about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
* Fix tcache count maximum (BZ #24531)Wilco Dijkstra2019-05-223-4/+16
| | | | | | | | | | | | | | The tcache counts[] array is a char, which has a very small range and thus may overflow. When setting tcache_count tunable, there is no overflow check. However the tunable must not be larger than the maximum value of the tcache counts[] array, otherwise it can overflow when filling the tcache. [BZ #24531] * malloc/malloc.c (MAX_TCACHE_COUNT): New define. (do_set_tcache_count): Only update if count is small enough. * manual/tunables.texi (glibc.malloc.tcache_count): Document max value. (cherry picked from commit 5ad533e8e65092be962e414e0417112c65d154fb)
* Fix crash in _IO_wfile_sync (bug 20568)Andreas Schwab2019-05-166-3/+56
| | | | | | | | When computing the length of the converted part of the stdio buffer, use the number of consumed wide characters, not the (negative) distance to the end of the wide buffer. (cherry picked from commit 32ff397533715988c19cbf3675dcbd727ec13e18)
* Add compiler barriers around modifications of the robust mutex list for ↵Stefan Liebler2019-02-072-4/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pthread_mutex_trylock. [BZ #24180] While debugging a kernel warning, Thomas Gleixner, Sebastian Sewior and Heiko Carstens found a bug in pthread_mutex_trylock due to misordered instructions: 140: a5 1b 00 01 oill %r1,1 144: e5 48 a0 f0 00 00 mvghi 240(%r10),0 <--- THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL); 14a: e3 10 a0 e0 00 24 stg %r1,224(%r10) <--- last THREAD_SETMEM of ENQUEUE_MUTEX_PI vs (with compiler barriers): 140: a5 1b 00 01 oill %r1,1 144: e3 10 a0 e0 00 24 stg %r1,224(%r10) 14a: e5 48 a0 f0 00 00 mvghi 240(%r10),0 Please have a look at the discussion: "Re: WARN_ON_ONCE(!new_owner) within wake_futex_pi() triggerede" (https://lore.kernel.org/lkml/20190202112006.GB3381@osiris/) This patch is introducing the same compiler barriers and comments for pthread_mutex_trylock as introduced for pthread_mutex_lock and pthread_mutex_timedlock by commit 8f9450a0b7a9e78267e8ae1ab1000ebca08e473e "Add compiler barriers around modifications of the robust mutex list." ChangeLog: [BZ #24180] * nptl/pthread_mutex_trylock.c (__pthread_mutex_trylock): Add compiler barriers and comments. (cherry picked from commit 823624bdc47f1f80109c9c52dee7939b9386d708)
* x86-64 memcmp: Use unsigned Jcc instructions on size [BZ #24155]H.J. Lu2019-02-045-9/+114
| | | | | | | | | | | | | | | | | | Since the size argument is unsigned. we should use unsigned Jcc instructions, instead of signed, to check size. Tested on x86-64 and x32, with and without --disable-multi-arch. [BZ #24155] CVE-2019-7309 * NEWS: Updated for CVE-2019-7309. * sysdeps/x86_64/memcmp.S: Use RDX_LP for size. Clear the upper 32 bits of RDX register for x32. Use unsigned Jcc instructions, instead of signed. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp-2. * sysdeps/x86_64/x32/tst-size_t-memcmp-2.c: New test. (cherry picked from commit 3f635fb43389b54f682fc9ed2acc0b2aaf4a923d)
* x86-64 strnlen/wcsnlen: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-016-11/+118
| | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes strnlen/wcsnlen for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/strlen-avx2.S: Use RSI_LP for length. Clear the upper 32 bits of RSI register. * sysdeps/x86_64/strlen.S: Use RSI_LP for length. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-strnlen and tst-size_t-wcsnlen. * sysdeps/x86_64/x32/tst-size_t-strnlen.c: New file. * sysdeps/x86_64/x32/tst-size_t-wcsnlen.c: Likewise. (cherry picked from commit 5165de69c0908e28a380cbd4bb054e55ea4abc95)
* x86-64 strncpy: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-015-6/+74
| | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes strncpy for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S: Use RDX_LP for length. * sysdeps/x86_64/multiarch/strcpy-ssse3.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-strncpy. * sysdeps/x86_64/x32/tst-size_t-strncpy.c: New file. (cherry picked from commit c7c54f65b080affb87a1513dee449c8ad6143c8b)
