code:
From b3b37f1a5559a7620e31c8053ed1b44f798f2b6d Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Sat, 31 Dec 2016 20:22:09 +0100
Subject: [PATCH] CVE-2015-5180: resolv: Fix crash with internal QTYPE [BZ
 #18784]

Also rename T_UNSPEC because an upcoming public header file
update will use that name.

(cherry picked from commit fc82b0a2dfe7dbd35671c10510a8da1043d746a5)
---
 ChangeLog                     |  14 ++++
 NEWS                          |   6 ++
 include/arpa/nameser_compat.h |   6 +-
 resolv/Makefile               |   5 ++
 resolv/nss_dns/dns-host.c     |   2 +-
 resolv/res_mkquery.c          |   4 +
 resolv/res_query.c            |   6 +-
 resolv/tst-resolv-qtypes.c    | 185 ++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 221 insertions(+), 7 deletions(-)
 create mode 100644 resolv/tst-resolv-qtypes.c

diff --git a/include/arpa/nameser_compat.h b/include/arpa/nameser_compat.h
index 2e735ed..7c0deed 100644
--- a/include/arpa/nameser_compat.h
+++ b/include/arpa/nameser_compat.h
@@ -1,8 +1,8 @@
 #ifndef _ARPA_NAMESER_COMPAT_
 #include <resolv/arpa/nameser_compat.h>

-/* Picksome unused number to represent lookups of IPv4 and IPv6 (i.e.,
-   T_A and T_AAAA).  */
-#define T_UNSPEC 62321
+/* The number is outside the 16-bit RR type range and is used
+   internally by the implementation.  */
+#define T_QUERY_A_AND_AAAA 439963904

 #endif
diff --git a/resolv/Makefile b/resolv/Makefile
index 8be41d3..a4c86b9 100644
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -40,6 +40,9 @@ ifeq ($(have-thread-library),yes)
 extra-libs += libanl
 routines += gai_sigqueue
 tests += tst-res_hconf_reorder
+
+# This test sends millions of packets and is rather slow.
+xtests += tst-resolv-qtypes
 endif
 extra-libs-others = $(extra-libs)
 libresolv-routines := gethnamaddr res_comp res_debug	\
@@ -117,3 +120,5 @@ tst-leaks2-ENV = MALLOC_TRACE=$(objpfx)tst-leaks2.mtrace
 $(objpfx)mtrace-tst-leaks2.out: $(objpfx)tst-leaks2.out
 	$(common-objpfx)malloc/mtrace $(objpfx)tst-leaks2.mtrace > $@; \
 	$(evaluate-test)
+
+$(objpfx)tst-resolv-qtypes: $(objpfx)libresolv.so $(shared-thread-library)
diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index 5f9e357..d16fa4b 100644
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -323,7 +323,7 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,

   int olderr = errno;
   enum nss_status status;
-  int n = __libc_res_nsearch (&_res, name, C_IN, T_UNSPEC,
+  int n = __libc_res_nsearch (&_res, name, C_IN, T_QUERY_A_AND_AAAA,
 			      host_buffer.buf->buf, 2048, &host_buffer.ptr,
 			      &ans2p, &nans2p, &resplen2, &ans2p_malloced);
   if (n >= 0)
diff --git a/resolv/res_mkquery.c b/resolv/res_mkquery.c
index 12f9730..d80b531 100644
--- a/resolv/res_mkquery.c
+++ b/resolv/res_mkquery.c
@@ -103,6 +103,10 @@ res_nmkquery(res_state statp,
 	int n;
 	u_char *dnptrs[20], **dpp, **lastdnptr;

+	if (class < 0 || class > 65535
+	    || type < 0 || type > 65535)
+	  return -1;
+
 #ifdef DEBUG
 	if (statp->options & RES_DEBUG)
 		printf(";; res_nmkquery(%s, %s, %s, %s)\n",
diff --git a/resolv/res_query.c b/resolv/res_query.c
index 944d1a9..07dc6f6 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -122,7 +122,7 @@ __libc_res_nquery(res_state statp,
 	int n, use_malloc = 0;
 	u_int oflags = statp->_flags;

-	size_t bufsize = (type == T_UNSPEC ? 2 : 1) * QUERYSIZE;
+	size_t bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * QUERYSIZE;
 	u_char *buf = alloca (bufsize);
 	u_char *query1 = buf;
 	int nquery1 = -1;
@@ -137,7 +137,7 @@ __libc_res_nquery(res_state statp,
 		printf(";; res_query(%s, %d, %d)\n", name, class, type);
 #endif

-	if (type == T_UNSPEC)
+	if (type == T_QUERY_A_AND_AAAA)
 	  {
 	    n = res_nmkquery(statp, QUERY, name, class, T_A, NULL, 0, NULL,
 			     query1, bufsize);
@@ -190,7 +190,7 @@ __libc_res_nquery(res_state statp,
 	if (__builtin_expect (n <= 0, 0) && !use_malloc) {
 		/* Retry just in case res_nmkquery failed because of too
 		   short buffer.  Shouldn't happen.  */
-		bufsize = (type == T_UNSPEC ? 2 : 1) * MAXPACKET;
+		bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * MAXPACKET;
 		buf = malloc (bufsize);
 		if (buf != NULL) {
 			query1 = buf;
diff --git a/resolv/tst-resolv-qtypes.c b/resolv/tst-resolv-qtypes.c
new file mode 100644
index 0000000..b3e60c6
--- /dev/null
+++ b/resolv/tst-resolv-qtypes.c
@@ -0,0 +1,185 @@
+/* Exercise low-level query functions with different QTYPEs.
+   Copyright (C) 2016 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <resolv.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/check_nss.h>
+#include <support/resolv_test.h>
+#include <support/support.h>
+#include <support/test-driver.h>
+#include <support/xmemstream.h>
+
+/* If ture, the response function will send the actual response packet
+   over TCP instead of UDP.  */
+static volatile bool force_tcp;
+
+/* Send back a fake resource record matching the QTYPE.  */
+static void
+response (const struct resolv_response_context *ctx,
+          struct resolv_response_builder *b,
+          const char *qname, uint16_t qclass, uint16_t qtype)
+{
+  if (force_tcp && ctx->tcp)
+    {
+      resolv_response_init (b, (struct resolv_response_flags) { .tc = 1 });
+      resolv_response_add_question (b, qname, qclass, qtype);
+      return;
+    }
+
+  resolv_response_init (b, (struct resolv_response_flags) { });
+  resolv_response_add_question (b, qname, qclass, qtype);
+  resolv_response_section (b, ns_s_an);
+  resolv_response_open_record (b, qname, qclass, qtype, 0);
+  resolv_response_add_data (b, &qtype, sizeof (qtype));
+  resolv_response_close_record (b);
+}
+
+static const const char *domain = "www.example.com";
+
+static int
+wrap_res_query (int type, unsigned char *answer, int answer_length)
+{
+  return res_query (domain, C_IN, type, answer, answer_length);
+}
+
+static int
+wrap_res_search (int type, unsigned char *answer, int answer_length)
+{
+  return res_query (domain, C_IN, type, answer, answer_length);
+}
+
+static int
+wrap_res_querydomain (int type, unsigned char *answer, int answer_length)
+{
+  return res_querydomain ("www", "example.com", C_IN, type,
+                           answer, answer_length);
+}
+
+static int
+wrap_res_send (int type, unsigned char *answer, int answer_length)
+{
+  unsigned char buf[512];
+  int ret = res_mkquery (QUERY, domain, C_IN, type,
+                         (const unsigned char *) "", 0, NULL,
+                         buf, sizeof (buf));
+  if (type < 0 || type >= 65536)
+    {
+      /* res_mkquery fails for out-of-range record types.  */
+      TEST_VERIFY_EXIT (ret == -1);
+      return -1;
+    }
+  TEST_VERIFY_EXIT (ret > 12);  /* DNS header length.  */
+  return res_send (buf, ret, answer, answer_length);
+}
+
+static int
+wrap_res_nquery (int type, unsigned char *answer, int answer_length)
+{
+  return res_nquery (&_res, domain, C_IN, type, answer, answer_length);
+}
+
+static int
+wrap_res_nsearch (int type, unsigned char *answer, int answer_length)
+{
+  return res_nquery (&_res, domain, C_IN, type, answer, answer_length);
+}
+
+static int
+wrap_res_nquerydomain (int type, unsigned char *answer, int answer_length)
+{
+  return res_nquerydomain (&_res, "www", "example.com", C_IN, type,
+                           answer, answer_length);
+}
+
+static int
+wrap_res_nsend (int type, unsigned char *answer, int answer_length)
+{
+  unsigned char buf[512];
+  int ret = res_nmkquery (&_res, QUERY, domain, C_IN, type,
+                         (const unsigned char *) "", 0, NULL,
+                         buf, sizeof (buf));
+  if (type < 0 || type >= 65536)
+    {
+      /* res_mkquery fails for out-of-range record types.  */
+      TEST_VERIFY_EXIT (ret == -1);
+      return -1;
+    }
+  TEST_VERIFY_EXIT (ret > 12);  /* DNS header length.  */
+  return res_nsend (&_res, buf, ret, answer, answer_length);
+}
+
+static void
+test_function (const char *fname,
+               int (*func) (int type,
+                            unsigned char *answer, int answer_length))
+{
+  unsigned char buf[512];
+  for (int tcp = 0; tcp < 2; ++tcp)
+    {
+      force_tcp = tcp;
+      for (unsigned int type = 1; type <= 65535; ++type)
+        {
+          if (test_verbose)
+            printf ("info: sending QTYPE %d with %s (tcp=%d)\n",
+                    type, fname, tcp);
+          int ret = func (type, buf, sizeof (buf));
+          if (ret != 47)
+            FAIL_EXIT1 ("%s tcp=%d qtype=%d return value %d",
+                        fname,tcp, type, ret);
+          /* One question, one answer record.  */
+          TEST_VERIFY (memcmp (buf + 4, "\0\1\0\1\0\0\0\0", 8) == 0);
+          /* Question section.  */
+          static const char qname[] = "\3www\7example\3com";
+          size_t qname_length = sizeof (qname);
+          TEST_VERIFY (memcmp (buf + 12, qname, qname_length) == 0);
+          /* RDATA part of answer.  */
+          uint16_t type16 = type;
+          TEST_VERIFY (memcmp (buf + ret - 2, &type16, sizeof (type16)) == 0);
+        }
+    }
+
+  TEST_VERIFY (func (-1, buf, sizeof (buf) == -1));
+  TEST_VERIFY (func (65536, buf, sizeof (buf) == -1));
+}
+
+static int
+do_test (void)
+{
+  struct resolv_redirect_config config =
+    {
+      .response_callback = response,
+    };
+  struct resolv_test *obj = resolv_test_start (config);
+
+  test_function ("res_query", &wrap_res_query);
+  test_function ("res_search", &wrap_res_search);
+  test_function ("res_querydomain", &wrap_res_querydomain);
+  test_function ("res_send", &wrap_res_send);
+
+  test_function ("res_nquery", &wrap_res_nquery);
+  test_function ("res_nsearch", &wrap_res_nsearch);
+  test_function ("res_nquerydomain", &wrap_res_nquerydomain);
+  test_function ("res_nsend", &wrap_res_nsend);
+
+  resolv_test_end (obj);
+  return 0;
+}
+
+#define TIMEOUT 300
+#include <support/test-driver.c>
--
2.9.3


code:
From b995d95a5943785be3ab862b2d3276f3b4a22481 Mon Sep 17 00:00:00 2001
From: Carlos O'Donell <carlos@systemhalted.org>
Date: Tue, 16 Feb 2016 21:26:37 -0500
Subject: [PATCH] CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug
 18665).

