With fortification enabled, few function calls return result need to be
checked, has they get the __wur macro enabled.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
With fortification enabled, few function calls return result need to be
checked, has they get the __wur macro enabled.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Without these fixes, the first three included tests segfault (on a
NULL dereference); the fourth aborts on an assertion, which is itself
unnecessary.
Signed-off-by: Julian Squires <julian@cipht.net>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The Z modifier is a nonstandard synonymn for z (that predates z
itself) and compiler might issue an warning for in invalid
conversion specifier.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
I used these shell commands:
../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright
(cd ../glibc && git commit -am"[this commit message]")
and then ignored the output, which consisted lines saying "FOO: warning:
copyright statement not found" for each of 7061 files FOO.
I then removed trailing white space from math/tgmath.h,
support/tst-support-open-dev-null-range.c, and
sysdeps/x86_64/multiarch/strlen-vec.S, to work around the following
obscure pre-commit check failure diagnostics from Savannah. I don't
know why I run into these diagnostics whereas others evidently do not.
remote: *** 912-#endif
remote: *** 913:
remote: *** 914-
remote: *** error: lines with trailing whitespace found
...
remote: *** error: sysdeps/unix/sysv/linux/statx_cp.c: trailing lines
I used these shell commands:
../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright
(cd ../glibc && git commit -am"[this commit message]")
and then ignored the output, which consisted lines saying "FOO: warning:
copyright statement not found" for each of 6694 files FOO.
I then removed trailing white space from benchtests/bench-pthread-locks.c
and iconvdata/tst-iconv-big5-hkscs-to-2ucs4.c, to work around this
diagnostic from Savannah:
remote: *** pre-commit check failed ...
remote: *** error: lines with trailing whitespace found
remote: error: hook declined to update refs/heads/master
This patch replaces the fork+exec by posix_spawn on wordexp, which
allows a better scability on Linux and simplifies the thread
cancellation handling.
The only change which can not be implemented with posix_spawn the
/dev/null check to certify it is indeed the expected device. I am
not sure how effetive this check is since /dev/null tampering means
something very wrong with the system and this is the least of the
issues. My view is the tests is really out of the place and the
hardening provided is minimum.
If the idea is still to provide such check, I think a possibilty
would be to open /dev/null, check it, add a dup2 file action, and
close the file descriptor.
Checked on powerpc64le-linux-gnu and x86_64-linux-gnu.
* include/spawn.h (__posix_spawn_file_actions_addopen): New
prototype.
* posix/spawn_faction_addopen.c (posix_spawn_file_actions_addopen):
Add internal alias.
* posix/wordexp.c (create_environment, free_environment): New
functions.
(exec_comm_child, exec_comm): Use posix_spawn instead of fork+exec.
* posix/wordexp-test.c: Use libsupport.
Once wordexp switches to posix_spawn, testing for command execution
based on fork handlers will not work anymore. Therefore, move these
subtests into a new test, posix/tst-wordexp-nocmd, which uses a
different form of command execution detection, based on PID
namespaces.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
posix/wordexp-test.c used libc-internal.h for PTR_ALIGN_DOWN; similar
to what was done with libc-diag.h, I have split the definitions of
cast_to_integer, ALIGN_UP, ALIGN_DOWN, PTR_ALIGN_UP, and PTR_ALIGN_DOWN
to a new header, libc-pointer-arith.h.
It then occurred to me that the remaining declarations in libc-internal.h
are mostly to do with early initialization, and probably most of the
files including it, even in the core code, don't need it anymore. Indeed,
only 19 files actually need what remains of libc-internal.h. 23 others
need libc-diag.h instead, and 12 need libc-pointer-arith.h instead.
No file needs more than one of them, and 16 don't need any of them!
So, with this patch, libc-internal.h stops including libc-diag.h as
well as losing the pointer arithmetic macros, and all including files
are adjusted.