* x86-64 strncmp family: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-017-8/+179
| | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes the strncmp family for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/strcmp-sse42.S: Use RDX_LP for length. * sysdeps/x86_64/strcmp.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-strncasecmp, tst-size_t-strncmp and tst-size_t-wcsncmp. * sysdeps/x86_64/x32/tst-size_t-strncasecmp.c: New file. * sysdeps/x86_64/x32/tst-size_t-strncmp.c: Likewise. * sysdeps/x86_64/x32/tst-size_t-wcsncmp.c: Likewise. (cherry picked from commit ee915088a0231cd421054dbd8abab7aadf331153)
* x86-64 memset/wmemset: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-016-15/+131
| | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memset/wmemset for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/memset-avx512-no-vzeroupper.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-wmemset. * sysdeps/x86_64/x32/tst-size_t-memset.c: New file. * sysdeps/x86_64/x32/tst-size_t-wmemset.c: Likewise. (cherry picked from commit 82d0b4a4d76db554eb6757acb790fcea30b19965)
* x86-64 memrchr: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-015-5/+72
| | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memrchr for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/memrchr.S: Use RDX_LP for length. * sysdeps/x86_64/multiarch/memrchr-avx2.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memrchr. * sysdeps/x86_64/x32/tst-size_t-memrchr.c: New file. (cherry picked from commit ecd8b842cf37ea112e59cd9085ff1f1b6e208ae0)
* x86-64 memcpy: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-017-40/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memcpy for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/memcpy-ssse3-back.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memcpy-ssse3.S: Likewise. * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S: Likewise. * sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcpy. tst-size_t-wmemchr. * sysdeps/x86_64/x32/tst-size_t-memcpy.c: New file. (cherry picked from commit 231c56760c1e2ded21ad96bbb860b1f08c556c7a)
* x86-64 memcmp/wmemcmp: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-017-9/+127
| | | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memcmp/wmemcmp for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memcmp-sse4.S: Likewise. * sysdeps/x86_64/multiarch/memcmp-ssse3.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp and tst-size_t-wmemcmp. * sysdeps/x86_64/x32/tst-size_t-memcmp.c: New file. * sysdeps/x86_64/x32/tst-size_t-wmemcmp.c: Likewise. (cherry picked from commit b304fc201d2f6baf52ea790df8643e99772243cd)
* x86-64 memchr/wmemchr: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-018-5/+168
| | | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memchr/wmemchr for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/memchr.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memchr-avx2.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memchr and tst-size_t-wmemchr. * sysdeps/x86_64/x32/test-size_t.h: New file. * sysdeps/x86_64/x32/tst-size_t-memchr.c: Likewise. * sysdeps/x86_64/x32/tst-size_t-wmemchr.c: Likewise. (cherry picked from commit 97700a34f36721b11a754cf37a1cc40695ece1fd)
* powerpc: Regenerate ULPsGabriel F. T. Gomes2019-01-112-2/+6
| | | | | | | | | On POWER9, cbrtf128 fails by 1 ULP. * sysdeps/powerpc/fpu/libm-test-ulps: Regenerate. Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com> (cherry picked from commit 428fc49eaafe0fe5352445fcf23d9f603e9083a2)
* [BZ #21745] powerpc: build some IFUNC math functions for libc and libmTulio Magno Quites Machado Filho2019-01-113-17/+36
