[BZ #2126]

	* sysdeps/i386/i686/strtok.S: Store pointer to NUL byte if NULL is
	returned.
	* sysdeps/i386/strtok.S: Likewise.
	* sysdeps/x86_64/strtok.S: Likewise.
	* string/Makefile (tests): Add bug-strtok1.
	* string/bug-strtok1.c: New file.

6 files changed, 70 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index f74c8b3bbd..66e075fb16 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2006-01-09  Ulrich Drepper  <drepper@redhat.com>
 
+	[BZ #2126]
+	* sysdeps/i386/i686/strtok.S: Store pointer to NUL byte if NULL is
+	returned.
+	* sysdeps/i386/strtok.S: Likewise.
+	* sysdeps/x86_64/strtok.S: Likewise.
+	* string/Makefile (tests): Add bug-strtok1.
+	* string/bug-strtok1.c: New file.
+
 	* elf/check-textrel.c (AB): Also check for writable and executable
 	segments.
 
diff --git a/string/Makefile b/string/Makefile
index 2f37d29526..8f9b2ac371 100644
--- a/string/Makefile
+++ b/string/Makefile
@@ -1,4 +1,4 @@
-# Copyright (C) 1991-1999,2000,2001,2002, 2005 Free Software Foundation, Inc.
+# Copyright (C) 1991-2002, 2005, 2006 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 
 # The GNU C Library is free software; you can redistribute it and/or
@@ -53,7 +53,7 @@ tests		:= tester inl-tester noinl-tester testcopy test-ffs	\
 		   tst-strlen stratcliff tst-svc tst-inlcall		\
 		   bug-strncat1 bug-strspn1 bug-strpbrk1 tst-bswap	\
 		   tst-strtok tst-strxfrm bug-strcoll1 tst-strfry	\
-		   $(addprefix test-,$(strop-tests))
+		   bug-strtok1 $(addprefix test-,$(strop-tests))
 distribute	:= memcopy.h pagecopy.h tst-svc.expect test-string.h
 
 
diff --git a/string/bug-strtok1.c b/string/bug-strtok1.c
new file mode 100644
index 0000000000..da30acf2e6
--- /dev/null
+++ b/string/bug-strtok1.c
@@ -0,0 +1,45 @@
+/* See BZ #2126.  */
+#include <string.h>
+#include <stdio.h>
+
+static int
+do_test (void)
+{
+  const char str[] = "axaaba";
+  char *token;
+  char *cp;
+  char *l;
+  int result = 0;
+
+  puts ("test strtok");
+  cp = strdupa (str);
+  printf ("cp = %p, len = %zu\n", cp, strlen (cp));
+  token = strtok (cp, "ab");
+  result |= token == NULL || strcmp (token, "x");
+  printf ("token: %s (%d)\n", token ? token : "NULL", result);
+  token = strtok(0, "ab");
+  result |= token != NULL;
+  printf ("token: %s (%d)\n", token ? token : "NULL", result);
+  token = strtok(0, "a");
+  result |= token != NULL;
+  printf ("token: %s (%d)\n", token ? token : "NULL", result);
+
+  puts ("test strtok_r");
+  cp = strdupa (str);
+  size_t len = strlen (cp);
+  printf ("cp = %p, len = %zu\n", cp, len);
+  token = strtok_r (cp, "ab", &l);
+  result |= token == NULL || strcmp (token, "x");
+  printf ("token: %s, next = %p (%d)\n", token ? token : "NULL", l, result);
+  token = strtok_r(0, "ab", &l);
+  result |= token != NULL || l != cp + len;
+  printf ("token: %s, next = %p (%d)\n", token ? token : "NULL", l, result);
+  token = strtok_r(0, "a", &l);
+  result |= token != NULL || l != cp + len;
+  printf ("token: %s,  next = %p (%d)\n", token ? token : "NULL", l, result);
+
+  return result;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/sysdeps/i386/i686/strtok.S b/sysdeps/i386/i686/strtok.S
index 0cd266a2a1..fe225e5485 100644
--- a/sysdeps/i386/i686/strtok.S
+++ b/sysdeps/i386/i686/strtok.S
@@ -1,6 +1,6 @@
 /* strtok (str, delim) -- Return next DELIM separated token from STR.
    For Intel 80686.
-   Copyright (C) 1998, 2000, 2001, 2005 Free Software Foundation, Inc.
+   Copyright (C) 1998, 2000, 2001, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -250,9 +250,9 @@ L(8):	cmpl %eax, %edx
 	cmovne %ecx, %edx
 
 	/* Store the pointer to the next character.  */
-# ifdef USE_AS_STRTOK_R
+#ifdef USE_AS_STRTOK_R
 	movl SAVE(%esp), %ecx
-# endif
+#endif
 	movl %edx, SAVE_PTR
 	CHECK_BOUNDS_HIGH (%edx, SAVE_PTR, jb)
 	RETURN_BOUNDED_POINTER (SAVE_PTR)
@@ -271,6 +271,10 @@ L(epilogue):
 
 L(returnNULL):
 	xorl %eax, %eax
+#ifdef USE_AS_STRTOK_R
+	movl SAVE(%esp), %ecx
+#endif
+	movl %edx, SAVE_PTR
 	RETURN_NULL_BOUNDED_POINTER
 	jmp L(epilogue)
 
diff --git a/sysdeps/i386/strtok.S b/sysdeps/i386/strtok.S
index 88b343b6fe..c5f40a83b1 100644
--- a/sysdeps/i386/strtok.S
+++ b/sysdeps/i386/strtok.S
@@ -1,6 +1,6 @@
 /* strtok (str, delim) -- Return next DELIM separated token from STR.
    For Intel 80x86, x>=3.
-   Copyright (C) 1996-1998, 2000, 2001, 2005 Free Software Foundation, Inc.
+   Copyright (C) 1996-1998,2000,2001,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1996.
 
@@ -385,6 +385,10 @@ L(epilogue):
 
 L(returnNULL):
 	xorl %eax, %eax
+#ifdef USE_AS_STRTOK_R
+	movl SAVE(%esp), %ecx
+#endif
+	movl %edx, SAVE_PTR
 	RETURN_NULL_BOUNDED_POINTER
 	jmp L(epilogue)
 
diff --git a/sysdeps/x86_64/strtok.S b/sysdeps/x86_64/strtok.S
index de427dc6f3..4037f0b850 100644
--- a/sysdeps/x86_64/strtok.S
+++ b/sysdeps/x86_64/strtok.S
@@ -1,6 +1,6 @@
 /* strtok (str, delim) -- Return next DELIM separated token from STR.
    For AMD x86-64.
-   Copyright (C) 1998,2000,2001,2002,2003,2005 Free Software Foundation, Inc.
+   Copyright (C) 1998,2000-2003,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Based on i686 version contributed by Ulrich Drepper
    <drepper@cygnus.com>, 1998.
@@ -205,6 +205,8 @@ L(epilogue):
 
 L(returnNULL):
 	xorl %eax, %eax
+	/* Store the pointer to the next character.  */
+	movq %rdx, SAVE_PTR
 	jmp L(epilogue)
 
 END (BP_SYM (FUNCTION))