Paul Eggert [Sun, 18 Apr 2021 23:53:11 +0000 (16:53 -0700)]
safe-alloc: simplify via reallocarray
* lib/safe-alloc.c: Do not include xalloc-oversized.h.
(safe_alloc_alloc_n, safe_alloc_realloc_n):
Use reallocarray to check for size or ptrdiff_t overflow.
* modules/reallocarray (License): Switch from LGPL to LGPLv2+, as
this is needed for safe-alloc and anyway is more appropriate for
this library function common with BSD.
* modules/safe-alloc (Depends-on): Depend on reallocarray
rather than xalloc-oversized.
Paul Eggert [Sun, 18 Apr 2021 23:30:59 +0000 (16:30 -0700)]
xalloc-oversized: fix SIZE_MAX optimization bug
* lib/xalloc-oversized.h (xalloc_count_t): Remove; no longer
needed and was evidently error-prone anyway.
(xalloc_oversized): Omit some over-optimization that caused
SIZE_MAX to not be treated as too large (the Gnulib convention) on
unusual platforms where PTRDIFF_MAX == SIZE_MAX. This change
should not affect typical platforms where PTRDIFF_MAX < SIZE_MAX.
When optimizing, simply use ptrdiff_t instead of xalloc_count_t.
Paul Eggert [Sun, 18 Apr 2021 23:24:51 +0000 (16:24 -0700)]
xalloc: new function xreallocarray
This effectively replaces xnmalloc, which perhaps should be deprecated.
The name xreallocarray should be easier to remember now that
reallocarray is a standard GNU function.
* lib/xalloc.h [GNULIB_XALLOC]: Do not include xalloc-oversized.h.
(xnmalloc, xnrealloc, x2nrealloc): Simplify by using xreallocarray.
* lib/xmalloc.c (xreallocarray): New function.
* modules/xalloc (Depends-on): Add reallocarray;
remove xalloc-oversized.
Paul Eggert [Sun, 18 Apr 2021 23:05:30 +0000 (16:05 -0700)]
backupfile: simplify via realloc-gnu
* lib/backupfile.c: Do not include xalloc-oversized.h.
(numbered_backup): Simplify now that realloc will do the right
thing about ptrdiff_t overflow.
* modules/backupfile (Depends-on): Add realloc-gnu;
remove xalloc-oversized.
Paul Eggert [Sun, 18 Apr 2021 22:38:36 +0000 (15:38 -0700)]
safe-alloc: improve doc
* doc/safe-alloc.texi: Clarify that reallocating an array appends
uninitialized storage. Say ‘sizeof *p’ rather than ‘sizeof(*p)’
which would need a space before the paren to follow GNU style.
Paul Eggert [Sun, 18 Apr 2021 18:23:24 +0000 (11:23 -0700)]
malloc-gnu, etc.: sync better with Autoconf
* m4/calloc.m4 (_AC_FUNC_CALLOC_IF):
* m4/malloc.m4 (_AC_FUNC_MALLOC_IF):
* m4/realloc.m4 (_AC_FUNC_REALLOC_IF):
Avoid some unnecessary differences from Autoconf’s versions.
Separate our platforms into a different line so that it’s easier
to diff. Use AS_IF in case the args use AC_REQUIRE.
However, don’t bother with omitting the first newline, as
omitting the newline is not Gnulib style and the difference
doesn’t seem to matter here.
Paul Eggert [Sun, 18 Apr 2021 01:44:25 +0000 (18:44 -0700)]
malloc, etc.: check for ptrdiff_t overflow
In glibc 2.30 and later, malloc, realloc and calloc reject
attempts to create objects larger than PTRDIFF_MAX bytes.
This patch changes malloc-gnu etc. to support this behavior
on non-GNU hosts. It also makes this change for malloc-posix etc.
since it’s a safety measure that ought to be in POSIX (perhaps
we can talk them into that...).
In writing this patch I found a complicated set of code that had
accumulated over the years, some written by yours truly. I got
rid of the code I couldn’t see the need for nowadays. Among other
things, the GNU realloc behavior is no longer incompatible with
the C standard, because in C17 the latter was relaxed to allow the
former. If I went too far in cleaning up, the old stuff can be
resurrected.
This change is mostly for 32-bit platforms, since practical 64-bit
platforms cannot create objects larger than PTRDIFF_MAX bytes anyway.
* doc/posix-functions/calloc.texi:
* doc/posix-functions/malloc.texi:
* doc/posix-functions/realloc.texi:
Mention ptrdiff_t issues, and go into more detail about what
the gnu extension module does.