| | | | | | | | | | | | | | | | | | | | | | | | | Some math functions have to be distributed in libc because they're required by printf. libc and libm require their own builds of these functions, e.g. libc functions have to call __stack_chk_fail_local in order to bypass the PLT, while libm functions have to call __stack_chk_fail. While math/Makefile treat the generic cases, i.e. s_isinff, the multiarch Makefile has to treat its own files, i.e. s_isinff-ppc64. [BZ #21745] * sysdeps/powerpc/powerpc64/fpu/multiarch/Makefile: [$(subdir) = math] (sysdep_calls): New variable. Has the previous contents of sysdep_routines, but re-sorted.. [$(subdir) = math] (sysdep_routines): Re-use the contents from sysdep_calls. [$(subdir) = math] (libm-sysdep_routines): Remove the functions defined in sysdep_calls and replace by the respective m_* names. * sysdeps/powerpc/powerpc64/fpu/multiarch/s_isnan-ppc64.S: (compat_symbol): Undefine to avoid duplicated compat symbols in libc. (cherry picked from commit 61c45f250528dae431391823a9766053e61ccde1)
* intl: Do not return NULL on asprintf failure in gettext [BZ #24018]Florian Weimer2019-01-023-1/+8
| | | | | | | Fixes commit 9695dd0c9309712ed8e9c17a7040fe7af347f2dc ("DCIGETTEXT: Use getcwd, asprintf to construct absolute pathname"). (cherry picked from commit 8c1aafc1f34d090a5b41dc527c33e8687f6a1287)
* malloc: Always call memcpy in _int_realloc [BZ #24027]Florian Weimer2019-01-013-42/+9
| | | | | | | | | | This commit removes the custom memcpy implementation from _int_realloc for small chunk sizes. The ncopies variable has the wrong type, and an integer wraparound could cause the existing code to copy too few elements (leaving the new memory region mostly uninitialized). Therefore, removing this code fixes bug 24027. (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)
* CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]Florian Weimer2018-11-273-5/+18
| | | | (cherry picked from commit d527c860f5a3f0ed687bd03f0cb464612dc23408)
* Add an additional test to resolv/tst-resolv-network.cAlexandra Hájková2018-11-092-0/+11
| | | | | | Test for the infinite loop in getnetbyname, bug #17630. (cherry picked from commit ac8060265bcaca61568ef3a20b9a0140a270af54)
* libanl: properly cleanup if first helper thread creation failed (bug 22927)Andreas Schwab2018-11-063-2/+12
| | | | (cherry picked from commit bd3b0fbae33a9a4cc5e2daf049443d5cf03d4251)
* x86: Fix Haswell CPU string flags (BZ#23709)Adhemerval Zanella2018-11-023-0/+13
| | | | | | | | | | | | | | | | | | | | | Th commit 'Disable TSX on some Haswell processors.' (2702856bf4) changed the default flags for Haswell models. Previously, new models were handled by the default switch path, which assumed a Core i3/i5/i7 if AVX is available. After the patch, Haswell models (0x3f, 0x3c, 0x45, 0x46) do not set the flags Fast_Rep_String, Fast_Unaligned_Load, Fast_Unaligned_Copy, and Prefer_PMINUB_for_stringop (only the TSX one). This patch fixes it by disentangle the TSX flag handling from the memory optimization ones. The strstr case cited on patch now selects the __strstr_sse2_unaligned as expected for the Haswell cpu. Checked on x86_64-linux-gnu. [BZ #23709] * sysdeps/x86/cpu-features.c (init_cpu_features): Set TSX bits independently of other flags. (cherry picked from commit c3d8dc45c9df199b8334599a6cbd98c9950dba62)
* Disable -Wrestrict for two nptl/tst-attr3.c tests.Joseph Myers2018-10-222-0/+24
| | | | | | | | | | | | | | | | | | | | | | nptl/tst-attr3 fails to build with GCC mainline because of (deliberate) aliasing between the second (attributes) and fourth (argument to thread start routine) arguments to pthread_create. Although both those arguments are restrict-qualified in POSIX, pthread_create does not actually dereference its fourth argument; it's an opaque pointer passed to the thread start routine. Thus, the aliasing is actually valid in this case, and it's deliberate in the test. So this patch makes the test disable -Wrestrict for the two pthread_create calls in question. (-Wrestrict was added in GCC 7, hence the __GNUC_PREREQ conditions, but the particular warning in question is new in GCC 8.) Tested compilation with build-many-glibcs.py for aarch64-linux-gnu. * nptl/tst-attr3.c: Include <libc-diag.h>. (do_test) [__GNUC_PREREQ (7, 0)]: Ignore -Wrestrict for two tests. (cherry picked from commit 40c4162df6766fb1e8ede875ca8df25d8075d3a5)