* A stack-based buffer overflow was found in libresolv when invoked from
  libnss_dns, allowing specially crafted DNS responses to seize control
  of execution flow in the DNS client.  The buffer overflow occurs in
  the functions send_dg (send datagram) and send_vc (send TCP) for the
  NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
  family.  The use of AF_UNSPEC triggers the low-level resolver code to
  send out two parallel queries for A and AAAA.  A mismanagement of the
  buffers used for those queries could result in the response of a query
  writing beyond the alloca allocated buffer created by
  _nss_dns_gethostbyname4_r.  Buffer management is simplified to remove
  the overflow.  Thanks to the Google Security Team and Red Hat for
  reporting the security impact of this issue, and Robert Holiday of
  Ciena for reporting the related bug 18665. (CVE-2015-7547)

See also:
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://sourceware.org/ml/libc-alpha/2016-02/msg00418.html

(cherry picked from commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca)
---
 ChangeLog                 |  15 +++
 NEWS                      |  14 +++
 resolv/nss_dns/dns-host.c | 111 ++++++++++++++++++-
 resolv/res_query.c        |   3 +
 resolv/res_send.c         | 264 ++++++++++++++++++++++++++++++++++------------
 5 files changed, 338 insertions(+), 69 deletions(-)

diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index 357ac04..a0fe9a8 100644
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -1031,7 +1031,10 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
   int h_namelen = 0;

   if (ancount == 0)
-    return NSS_STATUS_NOTFOUND;
+    {
+      *h_errnop = HOST_NOT_FOUND;
+      return NSS_STATUS_NOTFOUND;
+    }

   while (ancount-- > 0 && cp < end_of_message && had_error == 0)
     {
@@ -1208,7 +1211,14 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
   /* Special case here: if the resolver sent a result but it only
      contains a CNAME while we are looking for a T_A or T_AAAA record,
      we fail with NOTFOUND instead of TRYAGAIN.  */
-  return canon == NULL ? NSS_STATUS_TRYAGAIN : NSS_STATUS_NOTFOUND;
+  if (canon != NULL)
+    {
+      *h_errnop = HOST_NOT_FOUND;
+      return NSS_STATUS_NOTFOUND;
+    }
+
+  *h_errnop = NETDB_INTERNAL;
+  return NSS_STATUS_TRYAGAIN;
 }

@@ -1222,11 +1232,101 @@ gaih_getanswer (const querybuf *answer1, int anslen1, const querybuf *answer2,

   enum nss_status status = NSS_STATUS_NOTFOUND;

+  /* Combining the NSS status of two distinct queries requires some
+     compromise and attention to symmetry (A or AAAA queries can be
+     returned in any order).  What follows is a breakdown of how this
+     code is expected to work and why. We discuss only SUCCESS,
+     TRYAGAIN, NOTFOUND and UNAVAIL, since they are the only returns
+     that apply (though RETURN and MERGE exist).  We make a distinction
+     between TRYAGAIN (recoverable) and TRYAGAIN' (not-recoverable).
+     A recoverable TRYAGAIN is almost always due to buffer size issues
+     and returns ERANGE in errno and the caller is expected to retry
+     with a larger buffer.
+
+     Lastly, you may be tempted to make significant changes to the
+     conditions in this code to bring about symmetry between responses.
+     Please don't change anything without due consideration for
+     expected application behaviour.  Some of the synthesized responses
+     aren't very well thought out and sometimes appear to imply that
+     IPv4 responses are always answer 1, and IPv6 responses are always
+     answer 2, but that's not true (see the implementation of send_dg
+     and send_vc to see response can arrive in any order, particularly
+     for UDP). However, we expect it holds roughly enough of the time
+     that this code works, but certainly needs to be fixed to make this
+     a more robust implementation.
+
+     ----------------------------------------------
+     | Answer 1 Status /   | Synthesized | Reason |
+     | Answer 2 Status     | Status      |        |
+     |--------------------------------------------|
+     | SUCCESS/SUCCESS     | SUCCESS     | [1]    |
+     | SUCCESS/TRYAGAIN    | TRYAGAIN    | [5]    |
+     | SUCCESS/TRYAGAIN'   | SUCCESS     | [1]    |
+     | SUCCESS/NOTFOUND    | SUCCESS     | [1]    |
+     | SUCCESS/UNAVAIL     | SUCCESS     | [1]    |
+     | TRYAGAIN/SUCCESS    | TRYAGAIN    | [2]    |
+     | TRYAGAIN/TRYAGAIN   | TRYAGAIN    | [2]    |
+     | TRYAGAIN/TRYAGAIN'  | TRYAGAIN    | [2]    |
+     | TRYAGAIN/NOTFOUND   | TRYAGAIN    | [2]    |
+     | TRYAGAIN/UNAVAIL    | TRYAGAIN    | [2]    |
+     | TRYAGAIN'/SUCCESS   | SUCCESS     | [3]    |
+     | TRYAGAIN'/TRYAGAIN  | TRYAGAIN    | [3]    |
+     | TRYAGAIN'/TRYAGAIN' | TRYAGAIN'   | [3]    |
+     | TRYAGAIN'/NOTFOUND  | TRYAGAIN'   | [3]    |
+     | TRYAGAIN'/UNAVAIL   | UNAVAIL     | [3]    |
+     | NOTFOUND/SUCCESS    | SUCCESS     | [3]    |
+     | NOTFOUND/TRYAGAIN   | TRYAGAIN    | [3]    |
+     | NOTFOUND/TRYAGAIN'  | TRYAGAIN'   | [3]    |
+     | NOTFOUND/NOTFOUND   | NOTFOUND    | [3]    |
+     | NOTFOUND/UNAVAIL    | UNAVAIL     | [3]    |
+     | UNAVAIL/SUCCESS     | UNAVAIL     | [4]    |
+     | UNAVAIL/TRYAGAIN    | UNAVAIL     | [4]    |
+     | UNAVAIL/TRYAGAIN'   | UNAVAIL     | [4]    |
+     | UNAVAIL/NOTFOUND    | UNAVAIL     | [4]    |
+     | UNAVAIL/UNAVAIL     | UNAVAIL     | [4]    |
+     ----------------------------------------------
+
+     [1] If the first response is a success we return success.
+	 This ignores the state of the second answer and in fact
+	 incorrectly sets errno and h_errno to that of the second
+	 answer.  However because the response is a success we ignore
+	 *errnop and *h_errnop (though that means you touched errno on
+	 success).  We are being conservative here and returning the
+	 likely IPv4 response in the first answer as a success.
+
+     [2] If the first response is a recoverable TRYAGAIN we return
+	 that instead of looking at the second response.  The
+	 expectation here is that we have failed to get an IPv4 response
+	 and should retry both queries.
+
+     [3] If the first response was not a SUCCESS and the second
+	 response is not NOTFOUND (had a SUCCESS, need to TRYAGAIN,
+	 or failed entirely e.g. TRYAGAIN' and UNAVAIL) then use the
+	 result from the second response, otherwise the first responses
+	 status is used.  Again we have some odd side-effects when the
+	 second response is NOTFOUND because we overwrite *errnop and
+	 *h_errnop that means that a first answer of NOTFOUND might see
+	 its *errnop and *h_errnop values altered.  Whether it matters
+	 in practice that a first response NOTFOUND has the wrong
+	 *errnop and *h_errnop is undecided.
+
+     [4] If the first response is UNAVAIL we return that instead of
+	 looking at the second response.  The expectation here is that
+	 it will have failed similarly e.g. configuration failure.
+
+     [5] Testing this code is complicated by the fact that truncated
+	 second response buffers might be returned as SUCCESS if the
+	 first answer is a SUCCESS.  To fix this we add symmetry to
+	 TRYAGAIN with the second response.  If the second response
+	 is a recoverable error we now return TRYAGIN even if the first
+	 response was SUCCESS.  */
+
   if (anslen1 > 0)
     status = gaih_getanswer_slice(answer1, anslen1, qname,
 				  &pat, &buffer, &buflen,
 				  errnop, h_errnop, ttlp,
 				  &first);
+
   if ((status == NSS_STATUS_SUCCESS || status == NSS_STATUS_NOTFOUND
        || (status == NSS_STATUS_TRYAGAIN
 	   /* We want to look at the second answer in case of an
@@ -1242,8 +1342,15 @@ gaih_getanswer (const querybuf *answer1, int anslen1, const querybuf *answer2,
 						     &pat, &buffer, &buflen,
 						     errnop, h_errnop, ttlp,
 						     &first);
+      /* Use the second response status in some cases.  */
       if (status != NSS_STATUS_SUCCESS && status2 != NSS_STATUS_NOTFOUND)
 	status = status2;
+      /* Do not return a truncated second response (unless it was
+	 unavoidable e.g. unrecoverable TRYAGAIN).  */
+      if (status == NSS_STATUS_SUCCESS
+	  && (status2 == NSS_STATUS_TRYAGAIN
+	      && *errnop == ERANGE && *h_errnop != NO_RECOVERY))
+	status = NSS_STATUS_TRYAGAIN;
     }

   return status;
diff --git a/resolv/res_query.c b/resolv/res_query.c
index 4a9b3b3..95470a9 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -396,6 +396,7 @@ __libc_res_nsearch(res_state statp,
 		  {
 		    free (*answerp2);
 		    *answerp2 = NULL;
+		    *nanswerp2 = 0;
 		    *answerp2_malloced = 0;
 		  }
 	}
@@ -447,6 +448,7 @@ __libc_res_nsearch(res_state statp,
 			  {
 			    free (*answerp2);
 			    *answerp2 = NULL;
+			    *nanswerp2 = 0;
 			    *answerp2_malloced = 0;
 			  }