* include/libc-pointer-arith.h: New file. Define
cast_to_integer, ALIGN_UP, ALIGN_DOWN, PTR_ALIGN_UP, and
PTR_ALIGN_DOWN here.
* include/libc-internal.h: Definitions of above macros
moved from here. Don't include libc-diag.h anymore either.
* posix/wordexp-test.c: Include stdint.h and libc-pointer-arith.h.
Don't include libc-internal.h.
* debug/pcprofile.c, elf/dl-tunables.c, elf/soinit.c, io/openat.c
* io/openat64.c, misc/ptrace.c, nptl/pthread_clock_gettime.c
* nptl/pthread_clock_settime.c, nptl/pthread_cond_common.c
* string/strcoll_l.c, sysdeps/nacl/brk.c
* sysdeps/unix/clock_settime.c
* sysdeps/unix/sysv/linux/i386/get_clockfreq.c
* sysdeps/unix/sysv/linux/ia64/get_clockfreq.c
* sysdeps/unix/sysv/linux/powerpc/get_clockfreq.c
* sysdeps/unix/sysv/linux/sparc/sparc64/get_clockfreq.c:
Don't include libc-internal.h.
* elf/get-dynamic-info.h, iconv/loop.c
* iconvdata/iso-2022-cn-ext.c, locale/weight.h, locale/weightwc.h
* misc/reboot.c, nis/nis_table.c, nptl_db/thread_dbP.h
* nscd/connections.c, resolv/res_send.c, soft-fp/fmadf4.c
* soft-fp/fmasf4.c, soft-fp/fmatf4.c, stdio-common/vfscanf.c
* sysdeps/ieee754/dbl-64/e_lgamma_r.c
* sysdeps/ieee754/dbl-64/k_rem_pio2.c
* sysdeps/ieee754/flt-32/e_lgammaf_r.c
* sysdeps/ieee754/flt-32/k_rem_pio2f.c
* sysdeps/ieee754/ldbl-128/k_tanl.c
* sysdeps/ieee754/ldbl-128ibm/k_tanl.c
* sysdeps/ieee754/ldbl-96/e_lgammal_r.c
* sysdeps/ieee754/ldbl-96/k_tanl.c, sysdeps/nptl/futex-internal.h:
Include libc-diag.h instead of libc-internal.h.
* elf/dl-load.c, elf/dl-reloc.c, locale/programs/locarchive.c
* nptl/nptl-init.c, string/strcspn.c, string/strspn.c
* malloc/malloc.c, sysdeps/i386/nptl/tls.h
* sysdeps/nacl/dl-map-segments.h, sysdeps/x86_64/atomic-machine.h
* sysdeps/unix/sysv/linux/spawni.c
* sysdeps/x86_64/nptl/tls.h:
Include libc-pointer-arith.h instead of libc-internal.h.
* elf/get-dynamic-info.h, sysdeps/nacl/dl-map-segments.h
* sysdeps/x86_64/atomic-machine.h:
Add multiple include guard.
The function wordexp() fails to properly handle the WRDE_NOCMD
flag when processing arithmetic inputs in the form of "$((... ``))"
where "..." can be anything valid. The backticks in the arithmetic
epxression are evaluated by in a shell even if WRDE_NOCMD forbade
command substitution. This allows an attacker to attempt to pass
dangerous commands via constructs of the above form, and bypass
the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
in exec_comm(), the only place that can execute a shell. All other
checks for WRDE_NOCMD are superfluous and removed.
We expand the testsuite and add 3 new regression tests of roughly
the same form but with a couple of nested levels.
On top of the 3 new tests we add fork validation to the WRDE_NOCMD
testing. If any forks are detected during the execution of a wordexp()
call with WRDE_NOCMD, the test is marked as failed. This is slightly
heuristic since vfork might be used in the future, but it provides a
higher level of assurance that no shells were executed as part of
command substitution with WRDE_NOCMD in effect. In addition it doesn't
require libpthread or libdl, instead we use the public implementation
namespace function __register_atfork (already part of the public ABI
for libpthread).
