about summary refs log tree commit diff
path: root/stdio-common
Commit message (Collapse)AuthorAgeFilesLines
* libio: Avoid RMW of flags2 outside lock (BZ #27842)Wilco Dijkstra2022-06-101-1/+0
| | | | | | | | Remove an unconditional RMW on flags2 in flockfile - we don't need to change _IO_FLAGS2_NEED_LOCK since it isn't used in flockfile or funlockfile. This fixes BZ #27842. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Simplify printf_unknown interface in vfprintf-internal.cFlorian Weimer2022-05-241-18/+3
| | | | | | | The called function does not use the args array, so there is no need to produce it. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Move union printf_arg int <printf.h>Florian Weimer2022-05-241-23/+0
| | | | | | | The type does not depend on wide vs narrow preprocessor macros, so it does not need to be customized in stdio-common/printf-parse.h. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Add printf specifier registry to <printf.h>Florian Weimer2022-05-244-14/+1
| | | | | | Add __printf_arginfo_table, __printf_function_table, __printf_va_arg_table, __register_printf_specifier to include/printf.h.
* stdio-common: Add tst-memstream-string for open_memstream overflowFlorian Weimer2022-05-232-0/+80
| | | | | | | | | | This code path is exercised indirectly by some of the DNS stub resolver tests, via their own use of xopen_memstream for constructing strings describing result data. The relative lack of test suite coverage became apparent when these tests starting failing after a printf changes uncovered bug 28949. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* __printf_fphex always uses LC_NUMERICFlorian Weimer2022-05-231-19/+11
| | | | | | | There is no hexadecimal currency printing. strfmon uses __printf_fp_l exclusively. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* vfprintf: Consolidate some multibyte/wide character processingFlorian Weimer2022-05-231-87/+43
| | | | | | | form_character and form_string processing a sufficiently similar that the logic can be shared. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* vfprintf: Move argument processing into vfprintf-process-arg.cFlorian Weimer2022-05-232-499/+517
| | | | | | | This simplies formatting and helps with debugging. It also allows the use of localized COMPILE_WPRINTF preprocessor conditionals. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Add tst-vfprintf-width-i18n to cover numeric field widthFlorian Weimer2022-05-232-0/+98
| | | | | | Related to bug 28943 and bug 28944. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio: Remove the usage of $(fno-unit-at-a-time) for siglist.cAdhemerval Zanella2022-05-133-5/+20
| | | | | | | | | | | | | | | | | | The siglist.c is built with -fno-toplevel-reorder to avoid compiler to reorder the compat assembly directives due an assembler issue [1] (fixed on 2.39). This patch removes the compiler flags by split the compat symbol generation in two phases. First the __sys_siglist and __sys_sigabbrev without any compat symbol directive is preprocessed to generate an assembly source code. This generate assembly is then used as input on a platform agnostic siglist.S which then creates the compat definitions. This prevents compiler to move any compat directive prior the _sys_errlist definition itself. Checked on a make check run-built-tests=no on all affected ABIs. Reviewed-by: Fangrui Song <maskray@google.com>
* stdio: Remove the usage of $(fno-unit-at-a-time) for errlist.cAdhemerval Zanella2022-05-137-18/+89
| | | | | | | | | | | | | | | | | | The errlist.c is built with -fno-toplevel-reorder to avoid compiler to reorder the compat assembly directives due an assembler issue [1] (fixed on 2.39). This patch removes the compiler flags by split the compat symbol generation in two phases. First the _sys_errlist_internal internal without any compat symbol directive is preprocessed to generate an assembly source code. This generate assembly is then used as input on a platform agnostic errlist-data.S which then creates the compat definitions. This prevents compiler to move any compat directive prior the _sys_errlist_internal definition itself. Checked on a make check run-built-tests=no on all affected ABIs. [1] https://sourceware.org/bugzilla/show_bug.cgi?id=29012
* stdio: Split __get_errname definition from errlist.cAdhemerval Zanella2022-04-153-36/+64
| | | | | | | | | | | | | | | | | The loader does not need to pull all __get_errlist definitions and its size is decreased: Before: $ size elf/ld.so text data bss dec hex filename 197774 11024 456 209254 33166 elf/ld.so After: $ size elf/ld.so text data bss dec hex filename 191510 9936 456 201902 314ae elf/ld.so Checked on x86_64-linux-gnu.