@@ -521,6 +523,7 @@ __libc_res_nsearch(res_state statp,
 	  {
 	    free (*answerp2);
 	    *answerp2 = NULL;
+	    *nanswerp2 = 0;
 	    *answerp2_malloced = 0;
 	  }
 	if (saved_herrno != -1)
diff --git a/resolv/res_send.c b/resolv/res_send.c
index 5e53cc2..6511bb1 100644
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -1,3 +1,20 @@
+/* Copyright (C) 2016 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
 /*
  * Copyright (c) 1985, 1989, 1993
  *    The Regents of the University of California.  All rights reserved.
@@ -363,6 +380,8 @@ __libc_res_nsend(res_state statp, const u_char *buf, int buflen,
 #ifdef USE_HOOKS
 	if (__glibc_unlikely (statp->qhook || statp->rhook))       {
 		if (anssiz < MAXPACKET && ansp) {
+			/* Always allocate MAXPACKET, callers expect
+			   this specific size.  */
 			u_char *buf = malloc (MAXPACKET);
 			if (buf == NULL)
 				return (-1);
@@ -638,6 +657,77 @@ get_nsaddr (res_state statp, int n)
     return (struct sockaddr *) (void *) &statp->nsaddr_list[n];
 }

+/* The send_vc function is responsible for sending a DNS query over TCP
+   to the nameserver numbered NS from the res_state STATP i.e.
+   EXT(statp).nssocks[ns].  The function supports sending both IPv4 and
+   IPv6 queries at the same serially on the same socket.
+
+   Please note that for TCP there is no way to disable sending both
+   queries, unlike UDP, which honours RES_SNGLKUP and RES_SNGLKUPREOP
+   and sends the queries serially and waits for the result after each
+   sent query.  This implemetnation should be corrected to honour these
+   options.
+
+   Please also note that for TCP we send both queries over the same
+   socket one after another.  This technically violates best practice
+   since the server is allowed to read the first query, respond, and
+   then close the socket (to service another client).  If the server
+   does this, then the remaining second query in the socket data buffer
+   will cause the server to send the client an RST which will arrive
+   asynchronously and the client's OS will likely tear down the socket
+   receive buffer resulting in a potentially short read and lost
+   response data.  This will force the client to retry the query again,
+   and this process may repeat until all servers and connection resets
+   are exhausted and then the query will fail.  It's not known if this
+   happens with any frequency in real DNS server implementations.  This
+   implementation should be corrected to use two sockets by default for
+   parallel queries.
+
+   The query stored in BUF of BUFLEN length is sent first followed by
+   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
+   serially on the same socket.
+
+   Answers to the query are stored firstly in *ANSP up to a max of
+   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
+   is non-NULL (to indicate that modifying the answer buffer is allowed)
+   then malloc is used to allocate a new response buffer and ANSCP and
+   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
+   are needed but ANSCP is NULL, then as much of the response as
+   possible is read into the buffer, but the results will be truncated.
+   When truncation happens because of a small answer buffer the DNS
+   packets header field TC will bet set to 1, indicating a truncated
+   message and the rest of the socket data will be read and discarded.
+
+   Answers to the query are stored secondly in *ANSP2 up to a max of
+   *ANSSIZP2 bytes, with the actual response length stored in
+   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
+   is non-NULL (required for a second query) then malloc is used to
+   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
+   size and *ANSP2_MALLOCED is set to 1.
+
+   The ANSP2_MALLOCED argument will eventually be removed as the
+   change in buffer pointer can be used to detect the buffer has
+   changed and that the caller should use free on the new buffer.
+
+   Note that the answers may arrive in any order from the server and
+   therefore the first and second answer buffers may not correspond to
+   the first and second queries.
+
+   It is not supported to call this function with a non-NULL ANSP2
+   but a NULL ANSCP.  Put another way, you can call send_vc with a
+   single unmodifiable buffer or two modifiable buffers, but no other
+   combination is supported.
+
+   It is the caller's responsibility to free the malloc allocated
+   buffers by detecting that the pointers have changed from their
+   original values i.e. *ANSCP or *ANSP2 has changed.
+
+   If errors are encountered then *TERRNO is set to an appropriate
+   errno value and a zero result is returned for a recoverable error,
+   and a less-than zero result is returned for a non-recoverable error.
+
+   If no errors are encountered then *TERRNO is left unmodified and
+   a the length of the first response in bytes is returned.  */
 static int
 send_vc(res_state statp,
 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
@@ -647,11 +737,7 @@ send_vc(res_state statp,
 {
 	const HEADER *hp = (HEADER *) buf;
 	const HEADER *hp2 = (HEADER *) buf2;
-	u_char *ans = *ansp;
-	int orig_anssizp = *anssizp;
-	// XXX REMOVE
-	// int anssiz = *anssizp;
-	HEADER *anhp = (HEADER *) ans;
+	HEADER *anhp = (HEADER *) *ansp;
 	struct sockaddr *nsap = get_nsaddr (statp, ns);
 	int truncating, connreset, n;
 	/* On some architectures compiler might emit a warning indicating
@@ -743,6 +829,8 @@ send_vc(res_state statp,
 	 * Receive length & response
 	 */
 	int recvresp1 = 0;
+	/* Skip the second response if there is no second query.
+	   To do that we mark the second response as received.  */
 	int recvresp2 = buf2 == NULL;
 	uint16_t rlen16;
  read_len:
@@ -779,40 +867,14 @@ send_vc(res_state statp,
 	u_char **thisansp;
 	int *thisresplenp;
 	if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
+		/* We have not received any responses
+		   yet or we only have one response to
+		   receive.  */
 		thisanssizp = anssizp;
 		thisansp = anscp ?: ansp;
 		assert (anscp != NULL || ansp2 == NULL);
 		thisresplenp = &resplen;
 	} else {
-		if (*anssizp != MAXPACKET) {
-			/* No buffer allocated for the first
-			   reply.  We can try to use the rest
-			   of the user-provided buffer.  */
-#if __GNUC_PREREQ (4, 7)
-			DIAG_PUSH_NEEDS_COMMENT;
-			DIAG_IGNORE_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
-#endif
-#if _STRING_ARCH_unaligned
-			*anssizp2 = orig_anssizp - resplen;
-			*ansp2 = *ansp + resplen;
-#else
-			int aligned_resplen
-			  = ((resplen + __alignof__ (HEADER) - 1)
-			     & ~(__alignof__ (HEADER) - 1));
-			*anssizp2 = orig_anssizp - aligned_resplen;
-			*ansp2 = *ansp + aligned_resplen;
-#endif
-#if __GNUC_PREREQ (4, 7)
-			DIAG_POP_NEEDS_COMMENT;
-#endif
-		} else {
-			/* The first reply did not fit into the
-			   user-provided buffer.  Maybe the second
-			   answer will.  */
-			*anssizp2 = orig_anssizp;
-			*ansp2 = *ansp;
-		}
-
 		thisanssizp = anssizp2;
 		thisansp = ansp2;
 		thisresplenp = resplen2;
@@ -820,10 +882,14 @@ send_vc(res_state statp,
 	anhp = (HEADER *) *thisansp;

 	*thisresplenp = rlen;
-	if (rlen > *thisanssizp) {
-		/* Yes, we test ANSCP here.  If we have two buffers
-		   both will be allocatable.  */
-		if (__glibc_likely (anscp != NULL))       {
+	/* Is the answer buffer too small?  */
+	if (*thisanssizp < rlen) {
+		/* If the current buffer is not the the static
+		   user-supplied buffer then we can reallocate
+		   it.  */
+		if (thisansp != NULL && thisansp != ansp) {
+			/* Always allocate MAXPACKET, callers expect
+			   this specific size.  */
 			u_char *newp = malloc (MAXPACKET);
 			if (newp == NULL) {
 				*terrno = ENOMEM;
@@ -835,6 +901,9 @@ send_vc(res_state statp,
 			if (thisansp == ansp2)
 			  *ansp2_malloced = 1;
 			anhp = (HEADER *) newp;
+			/* A uint16_t can't be larger than MAXPACKET
+			   thus it's safe to allocate MAXPACKET but
+			   read RLEN bytes instead.  */
 			len = rlen;
 		} else {
 			Dprint(statp->options & RES_DEBUG,
@@ -997,6 +1066,66 @@ reopen (res_state statp, int *terrno, int ns)
 	return 1;
 }

