Eric Blake [Fri, 1 Jul 2011 14:20:06 +0000 (08:20 -0600)]
snprintf: guarantee %1$d, for libintl
Newer mingw (but not yet mingw64) provides two flavors of
snprintf: _snprintf defers straight to msvcrt, which has broken
return value and does not understand %llu or %zu; and snprintf,
which fixes these two bugs but does not understand %1$s.
Libintl specifically favors _snprintf, with broken return value,
even when compiled on mingw with a fixed snprintf, because the
only behavior which it wants to fix is %1$s handling. But this
means that the replacement libintl_snprintf has a broken return.
If one uses the 'snprintf-posix' module, then the gnulib
replacement kicks in, and does everything that libintl needs, so
on mingw, <libintl.h> specifically avoids overriding snprintf if
it detected that gnulib replaced snprintf. However, if one only
uses the 'snprintf' module and also uses libintl, this means
there are two problems:
1. The gnulib 'snprintf' module does not replace the mingw
snprintf function, because it has proper return values, while the
libintl.h header knows that %1$d is broken so snprintf must be
replaced, with the end result that the application gets the
libintl replacement snprintf with broken return values in spite
of the gnulib module.
2. Conversely, if the application did '#define snprintf snprintf',
that would be enough to make libintl avoid installing its own
replacement because libintl would see the define as a sign that
gnulib is happy with snprintf. However, if gnulib didn't enforce
%1$s, users can end up with translated strings that break when
passed to the native snprintf.
Happily, the gnulib snprintf replacement already guarantees %1$s
without needing any further preprocessor macros defined, and
without dragging in the LGPLv3+ bulk of snprintf-posix, so the
problem boils down to guaranteeing that gnulib will replace
snprintf if it lacks %1$s support. Basically, gnulib must
replace snprintf under all the same conditions as libintl, as
well as any other conditions of its own, if the libintl trick
of deferring to gnulib is to work correctly.
Jim Meyering [Tue, 5 Jul 2011 08:32:30 +0000 (10:32 +0200)]
maint: exempt stdio-read.c and stdio-write.c from the cppi check
* Makefile (sc_cpp_indent_check): Exempt stdio-read.c and stdio-write.c
per Bruno's request, to accommodate this idiom (no space after "#")
even when the function is inside an #if block:
char *
gets (char *s)
#undef gets
{
...
}
Jim Meyering [Sun, 3 Jul 2011 21:00:15 +0000 (23:00 +0200)]
maint.mk: correct omissions in prohibit_argmatch_without_use check
This rule would mistakenly report that argmatch.h is included without
use even when both the argmatch and invalid_arg macro were used.
* top/maint.mk (sc_prohibit_argmatch_without_use): Also detect uses
of argmatch and invalid_arg.
Bruno Haible [Sun, 3 Jul 2011 11:36:43 +0000 (13:36 +0200)]
Comments about EINTR.
* lib/safe-read.h: Explain the purpose of this module.
* lib/safe-write.h: Likewise.
* doc/posix-functions/read.texi: Mention EINTR and the 'safe-read'
module.
* doc/posix-functions/write.texi: Mention EINTR and the 'safe-write'
module.
Reported by Ralf Wildenhues <Ralf.Wildenhues@gmx.de>.
Paul Eggert [Thu, 30 Jun 2011 22:23:29 +0000 (15:23 -0700)]
xnanosleep: Rewrite to use new dtotimespec module.
It has the conversion code that used to be in xnanosleep.
* lib/xnanosleep.c: Do not include limits.h, stdbool.h, stdio.h,
assert.h, sys/types.h, or intprops.h. Include timespec.h instead.
(TIME_T_MAX): Remove.
(xnanosleep): Rewrite in terms of dtotimespec.
* modules/xnanosleep (Depends-on): Add dtotimespec.
Remove intprops, stdbool.
Paul Eggert [Thu, 30 Jun 2011 17:58:24 +0000 (10:58 -0700)]
sys_select: don't depend on sys_socket
This is so that Emacs doesn't have to drag in m4/sockpfaf.m4 etc; see
<http://lists.gnu.org/archive/html/bug-gnulib/2011-06/msg00358.html>.
