff -c -p -u -5 -r1.245 ltdl.c
--- libltdl/ltdl.c      13 Oct 2006 14:11:18 -0000      1.245
+++ libltdl/ltdl.c      18 Jan 2007 18:31:21 -0000
@@ -1,7 +1,7 @@
 /* ltdl.c -- system independent dlopen wrapper
-   Copyright (C) 1998, 1999, 2000, 2004, 2005, 2006 Free Software Foundation, 
Inc.
+   Copyright (C) 1998, 1999, 2000, 2004, 2005, 2006, 2007 Free Software 
Foundation, Inc.
    Originally by Thomas Tanner <address@hidden>
 
    NOTE: The canonical source of this file is maintained with the
    GNU Libtool package.  Report bugs to address@hidden
 
@@ -283,10 +283,19 @@ lt_dlexit (void)
                        {
                          ++errors;
                        }
                    }
                }
+             /* Make sure that the handle pointed to by 'cur' still exists.
+                lt_dlclose recursively closes dependent libraries which removes
+                them from the linked list.  One of these might be the one
+                pointed to by 'cur'.  */
+             for (tmp = handles; tmp; tmp = tmp->next)
+               if (tmp == cur)
+                 break;
+             if (! tmp)
+               cur = handles;
            }
          /* done if only resident modules are left */
          if (!saw_nonresident)
            break;
        }