* doc/posix-functions/realloc.texi: Fix now-obsolete commentary
about C99 vs glibc, as C17 allows the glibc behavior and POSIX
will follow suit when it gets around to it.
* lib/calloc.c, lib/malloc.c, lib/realloc.c:
Simplify by always supplying a GNU-compatible version,
as that suffices for correctness and is good enough for performance.
Include xalloc-oversized.h, and use xalloc_oversized to
check for ptrdiff_t overflow.
(NEED_CALLOC_GNU, NEED_MALLOC_GNU, NEED_REALLOC_GNU): Remove.
* m4/calloc.m4 (_AC_FUNC_CALLOC_IF):
* m4/malloc.m4 (_AC_FUNC_MALLOC_IF):
* m4/realloc.m4 (_AC_FUNC_REALLOC_IF):
Don’t start with a newline. Fix message to match behavior.
* m4/calloc.m4 (_AC_FUNC_CALLOC_IF): Don’t test for size_t overflow,
as the ptrdiff_t test is good enough.
* m4/calloc.m4 (gl_FUNC_CALLOC_GNU):
* m4/malloc.m4 (gl_FUNC_MALLOC_GNU):
* m4/realloc.m4 (gl_FUNC_REALLOC_GNU):
Do not define HAVE_CALLOC_GNU, HAVE_MALLOC_GNU, HAVE_REALLOC_GNU.
It’s not worth the aggravation of maintaining these, as they
are confusing (they don’t really mean GNU-compatible anyway).
Don’t bother testing for GNU behavior if we have already decided
to replace the function, since the replacement is always GNUish.
* m4/calloc.m4 (gl_FUNC_CALLOC_POSIX):
* m4/realloc.m4 (gl_FUNC_REALLOC_POSIX):
Defer to gl_FUNC_MALLOC_POSIX.
* m4/malloc.m4 (gl_FUNC_MALLOC_PTRDIFF, gl_CHECK_MALLOC_PTRDIFF):
New macros.
(gl_FUNC_MALLOC_POSIX): Use them to check for ptrdiff_t overflow.
* modules/calloc-gnu, modules/malloc-gnu, modules/realloc-gnu:
Remove no-longer-needed module indicators.
* modules/calloc-posix, modules/malloc-posix, modules/realloc-posix:
Depend on xalloc-oversized.
* modules/malloc-posix: Require gl_FUNC_MALLOC_POSIX instead of
calling it directly, so that other code can require it.
* modules/realloc-posix: Depend on free-posix and malloc-posix.
Bruno Haible [Sun, 11 Apr 2021 20:00:25 +0000 (22:00 +0200)]
malloc, realloc, calloc: Support restricted library symbols on AIX.
Suggested by Paul Eggert in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-04/msg00119.html>.
* lib/malloc.c: Drop the code that intends to collaborate with
AC_FUNC_MALLOC.
* lib/realloc.c: Drop the code that intends to collaborate with
AC_FUNC_REALLOC.
* lib/calloc.c: Drop the code that intends to collaborate with the
nonexistent macro AC_FUNC_CALLOC.
Bruno Haible [Sun, 11 Apr 2021 19:25:54 +0000 (21:25 +0200)]
Support several gnulib-tool invocations under the same configure.ac.
Reported by Reuben Thomas <rrt@sc3d.org> in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-04/msg00104.html>.
This is done by defining the Gnulib module indicator variables per
gnulib-tool invocation. So that a generated .h file is no longer
influenced by the set of modules used in other gnulib-tool invocations.
Paul Eggert [Sat, 10 Apr 2021 20:38:50 +0000 (13:38 -0700)]
realloc: fix undef typo
* lib/realloc.c: #undef realloc if config.h defines it.
This fixes a typo that I introduced in
2011-04-08T18:39:01Z!eggert@cs.ucla.edu.
Apparently nobody uses Gnulib realloc in that way?
Paul Eggert [Thu, 8 Apr 2021 00:29:59 +0000 (17:29 -0700)]
utimens: fix confusing arg type in internal func
Although the old code was technically correct, this was accidental
and it understandably confused Coverity. Reported by Ondrej Dubaj in:
https://lists.gnu.org/r/bug-tar/2021-04/msg00000.html
* lib/utimens.c (update_timespec): Change arg type from ‘struct
timespec *[2]’ (pointer to array of 2 pointers to timespecs) to
‘struct timespec **’ (pointer to pointer to the first timespec in
an array of 2 timespecs). Although the old code happened to be
technically correct, it was misleading and confused Coverity.