This fix works on GNU and GNU-like platforms, but has not been tested
on native Windows.
* lib/sys_select.in.h: Include <sys/socket.h> only if native Windows.
* m4/sys_select_h.m4 (gl_HEADER_SYS_SELECT): Do not require
gl_HEADER_SYS_SOCKET.
* modules/sys_select (Files): Add m4/sys_socket_h.m4, for
gl_PREREQ_SYS_H_WINSOCK2.
Eric Blake [Wed, 29 Jun 2011 21:46:50 +0000 (15:46 -0600)]
pipe, pipe2: don't corrupt fd on error
I noticed a potential subtle double-close bug in libvirt. There,
a common idiom is to initialize an int fd[2]={-1,-1}, then have
multiple error paths goto common cleanup code. In the cleanup
code, the fds are closed if they are not already -1; this works
if the error label is reached before the pipe call, or after
pipe succeeds, but if it was the pipe call itself that jumped
to the error label, then it is relying on failed pipe() not
altering the values already in fd array prior to the failure.
Our pipe2 replacement violated this assumption, and could leave
a non-negative value in the array, which in turn would let
libvirt close an already-closed fd, possibly nuking an unrelated
fd opened by another thread that happened to get the same value.
As a result, I raised a POSIX issue regarding the behavior of
pipe on failure: http://austingroupbugs.net/view.php?id=467
Using that test program, I learned that most systems leave fd
unchanged on error, but that mingw always assigns -1 into the
array. This fixes the mingw pipe() replacement, as well as
the gnulib pipe2() replacement.
I don't know of any race-free way to work around a cygwin crash:
http://cygwin.com/ml/cygwin/2011-06/msg00328.html - we could
always open() and then close() two fds to guess whether two
spare fd still remain before calling pipe(), but that is racy.
Paul Eggert [Sat, 25 Jun 2011 18:55:20 +0000 (11:55 -0700)]
nanosleep: simplify carrying
* lib/nanosleep.c (nanosleep): Use the requested tv_nsec for the
first call to the underyling nanosleep, not for the last one.
This doesn't fix any bugs, but it simplifies the computation of
the remaining delay. Found while auditing integer overflow issues.
Paul Eggert [Sat, 25 Jun 2011 08:56:52 +0000 (01:56 -0700)]
dup2: remove test for existence of fcntl
* m4/dup2.m4 (gl_FUNC_DUP2): Use "#ifdef FD_CLOEXEC", not
"#if HAVE_FCNTL", in the configure-time test program.
This removes the need for the AC_CHECK_FUNCS_ONCE([fcntl]),
and therefore speeds up "configure" a bit. Found while
adding the dup2 module to Emacs.
Eric Blake [Fri, 24 Jun 2011 21:46:01 +0000 (15:46 -0600)]
maint.mk: enhance useless header checks
Libvirt was mistakenly using <intprops.h> instead of "intprops.h"
in one place; when I fixed that, I was surprised to get a
syntax-check failure from an unused header.
Jim Meyering [Fri, 24 Jun 2011 18:52:00 +0000 (20:52 +0200)]
syntax-check: keep one maint.mk rule in sync with its header
* Makefile (sc_check_sym_list): Add a rule to prevent a repeat
of the bug Eric has just fixed, with today's commit 25e4c2ec.
I prefer to avoid temporary files here, so use <(...), but that
is not supported by /bin/sh, so...
(SHELL): Define to /bin/bash.
Eric Blake [Wed, 22 Jun 2011 21:02:24 +0000 (15:02 -0600)]
maint.mk: add syntax-check to avoid char[PATH_MAX]
POSIX allows PATH_MAX to be undefined. And even if you use the
gnulib pathmax module, where "pathmax.h" guarantees a definition,
the definition might not be constant or might be so large as to
be wasteful or cause stack overflows. PATH_MAX should only be
used as a limit or hueristic, not an array size.
* top/maint.mk (sc_prohibit_path_max_array): New rule.
