AgeCommit message (Collapse)AuthorLines
2015-03-30release 1.0.5v1.0.5rs-1.0Rich Felker-1/+37
2015-03-30regex: fix character class repetitionsSzabolcs Nagy-0/+5
Internally regcomp needs to copy some iteration nodes before translating the AST into TNFA representation. Literal nodes were not copied correctly: the class type and list of negated class types were not copied so classes were ignored (in the non-negated case an ignored char class caused the literal to match everything). This affects iterations when the upper bound is finite, larger than one or the lower bound is larger than one. So eg. the EREs [[:digit:]]{2} [^[:space:]ab]{1,4} were treated as .{2} [^ab]{1,4} The fix is done with minimal source modification to copy the necessary fields, but the AST preparation and node handling code of tre will need to be cleaned up for clarity. (cherry picked from commit c498efe117539a9d40d90b588c033316701c4b3e)
2015-03-30fix internal buffer overrun in inet_ptonRich Felker-2/+3
one stop condition for parsing abbreviated ipv6 addressed was missed, allowing the internal ip[] buffer to overflow. this patch adds the missing stop condition and masks the array index so that, in case there are any remaining stop conditions missing, overflowing the buffer is not possible. (cherry picked from commit fc13acc3dcb5b1f215c007f583a63551f6a71363)
2015-03-30fix regcomp handling of backslash followed by high byteRich Felker-4/+1
the regex parser handles the (undefined) case of an unexpected byte following a backslash as a literal. however, instead of correctly decoding a character, it was treating the byte value itself as a character. this was not only semantically unjustified, but turned out to be dangerous on archs where plain char is signed: bytes in the range 252-255 alias the internal codes -4 through -1 used for special types of literal nodes in the AST. analogous to commit 39dfd58417ef642307d90306e1c7e50aaec5a35c in mainline. it's unclear whether the same crash that affected mainline is possible in the older regcomp code in 1.0.x, but conceptually the bug is the same.
2015-03-30fix signed left-shift overflow in pthread_condattr_setpsharedRich Felker-1/+1
(cherry picked from commit 380857bf21bcffbbee2fe8ab52feadf39366d7ec)
2015-03-30fix preprocessor error introduced in poll.h in last commitRich Felker-1/+1
(cherry picked from commit 91a3bd743e91604bde83e9ce1ad3a2e2d4ff0f0f)
2015-03-30fix POLLWRNORM and POLLWRBAND on mipsTrutz Behn-0/+8
these macros have the same distinct definition on blackfin, frv, m68k, mips, sparc and xtensa kernels. POLLMSG and POLLRDHUP additionally differ on sparc. (cherry picked from commit f5011c62c3329f15652a60b6b2300d7e3f570977)
2015-03-30fix init race that could lead to deadlock in malloc init codeRich Felker-39/+14
the malloc init code provided its own version of pthread_once type logic, including the exact same bug that was fixed in pthread_once in commit 0d0c2f40344640a2a6942dda156509593f51db5d. since this code is called adjacent to expand_heap, which takes a lock, there is no reason to have pthread_once-type initialization. simply moving the init code into the interval where expand_heap already holds its lock on the brk achieves the same result with much less synchronization logic, and allows the buggy code to be eliminated rather than just fixed. (cherry picked from commit 7a81fe3710be0128d29071e76c5acbea3d84277b)
2015-03-30avoid malloc failure for small requests when brk can't be extendedRich Felker-1/+23
this issue mainly affects PIE binaries and execution of programs via direct invocation of the dynamic linker binary: depending on kernel behavior, in these cases the initial brk may be placed at at location where it cannot be extended, due to conflicting adjacent maps. when brk fails, mmap is used instead to expand the heap. in order to avoid expensive bookkeeping for managing fragmentation by merging these new heap regions, the minimum size for new heap regions increases exponentially in the number of regions. this limits the number of regions, and thereby the number of fixed fragmentation points, to a quantity which is logarithmic with respect to the size of virtual address space and thus negligible. the exponential growth is tuned so as to avoid expanding the heap by more than approximately 50% of its current total size. (cherry picked from commit 5446303328adf4b4e36d9fba21848e6feb55fab4)
2015-03-30fix bad character checking in wordexpRich Felker-0/+1
