libc crash

["Sparky Markowitz" <amarkowitz at inprise dot com>]

Hello,
  I've run across what appears to be a fairly evil bug in libc when
working with shared objects.  I have attached a very simplified example
which causes libc to segfault in dlopen().  To see the problem, bunzip2
and untar the attachment and run make.  Once it finishes building, run
./libcbug.  Make sure that the built modules can be found on
LD_LIBRARY_PATH.

The scenario is the following:

1. executable 'foo' is launched and it statically links to shared object
bar (bar is in foos DT_NEEDED section).
2. foo then calls dlopen(baz, ...).  baz is a shared object which
statically links to bar as well (bar is in bazs DT_NEEDED section).
3. baz also statically links to an unavailable shared object (this is
done in the makefile by creating a symlink to an existing shared object,
linking to the symlink, then removing the symlink).
4. when baz fails to load, it trashes something and does not unload
gracefully.
5. after the failed call to dlopen(baz, ...), attempting to call
dlopen(bar, ...) seg faults when it should load fine.

This has been tested (and segfaults) on:
Red Hat 6.2, Red Hat 7.0, Mandrake 7.2
libc 2.2, libc 2.1.3
tested using : g++ 2.95.3 and 2.96

If there is any other information which is necessary to help track down
this problem, please let me know...

Thanks in advance,
-Sparky

bug.tar.bz2