FROM: Siddhesh Poyarekar <siddhesh@sourceware.org>

SUBJECT: The GNU C Library version 2.26 is now available

The GNU C Library
=================

The GNU C Library version 2.26 is now available.

The GNU C Library is used as *the* C library in the GNU system and
in GNU/Linux systems, as well as many other systems that use Linux
as the kernel.

The GNU C Library is primarily designed to be a portable
and high performance C library.  It follows all relevant
standards including ISO C11 and POSIX.1-2008.  It is also
internationalized and has one of the most complete
internationalization interfaces known.

The GNU C Library webpage is at http://www.gnu.org/software/libc/

Packages for the 2.26 release may be downloaded from:
        http://ftpmirror.gnu.org/libc/
        http://ftp.gnu.org/gnu/libc/

The mirror list is at http://www.gnu.org/order/ftp.html

NEWS for version 2.26
=====================

Major new features:

* A per-thread cache has been added to malloc. Access to the cache requires
  no locks and therefore significantly accelerates the fast path to allocate
  and free small amounts of memory. Refilling an empty cache requires locking
  the underlying arena. Performance measurements show significant gains in a
  wide variety of user workloads. Workloads were captured using a special
  instrumented malloc and analyzed with a malloc simulator. Contributed by
  DJ Delorie with the help of Florian Weimer, and Carlos O'Donell.

* Unicode 10.0.0 Support: Character encoding, character type info, and
  transliteration tables are all updated to Unicode 10.0.0, using
  generator scripts contributed by Mike FABIAN (Red Hat).
  These updates cause user visible changes, especially the changes in
  wcwidth for many emoji characters cause problems when emoji sequences
  are rendered with pango, see for example:
  https://bugzilla.gnome.org/show_bug.cgi?id=780669#c5

* Collation of Hungarian has been overhauled and is now consistent with "The
  Rules of Hungarian Orthography, 12th edition" (Bug 18934).  Contributed by
  Egmont Koblinger.

* Improvements to the DNS stub resolver, contributed by Florian Weimer:

  - The GNU C Library will now detect when /etc/resolv.conf has been
    modified and reload the changed configuration.  The new resolver option
    “no-reload” (RES_NORELOAD) disables this behavior.

  - The GNU C Library now supports an arbitrary number of search domains
    (configured using the “search” directive in /etc/resolv.conf);
    previously, there was a hard limit of six domains.  For backward
    compatibility, applications that directly modify the ‘_res’ global
    object are still limited to six search domains.

  - When the “rotate” (RES_ROTATE) resolver option is active, the GNU C
    Library will now randomly pick a name server from the configuration as a
    starting point.  (Previously, the second name server was always used.)

* The tunables feature is now enabled by default.  This allows users to tweak
  behavior of the GNU C Library using the GLIBC_TUNABLES environment variable.

* New function reallocarray, which resizes an allocated block (like realloc)
  to the product of two sizes, with a guaranteed clean failure upon integer
  overflow in the multiplication.  Originally from OpenBSD, contributed by
  Dennis Wölfing and Rüdiger Sonderfeld.

* New wrappers for the Linux-specific system calls preadv2 and pwritev2.
  These are extended versions of preadv and pwritev, respectively, taking an
  additional flags argument.  The set of supported flags depends on the
  running kernel; full support currently requires kernel 4.7 or later.

* posix_spawnattr_setflags now supports the flag POSIX_SPAWN_SETSID, to
  create a new session ID for the spawned process.  This feature is
  scheduled to be added to the next major revision of POSIX; for the time
  being, it is available under _GNU_SOURCE.

* errno.h is now safe to use from C-preprocessed assembly language on all
  supported operating systems.  In this context, it will only define the
  Exxxx constants, as preprocessor macros expanding to integer literals.

* On ia64, powerpc64le, x86-32, and x86-64, the math library now implements
  128-bit floating point as defined by ISO/IEC/IEEE 60559:2011 (IEEE
  754-2008) and ISO/IEC TS 18661-3:2015.  Contributed by Paul E. Murphy,
  Gabriel F. T. Gomes, Tulio Magno Quites Machado Filho, and Joseph Myers.

  To compile programs that use this feature, the compiler must support
  128-bit floating point with the type name _Float128 (as defined by TS
  18661-3) or __float128 (the nonstandard name used by GCC for C++, and for
  C prior to version 7).  _GNU_SOURCE or __STDC_WANT_IEC_60559_TYPES_EXT__
  must be defined to make the new interfaces visible.