the character sequence '$((' was incorrectly interpreted as the opening of arithmetic even within single-quoted contexts, thereby suppressing the checks for bad characters after the closing quote. presently bad character checking is only performed when the WRDE_NOCMD is used; this patch only corrects checking in that case. (cherry picked from commit 594ffed82f4e6ee7da85e9c5da35e32946ae32c9)
2015-03-30fix fesetenv(FE_DFL_ENV) on mipsSzabolcs Nagy-1/+3
mips fesetenv did not handle FE_DFL_ENV, now fcsr is cleared in that case. (cherry picked from commit 5fc1487832e16aa2119e735a388d5f36c8c139e2)
2015-03-30fix failure of fchmodat to report EOPNOTSUPP in the race pathRich Felker-2/+5
in the case where a non-symlink file was replaced by a symlink during the fchmodat operation with AT_SYMLINK_NOFOLLOW, mode change on the new symlink target was successfully suppressed, but the error was not reported. instead, fchmodat simply returned 0. (cherry picked from commit 61b1d102129990f6e903c6ddcf46c7d79d1a1e99) (conflicts from commit dd5f50da6f6c3df5647e922e47f8568a8896a752)
2015-03-30fix fd leak race (missing O_CLOEXEC) in fchmodatRich Felker-1/+1
(cherry picked from commit 2736eb6caa70bb6e909d7d8ebbe145c2071435e0)
2015-03-30fix typo in x86_64/x32 user_fpregs_structFelix Janda-2/+2
mxcs_mask should be mxcr_mask (cherry picked from commit 4758f0565df83beb8f9b24857ec40ca3a40d2281)
2015-03-30fix erroneous return of partial username matches by getspnam[_r]Rich Felker-1/+1
when using /etc/shadow (rather than tcb) as its backend, getspnam_r matched any username starting with the caller-provided string rather than requiring an exact match. in practice this seems to have affected only systems where one valid username is a prefix for another valid username, and where the longer username appears first in the shadow file. (cherry picked from commit ecb608192a48d3688e1a0a21027bfd968d3301a1)
2015-03-30check for connect failure in syslog log openingRich Felker-2/+6
based on patch by Dima Krasner, with minor improvements for code size. connect can fail if there is no listening syslogd, in which case a useless socket was kept open, preventing subsequent syslog call from attempting to connect again. (cherry picked from commit c574321d75f035ff6d2c18dfb7e3f70db60ba7bd)
2015-03-30fix signedness of WINT_MIN expressionRich Felker-1/+1
since wint_t is unsigned, WINT_MIN needs to expand to an unsigned zero. (cherry picked from commit aee9b1526247f74e9b755b50e102b3b4ce2aac1d)
2015-03-30correctly handle write errors encountered by printf-family functionsRich Felker-2/+12
previously, write errors neither stopped further output attempts nor caused the function to return an error to the caller. this could result in silent loss of output, possibly in the middle of output in the event of a non-permanent error. the simplest solution is temporarily clearing the error flag for the target stream, then suppressing further output when the error flag is set and checking/restoring it at the end of the operation to determine the correct return value. since the wide version of the code internally calls the narrow fprintf to perform some of its underlying operations, initial clearing of the error flag is suppressed when performing a narrow vfprintf on a wide-oriented stream. this is not a problem since the behavior of narrow operations on wide-oriented streams is undefined. (cherry picked from commit d42269d7c85308abdbf8cee38b1a1097249eb38b)
2015-03-30fix return value of pthread_getaffinity_np and pthread_setaffinity_npRich Felker-8/+11
these functions are expected to return an error code rather than setting errno and returning -1. (cherry picked from commit 66140b0c926ed097f2cb7474863523e4af351f5b)
2015-03-30fix uninitialized output from sched_getaffinityRich Felker-1/+5
the sched_getaffinity syscall only fills a cpu set up to the set size used/supported by the kernel. the rest is left untouched and userspace is responsible for zero-filling it based on the return value of the syscall. (cherry picked from commit a56e339419c1a90f8a85f86621f3c73945e07b23)
2015-03-30adapt dynamic linker for new binutils versions that omit DT_RPATHRich Felker-0/+2
the new DT_RUNPATH semantics for search order are always used, and since binutils had always set both DT_RPATH and DT_RUNPATH when the latter was used, processing only DT_RPATH worked fine. however, recent binutils has stopped generating DT_RPATH when DT_RUNPATH is used, which broke support for this feature completely. (cherry picked from commit d8dc2b7c0289b12eeef4feff65e3c918111b0f55)
2015-03-30fix behavior of printf with alt-form octal, zero precision, zero valueRich Felker-1/+1