Eric Blake [Wed, 22 Jun 2011 18:15:02 +0000 (12:15 -0600)]
link: work around IRIX bug
On IRIX 6.5, link(file, "dangling") creates the target of dangling
as a link to file, rather than failing with EEXIST.
* m4/link.m4 (gl_FUNC_LINK): Expose the bug.
* lib/link.c (rpl_link): Work around it.
* tests/test-link.h (test_link): Enhance test.
* doc/posix-functions/link.texi (link): Document the bug.
Only triggered by a program that uses "W;" in the short opt string
without providing a longopts array; that can be argued to be a
programmer error, so gnulib won't bother replacing glibc getopt if
it has that bug.
* lib/getopt.c (_getopt_internal_r): Avoid unlikely NULL
dereference.
Reported by Gustavo Martin Domato.
Eric Blake [Tue, 21 Jun 2011 22:44:30 +0000 (16:44 -0600)]
perror: test for output mismatch
On IRIX 6.5, strerror(-1) returns NULL but perror("") for errno
of -1 prints "Unknown error"; POSIX requires that the two must
match, so we must replace perror. But since IRIX also lacks
strerror_r, our probe for a working [__xpg_]strerror_r was
never even happening.
* m4/perror.m4 (gl_FUNC_PERROR): Add test, in order to replace
perror on IRIX.
Eric Blake [Tue, 21 Jun 2011 16:00:55 +0000 (10:00 -0600)]
strerror_r: fix OpenBSD behavior on out-of-range
On OpenBSD, strerror_r(1000,buf,19) gives "Unknown error: " rather
than "Unknown error: 100" while failing with ERANGE. Admittedly,
this behavior is nice, since a truncated integer is misleading,
but all other platforms use maximal strings on ERANGE and we are
already replacing strerror_r for other reasons, so it is easier
to work around this behavior than to adjust the testsuite (how
do you quickly decide if the only reason that the ERANGE string
was shorter than maximal was because the implementation avoided
truncating an integer?).
This patch intentionally avoids dragging in the strnlen module.
* lib/strerror_r.c (strerror_r): Always use maximal string.
* doc/posix-functions/strerror_r.texi (strerror_r): Document it.
Eric Blake [Tue, 21 Jun 2011 14:50:51 +0000 (08:50 -0600)]
strerror_r: fix OpenBSD behavior on 0
OpenBSD treats strerror_r(0,,) as a success, but with a message
"Undefined error: 0"; while this is distinct from strerror_r(-1,,)
returning "Unknown error: -1", it does not imply success. Meanwhile,
if buf is short enough for ERANGE, then we can't use strstr to look
for "Unknown" or "Undefined" in the resulting message, like we had
been doing for strerror(). Fix this by shifting the burden - now
the strerror-override code guarantees that 0 will have an
override when needed.
* lib/strerror-override.c (strerror_override): Also override 0
when needed.
* lib/strerror-override.h (strerror_override): Likewise.
* lib/strerror.c (strerror): Simplify, now that 0 override is done
earlier.
* lib/strerror_r.c (strerror_r): Likewise.
* m4/strerror.m4 (gl_FUNC_STRERROR): Split detection of 0
behavior...
(gl_FUNC_STRERROR_0): ...into new macro.
* m4/strerror_r.m4 (gl_FUNC_STRERROR_R): Replace strerror_r if 0
is overridden.
(gl_FUNC_STRERROR_R_WORKS): Avoid extra tests if 0 is broken.
* modules/strerror-override (Files): Add strerror.m4.
(configure.ac): Also provide override for 0 when needed.
* doc/posix-functions/strerror.texi (strerror): Document this.
* doc/posix-functions/perror.texi (perror): Likewise.
Paul Eggert [Mon, 20 Jun 2011 22:03:03 +0000 (15:03 -0700)]
alloca: port to compilers that can optimize like GCC 4.6.0
* lib/alloca.c (find_stack_direction): New signature, taken from
Autoconf git. This works with GCC 4.6.0. This code should never
be used with GCC 4.6.0 itself, as GCC has alloca, but it might
be used with other compilers that optimize as well as GCC 4.6.0 does.
(alloca): Adjust to new signature.
