libdwarf is a library to consume and produce DWARF debug information.
A fuzz with the Undefined Behavior Sanitizer shows a negation that cannot be represented as long long.
The complete UBSan output:
# dwarfdump $FILE dwarf_leb.c:306:19: runtime error: negation of -9223372036854775808 cannot be represented in type 'Dwarf_Signed' (aka 'long long'); cast to an unsigned type to negate this value to itself
This bug was discovered by Agostino Sarubbo of Gentoo.
2016-11-11: bug discovered and reported to upstream
2016-11-11: upstream released a patch
2016-11-19: blog post about the issue
2016-11-23: CVE assigned
2016-11-24: upstream released 20161124
This bug was found with American Fuzzy Lop.