Tested on x86_64 with no regressions.
2003-09-17 Ulrich Drepper <drepper@redhat.com>
* sysdeps/generic/wordexp.c (eval_expr_val): Use strtol since we
have to recognize octal and hexadecimal numbers as well. Simplify
function, signs are handled in strtol.
* posix/wordexp-test.c: Add tests for octal and hexadecimal
numbers in arithmetic expressions.
2001-07-06 Paul Eggert <eggert@twinsun.com>
* manual/argp.texi: Remove ignored LGPL copyright notice; it's
not appropriate for documentation anyway.
* manual/libc-texinfo.sh: "Library General Public License" ->
"Lesser General Public License".
2001-07-06 Andreas Jaeger <aj@suse.de>
* All files under GPL/LGPL version 2: Place under LGPL version
2.1.
2000-02-24 Geoff Clare <gwc@unisoft.com>
* posix/wordexp-test.c: Updated to include tests for all the
problems fixed by the last changes to wordexp.c.
* posix/wordexp.c: Use $HOME to expand ~ (if set); fix off-by-one
error in expansion of ~user; correct handling of WRDE_APPEND and
WRDE_DOOFFS; return WRDE_SYNTAX for syntax errors in command
substitutions; limit removal of newlines to those that are
really `trailing'; allow for current word to continue after
a command substitution (e.g. "a$(echo b)c"); restore pwordexp
members properly on error returns.
1999-11-05 Ulrich Drepper <drepper@cygnus.com>
* sysdeps/unix/sysv/linux/bits/resource.h (RLIM_INFINITY): Adjust
for kernel changes.
* sysdeps/unix/sysv/linux/bits/types.h (__rlim_t, __rlim64_t): Make
unsigned.
1999-10-04 Tim Waugh <twaugh@redhat.com>
* posix/wordexp-test.c: More tests.
* posix/wordexp.c (wordexp): Explicit null words should be kept.
1999-11-04 Shinya Hanataka <hanataka@abyss.rim.or.jp>
* locale/programs/linereader.c (get_string): Correct type of buf2
variable.
* locale/programs/ld-ctype.c (ctype_output): Store index correctly
for _NL_CTYPE_INDIGITS_MB_LEN, _NL_CTYPE_INDIGITS_WC_LEN,
_NL_CTYPE_INDIGITS*_MB, _NL_CTYPE_OUTDIGIT*_MB, and
_NL_CTYPE_OUTDIGIT*_WC.
(allocate_arrays): Completely initialize mapping tables.
* locale/programs/ld-time.c (time_startup): We need the wide car
string.
(time_finish): Correct handling of era.
(time_output): Fix a few array indeces.
(time_read): Pass the repertoire map to lr_token.
1999-07-02 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Revert bogus 'unset IFS' change. It
doesn't belong in the tests, but in the wordexp implementation.
* posix/wordexp.c (exec_comm): Unset IFS so that subshells don't
split fields.
1999-04-12 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: In field-splitting test cases where
subshells were involved, unset IFS first: some shells (ash) use
IFS even when no expansion is performed.
1999-04-11 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp.c (wordexp): Fix a leak when an invalid character
is seen, as well as fixing semantics. Don't reset the word count
to zero when an invalid character is seen, but leave it as it was
(this makes a difference with WRDE_APPEND).
* posix/wordexp-test.c: More test cases.
* posix/wordexp.c (parse_param): In words like ${var#pattern},
always expand pattern when it is needed. Also, handle quoting in
pattern properly.
1998-09-17 19:34 Ulrich Drepper <drepper@cygnus.com>
* sysdeps/unix/sysv/sysv4/bits/utsname.h: Fix typo.
Patch by John Tobey <jtobey@banta-im.com>.
