delta/glibc.git/stdlib/stdlib.h, branch fw/tst-mallocfork2

malloc: make malloc fail with requests larger than PTRDIFF_MAX (BZ#23741)

2019-04-18T20:30:06+00:00

As discussed previously on libc-alpha [1], this patch follows up the idea
and add both the __attribute_alloc_size__ on malloc functions (malloc,
calloc, realloc, reallocarray, valloc, pvalloc, and memalign) and limit
maximum requested allocation size to up PTRDIFF_MAX (taking into
consideration internal padding and alignment).

This aligns glibc with gcc expected size defined by default warning
-Walloc-size-larger-than value which warns for allocation larger than
PTRDIFF_MAX.  It also aligns with gcc expectation regarding libc and
expected size, such as described in PR#67999 [2] and previously discussed
ISO C11 issues [3] on libc-alpha.

From the RFC thread [4] and previous discussion, it seems that consensus
is only to limit such requested size for malloc functions, not the system
allocation one (mmap, sbrk, etc.).

The implementation changes checked_request2size to check for both overflow
and maximum object size up to PTRDIFF_MAX. No additional checks are done
on sysmalloc, so it can still issue mmap with values larger than
PTRDIFF_T depending on the requested size.

The __attribute_alloc_size__ is for functions that return a pointer only,
which means it cannot be applied to posix_memalign (see remarks in GCC
PR#87683 [5]). The runtimes checks to limit maximum requested allocation
size does applies to posix_memalign.

Checked on x86_64-linux-gnu and i686-linux-gnu.

[1] https://sourceware.org/ml/libc-alpha/2018-11/msg00223.html
[2] https://gcc.gnu.org/bugzilla//show_bug.cgi?id=67999
[3] https://sourceware.org/ml/libc-alpha/2011-12/msg00066.html
[4] https://sourceware.org/ml/libc-alpha/2018-11/msg00224.html
[5] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87683

	[BZ #23741]
	* malloc/hooks.c (malloc_check, realloc_check): Use
	__builtin_add_overflow on overflow check and adapt to
	checked_request2size change.
	* malloc/malloc.c (__libc_malloc, __libc_realloc, _mid_memalign,
	__libc_pvalloc, __libc_calloc, _int_memalign): Limit maximum
	allocation size to PTRDIFF_MAX.
	(REQUEST_OUT_OF_RANGE): Remove macro.
	(checked_request2size): Change to inline function and limit maximum
	requested size to PTRDIFF_MAX.
	(__libc_malloc, __libc_realloc, _int_malloc, _int_memalign): Limit
	maximum allocation size to PTRDIFF_MAX.
	(_mid_memalign): Use _int_memalign call for overflow check.
	(__libc_pvalloc): Use __builtin_add_overflow on overflow check.
	(__libc_calloc): Use __builtin_mul_overflow for overflow check and
	limit maximum requested size to PTRDIFF_MAX.
	* malloc/malloc.h (malloc, calloc, realloc, reallocarray, memalign,
	valloc, pvalloc): Add __attribute_alloc_size__.
	* stdlib/stdlib.h (malloc, realloc, reallocarray, valloc): Likewise.
	* malloc/tst-malloc-too-large.c (do_test): Add check for allocation
	larger than PTRDIFF_MAX.
	* malloc/tst-memalign.c (do_test): Disable -Walloc-size-larger-than=
	around tests of malloc with negative sizes.
	* malloc/tst-posix_memalign.c (do_test): Likewise.
	* malloc/tst-pvalloc.c (do_test): Likewise.
	* malloc/tst-valloc.c (do_test): Likewise.
	* malloc/tst-reallocarray.c (do_test): Replace call to reallocarray
	with resulting size allocation larger than PTRDIFF_MAX with
	reallocarray_nowarn.
	(reallocarray_nowarn): New function.
	* NEWS: Mention the malloc function semantic change.

Update copyright dates with scripts/update-copyrights.

2019-01-01T00:11:28+00:00

	* All files with FSF copyright notices: Update copyright dates
	using scripts/update-copyrights.
	* locale/programs/charmap-kw.h: Regenerated.
	* locale/programs/locfile-kw.h: Likewise.

reallocarray: Declare under _DEFAULT_SOURCE

2018-08-30T12:14:53+00:00

Initially, this function was restricted to _GNU_SOURCE, but experience
shows that compatibility with existing build systems is improved if we
declare it under _DEFAULT_SOURCE as well.

Disallow use of DES encryption functions in new programs.

