about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
* minor perror behavior fixRich Felker2012-06-201-1/+1
| | | | patch by nsz
* fix localeconv values and implementationRich Felker2012-06-191-15/+28
| | | | | | | | dynamic-allocation of the structure is not valid; it can crash an application if malloc fails. since localeconv is not specified to have failure conditions, the object needs to have static storage duration. need to review whether all the values are right or not still..
* fix mistake in length test in getlogin_rRich Felker2012-06-191-1/+1
| | | | | this was actually dangerously wrong, but presumably nobody uses this broken function anymore anyway..
* fix dummied-out fsyncRich Felker2012-06-191-2/+1
| | | | | | | if we eventually have build options, it might be nice to make an option to dummy this out again, in case anybody needs a system-wide disable for disk/ssd-thrashing, etc. that some daemons do when logging...
* fix dummied-out fdatasyncRich Felker2012-06-191-1/+1
|
* fix pointer overflow bug in floating point printfRich Felker2012-06-191-3/+3
| | | | | | | | | | | | | | | | | | | | | large precision values could cause out-of-bounds pointer arithmetic in computing the precision cutoff (used to avoid expensive long-precision arithmetic when the result will be discarded). per the C standard, this is undefined behavior. one would expect that it works anyway, and in fact it did in most real-world cases, but it was randomly (depending on aslr) crashing in i386 binaries running on x86_64 kernels. this is because linux puts the userspace stack near 4GB (instead of near 3GB) when the kernel is 64-bit, leading to the out-of-bounds pointer arithmetic overflowing past the end of address space and giving a very low pointer value, which then compared lower than a pointer it should have been higher than. the new code rearranges the arithmetic so that no overflow can occur. while this bug could crash printf with memory corruption, it's unlikely to have security impact in real-world applications since the ability to provide an extremely large field precision value under attacker-control is required to trigger the bug.
* add vhangup syscall wrapperRich Felker2012-06-191-0/+8
| | | | | | request/patch by william haddonthethird, slightly modifed to add _GNU_SOURCE feature test macro so that the compiler can verify the prototype matches.
* include declarations for new stdio_ext functions (gnulib support)Rich Felker2012-06-191-0/+5
|
* add new stdio extension functions to make gnulib happyRich Felker2012-06-191-0/+24
| | | | | this is mildly ugly, but less ugly than gnulib trying to poke at the definition of the FILE structure...
* stdio: handle file position correctly at program exitRich Felker2012-06-194-6/+40
| | | | | | | | | | | | | | | | for seekable files, posix imposed requirements on the offset of the underlying open file description after a stream is closed. this was correctly handled (as a side effect of the unconditional fflush call) when streams were explicitly closed by fclose, but was not handled correctly at program exit time, where fflush(0) was being used. the weak symbol hackery is to pull in __stdio_exit if either of __toread or __towrite is used, but avoid calling it twice so we don't have to keep extra state. the new __stdio_exit is a streamlined fflush variant that avoids performing any unnecessary operations and which never unlocks the files or open file list, so we can be sure no other threads write new data to a stream's buffer after it's already flushed.
* minor cleanup in fflushRich Felker2012-06-191-5/+1
|
* remove flush hook cruft that was never used from stdioRich Felker2012-06-193-5/+1
| | | | | | | there is no need/use for a flush hook. the write function serves this purpose already. i originally created the hook for implementing mem streams based on a mistaken reading of posix, and later realized it wasn't useful but never removed it until now.
* fix multiple iconv bugs reading utf-16/32 and wchar_tRich Felker2012-06-181-8/+8
|
* fix iconv dest utf-16: unavailable chars must be replaced; EILSEQ is wrongRich Felker2012-06-181-2/+2
|
* fix erroneous utf-16 encoding with surrogates in iconvRich Felker2012-06-181-0/+1
| | | | apparently this was never tested before.
* change stdio_ext __freading/__fwriting semantics slightlyRich Felker2012-06-171-2/+2
| | | | | | | | | | | | | | the old behavior was to only consider a stream to be "reading" or "writing" if it had buffered, unread/unwritten data. this reportedly differs from the traditional behavior of these functions, which is essentially to return true as much as possible without creating the possibility that both __freading and __fwriting could return true. gnulib expects __fwriting to return true as soon as a file is opened write-only, and possibly expects other cases that depend on the traditional behavior. and since these functions exist mostly for gnulib (does anything else use them??), they should match the expected behavior to avoid even more ugly hacks and workarounds...