* stdio-common: Add wide stream coverage to tst-vfprintf-user-typeFlorian Weimer2022-03-181-27/+93
| | | | | | And use TEST_COMPARE_STRING for the narrow tests. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Generate ja_JP.EUC-JP localeFlorian Weimer2022-03-171-0/+1
| | | | It is needed by tst-swprintf.
* stdio-common: Re-flow and sort Makefile variablesFlorian Weimer2022-03-171-66/+217
|
* Update copyright dates with scripts/update-copyrightsPaul Eggert2022-01-01122-122/+122
| | | | | | | | | | | | | | | | | | | | | | | I used these shell commands: ../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright (cd ../glibc && git commit -am"[this commit message]") and then ignored the output, which consisted lines saying "FOO: warning: copyright statement not found" for each of 7061 files FOO. I then removed trailing white space from math/tgmath.h, support/tst-support-open-dev-null-range.c, and sysdeps/x86_64/multiarch/strlen-vec.S, to work around the following obscure pre-commit check failure diagnostics from Savannah. I don't know why I run into these diagnostics whereas others evidently do not. remote: *** 912-#endif remote: *** 913: remote: *** 914- remote: *** error: lines with trailing whitespace found ... remote: *** error: sysdeps/unix/sysv/linux/statx_cp.c: trailing lines
* stdio-common: Fix %m sprintf test output for GNU/HurdSamuel Thibault2021-12-271-0/+10
| | | | | GNU/Hurd has slightly different error messages for undefined numbers, due to the notion of error subsystems.
* stdio: Implement %#m for vfprintf and related functionsFlorian Weimer2021-12-233-6/+116
| | | | | | | | | %#m prints errno as an error constant if one is available, or a decimal number as a fallback. This intends to address the gap that strerrorname_np does not work well with printf for unknown error codes due to its NULL return values in those cases. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Support C2X printf %b, %BJoseph Myers2021-11-107-21/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | C2X adds a printf %b format (see <http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2630.pdf>, accepted for C2X), for outputting integers in binary. It also has recommended practice for a corresponding %B format (like %b, but %#B starts the output with 0B instead of 0b). Add support for these formats to glibc. One existing test uses %b as an example of an unknown format, to test how glibc printf handles unknown formats; change that to %v. Use of %b and %B as user-registered format specifiers continues to work (and we already have a test that covers that, tst-printfsz.c). Note that C2X also has scanf %b support, plus support for binary constants starting 0b in strtol (base 0 and 2) and scanf %i (strtol base 0 and scanf %i coming from a previous paper that added binary integer literals). I intend to implement those features in a separate patch or patches; as discussed in the thread starting at <https://sourceware.org/pipermail/libc-alpha/2020-December/120414.html>, they will be more complicated because they involve adding extra public symbols to ensure compatibility with existing code that might not expect 0b constants to be handled by strtol base 0 and 2 and scanf %i, whereas simply adding a new format specifier poses no such compatibility concerns. Note that the actual conversion from integer to string uses existing code in _itoa.c. That code has special cases for bases 8, 10 and 16, probably so that the compiler can optimize division by an integer constant in the code for those bases. If desired such special cases could easily be added for base 2 as well, but that would be an optimization, not actually needed for these printf formats to work. Tested for x86_64 and x86. Also tested with build-many-glibcs.py for aarch64-linux-gnu with GCC mainline to make sure that the test does indeed build with GCC 12 (where format checking warnings are enabled for most of the test).
