summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorLines
2017-05-27fix fchown fallback on arches without chown(2)Samuel Holland-1/+1
The flags argument was missing, causing uninitalized data to be passed to fchownat(2). The correct value of flags should match the fallback for chown(3).
2017-05-27fix iconv conversions to legacy 8bit encodingsRich Felker-9/+12
there was missing reverse-conversion logic for the case, handled specially in the character set tables, where a byte represents a unicode codepoint with the same value. this patch adds code to handle the case, and refactors the two-level 10-bit table lookup for legacy character sets into a function to avoid repeating it yet another time as part of the fix.
2017-04-22have posix_spawnattr_setflags check for supported flagsRich Felker-0/+11
per POSIX, EINVAL is not a mandatory error, only an optional one. but reporting unsupported flags allows an application to fallback gracefully when a requested feature is not supported. this is not helpful now, but it may be in the future if additional flags are added. had this checking been present before, applications would have been able to check for the newly-added POSIX_SPAWN_SETSID feature (added in commit bb439bb17108b67f3df9c9af824d3a607b5b059d) at runtime.
2017-04-22add no-op POSIX_SPAWN_USEVFORK to spawn.hRich Felker-0/+1
the bit is reserved anyway for ABI-compat reasons; this documents it and makes it so we can have posix_spawnattr_setflags check for flag validity without hard-coding an anonymous bit value.
2017-04-22s390x: provide sigcontext struct definitionBobby Bingham-0/+15
This structure was missed when creating the s390x port. This is based on the report and patch from William Pitcock, but with a modified structure defintion to more closely match the kernel's definition.
2017-04-22implement new posix_spawn flag POSIX_SPAWN_SETSIDRich Felker-0/+5
this functionality has been adopted for inclusion in the next issue of POSIX as the result of Austin Group issue #1044. based on patch by Daurnimator.
2017-04-22remove va_arg hacks in printf core with undefined behaviorRich Felker-26/+1
the code being removed was written to optimize for size assuming the compiler cannot collapse code paths for different types with the same underlying representation. modern compilers sometimes succeed in making this optimization themselves, but either way it's a small size difference and not worth the source-level complexity or the UB involved in this hack. some incorrect use of va_arg still remains, particularly use of void * where the actual argument has a different pointer type. fixing this requires some actual code additions, rather than just removing cruft, so I'm leaving it to be done later as a separate commit.
2017-04-21make ttyname[_r] return ENODEV rather than ENOENTRich Felker-1/+1
commit 0a950dcf15bb9f7274c804dca490e9e20e475f3e added checking that the pathname a tty device was opened with actually matches the device, which can fail to hold when a container inherits a tty from outside the container. the error code added at the time was ENOENT; however, discussions between affected applications and glibc developers resulted in glibc adopting ENODEV as the error for this condition, and this has now been documented in the man pages project as well. adopt the same error code for consistency. patch by Christian Brauner.
2017-04-21fix regression in support for resolv.conf attempts optionRich Felker-2/+2
commit d6cb08bcaca4ff1f921375510ca72bccea969c75 moved the code and introduced an incorrect string offset for the new parsing, probably due to a copy-and-paste error. patch by Stefan Sedich.
2017-04-21fix scalbn when result is in the subnormal rangeSzabolcs Nagy-12/+14
in nearest rounding mode scalbn could introduce double rounding error when an intermediate value and the final result were both in the subnormal range e.g. scalbn(0x1.7ffffffffffffp-1, -1073) returned 0x1p-1073 instead of 0x1p-1074, because the intermediate computation got rounded to 0x1.8p-1023. with the fix an intermediate value can only be in the subnormal range if the final result is 0 which is correct even after double rounding. (there still can be two roundings so signals may be raised twice, but that's only observable with trapping exceptions which is not supported.)
2017-04-21allow full-range file offsets to mmap on archs with 64-bit syscall argsRich Felker-1/+1
normally 32-bit archs use the mmap2 syscall and are limited to an offset of 2^32 pages. however some 32-bit archs (mainly ILP32-on-64 ones like x32) have 64-bit syscall argument slots and thus can accept the full range. don't artifically limit them.