+/* The send_dg function is responsible for sending a DNS query over UDP
+   to the nameserver numbered NS from the res_state STATP i.e.
+   EXT(statp).nssocks[ns].  The function supports IPv4 and IPv6 queries
+   along with the ability to send the query in parallel for both stacks
+   (default) or serially (RES_SINGLKUP).  It also supports serial lookup
+   with a close and reopen of the socket used to talk to the server
+   (RES_SNGLKUPREOP) to work around broken name servers.
+
+   The query stored in BUF of BUFLEN length is sent first followed by
+   the query stored in BUF2 of BUFLEN2 length.  Queries are sent
+   in parallel (default) or serially (RES_SINGLKUP or RES_SNGLKUPREOP).
+
+   Answers to the query are stored firstly in *ANSP up to a max of
+   *ANSSIZP bytes.  If more than *ANSSIZP bytes are needed and ANSCP
+   is non-NULL (to indicate that modifying the answer buffer is allowed)
+   then malloc is used to allocate a new response buffer and ANSCP and
+   ANSP will both point to the new buffer.  If more than *ANSSIZP bytes
+   are needed but ANSCP is NULL, then as much of the response as
+   possible is read into the buffer, but the results will be truncated.
+   When truncation happens because of a small answer buffer the DNS
+   packets header field TC will bet set to 1, indicating a truncated
+   message, while the rest of the UDP packet is discarded.
+
+   Answers to the query are stored secondly in *ANSP2 up to a max of
+   *ANSSIZP2 bytes, with the actual response length stored in
+   *RESPLEN2.  If more than *ANSSIZP bytes are needed and ANSP2
+   is non-NULL (required for a second query) then malloc is used to
+   allocate a new response buffer, *ANSSIZP2 is set to the new buffer
+   size and *ANSP2_MALLOCED is set to 1.
+
+   The ANSP2_MALLOCED argument will eventually be removed as the
+   change in buffer pointer can be used to detect the buffer has
+   changed and that the caller should use free on the new buffer.
+
+   Note that the answers may arrive in any order from the server and
+   therefore the first and second answer buffers may not correspond to
+   the first and second queries.
+
+   It is not supported to call this function with a non-NULL ANSP2
+   but a NULL ANSCP.  Put another way, you can call send_vc with a
+   single unmodifiable buffer or two modifiable buffers, but no other
+   combination is supported.
+
+   It is the caller's responsibility to free the malloc allocated
+   buffers by detecting that the pointers have changed from their
+   original values i.e. *ANSCP or *ANSP2 has changed.
+
+   If an answer is truncated because of UDP datagram DNS limits then
+   *V_CIRCUIT is set to 1 and the return value non-zero to indicate to
+   the caller to retry with TCP.  The value *GOTSOMEWHERE is set to 1
+   if any progress was made reading a response from the nameserver and
+   is used by the caller to distinguish between ECONNREFUSED and
+   ETIMEDOUT (the latter if *GOTSOMEWHERE is 1).
+
+   If errors are encountered then *TERRNO is set to an appropriate
+   errno value and a zero result is returned for a recoverable error,
+   and a less-than zero result is returned for a non-recoverable error.
+
+   If no errors are encountered then *TERRNO is left unmodified and
+   a the length of the first response in bytes is returned.  */
 static int
 send_dg(res_state statp,
 	const u_char *buf, int buflen, const u_char *buf2, int buflen2,
@@ -1006,8 +1135,6 @@ send_dg(res_state statp,
 {
 	const HEADER *hp = (HEADER *) buf;
 	const HEADER *hp2 = (HEADER *) buf2;
-	u_char *ans = *ansp;
-	int orig_anssizp = *anssizp;
 	struct timespec now, timeout, finish;
 	struct pollfd pfd[1];
 	int ptimeout;
@@ -1040,6 +1167,8 @@ send_dg(res_state statp,
 	int need_recompute = 0;
 	int nwritten = 0;
 	int recvresp1 = 0;
+	/* Skip the second response if there is no second query.
+	   To do that we mark the second response as received.  */
 	int recvresp2 = buf2 == NULL;
 	pfd[0].fd = EXT(statp).nssocks[ns];
 	pfd[0].events = POLLOUT;
@@ -1203,55 +1332,56 @@ send_dg(res_state statp,
 		int *thisresplenp;

 		if ((recvresp1 | recvresp2) == 0 || buf2 == NULL) {
+			/* We have not received any responses
+			   yet or we only have one response to
+			   receive.  */
 			thisanssizp = anssizp;
 			thisansp = anscp ?: ansp;
 			assert (anscp != NULL || ansp2 == NULL);
 			thisresplenp = &resplen;
 		} else {
-			if (*anssizp != MAXPACKET) {
-				/* No buffer allocated for the first
-				   reply.  We can try to use the rest
-				   of the user-provided buffer.  */
-#if _STRING_ARCH_unaligned
-				*anssizp2 = orig_anssizp - resplen;
-				*ansp2 = *ansp + resplen;
-#else
-				int aligned_resplen
-				  = ((resplen + __alignof__ (HEADER) - 1)
-				     & ~(__alignof__ (HEADER) - 1));
-				*anssizp2 = orig_anssizp - aligned_resplen;
-				*ansp2 = *ansp + aligned_resplen;
-#endif
-			} else {
-				/* The first reply did not fit into the
-				   user-provided buffer.  Maybe the second
-				   answer will.  */
-				*anssizp2 = orig_anssizp;
-				*ansp2 = *ansp;
-			}
-
 			thisanssizp = anssizp2;
 			thisansp = ansp2;
 			thisresplenp = resplen2;
 		}

 		if (*thisanssizp < MAXPACKET
-		    /* Yes, we test ANSCP here.  If we have two buffers
-		       both will be allocatable.  */
-		    && anscp
+		    /* If the current buffer is not the the static
+		       user-supplied buffer then we can reallocate
+		       it.  */
+		    && (thisansp != NULL && thisansp != ansp)
 #ifdef FIONREAD
+		    /* Is the size too small?  */
 		    && (ioctl (pfd[0].fd, FIONREAD, thisresplenp) < 0
 			|| *thisanssizp < *thisresplenp)
 #endif
                     ) {
+			/* Always allocate MAXPACKET, callers expect
+			   this specific size.  */
 			u_char *newp = malloc (MAXPACKET);
 			if (newp != NULL) {
-				*anssizp = MAXPACKET;
-				*thisansp = ans = newp;
+				*thisanssizp = MAXPACKET;
+				*thisansp = newp;
 				if (thisansp == ansp2)
 				  *ansp2_malloced = 1;
 			}
 		}
+		/* We could end up with truncation if anscp was NULL
+		   (not allowed to change caller's buffer) and the
+		   response buffer size is too small.  This isn't a
+		   reliable way to detect truncation because the ioctl
+		   may be an inaccurate report of the UDP message size.
+		   Therefore we use this only to issue debug output.
+		   To do truncation accurately with UDP we need
+		   MSG_TRUNC which is only available on Linux.  We
+		   can abstract out the Linux-specific feature in the
+		   future to detect truncation.  */
+		if (__glibc_unlikely (*thisanssizp < *thisresplenp)) {
+			Dprint(statp->options & RES_DEBUG,
+			       (stdout, ";; response may be truncated (UDP)\n")
+			);
+		}
+
 		HEADER *anhp = (HEADER *) *thisansp;
 		socklen_t fromlen = sizeof(struct sockaddr_in6);
 		assert (sizeof(from) <= fromlen);
--
2.9.3

license: mit


code:
From 146b58d11fddbef15b888906e3be4f33900c416f Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Tue, 29 Mar 2016 12:57:56 +0200
Subject: [PATCH] CVE-2016-3075: Stack overflow in _nss_dns_getnetbyname_r [BZ
 #19879]

The defensive copy is not needed because the name may not alias the
output buffer.

(cherry picked from commit 317b199b4aff8cfa27f2302ab404d2bb5032b9a4)
(cherry picked from commit 883dceebc8f11921a9890211a4e202e5be17562f)
---
 ChangeLog                    |  7 +++++++
 NEWS                         | 10 ++++++++--
 resolv/nss_dns/dns-network.c |  5 +----
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
index 2eb2f67..8f301a7 100644
--- a/resolv/nss_dns/dns-network.c
+++ b/resolv/nss_dns/dns-network.c
@@ -118,17 +118,14 @@ _nss_dns_getnetbyname_r (const char *name, struct netent *result,
   } net_buffer;
   querybuf *orig_net_buffer;
   int anslen;
-  char *qbuf;
   enum nss_status status;

   if (__res_maybe_init (&_res, 0) == -1)
     return NSS_STATUS_UNAVAIL;

-  qbuf = strdupa (name);
-
   net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);

-  anslen = __libc_res_nsearch (&_res, qbuf, C_IN, T_PTR, net_buffer.buf->buf,
+  anslen = __libc_res_nsearch (&_res, name, C_IN, T_PTR, net_buffer.buf->buf,
 			       1024, &net_buffer.ptr, NULL, NULL, NULL, NULL);
   if (anslen < 0)
     {
--
2.9.3


code:
From 1a8a7c12950a0026a3c406a7cb1608f96aa1460e Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Fri, 29 Apr 2016 10:35:34 +0200
Subject: [PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent
 conversion [BZ #20010]

When converting a struct hostent response to struct gaih_addrtuple, the
gethosts macro (which is called from gaih_inet) used alloca, without
malloc fallback for large responses.  This commit changes this code to
use calloc unconditionally.

This commit also consolidated a second hostent-to-gaih_addrtuple
conversion loop (in gaih_inet) to use the new conversion function.

(cherry picked from commit 4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9)
---
 ChangeLog                   |  10 ++++
 sysdeps/posix/getaddrinfo.c | 130 +++++++++++++++++++++++---------------------
 2 files changed, 79 insertions(+), 61 deletions(-)

diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
index 1ef3f20..fed2d3b 100644
--- a/sysdeps/posix/getaddrinfo.c
+++ b/sysdeps/posix/getaddrinfo.c
@@ -168,9 +168,58 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
   return 0;
 }