* Fix string/bug-strncat1.c build with GCC 8.Joseph Myers2018-10-222-0/+13
| | | | | | | | | | | | | | | GCC 8 warns about strncat calls with truncated output. string/bug-strncat1.c tests such a call; this patch disables the warning for it. Tested (compilation) with GCC 8 for x86_64-linux-gnu with build-many-glibcs.py (in conjunction with Martin's patch to allow glibc to build). * string/bug-strncat1.c: Include <libc-diag.h>. (main): Disable -Wstringop-truncation for strncat call for GCC 8. (cherry picked from commit ec72135e5f1d061cb5cf7cd1b855fd6290be10d9)
* Ignore -Wrestrict for one strncat test.Joseph Myers2018-10-222-0/+9
| | | | | | | | | | | | | | | | | With current GCC mainline, one strncat test involving a size close to SIZE_MAX results in a -Wrestrict warning that that buffer size would imply that the two buffers must overlap. This patch fixes the build by adding disabling of -Wrestrict (for GCC versions supporting that option) to the already-present disabling of -Wstringop-overflow= and -Warray-bounds for this test. Tested with build-many-glibcs.py that this restores the testsuite build with GCC mainline for aarch64-linux-gnu. * string/tester.c (test_strncat) [__GNUC_PREREQ (7, 0)]: Also ignore -Wrestrict for one test. (cherry picked from commit 35ebb6b0c48bc671d9c54e089884f9bf6fca540e)
* Disable strncat test array-bounds warnings for GCC 8.Joseph Myers2018-10-222-2/+11
| | | | | | | | | | | | | | | | | | Some strncat tests fail to build with GCC 8 because of -Warray-bounds warnings. These tests are deliberately test over-large size arguments passed to strncat, and already disable -Wstringop-overflow warnings, but now the warnings for these tests come under -Warray-bounds so that option needs disabling for them as well, which this patch does (with an update on the comments; the DIAG_IGNORE_NEEDS_COMMENT call for -Warray-bounds doesn't need to be conditional itself, because that option is supported by all versions of GCC that can build glibc). Tested compilation with build-many-glibcs.py for aarch64-linux-gnu. * string/tester.c (test_strncat): Also disable -Warray-bounds warnings for two tests. (cherry picked from commit 1421f39b7eadd3b5fbd2a3f2da1fc006b69fbc42)
* Fix string/tester.c build with GCC 8.Joseph Myers2018-10-222-2/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GCC 8 warns about more cases of string functions truncating their output or not copying a trailing NUL byte. This patch fixes testsuite build failures caused by such warnings in string/tester.c. In general, the warnings are disabled around the relevant calls using DIAG_* macros, since the relevant cases are being deliberately tested. In one case, the warning is with -Wstringop-overflow= instead of -Wstringop-truncation; in that case, the conditional is __GNUC_PREREQ (7, 0) (being the version where -Wstringop-overflow= was introduced), to allow the conditional to be removed sooner, since it's harmless to disable the warning for a GCC version where it doesn't actually occur. In the case of warnings for strncpy calls in test_memcmp, the calls in question are changed to use memcpy, as they don't copy a trailing NUL and the point of that code is to test memcmp rather than strncpy. Tested (compilation) with GCC 8 for x86_64-linux-gnu with build-many-glibcs.py (in conjunction with Martin's patch to allow glibc to build). * string/tester.c (test_stpncpy): Disable -Wstringop-truncation for stpncpy calls for GCC 8. (test_strncat): Disable -Wstringop-truncation warning for strncat calls for GCC 8. Disable -Wstringop-overflow= warning for one strncat call for GCC 7. (test_strncpy): Disable -Wstringop-truncation warning for strncpy calls for GCC 8. (test_memcmp): Use memcpy instead of strncpy for calls not copying trailing NUL. (cherry picked from commit 2e64ec9c9eac3aeb70f7cfa2392846c87c28068e)