* Fix memmove call in vfprintf-internal.c:group_numberJoseph Myers2021-11-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent GCC mainline change introduces errors of the form: vfprintf-internal.c: In function 'group_number': vfprintf-internal.c:2093:15: error: 'memmove' specified bound between 9223372036854775808 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Werror=stringop-overflow=] 2093 | memmove (w, s, (front_ptr -s) * sizeof (CHAR_T)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is a genuine bug in the glibc code: s > front_ptr is always true at this point in the code, and the intent is clearly for the subtraction to be the other way round. The other arguments to the memmove call here also appear to be wrong; w and s point just *after* the destination and source for copying the rest of the number, so the size needs to be subtracted to get appropriate pointers for the copying. Adjust the memmove call to conform to the apparent intent of the code, so fixing the -Wstringop-overflow error. Now, if the original code were ever executed, a buffer overrun would result. However, I believe this code (introduced in commit edc1686af0c0fc2eb535f1d38cdf63c1a5a03675, "vfprintf: Reuse work_buffer in group_number", so in glibc 2.26) is unreachable in prior glibc releases (so there is no need for a bug in Bugzilla, no need to consider any backports unless someone wants to build older glibc releases with GCC 12 and no possibility of this buffer overrun resulting in a security issue). work_buffer is 1000 bytes / 250 wide characters. This case is only reachable if an initial part of the number, plus a grouped copy of the rest of the number, fail to fit in that space; that is, if the grouped number fails to fit in the space. In the wide character case, grouping is always one wide character, so even with a locale (of which there aren't any in glibc) grouping every digit, a number would need to occupy at least 125 wide characters to overflow, and a 64-bit integer occupies at most 23 characters in octal including a leading 0. In the narrow character case, the multibyte encoding of the grouping separator would need to be at least 42 bytes to overflow, again supposing grouping every digit, but MB_LEN_MAX is 16. So even if we admit the case of artificially constructed locales not shipped with glibc, given that such a locale would need to use one of the character sets supported by glibc, this code cannot be reached at present. (And POSIX only actually specifies the ' flag for grouping for decimal output, though glibc acts on it for other bases as well.) With binary output (if you consider use of grouping there to be valid), you'd need a 15-byte multibyte character for overflow; I don't know if any supported character set has such a character (if, again, we admit constructed locales using grouping every digit and a grouping separator chosen to have a multibyte encoding as long as possible, as well as accepting use of grouping with binary), but given that we have this code at all (clearly it's not *correct*, or in accordance with the principle of avoiding arbitrary limits, to skip grouping on running out of internal space like that), I don't think it should need any further changes for binary printf support to go in. On the other hand, support for large sizes of _BitInt in printf (see the N2858 proposal) *would* require something to be done about such arbitrary limits (presumably using dynamic allocation in printf again, for sufficiently large _BitInt arguments only - currently only floating-point uses dynamic allocation, and, as previously discussed, that could actually be replaced by bounded allocation given smarter code). Tested with build-many-glibcs.py for aarch64-linux-gnu (GCC mainline). Also tested natively for x86_64.
* Fix stdio-common tests for GCC 12 -WaddressJoseph Myers2021-10-043-10/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | My glibc bot shows failures building the testsuite with GCC mainline across all architectures: tst-vfprintf-width-prec.c: In function 'do_test': tst-vfprintf-width-prec.c:90:16: error: the comparison will always evaluate as 'false' for the address of 'result' will never be NULL [-Werror=address] 90 | if (result == NULL) | ^~ tst-vfprintf-width-prec.c:89:13: note: 'result' declared here 89 | wchar_t result[100]; | ^~~~~~ This is clearly a correct warning; the comparison against NULL is clearly a cut-and-paste mistake from an earlier case in the test that does use calloc. Thus, remove the unnecessary check for NULL shown up by the warning. Similarly, two other tests have bogus comparisons against NULL; remove those as well: scanf14a.c:95:13: error: the comparison will always evaluate as 'false' for the address of 'fname' will never be NULL [-Werror=address] 95 | if (fname == NULL) | ^~ scanf14a.c:93:8: note: 'fname' declared here 93 | char fname[strlen (tmpdir) + sizeof "/tst-scanf14.XXXXXX"]; | ^~~~~ scanf16a.c:125:13: error: the comparison will always evaluate as 'false' for the address of 'fname' will never be NULL [-Werror=address] 125 | if (fname == NULL) | ^~ scanf16a.c:123:8: note: 'fname' declared here 123 | char fname[strlen (tmpdir) + sizeof "/tst-scanf16.XXXXXX"]; | ^~~~~ Tested with build-many-glibcs.py (GCC mainline) for aarch64-linux-gnu.