2017-04-11fix dl_iterate_phdr in static PIE binariesRich Felker-0/+5
analogous to commit 5bf7eba213cacc4c1220627c91c28deff2ffecda, use of AT_PHDR/PT_PHDR does not actually work to find the program base, and the method with _DYNAMIC vs PT_DYNAMIC must be used as an alternative. patch by Shiz, along with testing to confirm that this fixes unwinding in static PIE.
2017-04-11fix read past end of buffer in getaddrinfo backendRich Felker-2/+2
due to testing buf[i].family==AF_INET before checking i==cnt, it was possible to read past the end of the array, or past the valid part. in practice, without active bounds/indeterminate-value checking by the compiler, the worst that happened was failure to return early and optimize out the sorting that's unneeded for v4-only results. returning on i==cnt-1 rather than i==cnt would be an alternate fix, but the approach this patch takes is more idiomatic and less error-prone. patch by Timo Teräs.
2017-03-21aarch64: add single instruction math functionsSzabolcs Nagy-24/+226
this should increase performance and reduce code size on aarch64. the compiled code was checked against using __builtin_* instead of inline asm with gcc-6.2.0. lrint is two instructions. c with inline asm is used because it is safer than a pure asm implementation, this prevents ll{rint,round} to be an alias of l{rint,round} (because the types don't match) and depends on gcc style inline asm support. ceil, floor, round, trunc can either raise inexact on finite non-integer inputs or not raise any exceptions. the new implementation does not raise exceptions while the generic c code does. on aarch64, the underflow exception is signaled before rounding (ieee 754 allows both before and after rounding, but it must be consistent), the generic fma c code signals it after rounding so using single instruction fixes a slight conformance issue too.
2017-03-21fix strptime output for %C without %yJulien Ramseier-2/+3
in this case, a potentially-uninitialized or unrelated existing value in tm_year was being used. instead use 0 if %y was not present.
2017-03-21fix processing of strptime %p formatJulien Ramseier-0/+2
string pointer was not advanced after matching.
2017-03-21fix off-by-one in strptime %jJulien Ramseier-0/+1
tm_yday range is 0-365 while %j is 1-366
2017-03-21regex: fix newline matching with negated bracketsJulien Ramseier-0/+14
With REG_NEWLINE, POSIX says: "A <newline> in string shall not be matched by a period outside a bracket expression or by any form of a non-matching list"
2017-03-21increase limit on locale name length from 15 to 23 bytesRich Felker-2/+2
the old limit was one byte too short to support locale names of the form xx_XX.UTF-8@modifier where modifier is more than 3 bytes, a form which various real-world locale names take. the problem could be avoided by omitting the useless ".UTF-8" part, but users may need to have it present when operating on mixed-libc systems or when it will be carried over (e.g. across ssh) to other systems. the new limit is chosen sufficient for existing/reasonable locale names while still keeping the size of setlocale's static buffer small. also add locale_impl.h to the Makefile's list of headers which force rebuild of source files, to prevent dangerously inconsistent object files from getting used after this change.
2017-03-21search locale name variants for gettext translationsRich Felker-32/+55
often translations will be named only by language, whereas locale names may also include a territory code, modifier, and codeset portion. previously, only translations exactly matching the locale name were loaded. this was a major usability issue, requiring workarounds like symlinks or tweaking of the locale name. with these changes, gettext now searches for translations by first removing the codeset portion of the locale name, then trying the remainder in full, with modifier (@mod) removed, with territory code (_XX) removed, and with both removed. part of the reason gettext lacked support for searching fallbacks before is that the candidate pathname for a translation file was constructed on each call and used as the key to lookup an already-mapped translation file. this was very costly/inefficient. we now use the tuple of textdomain binding pointer, locale map pointer, and integer category id as the key for looking up a translation file mapping. based on patch by He X.
2017-03-21make setlocale return a single name for LC_ALL if all categories matchRich Felker-2/+5
when called for LC_ALL, setlocale has to return a string representing the state of all locale categories. the simplest way to do this was to always return a delimited list of values for each category, but that's not friendly in the fairly common case where all categories have the same setting. He X proposed a patch to check for this case and return a single name; this patch is a simplified approach to do the same.