* Fix nscd readlink argument aliasing (bug 22446).Joseph Myers2018-10-223-2/+10
| | | | | | | | | | | | | | | | | | Current GCC mainline detects that nscd calls readlink with the same buffer for both input and output, which is not valid (those arguments are both restrict-qualified in POSIX). This patch makes it use a separate buffer for readlink's input (with a size that is sufficient to avoid truncation, so there should be no problems with warnings about possible truncation, though not strictly minimal, but much smaller than the buffer for output) to avoid this problem. Tested compilation for aarch64-linux-gnu with build-many-glibcs.py. [BZ #22446] * nscd/connections.c (handle_request) [SO_PEERCRED]: Use separate buffers for readlink input and output. (cherry picked from commit 49b036bce9f021ae994a85aee8b410d20b29c8b7)
* Increase buffer size due to warning from ToT GCCSteve Ellcey2018-10-222-1/+5
| | | | | | * nscd/dbg_log.c (dbg_log): Increase msg buffer size. (cherry picked from commit a7e3edf4f252fb72afeb8ecca946a2d8294bb577)
* Fix p_secstodate overflow handling (bug 22463).Joseph Myers2018-10-225-2/+107
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The resolv/res_debug.c function p_secstodate (which is a public function exported from libresolv, taking an unsigned long argument) does: struct tm timebuf; time = __gmtime_r(&clock, &timebuf); time->tm_year += 1900; time->tm_mon += 1; sprintf(output, "%04d%02d%02d%02d%02d%02d", time->tm_year, time->tm_mon, time->tm_mday, time->tm_hour, time->tm_min, time->tm_sec); If __gmtime_r returns NULL (because the year overflows the range of int), this will dereference a null pointer. Otherwise, if the computed year does not fit in four characters, this will cause a buffer overrun of the fixed-size 15-byte buffer. With current GCC mainline, there is a compilation failure because of the possible buffer overrun. I couldn't find a specification for how this function is meant to behave, but Paul pointed to RFC 4034 as relevant to the cases where this function is called from within glibc. The function's interface is inherently problematic when dates beyond Y2038 might be involved, because of the ambiguity in how to interpret 32-bit timestamps as such dates (the RFC suggests interpreting times as being within 68 years of the present date, which would mean some kind of interface whose behavior depends on the present date). This patch works on the basis of making a minimal fix in preparation for obsoleting the function. The function is made to handle times in the interval [0, 0x7fffffff] only, on all platforms, with <overflow> used as the output string in other cases (and errno set to EOVERFLOW in such cases). This seems to be a reasonable state for the function to be in when made a compat symbol by a future patch, being compatible with any existing uses for existing timestamps without trying to work for later timestamps. Results independent of the range of time_t also simplify the testcase. I couldn't persuade GCC to recognize the ranges of the struct tm fields by adding explicit range checks with a call to __builtin_unreachable if outside the range (this looks similar to <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80776>), so having added a range check on the input, this patch then disables the -Wformat-overflow= warning for the sprintf call (I prefer that to the use of strftime, as being more transparently correct without knowing what each of %m and %M etc. is). I do not know why this build failure should be new with mainline GCC (that is, I don't know what GCC change might have introduced it, when the basic functionality for such warnings was already in GCC 7). I do not know if this is a security issue (that is, if there are plausible ways in which a