  The new functions and macros correspond to those present for other
  floating-point types (except for a few obsolescent interfaces not
  supported for the new type), with F128 or f128 suffixes; for example,
  strtof128, HUGE_VAL_F128 and cosf128.  Following TS 18661-3, there are no
  printf or scanf formats for the new type; the strfromf128 and strtof128
  interfaces should be used instead.

Deprecated and removed features, and other changes affecting compatibility:

* The synchronization that pthread_spin_unlock performs has been changed to
  now be equivalent to a C11 atomic store with release memory order to the
  spin lock's memory location.  Previously, several (but not all)
  architectures used stronger synchronization (e.g., containing what is
  often called a full barrier).  This change can improve performance, but
  may affect odd fringe uses of spin locks that depend on the previous
  behavior (e.g., using spin locks as atomic variables to try to implement
  Dekker's mutual exclusion algorithm).

* The port to Native Client running on ARMv7-A (--host=arm-nacl) has been
  removed.

* Sun RPC is deprecated.  The rpcgen program, librpcsvc, and Sun RPC headers
  will only be built and installed when the GNU C Library is configured with
  --enable-obsolete-rpc.  This allows alternative RPC implementations, such
  as TIRPC or rpcsvc-proto, to be used.

* The NIS(+) name service modules, libnss_nis, libnss_nisplus, and
  libnss_compat, are deprecated, and will not be built or installed by
  default.

  The NIS(+) support library, libnsl, is also deprecated.  By default, a
  compatibility shared library will be built and installed, but not headers
  or development libraries. Only a few NIS-related programs require this
  library.  (In particular, the GNU C Library has never required programs
  that use 'gethostbyname' to be linked with libnsl.)

  Replacement implementations based on TIRPC, which additionally support
  IPv6, are available from <https://github.com/thkukuk/>.  The configure
  option --enable-obsolete-nsl will cause libnsl's headers, and the NIS(+)
  name service modules, to be built and installed.

* The DNS stub resolver no longer performs EDNS fallback.  If EDNS or DNSSEC
  support is enabled, the configured recursive resolver must support EDNS.
  (Responding to EDNS-enabled queries with responses which are not
  EDNS-enabled is fine, but FORMERR responses are not.)

* res_mkquery and res_nmkquery no longer support the IQUERY opcode.  DNS
  servers have not supported this opcode for a long time.

* The _res_opcodes variable has been removed from libresolv.  It had been
  exported by accident.

* <string.h> no longer includes inline versions of any string functions,
  as this kind of optimization is better done by the compiler.  The macros
  __USE_STRING_INLINES and __NO_STRING_INLINES no longer have any effect.

* The nonstandard header <xlocale.h> has been removed.  Most programs should
  use <locale.h> instead.  If you have a specific need for the definition of
  locale_t with no other declarations, please contact
  libc-alpha@sourceware.org and explain.

* The obsolete header <sys/ultrasound.h> has been removed.

* The obsolete signal constant SIGUNUSED is no longer defined by <signal.h>.

* The obsolete function cfree has been removed.  Applications should use
  free instead.

* The stack_t type no longer has the name struct sigaltstack.  This changes
  the C++ name mangling for interfaces involving this type.

* The ucontext_t type no longer has the name struct ucontext.  This changes
  the C++ name mangling for interfaces involving this type.

* On M68k GNU/Linux and MIPS GNU/Linux, the fpregset_t type no longer has
  the name struct fpregset.  On Nios II GNU/Linux, the mcontext_t type no
  longer has the name struct mcontext.  On SPARC GNU/Linux, the struct
  mc_fq, struct rwindow, struct fpq and struct fq types are no longer
  defined in sys/ucontext.h, the mc_fpu_t type no longer has the name struct
  mc_fpu, the gwindows_t type no longer has the name struct gwindows and the
  fpregset_t type no longer has the name struct fpu.  This changes the C++
  name mangling for interfaces involving those types.

* On S/390 GNU/Linux, the constants defined by <sys/ptrace.h> have been
  synced with the kernel:

    - PTRACE_GETREGS, PTRACE_SETREGS, PTRACE_GETFPREGS and PTRACE_SETFPREGS
      are not supported on this architecture and have been removed.