+/* Convert struct hostent to a list of struct gaih_addrtuple objects.
+   h_name is not copied, and the struct hostent object must not be
+   deallocated prematurely.  *RESULT must be NULL or a pointer to an
+   object allocated using malloc, which is freed.  */
+static bool
+convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
+				   int family,
+				   struct hostent *h,
+				   struct gaih_addrtuple **result)
+{
+  free (*result);
+  *result = NULL;
+
+  /* Count the number of addresses in h->h_addr_list.  */
+  size_t count = 0;
+  for (char **p = h->h_addr_list; *p != NULL; ++p)
+    ++count;
+
+  /* Report no data if no addresses are available, or if the incoming
+     address size is larger than what we can store.  */
+  if (count == 0 || h->h_length > sizeof (((struct gaih_addrtuple) {}).addr))
+    return true;
+
+  struct gaih_addrtuple *array = calloc (count, sizeof (*array));
+  if (array == NULL)
+    return false;
+
+  for (size_t i = 0; i < count; ++i)
+    {
+      if (family == AF_INET && req->ai_family == AF_INET6)
+	{
+	  /* Perform address mapping. */
+	  array[i].family = AF_INET6;
+	  memcpy(array[i].addr + 3, h->h_addr_list[i], sizeof (uint32_t));
+	  array[i].addr[2] = htonl (0xffff);
+	}
+      else
+	{
+	  array[i].family = family;
+	  memcpy (array[i].addr, h->h_addr_list[i], h->h_length);
+	}
+      array[i].next = array + i + 1;
+    }
+  array[0].name = h->h_name;
+  array[count - 1].next = NULL;
+
+  *result = array;
+  return true;
+}
+
 #define gethosts(_family, _type) \
  {									      \
-  int i;								      \
   int herrno;								      \
   struct hostent th;							      \
   struct hostent *h;							      \
@@ -219,36 +268,23 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
     }									      \
   else if (h != NULL)							      \
     {									      \
-      for (i = 0; h->h_addr_list[i]; i++)				      \
+      /* Make sure that addrmem can be freed.  */			      \
+      if (!malloc_addrmem)						      \
+	addrmem = NULL;							      \
+      if (!convert_hostent_to_gaih_addrtuple (req, _family,h, &addrmem))      \
 	{								      \
-	  if (*pat == NULL)						      \
-	    {								      \
-	      *pat = __alloca (sizeof (struct gaih_addrtuple));		      \
-	      (*pat)->scopeid = 0;					      \
-	    }								      \
-	  uint32_t *addr = (*pat)->addr;				      \
-	  (*pat)->next = NULL;						      \
-	  (*pat)->name = i == 0 ? strdupa (h->h_name) : NULL;		      \
-	  if (_family == AF_INET && req->ai_family == AF_INET6)		      \
-	    {								      \
-	      (*pat)->family = AF_INET6;				      \
-	      addr[3] = *(uint32_t *) h->h_addr_list[i];		      \
-	      addr[2] = htonl (0xffff);					      \
-	      addr[1] = 0;						      \
-	      addr[0] = 0;						      \
-	    }								      \
-	  else								      \
-	    {								      \
-	      (*pat)->family = _family;					      \
-	      memcpy (addr, h->h_addr_list[i], sizeof(_type));		      \
-	    }								      \
-	  pat = &((*pat)->next);					      \
+	  _res.options |= old_res_options & RES_USE_INET6;		      \
+	  result = -EAI_SYSTEM;						      \
+	  goto free_and_return;						      \
 	}								      \
+      *pat = addrmem;							      \
+      /* The conversion uses malloc unconditionally.  */		      \
+      malloc_addrmem = true;						      \
 									      \
       if (localcanon !=	NULL && canon == NULL)				      \
 	canon = strdupa (localcanon);					      \
 									      \
-      if (_family == AF_INET6 && i > 0)					      \
+      if (_family == AF_INET6 && *pat != NULL)				      \
 	got_ipv6 = true;						      \
     }									      \
  }
@@ -612,44 +648,16 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		{
 		  if (h != NULL)
 		    {
-		      int i;
-		      /* We found data, count the number of addresses.  */
-		      for (i = 0; h->h_addr_list[i]; ++i)
-			;
-		      if (i > 0 && *pat != NULL)
-			--i;
-
-		      if (__libc_use_alloca (alloca_used
-					     + i * sizeof (struct gaih_addrtuple)))
-			addrmem = alloca_account (i * sizeof (struct gaih_addrtuple),
-						  alloca_used);
-		      else
-			{
-			  addrmem = malloc (i
-					    * sizeof (struct gaih_addrtuple));
-			  if (addrmem == NULL)
-			    {
-			      result = -EAI_MEMORY;
-			      goto free_and_return;
-			    }
-			  malloc_addrmem = true;
-			}
-
-		      /* Now convert it into the list.  */
-		      struct gaih_addrtuple *addrfree = addrmem;
-		      for (i = 0; h->h_addr_list[i]; ++i)
+		      /* We found data, convert it.  */
+		      if (!convert_hostent_to_gaih_addrtuple
+			  (req, AF_INET, h, &addrmem))
 			{
-			  if (*pat == NULL)
-			    {
-			      *pat = addrfree++;
-			      (*pat)->scopeid = 0;
-			    }
-			  (*pat)->next = NULL;
-			  (*pat)->family = AF_INET;
-			  memcpy ((*pat)->addr, h->h_addr_list[i],
-				  h->h_length);
-			  pat = &((*pat)->next);
+			  result = -EAI_MEMORY;
+			  goto free_and_return;
 			}
+		      *pat = addrmem;
+		      /* The conversion uses malloc unconditionally.  */
+		      malloc_addrmem = true;
 		    }
 		}
 	      else
--
2.9.3


code:
From bdce95930e1d9a7d013d1ba78740243491262879 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 23 May 2016 20:18:34 +0200
Subject: [PATCH] CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call [BZ
 #20112]

The call is technically in a loop, and under certain circumstances
(which are quite difficult to reproduce in a test case), alloca
can be invoked repeatedly during a single call to clntudp_call.
As a result, the available stack space can be exhausted (even
though individual alloca sizes are bounded implicitly by what
can fit into a UDP packet, as a side effect of the earlier
successful send operation).

(cherry picked from commit bc779a1a5b3035133024b21e2f339fe4219fb11c)
---
 ChangeLog         |  7 +++++++
 NEWS              |  4 ++++
 sunrpc/clnt_udp.c | 10 +++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/sunrpc/clnt_udp.c b/sunrpc/clnt_udp.c
index a6cf5f1..4d9acb1 100644
--- a/sunrpc/clnt_udp.c
+++ b/sunrpc/clnt_udp.c
@@ -388,9 +388,15 @@ send_again:
 	  struct sock_extended_err *e;
 	  struct sockaddr_in err_addr;
 	  struct iovec iov;
-	  char *cbuf = (char *) alloca (outlen + 256);
+	  char *cbuf = malloc (outlen + 256);
 	  int ret;

+	  if (cbuf == NULL)
+	    {
+	      cu->cu_error.re_errno = errno;
+	      return (cu->cu_error.re_status = RPC_CANTRECV);
+	    }
+
 	  iov.iov_base = cbuf + 256;
 	  iov.iov_len = outlen;
 	  msg.msg_name = (void *) &err_addr;
@@ -415,10 +421,12 @@ send_again:
 		 cmsg = CMSG_NXTHDR (&msg, cmsg))
 	      if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
 		{
+		  free (cbuf);
 		  e = (struct sock_extended_err *) CMSG_DATA(cmsg);
 		  cu->cu_error.re_errno = e->ee_errno;
 		  return (cu->cu_error.re_status = RPC_CANTRECV);
 		}
+	  free (cbuf);
 	}
 #endif
       do
--
2.9.3


code:
From f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Jun 2017 17:09:55 +0200
Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1
 programs [BZ #21624]

LD_LIBRARY_PATH can only be used to reorder system search paths, which
is not useful functionality.

This makes an exploitable unbounded alloca in _dl_init_paths unreachable
for AT_SECURE=1 programs.

patch from:
https://sourceware.org/git/?p=glibc.git;a=commit;h=f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d
---
 ChangeLog  | 7 +++++++
 elf/rtld.c | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 2446a87..2269dbe 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2422,7 +2422,8 @@ process_envvars (enum mode *modep)

 	case 12:
 	  /* The library search path.  */
-	  if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
+	  if (!__libc_enable_secure
+	      && memcmp (envline, "LIBRARY_PATH", 12) == 0)
 	    {
 	      library_path = &envline[13];
 	      break;
--
2.9.3


code:
From 6d0ba622891bed9d8394eef1935add53003b12e8 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Jun 2017 22:31:04 +0200
Subject: [PATCH] ld.so: Reject overly long LD_PRELOAD path elements

patch from:
https://sourceware.org/git/?p=glibc.git;a=patch;h=6d0ba622891bed9d8394eef1935add53003b12e8

---
 ChangeLog  |  7 ++++++
 elf/rtld.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++------------
 2 files changed, 73 insertions(+), 16 deletions(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 2269dbe..86ae20c 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -99,6 +99,35 @@ uintptr_t __pointer_chk_guard_local
 strong_alias (__pointer_chk_guard_local, __pointer_chk_guard)
 #endif

+/* Length limits for names and paths, to protect the dynamic linker,
+   particularly when __libc_enable_secure is active.  */
+#ifdef NAME_MAX
+# define SECURE_NAME_LIMIT NAME_MAX
+#else
+# define SECURE_NAME_LIMIT 255
+#endif
+#ifdef PATH_MAX
+# define SECURE_PATH_LIMIT PATH_MAX
+#else
+# define SECURE_PATH_LIMIT 1024
+#endif
+
+/* Check that AT_SECURE=0, or that the passed name does not contain
+   directories and is not overly long.  Reject empty names
+   unconditionally.  */
+static bool
+dso_name_valid_for_suid (const char *p)
+{
+  if (__glibc_unlikely (__libc_enable_secure))
+    {
+      /* Ignore pathnames with directories for AT_SECURE=1
+	 programs, and also skip overlong names.  */
+      size_t len = strlen (p);
+      if (len >= SECURE_NAME_LIMIT || memchr (p, '/', len) != NULL)
+	return false;
+    }
+  return *p != '\0';
+}

 /* List of auditing DSOs.  */
 static struct audit_list
@@ -718,6 +747,42 @@ static const char *preloadlist attribute_relro;
 /* Nonzero if information about versions has to be printed.  */
 static int version_info attribute_relro;