in this case there are two conflicting rules in play: that an explicit precision of zero with the value zero produces no output, and that the '#' modifier for octal increases the precision sufficiently to yield a leading zero. ISO C ( paragraph 6 in C99+TC3) includes a parenthetical remark to clarify that the precision-increasing behavior takes precedence, but the corresponding text in POSIX off of which I based the implementation is missing this remark. this issue was covered in WG14 DR#151. (cherry picked from commit b91cdbe2bc8b626aa04dc6e3e84345accf34e4b1)
2015-03-30math: fix x86_64 and x32 asm not to use sahf instructionSzabolcs Nagy-28/+14
Some early x86_64 cpus (released before 2006) did not support sahf/lahf instructions so they should be avoided (intel manual says they are only supported if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1). The workaround simplifies exp2l and expm1l because fucomip can be used instead of the fucomp;fnstsw;sahf sequence copied from i386. In fmodl and remainderl sahf is replaced by a simple bit test. (cherry picked from commit a732e80d33b4fd6f510f7cec4f5573ef5d89bc4e)
2015-03-30fix uninitialized mode variable in openat functionRich Felker-1/+1
this was introduced in commit 2da3ab1382ca8e39eb1e4428103764a81fba73d3 as an oversight while making the variadic argument access conditional. (cherry picked from commit e146e6035fecea080fb17450db3c8bb44d36e07d)
2015-03-30fix invalid access by openat to possibly-missing variadic mode argumentRich Felker-4/+8
the mode argument is only required to be present when the O_CREAT or O_TMPFILE flag is used. (cherry picked from commit 2da3ab1382ca8e39eb1e4428103764a81fba73d3)
2015-03-30fix missing barrier in pthread_once/call_once shortcut pathRich Felker-2/+7
these functions need to be fast when the init routine has already run, since they may be called very often from code which depends on global initialization having taken place. as such, a fast path bypassing atomic cas on the once control object was used to avoid heavy memory contention. however, on archs with weakly ordered memory, the fast path failed to ensure that the caller actually observes the side effects of the init routine. preliminary performance testing showed that simply removing the fast path was not practical; a performance drop of roughly 85x was observed with 20 threads hammering the same once control on a 24-core machine. so the new explicit barrier operation from atomic.h is used to retain the fast path while ensuring memory visibility. performance may be reduced on some archs where the barrier actually makes a difference, but the previous behavior was unsafe and incorrect on these archs. future improvements to the implementation of a_barrier should reduce the impact. (cherry picked from commit df37d3960abec482e17fad2274a99b790f6cc08b) (edited not to depend on a_barrier, which is not available in 1.0.x)
2015-03-30fix handling of negative offsets in timezone spec stringsRich Felker-10/+7
previously, the hours were considered as a signed quantity while minutes and seconds were always treated as positive offsets. however, semantically the '-' sign should negate the whole hh:mm:ss offset. this bug only affected timezones east of GMT with non-whole-hours offsets, such as those used in India and Nepal. (cherry picked from commit 08b996d180323775d5457944eefbb8a51ea72539)
2015-03-30fix handling of odd lengths in swab functionRich Felker-1/+1
this function is specified to leave the last byte with "unspecified disposition" when the length is odd, so for the most part correct programs should not be calling swab with odd lengths. however, doing so is permitted, and should not write past the end of the destination buffer. (cherry picked from commit dccbf4c809efc311aa37da71de70d04dfd8b0db3)
2015-03-30fix incorrect sequence generation in *rand48 prng functionsRich Felker-2/+2
patch by Jens Gustedt. this fixes a bug reported by Nadav Har'El. the underlying issue was that a left-shift by 16 bits after promotion of unsigned short to int caused integer overflow. while some compilers define this overflow case as "shifting into the sign bit", doing so doesn't help; the sign bit then gets extended through the upper bits in subsequent arithmetic as unsigned long long. this patch imposes a promotion to unsigned prior to the shift, so that the result is well-defined and matches the specified behavior. (cherry picked from commit 05cef96d9e63a00b319f88343cf9869c8e612843)