date before -999 or after 9999 from an untrusted source might end up in this function). The system clock is arguably an untrusted source (in that e.g. NTP is insecure), but probably not to that extent (NTP can't communicate such wild timestamps), and uses from within glibc are limited to 32-bit inputs. Tested with build-many-glibcs.py that this restores the build for arm with yesterday's mainline GCC. Also tested for x86_64 and x86. [BZ #22463] * resolv/res_debug.c: Include <libc-diag.h>. (p_secstodate): Assert time_t at least as wide as u_long. On overflow, use integer seconds since the epoch as output, or use "<overflow>" as output and set errno to EOVERFLOW if integer seconds since the epoch would be 14 or more characters. (p_secstodate) [__GNUC_PREREQ (7, 0)]: Disable -Wformat-overflow= for sprintf call. * resolv/tst-p_secstodate.c: New file. * resolv/Makefile (tests): Add tst-p_secstodate. ($(objpfx)tst-p_secstodate): Depend on $(objpfx)libresolv.so. (cherry picked from commit f120cda6072d830df92656dad0c89967547b97dc)
* timezone: pacify GCC -Wstringop-truncationPaul Eggert2018-10-222-1/+8
| | | | | | | | Problem reported by Martin Sebor in: https://sourceware.org/ml/libc-alpha/2017-11/msg00336.html * timezone/zic.c (writezone): Use memcpy, not strncpy. (cherry picked from commit e69897bf202e18034cbef26f363bae64de70a196)
* utmp: Avoid -Wstringop-truncation warningMartin Sebor2018-10-224-6/+27
| | | | | | | | | | | | | | | | | | The -Wstringop-truncation option new in GCC 8 detects common misuses of the strncat and strncpy function that may result in truncating the copied string before the terminating NUL. To avoid false positive warnings for correct code that intentionally creates sequences of characters that aren't guaranteed to be NUL-terminated, arrays that are intended to store such sequences should be decorated with a new nonstring attribute. This change add this attribute to Glibc and uses it to suppress such false positives. ChangeLog: * misc/sys/cdefs.h (__attribute_nonstring__): New macro. * sysdeps/gnu/bits/utmp.h (struct utmp): Use it. * sysdeps/unix/sysv/linux/s390/bits/utmp.h (struct utmp): Same. (cherry picked from commit 7532837d7b03b3ca5b9a63d77a5bd81dd23f3d9c)
* Avoid use of strlen in getlogin_r (bug 22447).Joseph Myers2018-10-223-2/+11
| | | | | | | | | | | | | | | | | | | | Building glibc with current mainline GCC fails, among other reasons, because of an error for use of strlen on the nonstring ut_user field. This patch changes the problem code in getlogin_r to use __strnlen instead. It also needs to set the trailing NUL byte of the result explicitly, because of the case where ut_user does not have such a trailing NUL byte (but the result should always have one). Tested for x86_64. Also tested that, in conjunction with <https://sourceware.org/ml/libc-alpha/2017-11/msg00797.html>, it fixes the build for arm with mainline GCC. [BZ #22447] * sysdeps/unix/getlogin_r.c (__getlogin_r): Use __strnlen not strlen to compute length of ut_user and set trailing NUL byte of result explicitly. (cherry picked from commit 4bae615022cb5a5da79ccda83cc6c9ba9f2d479c)
* signal: Use correct type for si_band in siginfo_t [BZ #23562]Ilya Yu. Malakhov2018-10-223-1/+8
| | | | (cherry picked from commit f997b4be18f7e57d757d39e42f7715db26528aa0)
* Fix misreported errno on preadv2/pwritev2 (BZ#23579)Adhemerval Zanella2018-09-289-5/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fallback code of Linux wrapper for preadv2/pwritev2 executes regardless of the errno code for preadv2, instead of the case where the syscall is not supported. This fixes it by calling the fallback code iff errno is ENOSYS. The patch also adds tests for both invalid file descriptor and invalid iov_len and vector count. The only discrepancy between preadv2 and fallback code regarding error reporting is when an invalid flags are used. The fallback code bails out earlier with ENOTSUP instead of EINVAL/EBADF when the syscall is used. Checked on x86_64-linux-gnu on a 4.4.0 and 4.15.0 kernel. [BZ #23579] * misc/tst-preadvwritev2-common.c (do_test_with_invalid_fd): New test. * misc/tst-preadvwritev2.c, misc/tst-preadvwritev64v2.c (do_test): Call do_test_with_invalid_fd. * sysdeps/unix/sysv/linux/preadv2.c (preadv2): Use fallback code iff errno is ENOSYS. * sysdeps/unix/sysv/linux/preadv64v2.c (preadv64v2): Likewise. * sysdeps/unix/sysv/linux/pwritev2.c (pwritev2): Likewise. * sysdeps/unix/sysv/linux/pwritev64v2.c (pwritev64v2): Likewise. (cherry picked from commit 7a16bdbb9ff4122af0a28dc20996c95352011fdd)