2017-03-21fix dlopen/dlsym regression opening libs already loaded at startupRich Felker-2/+2
commit 4ff234f6cba96403b5de6d29d48a59fd73252040 erroneously changed the condition for running certain code at dlopen time to check whether the library was already relocated rather than whether it already had its deps[] table filled. this was out of concern over whether the code under the conditional would be idempotent/safe to call on an already-loaded libraries. however, I missed a consideration in the opposite direction: if a library was loaded at program startup rather than dlopen, its deps[] table was not yet allocated/filled, and load_deps needs to be called at dlopen time in order for dlsym to be able to perform dependency-order symbol lookups. in order to avoid wasteful allocation of lazy-binding relocation tables for libraries which were already loaded and relocated at startup, the check for !p->relocated is not deleted entirely, but moved to apply only to allocation of these dables.
2017-03-15fix POSIX-format TZ dst transition times for southern hemisphereRich Felker-8/+4
the time of day at which daylight time switches over is specified in local time in the dst state prior to the transition. the code for handling this wrongly assumed it needed to switch whether dst or standard offset is applied to the transition time when the dst end date is before the dst start date (souther hemisphere summer), but in fact the end transition time should always be adjusted for dst, and the start transition time should always be adjusted for standard time.
2017-03-15s390x: fix fpreg_t and remove unused per_structTuan M. Hoang-2/+2
Including sys/procfs.h complains unknown type name 'fpreg_t' in bits/user.h. fpreg_t in bits/signal.h and elf_fpreg_t in bits/user.h are practically the same. per_struct is never used, even conflicts with kernel header asm/ptrace.h
2017-03-15precalculate gnu hash rather than doing it lazily in find_sym inner loopRich Felker-8/+2
this change was suggested based on testing done by Timo Teräs almost two years ago; the branch (and probably call prep overhead) in the inner loop was found to contribute noticably to total symbol lookup time. this change will make lookup slightly slower if libraries were built with only the traditional "sysv" ELF hash table, but based on how much slower lookup tends to be without the gnu hash table, it seems reasonable to assume that (1) users building without gnu hash don't care about dynamic linking performance, and (2) the extra time spent computing the gnu hash is likely to be dominated by the slowness of the sysv hash table lookup anyway.
2017-03-15fix threshold constants in j0f, y0f, j1f, y1fSzabolcs Nagy-13/+12
partly following freebsd rev 279491 https://svnweb.freebsd.org/base?view=revision&revision=279491 (musl had some of the fixes before freebsd). the change should not matter much for j0f, y0f, but it improves j1f and y1f in [2.5,~3.75] (that is [0x40200000,~0x40700000]). near roots (e.g. around 3.8317 for j1f) there are still large ulp errors. dropped code that tried to raise inexact.
2017-03-14remove unused refcnt field for shared librariesRich Felker-4/+0
2017-03-14avoid loading of multiple libc versions via explicit pathnameRich Felker-1/+11
such loading is unsafe, and can happen when programs use their own logic to locate a .so file then pass the absolute pathname to dlopen, or if an absolute pathname ends up in DT_NEEDED headers. multiple loads with only the base name were already precluded, provided libc was named appropriately, by special-casing standard library names. one function symbol (in the reserved namespace, but public, since it's part of the crt1 entry point ABI) and one data symbol are checked. this way we avoid likely false positives, particularly from libraries interposing and wrapping functions. there is no hard requirement to avoid breaking such usage, since trying to run a hook before libc is even initialized is not a supported usage case, but it's friendlier not to break things.
2017-03-14fix one-byte overflow in legacy getpass functionRich Felker-1/+1
if the length of the input was equal to the buffer size (128), a fixed value of zero was written one byte past the end of the static buffer.
2017-03-14fix wide scanf's use of a compound literal past its lifetimeRich Felker-1/+2
2017-03-14fix possible fd leak, unrestored cancellation state on dns socket failRich Felker-1/+5
2017-03-14in static dl_iterate_phdr, fix use of possibly-uninitialized aux dataRich Felker-1/+1
this could only happen if an incomplete auxv was passed into the program, but it's better to just initialize the data anyway.
2017-03-14fix free of uninitialized buffer pointer on error in regexecRich Felker-3/+3
the fix in commit c3edc06d1e1360f3570db9155d6b318ae0d0f0f7 for CVE-2016-8859 used gotos to exit on overflow conditions, but the code in that error path assumed the buffer pointer was valid or null. thus, the conditions which previously led to under-allocation and buffer overflow could instead lead to an invalid pointer being passed to free.