2015-03-30fix overflow corner case in strtoul-family functionsRich Felker-0/+1
incorrect behavior occurred only in cases where the input overflows unsigned long long, not just the (possibly lower) range limit for the result type. in this case, processing of the '-' sign character was not suppressed, and the function returned a value of 1 despite setting errno to ERANGE. (cherry picked from commit e2e1bb81485a37321d928a8d8b63f40b9d8fa228)
2015-03-30fix memory leak in regexec when input contains illegal sequenceSzabolcs Nagy-5/+6
(cherry picked from commit 546f6b322bcafa2452925c19f9607d9689c75f95)
2015-03-30fix off-by-one in bounds check in fpathconfRich Felker-1/+1
this error resulted in an out-of-bounds read, as opposed to a reported error, when calling the function with an argument one greater than the max valid index. (cherry picked from commit 3bed89aa7456d9fe30e550cb5e21f8911036695b)
2015-03-30fix multiple stdio functions' behavior on zero-length operationsRich Felker-9/+7
previously, fgets, fputs, fread, and fwrite completely omitted locking and access to the FILE object when their arguments yielded a zero length read or write operation independent of the FILE state. this optimization was invalid; it wrongly skipped marking the stream as byte-oriented (a C conformance bug) and exposed observably missing synchronization (a POSIX conformance bug) where one of these functions could wrongly complete despite another thread provably holding the lock. (cherry picked from commit 6e2bb7acf42589fb7130b039d0623e2ca42503dd)
2015-03-30suppress null termination when fgets reads EOF with no dataRich Felker-1/+1
the C standard requires that "the contents of the array remain unchanged" in this case. this patch also changes the behavior on read errors, but in that case "the array contents are indeterminate", so the application cannot inspect them anyway. (cherry picked from commit 402611c3ba3be5b3b0486835d98e22ac7ced2722)
2015-03-30fix dn_expand empty name handling and offsets to 0Szabolcs Nagy-6/+9
Empty name was rejected in dn_expand since commit 56b57f37a46dab432247bf29d96fcb11fbd02a6d which is a regression as reported by Natanael Copa. Furthermore if an offset pointer in a compressed name pointed to a terminating 0 byte (instead of a label) the returned name was not null terminated. (cherry picked from commit 49d2c8c6bcf8c926e52c7f510033b6adc31355f5)
2015-03-30fix use of uninitialized memory with application-provided thread stacksRich Felker-0/+2
the subsequent code in pthread_create and the code which copies TLS initialization images to the new thread's TLS space assume that the memory provided to them is zero-initialized, which is true when it's obtained by pthread_create using mmap. however, when the caller provides a stack using pthread_attr_setstack, pthread_create cannot make any assumptions about the contents. simply zero-filling the relevant memory in this case is the simplest and safest fix. (cherry picked from commit a6293285e930dbdb0eff47e29b513ca22537b1a2)
2015-03-30fix CPU_EQUAL macro in sched.hSzabolcs Nagy-1/+1
(cherry picked from commit d146d4dc1104aa3472daf81d2581aca65df54d13)
2014-08-01release 1.0.4v1.0.4Rich Felker-1/+31
2014-07-28add missing yes/no strings to nl_langinfoRich Felker-2/+2
these were removed from the standard but still offered as an extension in langinfo.h, so nl_langinfo should support them. (cherry picked from commit 0206f596d5156af560e8af10e950d3cb2f29b73d)
2014-07-28fix nl_langinfo table for LC_TIME era-related itemsRich Felker-1/+2
due to a skipped slot and missing null terminator, the last few strings were off by one or two slots from their item codes. (cherry picked from commit a19cd2b64aabee4ae3c80bcf4ba8da26fba560e4)
2014-07-28fix regression that negated some mips syscall error returnsRich Felker-5/+5
due to what was essentially a copy and paste error, the changes made in commit f61be1f875a2758509d6e9e2cf6f1d9603b28b65 caused syscalls with 5 or 6 arguments (and syscalls with 2, 3, or 4 arguments when compiled with clang compatibility) to negate the returned error code a second time, breaking errno reporting. (cherry picked from commit 1312930f9bdea47006a8a8c8509c0bed5cf69e85)
2014-07-28fix mips struct stat dev_t members for big endianRich Felker-20/+81
