The appended test program registers an exit_handler with on_exit() and calls dlopen and dlclose on a plugin (can be compiled using an empty source file). It only needs to be compiled with a toolchain supporting ctors/dtors using __cxa_exit. Valgrind will report:

==1264== Conditional jump or move depends on uninitialised value(s)
==1264==    at 0x405675F: __cxa_finalize (_atexit.c:203)
==1264==    by 0x4463354: (within /lib/test_plugin.so)
==1264==    by 0x446344B: (within /lib/test_plugin.so)
==1264==    by 0x40149F4: do_dlclose (libdl.c:545)
==1264==    by 0x8048522: main (dlclose_atexit_test_main.c:17)

This is because on_exit does not initialize the dso_handle to NULL in on_exit(). The memory of the structure containing dso_handle is allocated with realloc() and is uninitialized. Maybe this can crash the program on dlclose() or even be used to call arbitrary code. Current uClibc seem to be affected as well - at least the code looks the same. This patch fixes this:

Index: libc/stdlib/_atexit.c
===================================================================
--- libc/stdlib/_atexit.c       (revision 198509)
+++ libc/stdlib/_atexit.c       (revision 198510)
@@ -145,6 +145,7 @@
 
     efp->funcs.on_exit.func = func;
     efp->funcs.on_exit.arg = arg;
+    efp->funcs.cxa_atexit.dso_handle = NULL;
     /* assign last for thread safety, since we're now unlocked */
     efp->type = ef_on_exit;


--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

#include <assert.h>
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>

static void exit_handler(int i, void* arg)
{
    (void)i;
    (void)arg;
}

int main(void)
{
    on_exit(exit_handler, NULL);
    void* dl_handle = dlopen("test_plugin.so", RTLD_LAZY);
    assert(dl_handle);
    dlclose(dl_handle);
    return 0;
}

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--