2018-06-29T14:53:18+00:00

The functions encrypt, setkey, encrypt_r, setkey_r, cbc_crypt,
ecb_crypt, and des_setparity should not be used in new programs,
because they use the DES block cipher, which is unacceptably weak by
modern standards.  Demote all of them to compatibility symbols, and
remove their prototypes from installed headers.  cbc_crypt, ecb_crypt,
and des_setparity were already compat symbols when glibc was
configured with --disable-obsolete-rpc.

POSIX requires encrypt and setkey to be available when _XOPEN_CRYPT
is defined, so this change also removes the definition of X_OPEN_CRYPT
from .

The entire "DES Encryption" section is dropped from the manual, as is
the mention of AUTH_DES and FIPS 140-2 in the introduction to
crypt.texi.  The documentation of 'memfrob' cross-referenced the DES
Encryption section, which is replaced by a hyperlink to libgcrypt, and
while I was in there I spruced up the actual documentation of
'memfrob' and 'strfry' a little.  It's still fairly jokey, because
those functions _are_ jokes, but they do also have real use cases, so
people trying to use them for real should have all the information
they need.

DES-based authentication for Sun RPC is also insecure and should be
deprecated or even removed, but maybe that can be left as TI-RPC's
problem.

Update copyright dates with scripts/update-copyrights.

2018-01-01T00:32:25+00:00

	* All files with FSF copyright notices: Update copyright dates
	using scripts/update-copyrights.
	* locale/programs/charmap-kw.h: Regenerated.
	* locale/programs/locfile-kw.h: Likewise.

Declare strtof, strfromf functions for more _FloatN, _FloatNx types.

2017-11-03T17:10:39+00:00

Continuing the preparation for additional _FloatN / _FloatNx type
support, this patch arranges for  to declare strtof and
strfromf functions for all such types, similarly to the declarations
already present for _Float128.

Tested for x86_64.

	* stdlib/stdlib.h
	[__HAVE_FLOAT16 && __GLIBC_USE (IEC_60559_TYPES_EXT)] (strtof16):
	Declare.
	[__HAVE_FLOAT32 && __GLIBC_USE (IEC_60559_TYPES_EXT)] (strtof32):
	Likewise.
	[__HAVE_FLOAT64 && __GLIBC_USE (IEC_60559_TYPES_EXT)] (strtof64):
	Likewise.
	[__HAVE_FLOAT32X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strtof32x): Likewise.
	[__HAVE_FLOAT64X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strtof64x): Likewise.
	[__HAVE_FLOAT128X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strtof128x): Likewise.
	[__HAVE_FLOAT16 && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf16): Likewise.
	[__HAVE_FLOAT32 && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf32): Likewise.
	[__HAVE_FLOAT64 && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf64): Likewise.
	[__HAVE_FLOAT32X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf32x): Likewise.
	[__HAVE_FLOAT64X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf64x): Likewise.
	[__HAVE_FLOAT128X && __GLIBC_USE (IEC_60559_TYPES_EXT)]
	(strfromf128x): Likewise.
	[__USE_GNU && __HAVE_FLOAT16] (strtof16_l): Likewise.
	[__USE_GNU && __HAVE_FLOAT32] (strtof32_l): Likewise.
	[__USE_GNU && __HAVE_FLOAT64] (strtof64_l): Likewise.
	[__USE_GNU && __HAVE_FLOAT32X] (strtof32x_l): Likewise.
	[__USE_GNU && __HAVE_FLOAT64X] (strtof64x_l): Likewise.
	[__USE_GNU && __HAVE_FLOAT128X] (strtof128x_l): Likewise.

Use locale_t, not __locale_t, throughout glibc

2017-06-21T00:30:06+00:00

 is specified to define locale_t in POSIX.1-2008, and so are
all of the headers that define functions that take locale_t arguments.
Under _GNU_SOURCE, the additional headers that define such functions
have also always defined locale_t.  Therefore, there is no need to use
__locale_t in public function prototypes, nor in any internal code.