* m4/alloca.m4 (__AC_LIBOBJ_ALLOCA) [Autoconf version < 2.69]:
New macro, which patches Autoconf in a similar way.
Paul Eggert [Mon, 20 Jun 2011 21:59:13 +0000 (14:59 -0700)]
c-stack: stop worrying about stack direction
* lib/c-stack.c (find_stack_direction): Remove.
(segv_handler): Don't worry about stack direction growth, as it's
too much of a pain to configure this correctly, given how compilers
are optimizing-away our stack-growth detection code. Instead, assume
that any access to just before or just after the stack is OK.
* m4/c-stack.m4 (AC_SYS_XSI_STACK_OVERFLOW_HEURISTIC):
Don't require AC_FUNC_ALLOCA; no longer needed.
Eric Blake [Mon, 20 Jun 2011 21:12:10 +0000 (15:12 -0600)]
test-stat: don't allocate PATH_MAX bytes
POSIX allows systems (like Hurd) that don't define PATH_MAX, or
which define it larger than a reasonable stack allocation should
be. The test originally used stack allocation to avoid portability
problems with getcwd, but the getcwd-lgpl module solves those.
* tests/test-stat.h (test_stat_func): Don't stack-allocate a
PATH_MAX-sized buffer.
* modules/openat-tests (Depends-on): Add getcwd-lgpl, drop pathmax.
* modules/stat-tests (Depends-on): Likewise.
* tests/test-fstatat.c (includes): Drop pathmax.h.
* tests/test-stat.c (includes): Likewise.
Reported by Bruno Haible.
Bruno Haible [Sun, 19 Jun 2011 12:41:22 +0000 (14:41 +0200)]
round-ieee: Fix test failures on AIX 7.1 and OSF/1 5.1.
* modules/round-ieee (Depends-on): Add floor-ieee, ceil-ieee.
* doc/posix-functions/round.texi: Mention problem with negative
arguments.
* doc/posix-functions/ceil.texi: Mention problem on OSF/1 5.1.
Bruno Haible [Sun, 19 Jun 2011 12:06:51 +0000 (14:06 +0200)]
roundf-ieee: Fix test failures on AIX 7.1 and OSF/1 5.1.
* m4/roundf.m4 (gl_FUNC_ROUNDF): Test also the sign of roundf (-0.3f).
* modules/roundf-ieee (Depends-on): Add floorf-ieee, ceilf-ieee.
* doc/posix-functions/roundf.texi: Mention problem with negative
arguments.
* doc/posix-functions/ceilf.texi: Mention problem on OSF/1 5.1.
Bruno Haible [Sat, 18 Jun 2011 18:26:19 +0000 (20:26 +0200)]
isfinite, isinf: Fix link error on AIX 6 and 7.
* m4/isfinite.m4 (gl_ISFINITE): When determining whether libm is
needed, also test the macro with a 'float' argument.
* m4/isinf.m4 (gl_ISINF): Likewise.
Bruno Haible [Sat, 18 Jun 2011 16:32:53 +0000 (18:32 +0200)]
getloadavg: Don't clobber LIBS. Regression from previous commit.
* m4/getloadavg.m4 (gl_PREREQ_GETLOADAVG): Move tests that use
AC_CHECK_LIB from here...
(gl_GETLOADAVG): ... to here, inside the experiment with LIBS.
(gl_GETLOADAVG, gl_PREREQ_GETLOADAVG): Rename gl_have_func to
gl_func_getloadavg_done.
Reported by Tom G. Christensen <tgc@jupiterrise.com>.
Bruno Haible [Fri, 17 Jun 2011 10:41:19 +0000 (12:41 +0200)]
Fix tests link errors.
* modules/ceil-ieee-tests (Makefile.am): Use CEIL_LIBM, not FLOOR_LIBM.
* modules/chown-tests (Makefile.am): Don't link test-chown with
LIBINTL.
* modules/lchown-tests (Makefile.am): Don't link test-lchown with
LIBINTL.
* modules/utimens-tests (Makefile.am): Don't link test-utimens with
LIBINTL.
* modules/futimens-tests (Makefile.am): Don't link test-futimens with
LIBINTL.