Update.

2000-07-29  Greg McGary  <greg@mcgary.org>

	* Rules (test-bp-inputs, make-test-out): New variables.
	($(objpfx)%-bp.out): New rule.
	($(objpfx)%.out): Rewrite in terms of new variables.

	* libio/iovswscanf.c (vswscanf): Pass _IO_FILE_plus pointer to
	internal function that uses vtable.
	* libio/vsnprintf.c (_IO_vsnprintf): Likewise.
	* libio/vswprintf.c (_IO_vswprintf): Likewise.

	* malloc/malloc.c (mem2chunk): Define in terms of chunk_at_offset.
	(malloc_extend_top): Convert brk to chunk using chunk_at_offset.
	(chunk_align): Likewise.

	* time/asctime.c (ab_day_name, ab_month_name): Rewrite expression
	in a way that conforms to decl, and avoids spurious bounds violation.

	* sysdeps/arm/frame.h (struct layout): Make pointers __unbounded.
	* sysdeps/generic/frame.h: Likewise.
	* sysdeps/generic/backtrace.c (ADVANCE_STACK_FRAME): Wrap bounds
	around return value.
	(__backtrace): Qualify frame-pointer chain and return address
	pointers as __unbounded.  Wrap bounds around variable `current'.
	* sysdeps/generic/segfault.c (ADVANCE_STACK_FRAME): Wrap bounds
	around return value.
	(catch_segfault): Qualify frame-pointer chain and return address
	pointers as __unbounded.  Wrap bounds around variable `current'.
	* sysdeps/i386/backtrace.c (struct layout): Make pointers __unbounded.
	(ADVANCE_STACK_FRAME): Wrap bounds around return value.
	* sysdeps/powerpc/backtrace.c (struct layout): Make pointers __unbounded.
	(__backtrace): Qualify frame-pointer chain and return address
	pointers as __unbounded.  Wrap bounds around variable `current'.

	* sysdeps/i386/addmul_1.S: s2_limb is scalar so remove bounds check.
	* sysdeps/i386/mul_1.S: Likewise.
	* sysdeps/i386/submul_1.S: Likewise.
	* sysdeps/i386/i586/addmul_1.S: Likewise.
	* sysdeps/i386/i586/mul_1.S: Add bounds checks.
	* sysdeps/i386/i586/submul_1.S: Likewise.

6 files changed, 30 insertions, 24 deletions

diff --git a/sysdeps/arm/frame.h b/sysdeps/arm/frame.h
index 16f329c0e5..5d7ac0fb55 100644
--- a/sysdeps/arm/frame.h
+++ b/sysdeps/arm/frame.h
@@ -20,7 +20,7 @@
 /* This is the APCS stack backtrace structure.  */
 struct layout
 {
-  struct layout *next;
-  void *sp;
-  void *return_address;
+  struct layout *__unbounded next;
+  void *__unbounded sp;
+  void *__unbounded return_address;
 };
diff --git a/sysdeps/generic/backtrace.c b/sysdeps/generic/backtrace.c
index b9242b587b..f743b56b4b 100644
--- a/sysdeps/generic/backtrace.c
+++ b/sysdeps/generic/backtrace.c
@@ -1,5 +1,5 @@
 /* Return backtrace of current program state.  Generic version.
-   Copyright (C) 1998 Free Software Foundation, Inc.
+   Copyright (C) 1998, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -22,6 +22,7 @@
 #include <signal.h>
 #include <frame.h>
 #include <sigcontextinfo.h>
+#include <bp-checks.h>
 
 /* This is a global variable set at program start time.  It marks the
    highest used stack address.  */
@@ -54,7 +55,7 @@ extern void *__libc_stack_end;
 /* By default assume the `next' pointer in struct layout points to the
    next struct layout.  */
 #ifndef ADVANCE_STACK_FRAME
-# define ADVANCE_STACK_FRAME(next) ((struct layout *) (next))
+# define ADVANCE_STACK_FRAME(next) BOUNDED_1 ((struct layout *) (next))
 #endif
 
 int
@@ -63,15 +64,15 @@ __backtrace (array, size)
      int size;
 {
   struct layout *current;
-  void *top_frame;
-  void *top_stack;
+  void *__unbounded top_frame;
+  void *__unbounded top_stack;
   int cnt = 0;
 
   top_frame = __builtin_frame_address (0);
   top_stack = CURRENT_STACK_FRAME;
 