+/* The LD_PRELOAD environment variable gives list of libraries
+   separated by white space or colons that are loaded before the
+   executable's dependencies and prepended to the global scope list.
+   (If the binary is running setuid all elements containing a '/' are
+   ignored since it is insecure.)  Return the number of preloads
+   performed.  */
+unsigned int
+handle_ld_preload (const char *preloadlist, struct link_map *main_map)
+{
+  unsigned int npreloads = 0;
+  const char *p = preloadlist;
+  char fname[SECURE_PATH_LIMIT];
+
+  while (*p != '\0')
+    {
+      /* Split preload list at space/colon.  */
+      size_t len = strcspn (p, " :");
+      if (len > 0 && len < sizeof (fname))
+	{
+	  memcpy (fname, p, len);
+	  fname[len] = '\0';
+	}
+      else
+	fname[0] = '\0';
+
+      /* Skip over the substring and the following delimiter.  */
+      p += len;
+      if (*p != '\0')
+	++p;
+
+      if (dso_name_valid_for_suid (fname))
+	npreloads += do_preload (fname, main_map, "LD_PRELOAD");
+    }
+  return npreloads;
+}
+
 static void
 dl_main (const ElfW(Phdr) *phdr,
 	 ElfW(Word) phnum,
@@ -1464,23 +1529,8 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",

   if (__glibc_unlikely (preloadlist != NULL))
     {
-      /* The LD_PRELOAD environment variable gives list of libraries
-	 separated by white space or colons that are loaded before the
-	 executable's dependencies and prepended to the global scope
-	 list.  If the binary is running setuid all elements
-	 containing a '/' are ignored since it is insecure.  */
-      char *list = strdupa (preloadlist);
-      char *p;
-
       HP_TIMING_NOW (start);
-
-      /* Prevent optimizing strsep.  Speed is not important here.  */
-      while ((p = (strsep) (&list, " :")) != NULL)
-	if (p[0] != '\0'
-	    && (__builtin_expect (! __libc_enable_secure, 1)
-		|| strchr (p, '/') == NULL))
-	  npreloads += do_preload (p, main_map, "LD_PRELOAD");
-
+      npreloads += handle_ld_preload (preloadlist, main_map);
       HP_TIMING_NOW (stop);
       HP_TIMING_DIFF (diff, start, stop);
       HP_TIMING_ACCUM_NT (load_time, diff);
--
2.9.3


code:
From 81b82fb966ffbd94353f793ad17116c6088dedd9 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Jun 2017 22:32:12 +0200
Subject: [PATCH] ld.so: Reject overly long LD_AUDIT path elements

Also only process the last LD_AUDIT entry.

patch from:
https://sourceware.org/git/?p=glibc.git;a=commit;h=81b82fb966ffbd94353f793ad17116c6088dedd9

---
 ChangeLog  |  11 +++++++
 elf/rtld.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++---------
 2 files changed, 106 insertions(+), 15 deletions(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 86ae20c..65647fb 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -129,13 +129,91 @@ dso_name_valid_for_suid (const char *p)
   return *p != '\0';
 }

-/* List of auditing DSOs.  */
+/* LD_AUDIT variable contents.  Must be processed before the
+   audit_list below.  */
+const char *audit_list_string;
+
+/* Cyclic list of auditing DSOs.  audit_list->next is the first
+   element.  */
 static struct audit_list
 {
   const char *name;
   struct audit_list *next;
 } *audit_list;

+/* Iterator for audit_list_string followed by audit_list.  */
+struct audit_list_iter
+{
+  /* Tail of audit_list_string still needing processing, or NULL.  */
+  const char *audit_list_tail;
+
+  /* The list element returned in the previous iteration.  NULL before
+     the first element.  */
+  struct audit_list *previous;
+
+  /* Scratch buffer for returning a name which is part of
+     audit_list_string.  */
+  char fname[SECURE_NAME_LIMIT];
+};
+
+/* Initialize an audit list iterator.  */
+static void
+audit_list_iter_init (struct audit_list_iter *iter)
+{
+  iter->audit_list_tail = audit_list_string;
+  iter->previous = NULL;
+}
+
+/* Iterate through both audit_list_string and audit_list.  */
+static const char *
+audit_list_iter_next (struct audit_list_iter *iter)
+{
+  if (iter->audit_list_tail != NULL)
+    {
+      /* First iterate over audit_list_string.  */
+      while (*iter->audit_list_tail != '\0')
+	{
+	  /* Split audit list at colon.  */
+	  size_t len = strcspn (iter->audit_list_tail, ":");
+	  if (len > 0 && len < sizeof (iter->fname))
+	    {
+	      memcpy (iter->fname, iter->audit_list_tail, len);
+	      iter->fname[len] = '\0';
+	    }
+	  else
+	    /* Do not return this name to the caller.  */
+	    iter->fname[0] = '\0';
+
+	  /* Skip over the substring and the following delimiter.  */
+	  iter->audit_list_tail += len;
+	  if (*iter->audit_list_tail == ':')
+	    ++iter->audit_list_tail;
+
+	  /* If the name is valid, return it.  */
+	  if (dso_name_valid_for_suid (iter->fname))
+	    return iter->fname;
+	  /* Otherwise, wrap around and try the next name.  */
+	}
+      /* Fall through to the procesing of audit_list.  */
+    }
+
+  if (iter->previous == NULL)
+    {
+      if (audit_list == NULL)
+	/* No pre-parsed audit list.  */
+	return NULL;
+      /* Start of audit list.  The first list element is at
+	 audit_list->next (cyclic list).  */
+      iter->previous = audit_list->next;
+      return iter->previous->name;
+    }
+  if (iter->previous == audit_list)
+    /* Cyclic list wrap-around.  */
+    return NULL;
+  iter->previous = iter->previous->next;
+  return iter->previous->name;
+}
+
 #ifndef HAVE_INLINED_SYSCALLS
 /* Set nonzero during loading and initialization of executable and
    libraries, cleared before the executable's entry point runs.  This
@@ -1305,11 +1383,13 @@ of this helper program; chances are you did not intend to run this program.\n\
     GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid ();

   /* If we have auditing DSOs to load, do it now.  */
-  if (__glibc_unlikely (audit_list != NULL))
+  bool need_security_init = true;
+  if (__glibc_unlikely (audit_list != NULL)
+      || __glibc_unlikely (audit_list_string != NULL))
     {
-      /* Iterate over all entries in the list.  The order is important.  */
       struct audit_ifaces *last_audit = NULL;
-      struct audit_list *al = audit_list->next;
+      struct audit_list_iter al_iter;
+      audit_list_iter_init (&al_iter);

       /* Since we start using the auditing DSOs right away we need to
 	 initialize the data structures now.  */
@@ -1320,9 +1400,14 @@ of this helper program; chances are you did not intend to run this program.\n\
 	 use different values (especially the pointer guard) and will
 	 fail later on.  */
       security_init ();
+      need_security_init = false;

-      do
+      while (true)
 	{
+	  const char *name = audit_list_iter_next (&al_iter);
+	  if (name == NULL)
+	    break;
+
 	  int tls_idx = GL(dl_tls_max_dtv_idx);

 	  /* Now it is time to determine the layout of the static TLS
@@ -1331,7 +1416,7 @@ of this helper program; chances are you did not intend to run this program.\n\
 	     no DF_STATIC_TLS bit is set.  The reason is that we know
 	     glibc will use the static model.  */
 	  struct dlmopen_args dlmargs;
-	  dlmargs.fname = al->name;
+	  dlmargs.fname = name;
 	  dlmargs.map = NULL;

 	  const char *objname;
@@ -1344,7 +1429,7 @@ of this helper program; chances are you did not intend to run this program.\n\
 	    not_loaded:
 	      _dl_error_printf ("\
 ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
-				al->name, err_str);
+				name, err_str);
 	      if (malloced)
 		free ((char *) err_str);
 	    }
@@ -1448,10 +1533,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
 		  goto not_loaded;
 		}
 	    }
-
-	  al = al->next;
 	}
-      while (al != audit_list->next);

       /* If we have any auditing modules, announce that we already
 	 have two objects loaded.  */
@@ -1715,7 +1797,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
   if (tcbp == NULL)
     tcbp = init_tls ();

-  if (__glibc_likely (audit_list == NULL))
+  if (__glibc_likely (need_security_init))
     /* Initialize security features.  But only if we have not done it
        earlier.  */
     security_init ();
@@ -2346,9 +2428,7 @@ process_dl_audit (char *str)
   char *p;

   while ((p = (strsep) (&str, ":")) != NULL)
-    if (p[0] != '\0'
-	&& (__builtin_expect (! __libc_enable_secure, 1)
-	    || strchr (p, '/') == NULL))
+    if (dso_name_valid_for_suid (p))
       {
 	/* This is using the local malloc, not the system malloc.  The
 	   memory can never be freed.  */
@@ -2412,7 +2492,7 @@ process_envvars (enum mode *modep)
 	      break;
 	    }
 	  if (memcmp (envline, "AUDIT", 5) == 0)
-	    process_dl_audit (&envline[6]);
+	    audit_list_string = &envline[6];
 	  break;

 	case 7:
--
2.9.3


code:
This patch allows libc to be used with the heavily-patched kernel found
on CentOS 6, which identifies itself as 2.6.32.

See <https://lists.gnu.org/archive/html/guix-devel/2018-02/msg00392.html>.

Patch taken from Nixpkgs.

diff --git a/sysdeps/unix/sysv/linux/configure b/sysdeps/unix/sysv/linux/configure
index cace758c01..38fe7fe0b0 100644
--- a/sysdeps/unix/sysv/linux/configure
+++ b/sysdeps/unix/sysv/linux/configure
@@ -69,7 +69,7 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for kernel header at least $minimum_kernel" >&5
 $as_echo_n "checking for kernel header at least $minimum_kernel... " >&6; }
 decnum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/(\1 * 65536 + \2 * 256 + \3)/'`;
-abinum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
+abinum=`echo "2.6.32.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <linux/version.h>
diff --git a/sysdeps/unix/sysv/linux/configure.ac b/sysdeps/unix/sysv/linux/configure.ac
index 13abda0a51..6abc12eaed 100644
--- a/sysdeps/unix/sysv/linux/configure.ac
+++ b/sysdeps/unix/sysv/linux/configure.ac
@@ -50,7 +50,7 @@ fi
 AC_MSG_CHECKING(for kernel header at least $minimum_kernel)
 changequote(,)dnl
 decnum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/(\1 * 65536 + \2 * 256 + \3)/'`;
-abinum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
+abinum=`echo "2.6.32.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
 changequote([,])dnl
 AC_TRY_COMPILE([#include <linux/version.h>
 #if LINUX_VERSION_CODE < $decnum
diff --git a/sysdeps/unix/sysv/linux/dl-osinfo.h b/sysdeps/unix/sysv/linux/dl-osinfo.h
index 823cd8224d..482caaeeec 100644
--- a/sysdeps/unix/sysv/linux/dl-osinfo.h
+++ b/sysdeps/unix/sysv/linux/dl-osinfo.h
@@ -39,7 +39,7 @@
 	  GLRO(dl_osversion) = version;					      \
 									      \
 	/* Now we can test with the required version.  */		      \
-	if (__LINUX_KERNEL_VERSION > 0 && version < __LINUX_KERNEL_VERSION)   \
+	if (__LINUX_KERNEL_VERSION > 0 && version < __LINUX_KERNEL_VERSION && version != 0x020620)   \
 	  /* Not sufficent.  */						      \
 	  FATAL ("FATAL: kernel too old\n");				      \
       }									      \


code:
We want to allow builds in chroots that lack /bin/sh.  Thus, system(3)
and popen(3) need to be tweaked to use the right shell.  For the bootstrap
glibc, we just use whatever `sh' can be found in $PATH.  The final glibc
instead uses the hard-coded absolute file name of `bash'.