	* ctype/ctype-c99_l.c, ctype/ctype.h, ctype/ctype_l.c
	* include/monetary.h, include/stdlib.h, include/time.h
	* include/wchar.h, locale/duplocale.c, locale/freelocale.c
	* locale/global-locale.c, locale/langinfo.h, locale/locale.h
	* locale/localeinfo.h, locale/newlocale.c
	* locale/nl_langinfo_l.c, locale/uselocale.c
	* localedata/bug-usesetlocale.c, localedata/tst-xlocale2.c
	* stdio-common/vfscanf.c, stdlib/monetary.h, stdlib/stdlib.h
	* stdlib/strfmon_l.c, stdlib/strtod_l.c, stdlib/strtof_l.c
	* stdlib/strtol.c, stdlib/strtol_l.c, stdlib/strtold_l.c
	* stdlib/strtoll_l.c, stdlib/strtoul_l.c, stdlib/strtoull_l.c
	* string/strcasecmp.c, string/strcoll_l.c, string/string.h
	* string/strings.h, string/strncase.c, string/strxfrm_l.c
	* sysdeps/ieee754/float128/strtof128_l.c
	* sysdeps/ieee754/float128/wcstof128.c
	* sysdeps/ieee754/float128/wcstof128_l.c
	* sysdeps/ieee754/ldbl-128ibm/strtold_l.c
	* sysdeps/ieee754/ldbl-64-128/strtold_l.c
	* sysdeps/ieee754/ldbl-opt/nldbl-compat.c
	* sysdeps/ieee754/ldbl-opt/nldbl-strfmon_l.c
	* sysdeps/ieee754/ldbl-opt/nldbl-strtold_l.c
	* sysdeps/ieee754/ldbl-opt/nldbl-wcstold_l.c
	* sysdeps/powerpc/powerpc32/power7/strcasecmp.S
	* sysdeps/powerpc/powerpc64/power7/strcasecmp.S
	* sysdeps/x86_64/strcasecmp_l-nonascii.c
	* sysdeps/x86_64/strncase_l-nonascii.c, time/strftime_l.c
	* time/strptime_l.c, time/time.h, wcsmbs/mbsrtowcs_l.c
	* wcsmbs/wchar.h, wcsmbs/wcscasecmp.c, wcsmbs/wcsncase.c
	* wcsmbs/wcstod.c, wcsmbs/wcstod_l.c, wcsmbs/wcstof.c
	* wcsmbs/wcstof_l.c, wcsmbs/wcstol_l.c, wcsmbs/wcstold.c
	* wcsmbs/wcstold_l.c, wcsmbs/wcstoll_l.c, wcsmbs/wcstoul_l.c
	* wcsmbs/wcstoull_l.c, wctype/iswctype_l.c
	* wctype/towctrans_l.c, wctype/wcfuncs_l.c
	* wctype/wctrans_l.c, wctype/wctype.h, wctype/wctype_l.c:
	Change all uses of __locale_t to locale_t.

Rename xlocale.h to bits/types/__locale_t.h.

2017-06-21T00:28:11+00:00

xlocale.h is already a single-type micro-header, defining struct
__locale_struct and the typedefs __locale_t and locale_t.  This patch
brings it into the bits/types/ scheme: there are now
bits/types/__locale_t.h which defines only __locale_struct and
__locale_t, and bits/types/locale_t.h which defines locale_t as well
as the other two.  None of *our* headers need __locale_t.h, but it
appears to me that libstdc++ could make use of it.

There are a lot of external uses of xlocale.h, but all the uses I
checked had an autoconf test or equivalent for its existence.  It has
never been available from other C libraries, and it has always
contained a comment reading "This file is not standardized, don't rely
on it, it can go away without warning" so I think dropping it is
pretty safe.

I also took the opportunity to clean up comments in various public
header files that still talk about the *_l interfaces as though they
were completely nonstandard.  There are a few of them, notably the
strtoX_l and wcstoX_l families, that haven't been standardized, but
the bulk are in POSIX.1-2008.

        * locale/xlocale.h: Rename to...
	* locale/bits/types/__locale_t.h: ...here.  Adjust commentary.
	Only define struct __locale_struct and __locale_t, not locale_t.
        * locale/bits/types/locale_t.h: New file; define locale_t here.
        * locale/Makefile (headers): Update to match.

        * include/xlocale.h: Delete wrapper.
        * include/bits/types/__locale_t.h: New wrapper.
        * include/bits/types/locale_t.h: New wrapper.

        * ctype/ctype.h, include/printf.h, include/time.h
        * locale/langinfo.h, locale/locale.h, stdlib/monetary.h
        * stdlib/stdlib.h, string/string.h, string/strings.h, time/time.h
        * wcsmbs/wchar.h, wctype/wctype.h: Use bits/types/locale_t.h.
        Correct outdated comments regarding the standardization status of
        the functions that take locale_t arguments.