2017-03-14emulate lazy relocation as deferrable relocationRich Felker-3/+66
traditional lazy relocation with call-time plt resolver is intentionally not implemented, as it is a huge bug surface and demands significant amounts of arch-specific code and requires ongoing maintenance to ensure compatibility with applications which make use of new additions to the arch's register file in passing function arguments. some applications, however, depend on the ability to dlopen modules which have unsatisfied symbol references at the time they are loaded, either avoiding use of the affected interfaces or manually loading another module to provide the missing definition via their own module dependency tracking outside the ELF data structures. while such usage is non-conforming, failure to support it has been a significant obstacle for users/distributions trying to support affected software, particularly the X.org server. instead of resolving lazy relocations at call time, this patch saves unresolved GOT/PLT relocations for deferral and retries them after each subsequent dlopen until they are resolved. since dlopen is the only time at which the effective global symbol table can change, this behavior is not observably different from traditional lazy binding, and the required code is minimal.
2017-03-13reorder addend handling before symbol lookup in relocation codeRich Felker-16/+17
these two tasks are independent now, but in order to support lazy relocations, the failure path for symbol lookup may want the addend to be available.
2017-03-12rework ldso handling of global symbol table for consistencyRich Felker-44/+53
when loading libraries with dlopen, the caller can request that the library's symbols become part of the global symbol table, or that they only be used for resolving relocations in the loaded library and its dependencies. in the latter case, a subsequent dlopen of the same library can upgrade it to global status. previously, if a library was upgraded from local to global mode, its symbols entered the symbol lookup search order at the point where the library was originally loaded. this means that a new call to dlopen could change the value of a symbol that already had a visible definition, an inconsistency which applications could observe. POSIX is unclear whether this should happen or whether it's permitted to happen, but the resolution of Austin Group issue #982 made it formally unspecified. with this patch, a library whose mode is upgraded from local to global enters the symbol lookup order at the point where it was made global, so that symbol resolution before and after the upgrade are consistent. in order to implement this change, the per-dso global flag is replaced with a separate set of linked-list pointers for participation in the global symbol table. this permits the order of dso objects for symbol resolution to differ from the order used for iteration of all loaded libraries. it also improves performance of find_sym, by avoiding a branch per iteration and skipping, and especially in the case where many non-global libraries have been loaded, by allowing the loop to skip over them entirely. logic for temporarily adding non-global libraries to the symbol table for relocation purposes is also mildly simplified.
2017-03-11treat STB_WEAK and STB_GNU_UNIQUE like STB_GLOBAL in find_symSzabolcs Nagy-3/+1
A weak symbol definition is not special during dynamic linking, so don't let a strong definition in a later module override it. (glibc dynamic linker allows overriding weak definitions if LD_DYNAMIC_WEAK is set, musl does not.) STB_GNU_UNIQUE means that the symbol is global, even if it is in a module that's loaded with RTLD_LOCAL, and all references resolve to the same definition. This semantics is only relevant for c++ plugin systems and even there it's often not what the user wants (so it can be turned off in g++ by -fno-gnu-unique when the c++ shared lib is compiled). In musl just treat it like STB_GLOBAL.
2017-03-08fix ld-behavior-dependent crash in ppc64 ldso startupRich Felker-1/+1
the 32-bit pc-relative address for stage 2 of dynamic linker entry was wrongly loaded with a zero-extending load instead of sign-extending load, resulting in an invalid jump if the offset happened to be negative, which depends on the linker's ordering of text sections.
2017-03-05fix lsearch and lfind to pass key as first arg to the compar callbackSzabolcs Nagy-2/+2
this is not a conformance issue as posix does not specify the argument order, but the order is specified for bsearch and some systems document the order for lsearch consistently (openbsd). since there were two indpendent reports of this issue it's better to use the more widely expected argument order.
2017-02-22allow page size to vary on armRich Felker-1/+0
the ABI for arm was silently changed at some point to allow page sizes other than 4k; traditional binaries built with only 4k-aligned offsets between load segments cannot run on such systems, but newer binutils versions use 64k offset alignment. while larger page size is undesirable for various reasons, users have encountered hardware and/or kernels that lock the page size to a larger value, so follow the new ABI and allow it to vary.