the mips version of this structure on the kernel side wrongly has 32-bit type rather than 64-bit type. fortunately there is adjacent padding to bring it up to 64 bits, and on little-endian, this allows us to treat the adjacent kernel st_dev and st_pad0[0] as as single 64-bit dev_t. however, on big endian, such treatment results in the upper and lower 32-bit parts of the dev_t value being swapped. for the purpose of just comparing st_dev values this did not break anything, but it precluded actually processing the device numbers as major/minor values. since the broken kernel behavior that needs to be worked around is isolated to one arch, I put the workarounds in syscall_arch.h rather than adding a stat fixup path in the common code. on little endian mips, the added code optimizes out completely. the changes necessary were incompatible with the way the __asm_syscall macro was factored so I just removed it and flattened the individual __syscallN functions. this arguably makes the code easier to read and understand, anyway. (cherry picked from commit f61be1f875a2758509d6e9e2cf6f1d9603b28b65)
2014-07-28fix missing barriers in powerpc atomic storeRich Felker-1/+5
(cherry picked from commit 522a0de2101abd12b19a4d2ba5c09abbb7c5fc79)
2014-07-28fix microblaze atomic storeRich Felker-1/+3
as far as I can tell, microblaze is strongly ordered, but this does not seem to be well-documented and the assumption may need revisiting. even with strong ordering, however, a volatile C assignment is not sufficient to implement atomic store, since it does not preclude reordering by the compiler with respect to non-volatile stores and loads. simply flanking a C store with empty volatile asm blocks with memory clobbers would achieve the desired result, but is likely to result in worse code generation, since the address and value for the store may need to be spilled. actually writing the store in asm, so that there's only one asm block, should give optimal code generation while satisfying the requirement for having a compiler barrier. (cherry picked from commit 884cc0c7e253601b96902120ed689f34d12f8aa0)
2014-07-28fix missing barrier instructions in powerpc atomic asmRich Felker-1/+4
(cherry picked from commit 1456b7ae6b72a4f2c446243acdde7c951268d4ab)
2014-07-28fix missing barrier instructions in mips atomic asmRich Felker-14/+18
previously I had wrongly assumed the ll/sc instructions also provided memory synchronization; apparently they do not. this commit adds sync instructions before and after each atomic operation and changes the atomic store to simply use sync before and after a plain store, rather than a useless compare-and-swap. (cherry picked from commit bcad48439494820989f5867c3f8ccfa6aae2909f)
2014-07-28use memory constraints for mips atomic asmRich Felker-24/+24
despite lacking the semantic content that the asm accesses the pointed-to object rather than just using its address as a value, the mips asm was not actually broken. the asm blocks were declared volatile, meaning that the compiler must treat them as having unknown side effects. however changing the asm to use memory constraints is desirable not just from a semantic correctness and consistency standpoint, but also produces better code. the compiler is able to use base/offset addressing expressions for the atomic object's address rather than having to load the address into a single register. this improves access to global locks in static libc, and access to non-zero-offset atomic fields in synchronization primitives, etc. (cherry picked from commit a294f539c78c6ba0a2786ef3c5b2a1210a33864e)
2014-07-28fix build breakage from ppc asm constraints changeRich Felker-3/+3
due to a mistake in my testing procedure, the changes in the previous commit were not correctly tested and wrongly assumed to be valid. the lwarx and stwcx. instructions do not accept general ppc memory address expressions and thus the argument associated with the memory constraint cannot be used directly. instead, the memory constraint can be left as an argument that the asm does not actually use, and the address can be provided in a separate register constraint. (cherry picked from commit bb3a3befeaa01531c273ef9130f3fbcaaf8a25e2)
2014-07-28remove cruft from microblaze atomic.hRich Felker-13/+0
(cherry picked from commit 94252dd341a7c72b31db2614abdc74142ad80562)
2014-07-28fix broken constraints for powerpc atomic cas asmRich Felker-1/+1
the register constraint for the address to be accessed did not convey that the asm can access the pointed-to object. as far as the compiler could tell, the result of the asm was just a pure function of the address and the values passed in, and thus the asm could be hoisted out of loops or omitted entirely if the result was not used. (cherry picked from commit 7fdae458bd421046a300a69dcb32953ac9450136)