* vfprintf: Unify argument handling in process_argFlorian Weimer2021-09-231-117/+89
| | | | | | | Instead of checking a pointer argument for NULL, use helper macros defined differently in the non-positional and positional cases. This avoids frequent conditional checks and a GCC 12 warning about comparing pointers against NULL which cannot be NULL.
* vfprintf: Handle floating-point cases outside of process_arg macroFlorian Weimer2021-09-231-111/+75
| | | | | | A lot of the code is unique to the positional and non-positional code. Also unify the decimal and hexadecimal cases via the new helper function __printf_fp_spec.
* Remove "Contributed by" linesSiddhesh Poyarekar2021-09-0319-22/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | We stopped adding "Contributed by" or similar lines in sources in 2012 in favour of git logs and keeping the Contributors section of the glibc manual up to date. Removing these lines makes the license header a bit more consistent across files and also removes the possibility of error in attribution when license blocks or files are copied across since the contributed-by lines don't actually reflect reality in those cases. Move all "Contributed by" and similar lines (Written by, Test by, etc.) into a new file CONTRIBUTED-BY to retain record of these contributions. These contributors are also mentioned in manual/contrib.texi, so we just maintain this additional record as a courtesy to the earlier developers. The following scripts were used to filter a list of files to edit in place and to clean up the CONTRIBUTED-BY file respectively. These were not added to the glibc sources because they're not expected to be of any use in future given that this is a one time task: https://gist.github.com/siddhesh/b5ecac94eabfd72ed2916d6d8157e7dc https://gist.github.com/siddhesh/15ea1f5e435ace9774f485030695ee02 Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* hurd: Fix errlist error mappingSamuel Thibault2021-08-231-5/+7
| | | | | | On the Hurd, the errno values don't start at 0, so _sys_errlist_internal needs index remapping. The _sys_errlist_internal definition already properly uses ERR_MAP, but __get_errlist and __get_errname were not.
* Move malloc hooks into a compat DSOSiddhesh Poyarekar2021-07-221-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | Remove all malloc hook uses from core malloc functions and move it into a new library libc_malloc_debug.so. With this, the hooks now no longer have any effect on the core library. libc_malloc_debug.so is a malloc interposer that needs to be preloaded to get hooks functionality back so that the debugging features that depend on the hooks, i.e. malloc-check, mcheck and mtrace work again. Without the preloaded DSO these debugging features will be nops. These features will be ported away from hooks in subsequent patches. Similarly, legacy applications that need hooks functionality need to preload libc_malloc_debug.so. The symbols exported by libc_malloc_debug.so are maintained at exactly the same version as libc.so. Finally, static binaries will no longer be able to use malloc debugging features since they cannot preload the debugging DSO. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* libio: Replace internal _IO_getdelim symbol with __getdelimFlorian Weimer2021-07-071-1/+1
| | | | | | | __getdelim is exported, _IO_getdelim is not. Add a hidden prototype for __getdelim. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Remove _IO_vfwscanfFlorian Weimer2021-06-012-39/+1
| | | | | | | | | The symbol has never been exported, so no compatibility symbol is needed. Removing this file prevents ld from creation an exported symbol in case GLIBC_2_0 expands to a symbol version which does not have a local: *; directive in the symbol version map file. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* linux: Move funlockfile/_IO_funlockfile into libcAdhemerval Zanella2021-05-101-3/+3
| | | | | | | | | | The nptl version is used as default, since now with symbol always present the single-thread optimization is tricky. Hurd is not change, it is used it own lock scheme (which call _cthreads_funlockfile). Checked on x86_64-linux-gnu.