    - PTRACE_SINGLEBLOCK, PTRACE_SECCOMP_GET_FILTER, PTRACE_PEEKUSR_AREA,
      PTRACE_POKEUSR_AREA, PTRACE_GET_LAST_BREAK, PTRACE_ENABLE_TE,
      PTRACE_DISABLE_TE and PTRACE_TE_ABORT_RAND have been added.

  Programs that assume the GET/SETREGS ptrace requests are universally
  available will now fail to build, instead of malfunctioning at runtime.

Changes to build and runtime requirements:

* Linux kernel 3.2 or later is required at runtime, on all architectures
  supported by that kernel.  (This is a change from version 2.25 only for
  x86-32 and x86-64.)

* GNU Binutils 2.25 or later is now required to build the GNU C Library.

* On most architectures, GCC 4.9 or later is required to build the GNU C
  Library.  On powerpc64le, GCC 6.2 or later is required.

  Older GCC versions and non-GNU compilers are still supported when
  compiling programs that use the GNU C Library.  (We do not know exactly
  how old, and some GNU extensions to C may be _de facto_ required.  If you
  are interested in helping us make this statement less vague, please
  contact libc-alpha@sourceware.org.)

Security related changes:

* The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes,
  to avoid fragmentation-based spoofing attacks (CVE-2017-12132).

* LD_LIBRARY_PATH is now ignored in binaries running in privileged AT_SECURE
  mode to guard against local privilege escalation attacks (CVE-2017-1000366).

* Avoid printing a backtrace from the __stack_chk_fail function since it is
  called on a corrupt stack and a backtrace is unreliable on a corrupt stack
  (CVE-2010-3192).

* A use-after-free vulnerability in clntudp_call in the Sun RPC system has been
  fixed (CVE-2017-12133).

Contributors
============

This release was made possible by the contributions of many people.
The maintainers are grateful to everyone who has contributed
changes or bug reports.  These include:

Adhemerval Zanella
Akhilesh Kumar
Alan Modra
Alexey Neyman
Andreas Schwab
Arjun Shankar
Benjamin Cama
Carlos O'Donell
Chris Leonard
Christian Borntraeger
Christian Brauner
Christopher Chittleborough
Chung-Lin Tang
DJ Delorie
Dennis Wölfing
Dmitry Bilunov
Dmitry V. Levin
Egmont Koblinger
Eyolf Østrem
Florian Weimer
Gabriel F. T. Gomes
Gordana Cmiljanovic
H.J. Lu
Ihar Hrachyshka
Ivo Raisr
Jiong Wang
John David Anglin
Joseph Myers
Justus Winter
Kir Kolyshkin
Marko Myllynen
Massimeddu Cireddu
Matthew Krupcale
Mike FABIAN
Mike Frysinger
Mousa Moradi
Nathan Rossi
Paul Clarke
Paul E. Murphy
Paul Eggert
Peng Wu
Phil Blundell
Prakhar Bahuguna
Rabin Vincent
Rafal Luzynski
Rajalakshmi Srinivasaraghavan
Rical Jasan
Rogerio A. Cardoso
Samuel Thibault
Santhosh Thottingal
Siddhesh Poyarekar
Slava Barinov
Stefan Liebler
Steve Ellcey
Sunyeop Lee
Szabolcs Nagy
Thorsten Kukuk
Tulio Magno Quites Machado Filho
Uros Bizjak
Vladimir Mezentsev
Wainer dos Santos Moschetta
Wilco Dijkstra
Wladimir J. van der Laan
Yury Norov
Zack Weinberg
-----BEGIN PGP SIGNATURE-----

iQEcBAABAgAGBQJZgddcAAoJEHnEPfvxzyGH+WAH/3R1K41WWcqSDxX/fgbDzK53
Rgf2QlO0tgJdprRKodeMEDfEfLxhbyAO/aREiTcy7Jeg9zHpcdJgX5H0hax4MYGW
e9ibTSXlxOPhVBrj3cBF+Y2HcqIen0iLFFI9afpstTPitQKgOLLOfjZVs8RKsAUQ
m8FMfWNXZJmexqFnY9b0gukZEUvou5Fq61jXZH6P99MQfovR6/xBbuCUTkWK+Xjy
JmQ8sz69aoTyPlNJNWlg7lFuLTqRzywYDo4Xf6jL+9tVoaTSaKhil3Ld23gekXFE
TzRXo4xeihMjAxhS43BqaSttbcEV0ha0GVGiVqVZWiM+89wQRzj1UAlxa8Wyhlk=
=Myq/
-----END PGP SIGNATURE-----