        * stdlib/strtod_l.c, stdlib/strtof_l.c, stdlib/strtol_l.c
        * stdlib/strtold_l.c, stdlib/strtoul_l.c, stdlib/strtoull_l.c
        * sysdeps/ieee754/ldbl-128ibm/strtold_l.c
        * sysdeps/ieee754/ldbl-64-128/strtold_l.c
        * wcsmbs/wcstod.c, wcsmbs/wcstod_l.c, wcsmbs/wcstof.c
        * wcsmbs/wcstof_l.c, wcsmbs/wcstold.c, wcsmbs/wcstold_l.c:
        Don't include xlocale.h. If necessary, include locale.h instead.

        * stdlib/strtold_l.c: Unconditionally include wchar.h.

float128: Add strtof128, wcstof128, and related functions.

2017-06-12T17:48:53+00:00

The implementations are contained with sysdeps/ieee754/float128 as
they are only built when _Float128 is enabled within libc/m.

	* include/gmp.h (__mpn_construct_float128): New declaration.
	* include/stdlib.h: Include bits/floatn.h for _Float128 tests.
	(__strtof128_l): New declaration.
	(__strtof128_nan): Likewise.
	(__wcstof128_nan): Likewise.
	(__strtof128_internal): Likewise.
	(____strtof128_l_internal): Likewise.
	* include/wchar.h: Include bits/floatn.h for _Float128 tests.
	(__wcstof128_l): New declaration.
	(__wcstof128_internal): Likewise.

	* stdlib/Makefile (bug-strtod2): Link libm too.

	* stdlib/stdlib.h (strtof128): New declaration.
	(strtof128_l): Likewise.

	* stdlib/tst-strtod-nan-locale-main.c: Updated to use
	tst-strtod.h macros to ensure float128 gets tested too.

	* stdlib/tst-strtod-round-skeleton.c (CHOOSE_f128): New macro.

	* stdlib/tst-strtod.h: Include bits/floatn.h for _Float128
	tests.
	(IF_FLOAT128): New macro.
	(GEN_TEST_STRTOD): Update to optionally include _Float128 in
	the tests.
	(STRTOD_TEST_FOREACH): Likewise.

	* sysdeps/ieee754/float128/Makefile: Insert new strtof128 and
	wcstof128 functions into libc.

	* sysdeps/ieee754/float128/Versions: Add exports for the above
	new functions.

	* sysdeps/ieee754/float128/mpn2float128.c: New file.
	* sysdeps/ieee754/float128/strtod_nan_float128.h: New file.
	* sysdeps/ieee754/float128/strtof128.c: New file.
	* sysdeps/ieee754/float128/strtof128_l.c: New file.
	* sysdeps/ieee754/float128/strtof128_nan.c: New file.
	* sysdeps/ieee754/float128/wcstof128.c: New file.
	* sysdeps/ieee754/float128/wcstof128_l.c: New file.
	* sysdeps/ieee754/float128/wcstof128_nan.c: New fike.
	* wcsmbs/Makefile: (CFLAGS-wcstof128.c): Append strtox-CFLAGS.
	(CFLAGS-wcstof128_l): Likewise.

	* wcsmbs/wchar.h: Include bits/floatn.h for _Float128 tests.
	(wcstof128): New declaration.
	(wcstof128_l): Likewise.

float128: Add strfromf128

2017-06-07T20:08:21+00:00

Add strfromf128 to stdlib when _Float128 support is enabled.

	* stdio-common/printf-parsemb.c (__parse_one_specmb): Initialize
	spec->info.is_binary128 to zero.
	* stdio-common/printf.h (printf_info): Add new member is_binary128
	to indicate that the number being converted to string is compatible
	with the IEC 60559 binary128 format.
	* stdio-common/printf_fp.c (__printf_fp_l): Add code to deal with
	_Float128 numbers.
	* stdio-common/printf_fphex.c: Include ieee754_float128.h and
	ldbl-128/printf_fphex_macros.h
	(__printf_fphex): Add code to deal with _Float128 numbers.
	* stdio-common/printf_size.c (__printf_size): Likewise.
	* stdio-common/vfprintf.c (process_arg): Initialize member
	info.is_binary128 to zero.
	* stdlib/fpioconst.h (FLT128_MAX_10_EXP_LOG): New macro.
	* stdlib/stdlib.h: Include bits/floatn.h for _Float128 support.
	(strfromf128): New declaration.
	* stdlib/strfrom-skeleton.c (STRFROM): Set member info.is_binary128
	to one.
	* sysdeps/ieee754/float128/Makefile: Add strfromf128.
	* sysdeps/ieee754/float128/Versions: Likewise.
	* sysdeps/ieee754/float128/strfromf128.c: New file.