* fdopen should set errno when it fails due to invalid mode stringRich Felker2012-06-171-1/+4
|
* header file fixes: multiple include guard consistency and correctnessRich Felker2012-06-1510-18/+18
| | | | | | | one file was reusing another file's macro name, and many had inconsistent underscores and application of SYS prefix, etc. patch by Szabolcs Nagy (nsz)
* direct syscall to open in __init_security needs O_LARGEFILERich Felker2012-06-141-1/+1
| | | | | it probably does not matter for /dev/null, but this should be done consistently anyway.
* reorder exit code to defer stdio flush until after dtorsRich Felker2012-06-141-4/+1
| | | | | | | | | | this is required in case dtors use stdio. also remove the old comments; one was cruft from when the code used to be using function pointers and conditional calls, and has little motivation now that we're using weak symbols. the other was just complaining about having to support dtors even though the cost was made essentially zero in the non-use case by the way it's done here.
* revert one change in time.h; no evidence BSD_SOURCE should expose these..Rich Felker2012-06-131-1/+1
|
* fix feature test macros in time.hRich Felker2012-06-131-5/+2
| | | | | stime is not _XOPEN_SOURCE, and some functions were missing with _BSD_SOURCE..
* add timegm function (inverse of gmtime), nonstandardRich Felker2012-06-132-0/+12
|
* add init_module/delete_module syscall wrappersRich Felker2012-06-131-0/+11
| | | | | | | these are not exposed publicly in any header, but the few programs that use them (modutils/kmod, etc.) are declaring the functions themselves rather than making the syscalls directly, and it doesn't really hurt to have them (same as the capset junk).
* add (currently stubbed due to stubbed strverscmp) versionsort functionRich Felker2012-06-132-0/+13
| | | | | | | | | | | based on patch by Emil Renner Berthing, with minor changes to dirent.h for LFS64 and organization of declarations this code should work unmodified once a real strverscmp is added, but I've been hesitant to add it because the GNU strverscmp behavior is harmful in a lot of cases (for instance if you have numeric filenames in hex). at some point I plan on trying to design a variant of the algorithm that behaves better on a mix of filename styles.
* add deprecated capabilities functionsRich Felker2012-06-131-0/+11
| | | | | | | these were left in glibc for binary compatibility after the public part of the interface was removed, and libcap kept using them (with its own copy of the header files) rather than just making the syscalls directly. might as well add them since they're so small...
* fix char signedness bug (arm-specific) in dynamic linkerRich Felker2012-06-091-1/+1
|
* add pthread_attr_setstack interface (and get)Rich Felker2012-06-094-10/+39
| | | | | | | | | | | | | i originally omitted these (optional, per POSIX) interfaces because i considered them backwards implementation details. however, someone later brought to my attention a fairly legitimate use case: allocating thread stacks in memory that's setup for sharing and/or fast transfer between CPU and GPU so that the thread can move data to a GPU directly from automatic-storage buffers without having to go through additional buffer copies. perhaps there are other situations in which these interfaces are useful too.
* fix scanning of "-0x" pseudo-hex float (must give negative zero)Rich Felker2012-06-081-1/+1
|
* fix signedness errors in stdint.h constant macrosRich Felker2012-06-081-2/+2
| | | | | the types of these expressions must match the integer promotions. unsigned 8- and 16-bit values promote to signed int, not unsigned int.
* fix %ls breakage in last printf fixRich Felker2012-06-081-2/+2
| | | | signedness issue kept %ls with no precision from working at all
* fix printf %ls with precision limit over-read issueRich Felker2012-06-081-2/+2
| | | | | | | printf was not printing too many characters, but it was reading one too many wchar_t elements from the input. this could lead to crashes if running off the page, or spurious failure if the conversion of the extra wchar_t resulted in EILSEQ.
* fix sysinfo, try 2. it seems to work this time.Rich Felker2012-06-071-10/+10
|
* sysinfo struct was utter nonsense; no idea where it came from.Rich Felker2012-06-071-4/+3
| | | | | this broke the busybox "free" utility (memory reporting) and possibly other things like uptime.
* fix scanf bug reading literals after width-limited fieldRich Felker2012-06-071-0/+1
| | | | | | the field width limit was not being cleared before reading the literal, causing spurious failures in scanf in cases like "%2d:" scanning "00:".
* check for ld support of -Bsymbolic-functions; disable shared if not availRich Felker2012-06-071-0/+7
| | | | | | | | | this issue affects the last gpl2 version of binutils, which some people are still using out of aversion to gpl3. musl requires -Bsymbolic-functions because it's the only way to make a libc.so that's able to operate prior to dynamic linking but that still behaves correctly with respect to global vars that may be moved to the main program via copy relocations.
* use -nostdlib in linker tests to avoid possible missing crt/lib issuesRich Felker2012-06-071-1/+1
|
* avoid linking main program in linker testsRich Felker2012-06-071-2/+2
| | | | | | it's possible that the user has provided a compiler that does not have any libc to link to, so linking a main program is a bad idea. instead, generate an empty shared library with no dependencies.