1998-09-17 Mark Kettenis <kettenis@phys.uva.nl>
* login/pty-internal.h: Removed. Moved constants related to the
`grantpt' helper program protocol to ...
* login/pty-private.h: ... here. New file.
* sysdeps/unix/sysv/linux/ptsname.c (ptsname): Reimplementation
to make the function work with kernels >= 2.1.115.
* sysdeps/unix/sysv/linux/getpt.c (getpt): Reimplement to call BSD
version if using the cloning device fails.
* sysdeps/unix/sysv/linux/grantpt.c: New file.
* sysdeps/unix/sysv/linux/unlockpt.c: General cleanup.
* sysdeps/unix/bsd/getpt.c (__getpt): Largely rewritten to allow
use by Linux specific code.
* sysdeps/unix/bsd/unlockpt.c: General cleanup.
* sysdeps/unix/grantpt.c: Largely rewritten. (pts_name): New
function. (grantpt): Use pts_name, check group and permission
mode in addition to owner. Try to set the owner, group and
permission mode first without invoking the helper program.
* login/programs/pt_chown.c: Largely rewritten. Add argp and
internationalization support. Use symbolic constants instead of
hardwired numbers for permission mode.
* sysdeps/unix/bsd/ptsname.c: New file.
1998-09-17 22:04 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Undo last change.
* posix/wordexp.c: Undo last change.
1998-09-16 00:47 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: If expansion or substitution occurs
anywhere in a word, the entire word is subject to field-splitting.
* posix/wordexp.c (parse_glob): Look for end of word instead of
end of field when deciding what to glob.
(field_split_word): New function, now the only place where
field-splitting is performed.
(parse_dollars): New parameter - tell the caller if
field-splitting should be performed on this word.
* posix/wordexp-test.c (testit): Only call wordfree if wordexp
succeeded (or failed with WRDE_NOSPACE).
1998-09-15 19:53 1998 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp.c (wordexp): Don't convert IFS characters to
blanks.
* posix/wordexp-test.c: Words not the result of expansion or
substitution should remain unchanged.
1998-09-14 22:46 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Chet Ramey confirmed that bash's behaviour
for field-splitting 🔤 is correct, and that two fields should
result. Revert tests to reflect this.
* posix/wordexp.c (w_emptyword): Remove function.
(exec_comm): Don't use w_emptyword.
(parse_param): Likewise.
1998-09-13 14:53 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Field-splitting '🔤' with IFS=: should
yield three fields, not two. Test both parameter expansion and
command substitution for correct field-splitting behaviour.
* posix/wordexp.c (w_emptyword): New function.
(parse_param): Use it.
(exec_comm): Likewise, for consistency with the way parse_param
splits fields.
(parse_param): Fix some memory leaks.
1998-09-12 01:09 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Fix wrong tests. Add new tests.
* posix/wordexp.c (wordexp): Perform word-splitting instead of
field-splitting here.
(wordexp): If out of memory mid-word, free the word (but still
leave pwordexp alone for caller to see).
(parse_param): Allow for zero-length fields (smarter checking of
memory allocation failure).
(w_addword): Convert NULL words to "".
(wordexp): Convert left-over IFS characters to blanks (like bash).
1998-05-15 14:36 Ulrich Drepper <drepper@cygnus.com>
* posix/wordexp-test.c: Avoid duplicate messages.
* sysdeps/generic/setenv.c: Use __tfind and __tsearch, not tfind and
tsearch. Correctly interpret values returned by those functions.
(unsetenv): Store pointer to string, not pointer to string pointer.
* time/tzfile.c (__tzfile_compute): Take new arguments. Store
DST information and offset in them.
* time/tzset.c (__tz_convert): Pass extra parameters to
__tzfile_compute. Compute equivalent values for use of tz_rules.
1998-05-15 00:49:11 Zack Weinberg <zack@rabi.phys.columbia.edu>
* iconvdata/Makefile (gen-8bit-table): Use move-if-change and
stamp files to avoid unnecessary recompilation.