--- a/sysdeps/posix/system.c
+++ b/sysdeps/posix/system.c
@@ -134,7 +134,7 @@ do_system (const char *line)
       INIT_LOCK ();

       /* Exec the shell.  */
-      (void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);
+      (void) __execvpe (SHELL_NAME, (char *const *) new_argv, __environ);
       _exit (127);
     }
   else if (pid < (pid_t) 0)

--- a/libio/iopopen.c
+++ b/libio/iopopen.c
@@ -145,7 +145,7 @@ _IO_new_proc_open (fp, command, mode)
 	    __close_nocancel (fd);
 	}

-      execl ("/bin/sh", "sh", "-c", command, (char *) 0);
+      execlp ("sh", "sh", "-c", command, (char *) 0);
       _exit (127);
     }
   __close_nocancel (child_end);


code:
Fix a regression in glibc 2.27 when built without ldconfig.  See
<https://sourceware.org/bugzilla/show_bug.cgi?id=22977> for details.

diff --git a/include/libc-symbols.h b/include/libc-symbols.h
index 6137304b0b..7d630f36d8 100644
--- a/include/libc-symbols.h
+++ b/include/libc-symbols.h
@@ -508,7 +508,7 @@ for linking")
 # ifndef __ASSEMBLER__
 #  if !defined SHARED && IS_IN (libc) && !defined LIBC_NONSHARED \
       && (!defined PIC || !defined NO_HIDDEN_EXTERN_FUNC_IN_PIE) \
-      && !defined NO_HIDDEN
+      && !defined NO_HIDDEN && defined USE_LDCONFIG
 #   define __hidden_proto_hiddenattr(attrs...) \
   __attribute__ ((visibility ("hidden"), ##attrs))
 #   define hidden_proto(name, attrs...) \


code:
This patch allows us to use glibc's build system to build locales
in a package separate from glibc.

  1. Use 'localedef' from $PATH since we are not rebuilding it.
  2. Use '--no-archive' to avoid building the big locale archive, and
     because the already-built 'localedef' would want to write it
     to '/run/current-system/locale', which is not possible.
  3. Pass $(inst_complocaledir)/$$locale to install files in the right
     place, and because otherwise, 'localedef' fails with:
     "cannot write output files to `(null)'".

--- glibc-2.27/localedata/Makefile
+++ glibc-2.27/localedata/Makefile
@@ -199,7 +199,7 @@ INSTALL-SUPPORTED-LOCALES=$(addprefix install-, $(SUPPORTED-LOCALES))

 # Sometimes the whole collection of locale files should be installed.
 LOCALEDEF=I18NPATH=. GCONV_PATH=$(common-objpfx)iconvdata LC_ALL=C \
-$(rtld-prefix) $(common-objpfx)locale/localedef
+  localedef --no-archive
 install-locales: $(INSTALL-SUPPORTED-LOCALES)

 install-locales-dir:
@@ -224,7 +224,7 @@ $(INSTALL-SUPPORTED-LOCALES): install-locales-dir
 	input=`echo $$locale | sed 's/\([^.]*\)[^@]*\(.*\)/\1\2/'`; \
 	$(LOCALEDEF) $$flags --alias-file=../intl/locale.alias \
 		     -i locales/$$input -f charmaps/$$charset \
-		     $(addprefix --prefix=,$(install_root)) $$locale \
+		     $(addprefix --prefix=,$(install_root)) $(inst_complocaledir)/$$locale \
 	&& echo ' done'; \

 tst-setlocale-ENV = LC_ALL=ja_JP.EUC-JP


code:
Extracted from glibc upstream git repository.  Changes to the ChangeLog have
been removed.  This patch is needed to fix spurious segmentation faults on
i686.

From 3abeeec5f46ff036bd9df60bb096e20314ccd078 Mon Sep 17 00:00:00 2001
From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Tue, 14 Mar 2017 14:16:13 -0300
Subject: [PATCH] Fix i686 memchr overflow calculation (BZ#21182)

This patch fixes the regression added by 23d2770 for final address
overflow calculation.  The subtraction of the considered size (16)
at line 120 is at wrong place, for sizes less than 16 subsequent
overflow check will not take in consideration an invalid size (since
the subtraction will be negative).  Also, the lea instruction also
does not raise the carry flag (CF) that is used in subsequent jbe
to check for overflow.

The fix is to follow x86_64 logic from 3daef2c where the overflow
is first check and a sub instruction is issued.  In case of resulting
negative size, CF will be set by the sub instruction and a NULL
result will be returned.  The patch also add similar tests reported
in bug report.

Checked on i686-linux-gnu and x86_64-linux-gnu.

	* string/test-memchr.c (do_test): Add BZ#21182 checks for address
	near end of a page.
	* sysdeps/i386/i686/multiarch/memchr-sse2.S (__memchr): Fix
	overflow calculation.
---
 string/test-memchr.c                      | 6 ++++++
 sysdeps/i386/i686/multiarch/memchr-sse2.S | 2 +-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/string/test-memchr.c b/string/test-memchr.c
index 2403c9242b..669e092e7d 100644
--- a/string/test-memchr.c
+++ b/string/test-memchr.c
@@ -210,6 +210,12 @@ test_main (void)
       do_test (0, i, i + 1, i + 1, 0);
     }

+  /* BZ#21182 - wrong overflow calculation for i686 implementation
+     with address near end of the page.  */
+  for (i = 2; i < 16; ++i)
+    /* page_size is in fact getpagesize() * 2.  */
+    do_test (page_size / 2 - i, i, i, 1, 0x9B);
+
   do_random_tests ();
   return ret;
 }
diff --git a/sysdeps/i386/i686/multiarch/memchr-sse2.S b/sysdeps/i386/i686/multiarch/memchr-sse2.S
index 910679cfc0..e41f324a77 100644
--- a/sysdeps/i386/i686/multiarch/memchr-sse2.S
+++ b/sysdeps/i386/i686/multiarch/memchr-sse2.S
@@ -117,7 +117,6 @@ L(crosscache):

 # ifndef USE_AS_RAWMEMCHR
 	jnz	L(match_case2_prolog1)
-	lea	-16(%edx), %edx
         /* Calculate the last acceptable address and check for possible
            addition overflow by using satured math:
            edx = ecx + edx
@@ -125,6 +124,7 @@ L(crosscache):
 	add	%ecx, %edx
 	sbb	%eax, %eax
 	or	%eax, %edx
+	sub	$16, %edx
 	jbe	L(return_null)
 	lea	16(%edi), %edi
 # else
--
2.12.2


code:
This fixes <https://sourceware.org/bugzilla/show_bug.cgi?id=18781>
whereby, on 32-bit platforms, libc 2.22 would fail to pass O_LARGEFILE
to 'openat'.  This was caught by 'tests/sparse03.at' in the tar
test suite.

commit eb32b0d40308166c4d8f6330cc2958cb1e545075
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon Aug 10 14:12:47 2015 +0200

    Readd O_LARGEFILE flag for openat64 (bug 18781)

--- a/sysdeps/unix/sysv/linux/openat.c
+++ b/sysdeps/unix/sysv/linux/openat.c
@@ -68,6 +68,11 @@ __OPENAT (int fd, const char *file, int oflag, ...)
       va_end (arg);
     }

+  /* We have to add the O_LARGEFILE flag for openat64.  */
+#ifdef MORE_OFLAGS
+  oflag |= MORE_OFLAGS;
+#endif
+
   return SYSCALL_CANCEL (openat, fd, file, oflag, mode);
 }
 libc_hidden_def (__OPENAT)


code:
This patch reinstates fallback code when the 'prlimit64' system call is
missing by reverting the relevant part of this upstream commit:

  commit 695d7d138eda449678a1650a8b8b58181033353f
  Author: Joseph Myers <joseph@codesourcery.com>
  Date:   Tue May 9 14:05:09 2017 +0000

      Assume prlimit64 is available.

The fallback code is useful on systems that lack 'prlimit64', such as the
2.6.32-on-steroid kernel found on RHEL 6:

  <https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00349.html>

diff --git a/sysdeps/unix/sysv/linux/getrlimit64.c b/sysdeps/unix/sysv/linux/getrlimit64.c
index 37c173286f..56af3c0646 100644
--- b/sysdeps/unix/sysv/linux/getrlimit64.c
+++ a/sysdeps/unix/sysv/linux/getrlimit64.c
@@ -35,7 +35,40 @@
 int
 __getrlimit64 (enum __rlimit_resource resource, struct rlimit64 *rlimits)
 {
-  return INLINE_SYSCALL_CALL (prlimit64, 0, resource, NULL, rlimits);
+#ifdef __NR_prlimit64
+  int res = INLINE_SYSCALL_CALL (prlimit64, 0, resource, NULL, rlimits);
+  if (res == 0 || errno != ENOSYS)
+    return res;
+#endif
+
+/* The fallback code only makes sense if the platform supports either
+   __NR_ugetrlimit and/or __NR_getrlimit.  */
+#if defined (__NR_ugetrlimit) || defined (__NR_getrlimit)
+# ifndef __NR_ugetrlimit
+#  define __NR_ugetrlimit __NR_getrlimit
+# endif
+# if __RLIM_T_MATCHES_RLIM64_T
+#  define rlimits32 (*rlimits)
+# else
+  struct rlimit rlimits32;
+# endif
+
+  if (INLINE_SYSCALL_CALL (ugetrlimit, resource, &rlimits32) < 0)
+    return -1;
+
+# if !__RLIM_T_MATCHES_RLIM64_T
+  if (rlimits32.rlim_cur == RLIM_INFINITY)
+    rlimits->rlim_cur = RLIM64_INFINITY;
+  else
+    rlimits->rlim_cur = rlimits32.rlim_cur;
+  if (rlimits32.rlim_max == RLIM_INFINITY)
+    rlimits->rlim_max = RLIM64_INFINITY;
+  else
+    rlimits->rlim_max = rlimits32.rlim_max;
+# endif /* !__RLIM_T_MATCHES_RLIM64_T */
+#endif /* defined (__NR_ugetrlimit) || defined (__NR_getrlimit)  */
+
+  return 0;
 }
 libc_hidden_def (__getrlimit64)

diff --git a/sysdeps/unix/sysv/linux/setrlimit.c b/sysdeps/unix/sysv/linux/setrlimit.c
index 01812ac355..8773c78236 100644
--- b/sysdeps/unix/sysv/linux/setrlimit.c
+++ a/sysdeps/unix/sysv/linux/setrlimit.c
@@ -34,6 +34,7 @@
 int
 __setrlimit (enum __rlimit_resource resource, const struct rlimit *rlim)
 {
+# ifdef __NR_prlimit64
   struct rlimit64 rlim64;

   if (rlim->rlim_cur == RLIM_INFINITY)
@@ -45,7 +46,11 @@
   else
     rlim64.rlim_max = rlim->rlim_max;

