Update.

	* string/bits/string2.h (strspn): Evaluate first argument if
	second is "".
	(strpbrk): Likewise.
	* sysdeps/i386/i486/bits/string.h: Likewise.
	* string/Makefile (tests): Add bug-strspn1 and bug-strpbrk1.
	* string/bug-strspn1.c: New file.
	* string/bug-strpbrk1.c: New file.
	Test cases by Joseph S. Myers <jsm28@cam.ac.uk>.

	* string/bits/string2.h (strncat): Terminate string correctly.
	* sysdeps/i386/i486/bits/string.h (strncat): Likewise.
	* string/Makefile (tests): Add bug-strncat1.
	* string/bug-strncat1.c: New file.
	Test case by Joseph S. Myers <jsm28@cam.ac.uk>.

2000-10-27  Ben Collins  <bcollins@debian.org>

	* sysdeps/generic/lockf.c (lockf): Set l_type to F_RDLCK before
	calling for F_GETLK.

2000-10-29  Ulrich Drepper  <drepper@redhat.com>

8 files changed, 101 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index a278eabca6..6ce521c22a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,27 @@
 2000-10-29  Ulrich Drepper  <drepper@redhat.com>
 
+	* string/bits/string2.h (strspn): Evaluate first argument if
+	second is "".
+	(strpbrk): Likewise.
+	* sysdeps/i386/i486/bits/string.h: Likewise.
+	* string/Makefile (tests): Add bug-strspn1 and bug-strpbrk1.
+	* string/bug-strspn1.c: New file.
+	* string/bug-strpbrk1.c: New file.
+	Test cases by Joseph S. Myers <jsm28@cam.ac.uk>.
+
+	* string/bits/string2.h (strncat): Terminate string correctly.
+	* sysdeps/i386/i486/bits/string.h (strncat): Likewise.
+	* string/Makefile (tests): Add bug-strncat1.
+	* string/bug-strncat1.c: New file.
+	Test case by Joseph S. Myers <jsm28@cam.ac.uk>.
+
+2000-10-27  Ben Collins  <bcollins@debian.org>
+
+	* sysdeps/generic/lockf.c (lockf): Set l_type to F_RDLCK before
+	calling for F_GETLK.
+
+2000-10-29  Ulrich Drepper  <drepper@redhat.com>
+
 	* elf/dl-load.c (open_path): Don't exit loop early if we didn't
 	use a directory at all.
 
diff --git a/string/Makefile b/string/Makefile
index e133b53266..970147c4a8 100644
--- a/string/Makefile
+++ b/string/Makefile
@@ -46,7 +46,8 @@ routines	:= strcat strchr strcmp strcoll strcpy strcspn		\
 o-objects.ob	:= memcpy.o memset.o memchr.o
 
 tests		:= tester inl-tester noinl-tester testcopy test-ffs	\
-		   tst-strlen stratcliff tst-svc tst-inlcall
+		   tst-strlen stratcliff tst-svc tst-inlcall		\
+		   bug-strncat1 bug-strspn1 bug-strpbrk1
 distribute	:= memcopy.h pagecopy.h tst-svc.expect
 