* preadv2/pwritev2: Handle offset == -1 [BZ #22753]Florian Weimer2018-09-2814-15/+105
| | | | | | Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit d4b4a00a462348750bb18544eb30853ee6ac5d10)
* Fix segfault in maybe_script_execute.Stefan Liebler2018-09-102-1/+6
| | | | | | | | | | | | | | | | | | | If glibc is built with gcc 8 and -march=z900, the testcase posix/tst-spawn4-compat crashes with a segfault. In function maybe_script_execute, the new_argv array is dynamically initialized on stack with (argc + 1) elements. The function wants to add _PATH_BSHELL as the first argument and writes out of bounds of new_argv. There is an off-by-one because maybe_script_execute fails to count the terminating NULL when sizing new_argv. ChangeLog: * sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute): Increment size of new_argv by one. (cherry picked from commit 28669f86f6780a18daca264f32d66b1428c9c6f1)
* pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]Martin Kuchta2018-08-273-2/+15
| | | | (cherry picked from commit 99ea93ca31795469d2a1f1570f17a5c39c2eb7e2)
* x86: Populate COMMON_CPUID_INDEX_80000001 for Intel CPUs [BZ #23459]H.J. Lu2018-07-294-10/+30
| | | | | | | | | | | | | | Reviewed-by: Carlos O'Donell <carlos@redhat.com> [BZ #23459] * sysdeps/x86/cpu-features.c (get_extended_indices): New function. (init_cpu_features): Call get_extended_indices for both Intel and AMD CPUs. * sysdeps/x86/cpu-features.h (COMMON_CPUID_INDEX_80000001): Remove "for AMD" comment. (cherry picked from commit be525a69a6630abc83144c0a96474f2e26da7443)
* x86: Correct index_cpu_LZCNT [BZ #23456]H.J. Lu2018-07-293-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | cpu-features.h has #define bit_cpu_LZCNT (1 << 5) #define index_cpu_LZCNT COMMON_CPUID_INDEX_1 #define reg_LZCNT But the LZCNT feature bit is in COMMON_CPUID_INDEX_80000001: Initial EAX Value: 80000001H ECX Extended Processor Signature and Feature Bits: Bit 05: LZCNT available index_cpu_LZCNT should be COMMON_CPUID_INDEX_80000001, not COMMON_CPUID_INDEX_1. The VMX feature bit is in COMMON_CPUID_INDEX_1: Initial EAX Value: 01H Feature Information Returned in the ECX Register: 5 VMX Reviewed-by: Carlos O'Donell <carlos@redhat.com> [BZ #23456] * sysdeps/x86/cpu-features.h (index_cpu_LZCNT): Set to COMMON_CPUID_INDEX_80000001. (cherry picked from commit 65d87ade1ee6f3ac099105e3511bd09bdc24cf3f)
* conform/conformtest.pl: Escape literal braces in regular expressionsFlorian Weimer2018-07-062-13/+18
| | | | | | | | | | | | This suppresses Perl warnings like these: Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.32), passed through in regex; marked by <-- HERE in m/^element *({ <-- HERE ([^}]*)}|([^{ ]*)) *({([^}]*)}|([^{ ]*)) *([A-Za-z0-9_]*) *(.*)/ at conformtest.pl line 370. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit ddb3c626b0a159de3547d901420198b626c29554)
* stdio-common/tst-printf.c: Remove part under a non-free license [BZ #23363]Florian Weimer2018-07-035-121/+8
| | | | | | | The license does not allow modification. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 5a357506659f9a00fcf5bc9c5d8fc676175c89a7)
* libio: Add tst-vtables, tst-vtables-interposedFlorian Weimer2018-07-035-0/+588
| | | | | | | (cherry picked from commit 29055464a03c72762969a2e8734d0d05d4d70e58) Some adjustments were needed for a tricky multi-inclusion issue related to libioP.h.