And though the type ‘struct timespec (**)[2]’ (pointer to pointer
to array of 2 timespecs) would perhaps be more technically
correct, it would be almost as confusing and would require changes
elsewhere in this file; let’s quit while we’re ahead.
Paul Eggert [Wed, 7 Apr 2021 00:45:33 +0000 (17:45 -0700)]
group-member: minor tweak to omit a *
* lib/group-member.c: Include intprops.h.
(get_group_info): Use INT_MULTIPLY_WRAPV instead of
xalloc_oversized (which does a multiplication) followed by the
same multiplication. The code was OK as-is; this is just
conceptual simplification, possible now that we have xalloc_count_t.
* modules/group-member: Depend on intprops.
Paul Eggert [Wed, 7 Apr 2021 00:39:31 +0000 (17:39 -0700)]
backupfile: less-aggressive buffer growth
* lib/backupfile.c: Include intprops.h.
(numbered_backup): Grow buffer by the usual 50%, not 100%.
This is easier to do now that we have xalloc_count_t.
* modules/backup-rename, modules/backupfile: Depend on intprops.
Paul Eggert [Wed, 7 Apr 2021 00:34:56 +0000 (17:34 -0700)]
xalloc-oversized: export xalloc_count_t
* lib/xalloc-oversized.h (__xalloc_oversized, xalloc_oversized):
* lib/xmalloca.h (nmalloca):
Comment re restrictions on arg types.
* lib/xalloc-oversized.h (xalloc_count_t): Rename from
__xalloc_count_type; all uses changed. This publicizes the type.
Paul Eggert [Tue, 6 Apr 2021 03:08:27 +0000 (20:08 -0700)]
xalloc: try to pacify gcc -Wsign-compare
Problem reported by Marc Nieper-Wißkirchen in:
https://lists.gnu.org/r/bug-gnulib/2021-04/msg00034.html
* lib/xmalloc.c (xpalloc): For odd platforms where SIZE_MAX < IDX_MAX,
use a tricky destination for INT_MULTIPLY_WRAPV instead of an
explicit comparison to SIZE_MAX. This should be more likely to
pacify gcc -Wsign-compare.
Reported by Bruno Haible in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-04/msg00047.html>
after a Coverity run.
* lib/hamt.c (bucket_do_while, hamt_iterator): Add missing
derefencing operator and silence a bogus warning on uninitialized
variables.
* tests/test-hamt.c (test_general): Replace two errorneous
assignment operators with comparison operators.
Suggested by Bruno Haible in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-04/msg00026.html>.
* doc/containers.texi: Add a subsection to section 15.11 Container
data types.
* lib/hamt.h: Improve documentation on how Hamt_entry is supposed
to be used.
Paul Eggert [Sun, 4 Apr 2021 03:14:36 +0000 (20:14 -0700)]
savedir: avoid unlikely undefined behavior
* lib/savedir.c (streamsavedir): Prefer idx_to size_t where
either will do. Simplify reallocation of entries.
Use xpalloc to reallocate name_space, to avoid some unlikely
integer overflows.
Paul Eggert [Sun, 4 Apr 2021 02:59:10 +0000 (19:59 -0700)]
quotearg: avoid undefined and/or O(N**2)
Avoid undefined and O(N**2) behavior in some very unlikely cases.
* lib/quotearg.c (quotearg_n_options): Document that N must
be less than MIN (INT_MAX, IDX_MAX), and add this to the
abort test; this also avoids a conditional branch.
Use xpalloc instead of xrealloc, to avoid O(N**2) behavior in
very-unlikely cases.
Paul Eggert [Sat, 3 Apr 2021 23:07:21 +0000 (16:07 -0700)]
xgethostname: reorganize / simplify
xgethostname and xgetdomainname were essentially copies long
ago, but they’ve diverged. Bring them back together again
by implementing the (rarely used) latter in terms of the former.
And avoid some unnecessary realloc calls while we’re at it.
* lib/xgetdomainname.c: Rewrite from scratch so that it merely
includes xgethostname.c with a few preliminaries.
* lib/xgethostname.c: Generalize so that it can be included
from xgetdomainname.c.
(GETANAME, XGETANAME): New macros.
(INITIAL_HOSTNAME_LENGTH): Remove. No need for this parameter.
Use 100 instead, as few hostnames are longer than that.
(XGETANAME): Try getting the hostname into the stack first,
as that avoids a malloc call in the usual case.
Check for both POSIX-style truncation and SunOS 5.5 bug
in a cleaner way, by simply checking string length.