* linux: Move ftrylockfile/_IO_ftrylockfile into libcAdhemerval Zanella2021-05-101-4/+3
| | | | | | | | | | The nptl version is used as default, since now with symbol always present the single-thread optimization is tricky. Hurd is not change, it is used it own lock scheme (which call _cthreads_ftrylockfile). Checked on x86_64-linux-gnu.
* linux: Move flockfile/_IO_flockfile into libcAdhemerval Zanella2021-05-101-3/+3
| | | | | | | | | | The nptl version is used as default, since now with symbol always present the single-thread optimization is tricky. Hurd is not change, it is used it own lock scheme (which call _cthreads_flockfile). Checked on x86_64-linux-gnu.
* Annotate additional APIs with GCC attribute access.Martin Sebor2021-05-062-2/+2
| | | | | | | | | | | | | | | | This change continues the improvements to compile-time out of bounds checking by decorating more APIs with either attribute access, or by explicitly providing the array bound in APIs such as tmpnam() that expect arrays of some minimum size as arguments. (The latter feature is new in GCC 11.) The only effects of the attribute and/or the array bound is to check and diagnose calls to the functions that fail to provide a sufficient number of elements, and the definitions of the functions that access elements outside the specified bounds. (There is no interplay with _FORTIFY_SOURCE here yet.) Tested with GCC 7 through 11 on x86_64-linux.
* stdio: fix vfscanf with matches longer than INT_MAX (bug 27650)Alyssa Ross2021-05-031-9/+4
| | | | | | | | | | Patterns like %*[ can safely be used to match a great many characters, and it's quite realisitic to use them for more than INT_MAX characters from an IO stream. With the previous approach, after INT_MAX characters (v)fscanf would return successfully, indicating an end to the match, even though there wasn't one.
* stdio-common/printf-prs.c: Reword commentAlejandro Colomar \(man-pages\)2021-03-311-2/+2
| | | | | | | | | | | 'this' can be understood as the current parameter, but in this case it is meaning the other one, the one holding the width/precission. 'it' better describes that parameter, differentiating it from the one corresponding to the current specifier. Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* printf: Add smoke tests for long doubleSiddhesh Poyarekar2021-02-052-28/+103
| | | | | | | The printf tests have no coverage for long double. Duplicate the double tests so that we have some basic coverage. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* stdio-common: Add a few double formatting tests [BZ #27245]Mike Hommey2021-02-031-1/+29
| | | | | | Checked on x86_64-linux-gnu. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Update copyright dates with scripts/update-copyrightsPaul Eggert2021-01-02120-120/+120
| | | | | | | | | | | | | | | | I used these shell commands: ../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright (cd ../glibc && git commit -am"[this commit message]") and then ignored the output, which consisted lines saying "FOO: warning: copyright statement not found" for each of 6694 files FOO. I then removed trailing white space from benchtests/bench-pthread-locks.c and iconvdata/tst-iconv-big5-hkscs-to-2ucs4.c, to work around this diagnostic from Savannah: remote: *** pre-commit check failed ... remote: *** error: lines with trailing whitespace found remote: error: hook declined to update refs/heads/master
* tests: Remove NULL check for an arraySiddhesh Poyarekar2020-11-124-8/+0
| | | | | The NULL check for an array on stack is pointless since it will always be false, so drop it.
* __vfscanf_internal: fix aliasing violation (bug 26690)Andreas Schwab2020-10-081-11/+11
| | | | | | | As noted in <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97264>, the cast in the call to the read_int function is an aliasing violation. Change the type of local variable f to a pointer to unsigned, which allows to eliminate most casts while only adding three new ones.
* Revert "Fix missing redirects in testsuite targets"Andreas Schwab2020-10-081-2/+2
| | | | | This reverts commit d5afb38503. The log files are actually created by the various shell scripts that drive the tests.