2017-02-15fix build regression in arm atomics asm with new binutilsRich Felker-1/+1
binutils commit bada43421274615d0d5f629a61a60b7daa71bc15 tightened immediate fixup handling in gas in such a way that the final .arch of an object file must be compatible with the fixups used when the instruction was assembled; this in turn broke assembling of atomics.s, at least in thumb mode. it's not clear whether this should be considered a bug in gas, but .object_arch is preferable anyway for our purpose here of controlling the ISA level tag on the object file being produced, and it's the intended directive for use in object files with runtime code selection. research by Szabolcs Nagy confirmed that .object_arch is supported in all relevant versions of binutils and clang's integrated assembler. patch by Reiner Herrmann.
2017-02-15s390x: implement dlsymBobby Bingham-0/+6
This was missed when writing the port initially.
2017-01-29avoid unbounded strlen in gettext functionsRich Felker-3/+3
use the standard strnlen idiom for cases where lengths greater than an imposed limit are going to be rejected immediately anyway.
2017-01-29fix use of uninitialized pointer in gettext coreRich Felker-2/+2
the plural_rule field of allocated msgcat structures was assumed to be initially-null but was never initialized. for future-proofing, the nplurals field which was left uninitialized should also be cleared. likewise, in the binding structure, the active field could be used uninitialized by a technicality: the a_store which stores the initial value of 0 may be implemented as a cas operation, which reads the old value. rather than fixing these issues individually, just use calloc for both allocations. this does result in wasteful clearing of name buffers (up to NAME_MAX+PATH_MAX) before filling them, but since the size if bounded and the time is dominated by filesystem operations, it really doesn't matter; simplicity and future-proofing have more value here. modified from patch submitted by He X.
2017-01-29fix bindtextdomain logic error deactivating other domainsRich Felker-1/+1
this loop was only supposed to deactivate other bindings for the same text domain name, but due to copy-and-paste error, deactivated all other bindings. patch by He X.
2017-01-19fix spurious EINTR errors from multithreaded set*id, etc.Rich Felker-1/+1
commit 78a8ef47c4d92b7680c52a85f80a81e29da86bb9 inadvertently removed the SA_RESTART flag from the sigaction for the internal signal handler used by __synccall for broadcasting. as a result, programs which did not use interrupting signals but which used set*id() in a multithreaded context could wrongly observe EINTR errors they're not prepared to handle.
2017-01-13fix crashes in x32 __tls_get_addrrofl0r-7/+13
x32 has another gratuitous difference to all other archs: it passes an array of 64bit values to __tls_get_addr(). usually it is an array of size_t.
2017-01-04fix crash from corrupted tls module list after failed dlopenRich Felker-0/+1
commit d56460c939c94a6c547abe8238f442b8de10bfbd introduced this regression as part of splitting the tls module list out of the dso list. the new code added to dlopen's failure path to undo the changes adding the partially-loaded libraries reset the tls_tail pointer correctly, but did not clear its link to the next list entry. thus, at least until the next successful dlopen, the list was not terminated but ended with an invalid next pointer, which __copy_tls attempted to follow when a new thread was created. patch by Mikael Vidstedt.
2017-01-04treat base 1 as an error in strtol-family functionsRich Felker-1/+1
ISO C and POSIX only specify behavior for base arguments of 0 and 2-36; POSIX mandates an EINVAL error for unsupported bases. it's not clear that there's a requirement for implementations not to "support" additional bases as an extension, but "base 1" did not work in any meaningful way anyway, so it should be considered unsupported and thus an error.
2017-01-04fix getopt[_long] clobbering of optopt on successRich Felker-2/+5
getopt is only specified to modify optopt on error, and some software apparently infers an error from optopt!=0. getopt_long is changed analogously. the resulting behavior differs slightly from the behavior of the GNU implementation of getopt_long, which keeps an internal shadow copy of optopt and copies it to the public one on return, but since the GNU implementation also exhibits this shadow-copy behavior for plain getopt where is is non-conforming, I think this can reasonably be considered a bug rather than an intentional behavior that merits mimicing.