Don’t use x2realloc, which wastes time preserving buffer garbage;
use xpalloc with NULL instead. Don’t bother shrinking buffer
in the very rare case where the hostname is longer than sizeof
buf; it’s not worth the aggravation.
* modules/xgetdomainname (Depends-on): Remove free-posix, xalloc.
Add xgethostname.
Bruno Haible [Sat, 3 Apr 2021 15:41:18 +0000 (17:41 +0200)]
xalloc-die: Fix compilation error (regression from 2021-03-28).
* lib/xalloc.h: Don't include idx.h and xalloc-oversized.h if the module
'xalloc' is not in use.
* modules/xalloc-die (Depends-on): Remove xalloc-oversized.
Bruno Haible [Fri, 2 Apr 2021 17:50:19 +0000 (19:50 +0200)]
strtol, strtoul, strtoll, strtoull: Optimize.
* lib/strtol.c (GROUP_PARAM_PROTO): New macro.
(INTERNAL): Define differently if !USE_NUMBER_GROUPING.
(INTERNAL (strtol)): Define without 'int group' parameter if
!USE_NUMBER_GROUPING.
(strtol): Don't define if !USE_NUMBER_GROUPING.
Paul Eggert [Thu, 1 Apr 2021 07:59:54 +0000 (00:59 -0700)]
xalloc: delay setting size until success
* lib/xalloc.h (x2nrealloc): Don’t change *PN until after xrealloc
succeeds, in case xalloc_die or one of its callees or longjmp
targets uses *PN. Similar code in xpalloc already does this.
Paul Eggert [Mon, 29 Mar 2021 03:02:21 +0000 (20:02 -0700)]
xalloc: new function xpalloc, from dfa
Move xpalloc from dfa.c to xmalloc.c and change it from static to
extern. The function is useful in other contexts; I’m about to
use it in coreutils.
* lib/dfa.c: Include idx.h, instead of rolling our own idx_t and
IDX_MAX. Do not include intprops.h; no longer needed.
(xpalloc): Move from here ...
* lib/xmalloc.c (xpalloc): ... to here, and make it extern.
Include intprops.h and minmax.h, needed by xpalloc.
* lib/xalloc.h: Include idx.h, for idx_t.
* modules/dfa (Depends-on): Add idx; remove intprops.
* modules/xalloc (Depends-on): Add idx, intprops, minmax.
Bruno Haible [Sun, 28 Mar 2021 18:10:43 +0000 (20:10 +0200)]
linked-list tests: Add another test for SIGNAL_SAFE_LIST.
* tests/test-asyncsafe-linked_list-strong.c: Renamed from
tests/test-asyncsafe-linked_list.c.
* tests/test-asyncsafe-linked_list-strong.sh: Renamed from
tests/test-asyncsafe-linked_list.sh.
* tests/test-asyncsafe-linked_list-weak.c: New file, based on
tests/test-asyncsafe-linked_list.c.
* tests/test-asyncsafe-linked_list-weak.sh: New file, based on
tests/test-asyncsafe-linked_list.sh.
* modules/linked-list-tests (Files): Add
tests/test-asyncsafe-linked_list-weak.*,
tests/test-asyncsafe-linked_list-strong.*.
(Makefile.am): Arrange to test also
tests/test-asyncsafe-linked_list-weak.sh. Mark
test-asyncsafe-linked_list-weak.sh and
test-asyncsafe-linked_list-strong.sh as expected failures.
Bruno Haible [Mon, 22 Mar 2021 23:08:38 +0000 (00:08 +0100)]
clean-temp-simple: Remove dependency upon xalloc, xalloc-die, xlist.
* lib/clean-temp-private.h (clean_temp_init): Change return type to
'int'.
* lib/clean-temp-simple.h (register_temporary_file): Change return type
to 'int'.
* lib/clean-temp-simple.c: Don't include xalloc.h, gl_xlist.h. Include
gl_list.h instead.
(init_failed): New variable.
(do_clean_temp_init): Set it.
(clean_temp_init): Return an error indicator.
(register_temporary_file): Invoke gl_list_nx_create_empty instead of
gl_list_create_empty. Invoke strdup instead of xstrdup. Invoke
gl_list_nx_add_first instead of gl_list_add_first. Return an error
indicator.
* lib/clean-temp.c (create_temp_dir, gen_register_open_temp): Call
xalloc_die() if clean_temp_init or register_temporary_file failed.
* modules/clean-temp-simple (Depends-on): Remove xalloc, xalloc-die,
xlist.
Bruno Haible [Mon, 22 Mar 2021 21:48:23 +0000 (22:48 +0100)]
clean-temp-simple: New module.