* make configure try to disable stack protectorRich Felker2012-06-061-0/+2
| | | | | | | | in theory we could support stack protector in the libc itself, and users wanting to experiment with such usage could add -fstack-protector to CFLAGS intentionally. but to avoid breakage in the default case, override broken distro-patched gcc that forces stack protector on.
* add configure check for gnu linker hash style settingRich Felker2012-06-061-1/+20
| | | | | | | | | | | some broken distro-provided toolchains have modified gcc to produce only "gnu hash" dynamic hash table by default. as this is unsupported by musl, that results in a non-working libc.so. we detect and switch this on in configure rather than hard-coding it in the Makefile because it's not supported by old binutils versions, but that might not even be relevant since old binutils versions already fail from -Bsymbolic-functions being missing. at some point I may review whether this should just go in the Makefile...
* make gcc wrapper rewrite link options rather than just extending themRich Felker2012-06-061-3/+1
| | | | | this is not tested yet, but should work to get rid of unwanted --hash-style=gnu hacks present in some distro-patched gcc versions.
* treat failure of mprotect in map_library as a fatal load failureRich Felker2012-06-061-9/+9
| | | | | | | | | | | | | | | | | | | | the error will propagate up and be printed to the user at program start time; at runtime, dlopen will just fail and leave a message for dlerror. previously, if mprotect failed, subsequent attempts to perform relocations would crash the program. this was resulting in an increasing number of false bug reports on grsec systems where rwx permission is not possible in cases where users were wrongly attempting to use non-PIC code in shared libraries. supporting that usage is in theory possible, but the x86_64 toolchain does not even support textrels, and the cost of keeping around the necessary information to handle textrels without rwx permissions is disproportionate to the benefit (which is essentially just supporting broken library setups on grsec machines). also, i unified the error-out code in map_library now that there are 3 places from which munmap might have to be called.
* fix ctype abi junk (pointer should point to 0 slot, not -128 slot)Rich Felker2012-06-053-3/+3
|
* _GNU_SOURCE is supposed to imply _LARGEFILE64_SOURCERich Felker2012-06-0415-15/+15
| | | | | | | | | this is ugly and stupid, but now that the *64 symbol names exist, a lot of broken GNU software detects them in configure, then either breaks during build due to missing off64_t definition, or attempts to compile without function declarations/prototypes. "fixing" it here is easier than telling everyone to add yet another feature test macro to their builds.
* release notes for 0.9.1 v0.9.1Rich Felker2012-06-031-0/+34
|
* fix configure build/host/target terminology usageRich Felker2012-06-031-13/+14
|
* ensure that abort always worksRich Felker2012-06-021-0/+2
| | | | | | | | | | | | | | | | Per POSIX, "The abort() function shall cause abnormal process termination to occur, unless the signal SIGABRT is being caught and the signal handler does not return." If SIGABRT is blocked or if a signal handler is installed and does return, abort is still required to cause abnormal program termination. We cannot use a_crash() to do this, since a SIGILL handler could also be installed (and might even longjmp out of the abort, not expecting to be invoked from within abort), nor can we rely on resetting the signal handler and re-raising the signal (this has race conditions in multi-threaded programs). On the other hand, SIGKILL is a perfectly safe, unblockable way to obtain abnormal program termination, and it requires no ugly loop-and-retry logic.
* add some ugly aliases for LSB ABI compatibilityRich Felker2012-06-027-0/+8
| | | | | | for some nonsensical reason, glibc's headers use inline functions that redirect some of the standard functions to ugly nonstandard names (and likewise for some of their nonstandard functions).
* increase default thread stack size to 80kRich Felker2012-06-021-1/+1
| | | | | | | | | | | | | | | | I've been looking for data that would suggest a good default, and since little has shown up, i'm doing this based on the limited data I have. the value 80k is chosen to accommodate 64k of application data (which happens to be the size of the buffer in git that made it crash without a patch to call pthread_attr_setstacksize) plus the max stack usage of most libc functions (with a few exceptions like crypt, which will be fixed soon to avoid excessive stack usage, and [n]ftw, which inherently uses a fair bit in recursive directory searching). if further evidence emerges suggesting that the default should be larger, I'll consider changing it again, but I'd like to avoid it getting too large to avoid the issues of large commit charge and rapid address space exhaustion on 32-bit machines.
* remove implementation-reserved bits when saving signal maskRich Felker2012-06-021-1/+11
| | | | | | | | this fix is necessary because a program could be started with some of the implementation-reserved signals masked (e.g. due to exec having been called from a signal handler, or from a non-musl program) and then could obtain an invalid-to-use-later sigset_t as the old/saved signal mask.