* Synchronize support/ infrastructure with masterFlorian Weimer2018-07-0317-4/+628
| | | | | | This commit updates the support/ subdirectory to commit 5c0202af4b3d588c04bcec7baf05706b21cd7416 on the master branch.
* NEWS: Reorder out-of-order bugsFlorian Weimer2018-07-031-3/+3
|
* libio: Disable vtable validation in case of interposition [BZ #23313]Florian Weimer2018-07-033-0/+22
| | | | (cherry picked from commit c402355dfa7807b8e0adb27c009135a7e2b9f1b0)
* Check length of ifname before copying it into to ifreq structure.Steve Ellcey2018-06-293-0/+13
| | | | | | | | [BZ #22442] * sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Check if ifname is too long. (cherry picked from commit 2180fee114b778515b3f560e5ff1e795282e60b0)
* getifaddrs: Don't return ifa entries with NULL names [BZ #21812]Daniel Alvarez2018-06-293-0/+16
| | | | | | | | | | | | | | | | | A lookup operation in map_newlink could turn into an insert because of holes in the interface part of the map. This leads to incorrectly set the name of the interface to NULL when the interface is not present for the address being processed (most likely because the interface was added between the RTM_GETLINK and RTM_GETADDR calls to the kernel). When such changes are detected by the kernel, it'll mark the dump as "inconsistent" by setting NLM_F_DUMP_INTR flag on the next netlink message. This patch checks this condition and retries the whole operation. Hopes are that next time the interface corresponding to the address entry is present in the list and correct name is returned. (cherry picked from commit c1f86a33ca32e26a9d6e29fc961e5ecb5e2e5eb4)
* Use _STRUCT_TIMESPEC as guard in <bits/types/struct_timespec.h> [BZ #23349]Florian Weimer2018-06-283-2/+10
| | | | | | | | | | | | After commit d76d3703551a362b472c866b5b6089f66f8daa8e ("Fix missing timespec definition for sys/stat.h (BZ #21371)") in combination with kernel UAPI changes, GCC sanitizer builds start to fail due to a conflicting definition of struct timespec in <linux/time.h>. Use _STRUCT_TIMESPEC as the header file inclusion guard, which is already checked in the kernel header, to support including <linux/time.h> and <sys/stat.h> in the same translation unit. (cherry picked from commit c1c2848b572ea7f92b7fa81dd5b1b9ef7c69b83b)
* Fix parameter type in C++ version of iseqsig (bug 23171)Gabriel F. T. Gomes2018-06-193-1/+8
| | | | | | | | | | | | | | | | | The commit commit c85e54ac6cef0faed7b7ffc722f52523dec59bf5 Author: Gabriel F. T. Gomes <gabriel@inconstante.eti.br> Date: Fri Nov 3 10:44:36 2017 -0200 Provide a C++ version of iseqsig (bug 22377) mistakenly used double parameters in the long double version of iseqsig, thus causing spurious conversions to double, as reported on bug 23171. Tested for powerpc64le and x86_64. (cherry picked from commit fb0e10b8eb1ebb68c57d4551f7a95118f3c54837)
* libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236]Florian Weimer2018-06-019-32/+50
| | | | | | | | | | | | | | | These unmangled function pointers reside on the heap and could be targeted by exploit writers, effectively bypassing libio vtable validation. Instead, we ignore these pointers and always call malloc or free. In theory, this is a backwards-incompatible change, but using the global heap instead of the user-supplied callback functions should have little application impact. (The old libstdc++ implementation exposed this functionality via a public, undocumented constructor in its strstreambuf class.) (cherry picked from commit 4e8a6346cd3da2d88bbad745a1769260d36f2783)
* Add NEWS entry for CVE-2018-11236Florian Weimer2018-05-241-0/+4
|
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-12-02 18:39:06 +0000