* string: Fix strerrorname_np return value [BZ #26555]Adhemerval Zanella2020-09-293-37/+669
| | | | | | | | | | | | | | | It returns the string of the error constant, not its description (as strerrordesc_np). To handle the Hurd error mapping, the ERR_MAP was removed from errlist.h to errlist.c. Also, the testcase test-strerr (added on 325081b9eb2) was not added on the check build neither it builds correctly. This patch also changed it to decouple from errlist.h, the expected return values are added explicitly for both both strerrorname_np and strerrordesc_np directly. Checked on x86_64-linux-gnu and i686-linux-gnu. I also run a make check for i686-gnu.
* Fix memory leak in __printf_fp_l (bug 26215).Joseph Myers2020-07-093-8/+57
| | | | | | | | | | __printf_fp_l has a memory leak in the case of some I/O errors, where both buffer and wbuffer have been malloced but the handling of I/O errors only frees wbuffer. This patch fixes this by moving the declaration of buffer to an outer scope and ensuring that it is freed when wbuffer is freed. Tested for x86_64 and x86.
* Fix double free in __printf_fp_l (bug 26214).Joseph Myers2020-07-093-3/+48
| | | | | | | | | | | __printf_fp_l has a double free bug in the case where it allocates memory with malloc internally, then has an I/O error while outputting trailing padding and tries to free that already-freed memory when the error occurs. This patch fixes this by setting the relevant pointer to NULL after the first free (the only free of this pointer that isn't immediately followed by returning from the function). Tested for x86_64 and x86.
* string: Add strerrorname_np and strerrordesc_npAdhemerval Zanella2020-07-072-0/+98
| | | | | | | | | | | | | | | | | The strerrorname_np returns error number name (e.g. "EINVAL" for EINVAL) while strerrordesc_np returns string describing error number (e.g "Invalid argument" for EINVAL). Different than strerror, strerrordesc_np does not attempt to translate the return description, both functions return NULL for an invalid error number. They should be used instead of sys_errlist and sys_nerr, both are thread and async-signal safe. These functions are GNU extensions. Checked on x86-64-linux-gnu, i686-linux-gnu, powerpc64le-linux-gnu, and s390x-linux-gnu. Tested-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* string: Add sigabbrev_np and sigdescr_npAdhemerval Zanella2020-07-071-0/+1
| | | | | | | | | | | | | | | | | | The sigabbrev_np returns the abbreviated signal name (e.g. "HUP" for SIGHUP) while sigdescr_np returns the string describing the error number (e.g "Hangup" for SIGHUP). Different than strsignal, sigdescr_np does not attempt to translate the return description and both functions return NULL for an invalid signal number. They should be used instead of sys_siglist or sys_sigabbrev and they are both thread and async-signal safe. They are added as GNU extensions on string.h header (same as strsignal). Checked on x86-64-linux-gnu, i686-linux-gnu, powerpc64le-linux-gnu, and s390x-linux-gnu. Tested-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* signal: Move sys_errlist to a compat symbolAdhemerval Zanella2020-07-074-14/+101
| | | | | | | | | | | | | | | | | | | | The symbol is deprecated by strerror since its usage imposes some issues such as copy relocations. Its internal name is also changed to _sys_errlist_internal to avoid static linking usage. The compat code is also refactored by removing the over enginered errlist-compat.c generation from manual entried and extra comment token in linker script file. It disantangle the code generation from manual and simplify both Linux and Hurd compat code. The definitions from errlist.c are moved to errlist.h and a new test is added to avoid a new errno entry without an associated one in manual. Checked on x86_64-linux-gnu and i686-linux-gnu. I also run a check-abi on all affected platforms. Tested-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* signal: Move sys_siglist to a compat symbolAdhemerval Zanella2020-07-073-5/+7