* lib/clean-temp-simple.h: New file, based on lib/clean-temp.h.
* lib/clean-temp-private.h: New file, based on lib/clean-temp.c.
* lib/clean-temp-simple.c: New file, based on lib/clean-temp.c.
* lib/clean-temp.h: Include clean-temp-simple.h.
(register_temporary_file, unregister_temporary_file,
cleanup_temporary_file): Remove declarations.
* lib/clean-temp.c: Don't include <limits.h>, <stdint.h>. Include
<signal.h>, <stdio.h>, clean-temp-simple.h, clean-temp-private.h.
(file_cleanup_list_lock, file_cleanup_list): Moved to
clean-temp-simple.c.
(struct tempdir, dir_cleanup_list, struct closeable_fd, descriptors):
Moved to clean-temp-private.h.
(string_equals, SIZE_BITS, string_hash, fatal_signal_set,
init_fatal_signal_set, asyncsafe_close): Moved to clean-temp-simple.c.
(asyncsafe_fclose_variant): Use get_fatal_signal_set() here.
(cleanup_action, do_init_clean_temp, clean_temp_once, init_clean_temp,
register_temporary_file, unregister_temporary_file, do_unlink,
cleanup_temporary_file): Moved to clean-temp-simple.c.
(create_temp_dir, cleanup_temp_file, cleanup_temp_dir_contents,
gen_register_open_temp, close_temp): Update for changed function names.
(fclose_variant_temp): Don't call init_fatal_signal_set().
* modules/clean-temp-simple: New file, based on modules/clean-temp.
* modules/clean-temp (Depends-on): Add clean-temp-simple, list. Remove
stdint.
(configure.ac): Don't define SIGNAL_SAFE_LIST here.
Bruno Haible [Mon, 22 Mar 2021 17:28:02 +0000 (18:28 +0100)]
error: Relicense under LGPLv2+.
Pino Toscano's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00109.html>.
Paul Eggert's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00110.html>.
Bruno Haible [Mon, 22 Mar 2021 17:25:09 +0000 (18:25 +0100)]
getprogname: Relicense under LGPLv2+.
Pino Toscano's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00109.html>.
Paul Eggert's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00110.html>.
Jim Meyering's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00107.html>.
Gisle Vanem's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00115.html>.
Daniel Richard G's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00112.html>.
John David Anglin's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00108.html>.
Benji Wiebe's approval is in
<https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00114.html>.
* modules/getprogname (License): Change to LGPLv2+.
Bruno Haible [Mon, 22 Mar 2021 12:47:44 +0000 (13:47 +0100)]
doc: Mention an open glibc bug.
* doc/posix-functions/mbrtowc.texi: Mention the possible out-of-range
wchar_t values returned by this function on glibc.
* doc/posix-functions/mbtowc.texi: Likewise.
Paul Eggert [Sun, 21 Mar 2021 21:52:08 +0000 (14:52 -0700)]
tests: fix signed overflow issues
* tests/test-dynarray.c (value_at): Avoid undefined behavior
in signed integer multiplication.
* tests/test-scratch-buffer.c (byte_at): Likewise, for the
theoretically-possible case where size_t is narrower than int.
Bruno Haible [Sun, 21 Mar 2021 02:46:05 +0000 (03:46 +0100)]
ftello: Work around bug in macOS >= 10.15.
Reported by Martin Storsjö <martin@martin.st> in
<https://lists.gnu.org/archive/html/bug-gnulib/2020-12/msg00002.html>.
* m4/ungetc.m4 (gl_FUNC_UNGETC_WORKS): On macOS, don't define
FUNC_UNGETC_BROKEN. Instead, set gl_ftello_broken_after_ungetc to yes.
* m4/ftello.m4 (gl_FUNC_FTELLO): Invoke gl_FUNC_UNGETC_WORKS, and
arrange to provide the workaround if ftello is broken after ungetc.
* lib/ftello.c: Include <errno.h>, intprops.h.
(ftello) [FTELLO_BROKEN_AFTER_UNGETC]: Implement from scratch.
* modules/ftello (Files): Add m4/ungetc.m4.
(Depends-on): Add intprops.
* doc/posix-functions/ftello.texi: Mention the macOS bug.
Paul Eggert [Thu, 18 Mar 2021 18:00:53 +0000 (11:00 -0700)]
argmatch: fix testing typo
Problem and fix reported by Gisle Vanem in:
https://lists.gnu.org/r/bug-gnulib/2021-03/msg00083.html
* lib/argmatch.c (main) [TEST]: Fix address-of typo.