(gen-8bit-gap-table): Likewise.
(move-if-change): New variable.
(all generated .h rules): Change to be .stmp rules.
(%.h): New rule; depend on %.stmp; no commands.
(distribute): Add gen-8bit.sh, gen-8bit-gap.sh,
gen-8bit-gap-1.sh.
1998-05-15 01:09 Zack Weinberg <zack@rabi.phys.columbia.edu>
* Makerules (libc-map): Deleted.
(load-map-file): Set to the appropriate compiler switch, not
just the file name. If libfoo-map is not set, look for a
libfoo.map in the current directory and $(..).
(map-file): New variable, contains just the mapfile name.
(build-shlib): Adjust for new value of load-map-file.
(libc.so): Correct dependencies.
* extra-lib.mk: Correct shlib dependencies since libfoo-map
may not be set anymore.
* elf/Makefile: Set ld-map to $(..)libc.map, not $(libc-map).
Delete libdl-map. Tweak ld.so link rule to work with changed
variable settings in Makerules.
* iconvdata/Makefile: Tweak build-module to work with changed
variable settings in Makerules.
* db/Makefile: Delete libdb-map.
* hesiod/Makefile: Delete libnss_hesiod-map.
* linuxthreads/Makefile: Delete libpthread-map.
* locale/Makefile: Delete libBrokenLocale-map.
* login/Makefile: Delete libutil-map.
* math/Makefile: Delete libm-map.
* md5-crypt/Makefile: Delete libcrypt-map.
* nis/Makefile: Delete libnsl-map, libnss_nis-map,
libnss_nisplus-map, and libnss_compat-map.
* nss/Makefile: Delete libnss_files-map, libnss_db-map, and
libnss_ldap-map.
* resolv/Makefile: Delete libresolv-map and libnss_dns-map.
* rt/Makefile: Delete librt-map.
1998-05-15 01:06 Zack Weinberg <zack@rabi.phys.columbia.edu>
* configure.in: Instead of substituting `yes' or `no' for whether
--no-whole-archive is available, set @no_whole_archive@ to the
appropriate gcc switch or the empty string. Likewise for
-fno-exceptions.
* config.make.in: Replace have-no-whole-archive with
no-whole-archive and have-no-exceptions with no-exceptions.
* Makerules: Delete stanzas setting no-whole-archive and
no-exceptions.
* sunrpc/Makefile: Use move-if-change to update generated .h
and .c files.
1998-05-13 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* wcsmbs/wcsmbsload.c (extract_charset_name): Use strcspn instead
of strchr loop.
1998-05-15 Andreas Jaeger <aj@arthur.rhein-neckar.de>
* time/tzfile.c (__tzfile_read): Remove unused variable info.
(__tzfile_compute): Likewise.
1998-05-15 Andreas Jaeger <aj@arthur.rhein-neckar.de>
* sysdeps/unix/sysv/linux/bits/socket.h (AF_SNA,PF_SNA): Add new
defines from Linux 2.1.102.
1998-04-04 Andreas Jaeger <aj@arthur.rhein-neckar.de>
* resolv/Makefile: Include ../Makeconfig - needed for building
static NSS module.
1998-04-04 Andreas Jaeger <aj@arthur.rhein-neckar.de>
* hesiod/Makefile (libnss_hesiod-inhibit-o): Remove condition for
static-nss since we don't want hesiod in the static NSS.
* nss/Makefile: Build only nss_files as static.
* nss/function.def: Remove support for service db.
1998-04-04 09:44 H.J. Lu <hjl@gnu.org>
* Makeconfig (CPPFLAGS-.oS): Add -DPIC.
1998-04-04 18:29 Tim Waugh <tim@cyberelk.demon.co.uk>
* posix/wordexp-test.c: Make IFS per test-case.