   /* We skip the call to this function, it makes no sense to record it.  */
-  current = (struct layout *) top_frame;
+  current = BOUNDED_1 ((struct layout *) top_frame);
   while (cnt < size)
     {
       if ((void *) current INNER_THAN top_stack
diff --git a/sysdeps/generic/frame.h b/sysdeps/generic/frame.h
index 7ad7a64aab..ec3310a7d3 100644
--- a/sysdeps/generic/frame.h
+++ b/sysdeps/generic/frame.h
@@ -19,6 +19,6 @@
 
 struct layout
 {
-  void *next;
-  void *return_address;
+  void *__unbounded next;
+  void *__unbounded return_address;
 };
diff --git a/sysdeps/generic/segfault.c b/sysdeps/generic/segfault.c
index 41e3aa54d8..24ed3f8308 100644
--- a/sysdeps/generic/segfault.c
+++ b/sysdeps/generic/segfault.c
@@ -1,5 +1,5 @@
 /* Catch segmentation faults and print backtrace.
-   Copyright (C) 1998, 1999 Free Software Foundation, Inc.
+   Copyright (C) 1998, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -28,6 +28,8 @@
 #include <unistd.h>
 #include <stdio-common/_itoa.h>
 
+#include <bp-checks.h>
+
 /* Get the definition of "struct layout".  */
 #include <frame.h>
 
@@ -69,7 +71,7 @@ extern void *__libc_stack_end;
 /* By default assume the `next' pointer in struct layout points to the
    next struct layout.  */
 #ifndef ADVANCE_STACK_FRAME
-# define ADVANCE_STACK_FRAME(next) ((struct layout *) (next))
+# define ADVANCE_STACK_FRAME(next) BOUNDED_1 ((struct layout *) (next))
 #endif
 
 /* We'll use tis a lot.  */
@@ -103,8 +105,8 @@ static void
 catch_segfault (int signal, SIGCONTEXT ctx)
 {
   struct layout *current;
-  void *top_frame;
-  void *top_stack;
+  void *__unbounded top_frame;
+  void *__unbounded top_stack;
   int fd;
   void **arr;
   size_t cnt;
@@ -135,7 +137,7 @@ catch_segfault (int signal, SIGCONTEXT ctx)
 
   /* First count how many entries we'll have.  */
   cnt = 1;
-  current = (struct layout *) top_frame;
+  current = BOUNDED_1 ((struct layout *) top_frame);
   while (!((void *) current INNER_THAN top_stack
 	   || !((void *) current INNER_THAN __libc_stack_end)))
     {
@@ -149,7 +151,7 @@ catch_segfault (int signal, SIGCONTEXT ctx)
   /* First handle the program counter from the structure.  */
   arr[0] = GET_PC (ctx);
 
-  current = (struct layout *) top_frame;
+  current = BOUNDED_1 ((struct layout *) top_frame);
   cnt = 1;
   while (!((void *) current INNER_THAN top_stack
 	   || !((void *) current INNER_THAN __libc_stack_end)))
diff --git a/sysdeps/i386/backtrace.c b/sysdeps/i386/backtrace.c
index 38635988f4..b2b92f796a 100644
--- a/sysdeps/i386/backtrace.c
+++ b/sysdeps/i386/backtrace.c
@@ -1,5 +1,5 @@
 /* Return backtrace of current program state.
-   Copyright (C) 1998 Free Software Foundation, Inc.
+   Copyright (C) 1998, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -19,6 +19,7 @@
    Boston, MA 02111-1307, USA.  */
 
 #include <execinfo.h>
+#include <bp-checks.h>
 
 
 /* This is a global variable set at program start time.  It marks the
@@ -36,8 +37,8 @@ extern void *__libc_stack_end;
 */
 struct layout
 {
-  struct layout *next;
-  void *return_address;
+  struct layout *__unbounded next;
+  void *__unbounded return_address;
 };
 
 int
@@ -52,7 +53,7 @@ __backtrace (array, size)
   int cnt = 0;
 
   /* We skip the call to this function, it makes no sense to record it.  */
-  current = (struct layout *) ebp;
+  current = BOUNDED_1 ((struct layout *) ebp);
   while (cnt < size)
     {
       if ((void *) current < esp || (void *) current > __libc_stack_end)
diff --git a/sysdeps/powerpc/backtrace.c b/sysdeps/powerpc/backtrace.c
index a89d33294b..fdf84f8e47 100644
--- a/sysdeps/powerpc/backtrace.c
+++ b/sysdeps/powerpc/backtrace.c
@@ -1,5 +1,5 @@
 /* Return backtrace of current program state.
-   Copyright (C) 1998 Free Software Foundation, Inc.
+   Copyright (C) 1998, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -19,6 +19,7 @@
 
 #include <execinfo.h>
 #include <stddef.h>
+#include <bp-checks.h>
 
 /* This is the stack layout we see with every stack frame.
    Note that every routine is required by the ABI to lay out the stack
@@ -32,8 +33,8 @@
 */
 struct layout
 {
-  struct layout *next;
-  void *return_address;
+  struct layout *__unbounded next;
+  void *__unbounded return_address;
 };
 
 int
@@ -47,10 +48,11 @@ __backtrace (void **array, int size)
 
   /* Get the address on top-of-stack.  */
   asm volatile ("lwz %0,0(1)" : "=r"(current));
+  current = BOUNDED_1 (current);
 
   for (				count = 0;
        current != NULL && 	count < size;
-       current = current->next, count++)
+       current = BOUNDED_1 (current->next), count++)
     array[count] = current->return_address;
 
   /* It's possible the second-last stack frame can't return