| | | | | | | | | | | | | | | | | | | The symbol was deprecated by strsignal and its usage imposes issues such as copy relocations. Its internal name is changed to __sys_siglist and __sys_sigabbrev to avoid static linking usage. The compat code is also refactored, since both Linux and Hurd usage the same strategy: export the same array with different object sizes. The libSegfault change avoids calling strsignal on the SIGFAULT signal handler (the current usage is already sketchy, adding a call that potentially issue locale internal function is even sketchier). Checked on x86_64-linux-gnu and i686-linux-gnu. I also run a check-abi on all affected platforms. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Remove most vfprintf width/precision-dependent allocations (bug 14231, bug ↵Joseph Myers2020-07-074-121/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 26211). The vfprintf implementation (used for all printf-family functions) contains complicated logic to allocate internal buffers of a size depending on the width and precision used for a format, using either malloc or alloca depending on that size, and with consequent checks for size overflow and allocation failure. As noted in bug 26211, the version of that logic used when '$' plus argument number formats are in use is missing the overflow checks, which can result in segfaults (quite possibly exploitable, I didn't try to work that out) when the width or precision is in the range 0x7fffffe0 through 0x7fffffff (maybe smaller values as well in the wprintf case on 32-bit systems, when the multiplication by sizeof (CHAR_T) can overflow). All that complicated logic in fact appears to be useless. As far as I can tell, there has been no need (outside the floating-point printf code, which does its own allocations) for allocations depending on width or precision since commit 3e95f6602b226e0de06aaff686dc47b282d7cc16 ("Remove limitation on size of precision for integers", Sun Sep 12 21:23:32 1999 +0000). Thus, this patch removes that logic completely, thereby fixing both problems with excessive allocations for large width and precision for non-floating-point formats, and the problem with missing overflow checks with such allocations. Note that this does have the consequence that width and precision up to INT_MAX are now allowed where previously INT_MAX / sizeof (CHAR_T) - EXTSIZ or more would have been rejected, so could potentially expose any other overflows where the value would previously have been rejected by those removed checks. I believe this completely fixes bugs 14231 and 26211. Excessive allocations are still possible in the floating-point case (bug 21127), as are other integer or buffer overflows (see bug 26201). This does not address the cases where a precision larger than INT_MAX (embedded in the format string) would be meaningful without printf's return value overflowing (when it's used with a string format, or %g without the '#' flag, so the actual output will be much smaller), as mentioned in bug 17829 comment 8; using size_t internally for precision to handle that case would be complicated by struct printf_info being a public ABI. Nor does it address the matter of an INT_MIN width being negated (bug 17829 comment 7; the same logic appears a second time in the file as well, in the form of multiplying by -1). There may be other sources of memory allocations with malloc in printf functions as well (bug 24988, bug 16060). From inspection, I think there are also integer overflows in two copies of "if ((width -= len) < 0)" logic (where width is int, len is size_t and a very long string could result in spurious padding being output on a 32-bit system before printf overflows the count of output characters). Tested for x86-64 and x86.
* Rename __LONG_DOUBLE_USES_FLOAT128 to __LDOUBLE_REDIRECTS_TO_FLOAT128_ABIPaul E. Murphy2020-04-302-2/+2
| | | | | | | | | | | | | | | Improve the commentary to aid future developers who will stumble upon this novel, yet not always perfect, mechanism to support alternative formats for long double. Likewise, rename __LONG_DOUBLE_USES_FLOAT128 to __LDOUBLE_REDIRECTS_TO_FLOAT128_ABI now that development work has settled down. The command used was git grep -l __LONG_DOUBLE_USES_FLOAT128 ':!./ChangeLog*' | \ xargs sed -i 's/__LONG_DOUBLE_USES_FLOAT128/__LDOUBLE_REDIRECTS_TO_FLOAT128_ABI/g' Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
* Fix tests which expose ldbl -> _Float128 redirectsPaul E. Murphy2020-03-251-0/+4
| | | | | | | | | | | | | | | | | | The ldbl redirects for ieee128 have some jagged edges when inspecting and manipulating symbols directly. e.g asprintf is unconditionally redirected to __asprintfieee128 thus any tests relying on GCC's redirect behavior will encounter problems if they inspect the symbol names too closely. I've mitigated tests which expose the limitations of the ldbl -> f128 redirects by giving them knowledge about the redirected symbol names. Hopefully there isn't much user code which depends on this implementation specific behavior. Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-05 09:02:12 +0000