[BZ #3313]

2006-10-17  Jakub Jelinek  <jakub@redhat.com>
	* sunrpc/xdr_mem.c (xdrmem_setpos): Don't compare addresses
	as signed longs, check for x_base + pos overflow.
	* sunrpc/Makefile (tests): Add tst-xdrmem2.
	* sunrpc/tst-xdrmem2.c: New test.

2006-10-18  Ulrich Drepper  <drepper@redhat.com>

	* elf/dl-lookup.c (_dl_lookup_symbol_x): Add warning to
	_dl_lookup_symbol_x code.

2006-10-17  Jakub Jelinek  <jakub@redhat.com>

	* elf/dl-runtime.c: Include sysdep-cancel.h.
	(_dl_fixup, _dl_profile_fixup): Use __rtld_mrlock_* and
	scoperec->nusers only if !SINGLE_THREAD_P.  Use atomic_*
	instead of catomic_* macros.
	* elf/dl-sym.c: Include sysdep-cancel.h.
	(do_sym): Use __rtld_mrlock_* and scoperec->nusers only
	if !SINGLE_THREAD_P.  Use atomic_* instead of catomic_* macros.
	* elf/dl-close.c: Include sysdep-cancel.h.
	(_dl_close): Use __rtld_mrlock_* and scoperec->nusers only
	if !SINGLE_THREAD_P.  Use atomic_* instead of catomic_* macros.
	* elf/dl-open.c: Include sysdep-cancel.h.
	(dl_open_worker): Use __rtld_mrlock_* and scoperec->nusers only
	if !SINGLE_THREAD_P.  Use atomic_* instead of catomic_* macros.

2006-10-17  Jakub Jelinek  <jakub@redhat.com>

	[BZ #3313]
	* malloc/malloc.c (malloc_consolidate): Set maxfb to address of last
	fastbin rather than end of fastbin array.

2006-10-18  Ulrich Drepper  <drepper@redhat.com>

	* sysdeps/i386/i486/bits/atomic.h (catomic_decrement): Use correct
	body macro.
	* sysdeps/x86_64/bits/atomic.h
	(__arch_c_compare_and_exchange_val_64_acq): Add missing casts.
	(catomic_decrement): Use correct body macro.

2006-10-17  Jakub Jelinek  <jakub@redhat.com>

	* include/atomic.h: Add a unique prefix to all local variables
	in macros.
	* csu/tst-atomic.c (do_test): Test also catomic_* macros.

	* include/link.h: Include <rtld-lowlevel.h>.  Define struct

3 files changed, 122 insertions, 6 deletions

diff --git a/sunrpc/Makefile b/sunrpc/Makefile
index bc826affdd..30f74dc135 100644
--- a/sunrpc/Makefile
+++ b/sunrpc/Makefile
@@ -1,4 +1,4 @@
-# Copyright (C) 1994-2004, 2005 Free Software Foundation, Inc.
+# Copyright (C) 1994-2004, 2005, 2006 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 
 # The GNU C Library is free software; you can redistribute it and/or
@@ -85,7 +85,7 @@ all: # Make this the default target; it will be defined in Rules.
 
 include ../Makeconfig
 
-tests = tst-xdrmem
+tests = tst-xdrmem tst-xdrmem2
 xtests := tst-getmyaddr
 
 ifeq ($(have-thread-library),yes)
diff --git a/sunrpc/tst-xdrmem2.c b/sunrpc/tst-xdrmem2.c
new file mode 100644
index 0000000000..eed8ccc072
--- /dev/null
+++ b/sunrpc/tst-xdrmem2.c
@@ -0,0 +1,114 @@
+/* Copyright (C) 2006 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+   Contributed by Jakub Jelinek <jakub@redhat.com>, 2006.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <rpc/rpc.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+static int
+do_test (void)
+{
+  XDR xdrs;
+  void *buf;
+  size_t ps = sysconf (_SC_PAGESIZE);
+  uintptr_t half = -1;
+  int v_int;
+  u_short v_u_short;
+
+  half = (half >> 1) & ~(uintptr_t) (ps - 1);
+  buf = mmap ((void *) half, 2 * ps, PROT_READ | PROT_WRITE,
+	      MAP_PRIVATE | MAP_ANON, -1, 0);
+  if (buf == MAP_FAILED || buf != (void *) half)
+    {
+      puts ("Couldn't mmap 2 pages in the middle of address space");
+      return 0;
+    }
+
+  xdrmem_create (&xdrs, (char *) buf, 2 * ps, XDR_ENCODE);
+
+#define T(type, val) \
+  v_##type = val;			\
+  if (! xdr_##type (&xdrs, &v_##type))	\
+    {					\
+      puts ("encoding of " #type	\
+	    " " #val " failed");	\
+      return 1;				\
+    }
+
+  T(int, 127)
+
+  u_int pos = xdr_getpos (&xdrs);
+
+  T(u_short, 31)
+
+  if (! xdr_setpos (&xdrs, pos))
+    {
+      puts ("xdr_setpos during encoding failed");
+      return 1;
+    }
+
+  T(u_short, 36)
+
+#undef T
+
+  xdr_destroy (&xdrs);
+
+  xdrmem_create (&xdrs, (char *) buf, 2 * ps, XDR_DECODE);
+
+#define T(type, val) \
+  v_##type = 0x15;			\
+  if (! xdr_##type (&xdrs, &v_##type))	\
+    {					\
+      puts ("decoding of " #type	\
+	    " " #val " failed");	\
+      return 1;				\
+    }					\
+  if (v_##type != val)			\
+    {					\
+      puts ("decoded value differs, "	\
+	    "type " #type " " #val);	\
+      return 1;				\
+    }
+
+  T(int, 127)
+
+  pos = xdr_getpos (&xdrs);
+
+  T(u_short, 36)
+
+  if (! xdr_setpos (&xdrs, pos))
+    {
+      puts ("xdr_setpos during encoding failed");
+      return 1;
+    }
+
+  T(u_short, 36)
+
+#undef T
+
+  xdr_destroy (&xdrs);
+
+  return 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/sunrpc/xdr_mem.c b/sunrpc/xdr_mem.c
index e3167de040..7b1261bbae 100644
--- a/sunrpc/xdr_mem.c
+++ b/sunrpc/xdr_mem.c
@@ -177,13 +177,15 @@ xdrmem_setpos (xdrs, pos)
 {
   caddr_t newaddr = xdrs->x_base + pos;
   caddr_t lastaddr = xdrs->x_private + xdrs->x_handy;
+  size_t handy = lastaddr - newaddr;
 
-  if ((long) newaddr > (long) lastaddr
-      || (UINT_MAX < LONG_MAX
-	  && (long) UINT_MAX < (long) lastaddr - (long) newaddr))
+  if (newaddr > lastaddr
+      || newaddr < xdrs->x_base
+      || handy != (u_int) handy)
     return FALSE;
+
   xdrs->x_private = newaddr;
-  xdrs->x_handy = (long) lastaddr - (long) newaddr;
+  xdrs->x_handy = (u_int) handy;
   return TRUE;
 }