 
diff --git a/string/bits/string2.h b/string/bits/string2.h
index de427f8cb4..bf174a4c8c 100644
--- a/string/bits/string2.h
+++ b/string/bits/string2.h
@@ -727,7 +727,8 @@ __stpcpy_small (char *__dest,
 		    __builtin_constant_p (src) && __builtin_constant_p (n)    \
 		    ? (strlen (src) < ((size_t) (n))			      \
 		       ? strcat (__dest, src)				      \
-		       : (memcpy (strchr (__dest, '\0'), src, n), __dest))    \
+		       : (*((char *) __mempcpy (strchr (__dest, '\0'),	      \
+						src, n)) = '\0', __dest))     \
 		    : strncat (dest, src, n); }))
 # else
 #  define strncat(dest, src, n) \
@@ -914,7 +915,7 @@ __strcspn_c3 (__const char *__s, char __reject1, char __reject2,
   ({ char __a0, __a1, __a2;						      \
      (__builtin_constant_p (accept) && __string2_1bptr_p (accept)	      \
       ? ((__a0 = ((__const char *) (accept))[0], __a0 == '\0')		      \
-	 ? 0								      \
+	 ? ((void) (s), 0)						      \
 	 : ((__a1 = ((__const char *) (accept))[1], __a1 == '\0')	      \
 	    ? __strspn_c1 (s, __a0)					      \
 	    : ((__a2 = ((__const char *) (accept))[2], __a2 == '\0')	      \
@@ -969,7 +970,7 @@ __strspn_c3 (__const char *__s, char __accept1, char __accept2, char __accept3)
   ({ char __a0, __a1, __a2;						      \
      (__builtin_constant_p (accept) && __string2_1bptr_p (accept)	      \
       ? ((__a0 = ((__const char  *) (accept))[0], __a0 == '\0')		      \
-	 ? NULL								      \
+	 ? ((void) (s), NULL)						      \
 	 : ((__a1 = ((__const char *) (accept))[1], __a1 == '\0')	      \
 	    ? strchr (s, __a0)						      \
 	    : ((__a2 = ((__const char *) (accept))[2], __a2 == '\0')	      \
diff --git a/string/bug-strncat1.c b/string/bug-strncat1.c
new file mode 100644
index 0000000000..0e41a3e727
--- /dev/null
+++ b/string/bug-strncat1.c
@@ -0,0 +1,30 @@
+/* Test case by Joseph S. Myers <jsm28@cam.ac.uk>.  */
+#define __USE_STRING_INLINES
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+char d[3] = "\0\1\2";
+
+int
+main (void)
+{
+  strncat (d, "\5\6", 1);
+  if (d[0] != '\5')
+    {
+      puts ("d[0] != '\\5'");
+      exit (1);
+    }
+  if (d[1] != '\0')
+    {
+      puts ("d[1] != '\\0'");
+      exit (1);
+    }
+  if (d[2] != '\2')
+    {
+      puts ("d[2] != '\\3'");
+      exit (1);
+    }
+
+  exit (0);
+}
diff --git a/string/bug-strpbrk1.c b/string/bug-strpbrk1.c
new file mode 100644
index 0000000000..7d5eef8e41
--- /dev/null
+++ b/string/bug-strpbrk1.c
@@ -0,0 +1,18 @@
+/* Test case by Joseph S. Myers <jsm28@cam.ac.uk>.  */
+#define __USE_STRING_INLINES
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+int
+main (void)
+{
+  const char *a = "abc";
+  const char *b = a;
+
+  strpbrk (b++, "");
+  if (b != a + 1)
+    exit (1);
+
+  exit (0);
+}
diff --git a/string/bug-strspn1.c b/string/bug-strspn1.c
new file mode 100644
index 0000000000..cd6c012275
--- /dev/null
+++ b/string/bug-strspn1.c
@@ -0,0 +1,18 @@
+/* Test case by Joseph S. Myers <jsm28@cam.ac.uk>.  */
+#define __USE_STRING_INLINES
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+int
+main (void)
+{
+  const char *a = "abc";
+  const char *b = a;
+
+  strspn (b++, "");
+  if (b != a + 1)
+    exit (1);
+
+  exit (0);
+}
diff --git a/sysdeps/generic/lockf.c b/sysdeps/generic/lockf.c
index 6e8851bed7..cc264cda56 100644
--- a/sysdeps/generic/lockf.c
+++ b/sysdeps/generic/lockf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1994, 1996, 1997, 1998 Free Software Foundation, Inc.
+/* Copyright (C) 1994, 1996, 1997, 1998, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -41,6 +41,7 @@ lockf (int fd, int cmd, off_t len)
     case F_TEST:
       /* Test the lock: return 0 if FD is unlocked or locked by this process;
 	 return -1, set errno to EACCES, if another process holds the lock.  */
+      fl.l_type = F_RDLCK;
       if (__fcntl (fd, F_GETLK, &fl) < 0)
 	return -1;
       if (fl.l_type == F_UNLCK || fl.l_pid == __getpid ())
diff --git a/sysdeps/i386/i486/bits/string.h b/sysdeps/i386/i486/bits/string.h
index 9d88ee3149..c880f94eed 100644
--- a/sysdeps/i386/i486/bits/string.h
+++ b/sysdeps/i386/i486/bits/string.h
@@ -987,8 +987,9 @@ __strcat_g (char *__dest, __const char *__src)
 		    __builtin_constant_p (src) && __builtin_constant_p (n)    \
 		    ? (strlen (src) < ((size_t) (n))			      \
 		       ? strcat (__dest, src)				      \
-		       : (memcpy (strchr (__dest, '\0'),		      \
-				  (__const char *) src, n), __dest))	      \
+		       : (*((char *)__mempcpy (strchr (__dest, '\0'),	      \
+					       (__const char *) src, n)) = 0, \
+			   __dest))					      \
 		    : __strncat_g (__dest, src, n); }))
 
 __STRING_INLINE char *__strncat_g (char *__dest, __const char __src[],
@@ -1543,7 +1544,7 @@ __strcspn_g (__const char *__s, __const char *__reject)
 #define strspn(s, accept) \
   (__extension__ (__builtin_constant_p (accept) && sizeof ((accept)[0]) == 1  \
 		  ? ((accept)[0] == '\0'				      \
-		     ? 0						      \
+		     ? ((void) (s), 0)					      \
 		     : ((accept)[1] == '\0'				      \
 			? __strspn_c1 (s, (((accept)[0] << 8 ) & 0xff00))     \
 			: __strspn_cg (s, accept, strlen (accept))))	      \
@@ -1656,7 +1657,7 @@ __strspn_g (__const char *__s, __const char *__accept)
 #define strpbrk(s, accept) \
   (__extension__ (__builtin_constant_p (accept) && sizeof ((accept)[0]) == 1  \
 		  ? ((accept)[0] == '\0'				      \
-		     ? NULL						      \
+		     ? ((void) (s), NULL)				      \
 		     : ((accept)[1] == '\0'				      \
 			? strchr (s, (accept)[0])			      \
 			: __strpbrk_cg (s, accept, strlen (accept))))	      \