-  return INLINE_SYSCALL_CALL (prlimit64, 0, resource, &rlim64, NULL);
+  int res = INLINE_SYSCALL_CALL (prlimit64, 0, resource, &rlim64, NULL);
+  if (res == 0 || errno != ENOSYS)
+    return res;
+# endif
+  return INLINE_SYSCALL_CALL (setrlimit, resource, rlim);
 }

 # if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_2)
diff --git a/sysdeps/unix/sysv/linux/setrlimit64.c b/sysdeps/unix/sysv/linux/setrlimit64.c
index 2dd129d99e..db1960fc18 100644
--- b/sysdeps/unix/sysv/linux/setrlimit64.c
+++ a/sysdeps/unix/sysv/linux/setrlimit64.c
@@ -36,7 +36,36 @@
 int
 __setrlimit64 (enum __rlimit_resource resource, const struct rlimit64 *rlimits)
 {
-  return INLINE_SYSCALL_CALL (prlimit64, 0, resource, rlimits, NULL);
+  int res;
+
+#ifdef __NR_prlimit64
+  res = INLINE_SYSCALL_CALL (prlimit64, 0, resource, rlimits, NULL);
+  if (res == 0 || errno != ENOSYS)
+    return res;
+#endif
+
+/* The fallback code only makes sense if the platform supports
+   __NR_setrlimit.  */
+#ifdef __NR_setrlimit
+# if !__RLIM_T_MATCHES_RLIM64_T
+  struct rlimit rlimits32;
+
+  if (rlimits->rlim_cur >= RLIM_INFINITY)
+    rlimits32.rlim_cur = RLIM_INFINITY;
+  else
+    rlimits32.rlim_cur = rlimits->rlim_cur;
+  if (rlimits->rlim_max >= RLIM_INFINITY)
+    rlimits32.rlim_max = RLIM_INFINITY;
+  else
+    rlimits32.rlim_max = rlimits->rlim_max;
+# else
+#  define rlimits32 (*rlimits)
+# endif
+
+  res = INLINE_SYSCALL_CALL (setrlimit, resource, &rlimits32);
+#endif
+
+  return res;
 }
 weak_alias (__setrlimit64, setrlimit64)


code:
Copied from Debian.

2017-06-14  Florian Weimer  <fweimer@redhat.com>

	* sysdeps/i386/i686/multiarch/strcspn-c.c: Add IS_IN (libc) guard.
	* sysdeps/i386/i686/multiarch/varshift.c: Likewise.

--- a/sysdeps/i386/i686/multiarch/strcspn-c.c
+++ b/sysdeps/i386/i686/multiarch/strcspn-c.c
@@ -1,2 +1,4 @@
-#define __strcspn_sse2 __strcspn_ia32
-#include <sysdeps/x86_64/multiarch/strcspn-c.c>
+#if IS_IN (libc)
+# define __strcspn_sse2 __strcspn_ia32
+# include <sysdeps/x86_64/multiarch/strcspn-c.c>
+#endif
--- a/sysdeps/i386/i686/multiarch/varshift.c
+++ b/sysdeps/i386/i686/multiarch/varshift.c
@@ -1 +1,3 @@
-#include <sysdeps/x86_64/multiarch/varshift.c>
+#if IS_IN (libc)
+# include <sysdeps/x86_64/multiarch/varshift.c>
+#endif


code:
The format of locale data can be incompatible between libc versions, and
loading incompatible data can lead to 'setlocale' returning EINVAL at best
or triggering an assertion failure at worst.  See
https://lists.gnu.org/archive/html/guix-devel/2015-09/msg00717.html
for background information.

To address that, this patch changes libc to honor a new 'GUIX_LOCPATH'
variable, and to look for locale data in version-specific sub-directories of
that variable.  So, if GUIX_LOCPATH=/foo:/bar, locale data is searched for in
/foo/X.Y and /bar/X.Y, where X.Y is the libc version number.

That way, a single 'GUIX_LOCPATH' setting can work even if different libc
versions coexist on the system.

--- a/locale/newlocale.c
+++ b/locale/newlocale.c
@@ -30,6 +30,7 @@
 /* Lock for protecting global data.  */
 __libc_rwlock_define (extern , __libc_setlocale_lock attribute_hidden)

+extern error_t compute_locale_search_path (char **, size_t *);

 /* Use this when we come along an error.  */
 #define ERROR_RETURN							      \
@@ -48,7 +49,6 @@ __newlocale (int category_mask, const char *locale, __locale_t base)
   __locale_t result_ptr;
   char *locale_path;
   size_t locale_path_len;
-  const char *locpath_var;
   int cnt;
   size_t names_len;

@@ -102,17 +102,8 @@ __newlocale (int category_mask, const char *locale, __locale_t base)
   locale_path = NULL;
   locale_path_len = 0;

-  locpath_var = getenv ("LOCPATH");
-  if (locpath_var != NULL && locpath_var[0] != '\0')
-    {
-      if (__argz_create_sep (locpath_var, ':',
-			     &locale_path, &locale_path_len) != 0)
-	return NULL;
-
-      if (__argz_add_sep (&locale_path, &locale_path_len,
-			  _nl_default_locale_path, ':') != 0)
-	return NULL;
-    }
+  if (compute_locale_search_path (&locale_path, &locale_path_len) != 0)
+    return NULL;

   /* Get the names for the locales we are interested in.  We either
      allow a composite name or a single name.  */
diff --git a/locale/setlocale.c b/locale/setlocale.c
index ead030d..0c0e314 100644
--- a/locale/setlocale.c
+++ b/locale/setlocale.c
@@ -215,12 +215,65 @@ setdata (int category, struct __locale_data *data)
     }
 }

+/* Return in *LOCALE_PATH and *LOCALE_PATH_LEN the locale data search path as
+   a colon-separated list.  Return ENOMEN on error, zero otherwise.  */
+error_t
+compute_locale_search_path (char **locale_path, size_t *locale_path_len)
+{
+  char* guix_locpath_var = getenv ("GUIX_LOCPATH");
+  char *locpath_var = getenv ("LOCPATH");
+
+  if (guix_locpath_var != NULL && guix_locpath_var[0] != '\0')
+    {
+      /* Entries in 'GUIX_LOCPATH' take precedence over 'LOCPATH'.  These
+	 entries are systematically prefixed with "/X.Y" where "X.Y" is the
+	 libc version.  */
+      if (__argz_create_sep (guix_locpath_var, ':',
+			     locale_path, locale_path_len) != 0
+	  || __argz_suffix_entries (locale_path, locale_path_len,
+				    "/" VERSION) != 0)
+	goto bail_out;
+    }
+
+  if (locpath_var != NULL && locpath_var[0] != '\0')
+    {
+      char *reg_locale_path = NULL;
+      size_t reg_locale_path_len = 0;
+
+      if (__argz_create_sep (locpath_var, ':',
+			     &reg_locale_path, &reg_locale_path_len) != 0)
+	goto bail_out;
+
+      if (__argz_append (locale_path, locale_path_len,
+			 reg_locale_path, reg_locale_path_len) != 0)
+	goto bail_out;
+
+      free (reg_locale_path);
+    }
+
+  if (*locale_path != NULL)
+    {
+      /* Append the system default locale directory.  */
+      if (__argz_add_sep (locale_path, locale_path_len,
+			  _nl_default_locale_path, ':') != 0)
+	goto bail_out;
+    }
+
+  return 0;
+
+ bail_out:
+  free (*locale_path);
+  *locale_path = NULL;
+  *locale_path_len = 0;
+
+  return ENOMEM;
+}
+
 char *
 setlocale (int category, const char *locale)
 {
   char *locale_path;
   size_t locale_path_len;
-  const char *locpath_var;
   char *composite;

   /* Sanity check for CATEGORY argument.  */
@@ -251,17 +304,10 @@ setlocale (int category, const char *locale)
   locale_path = NULL;
   locale_path_len = 0;

-  locpath_var = getenv ("LOCPATH");
-  if (locpath_var != NULL && locpath_var[0] != '\0')
+  if (compute_locale_search_path (&locale_path, &locale_path_len) != 0)
     {
-      if (__argz_create_sep (locpath_var, ':',
-			     &locale_path, &locale_path_len) != 0
-	  || __argz_add_sep (&locale_path, &locale_path_len,
-			     _nl_default_locale_path, ':') != 0)
-	{
-	  __libc_rwlock_unlock (__libc_setlocale_lock);
-	  return NULL;
-	}
+      __libc_rwlock_unlock (__libc_setlocale_lock);
+      return NULL;
     }

   if (category == LC_ALL)
diff --git a/string/Makefile b/string/Makefile
index 8424a61..f925503 100644
--- a/string/Makefile
+++ b/string/Makefile
@@ -38,7 +38,7 @@ routines	:= strcat strchr strcmp strcoll strcpy strcspn		\
 		   swab strfry memfrob memmem rawmemchr strchrnul	\
 		   $(addprefix argz-,append count create ctsep next	\
 				     delete extract insert stringify	\
-				     addsep replace)			\
+				     addsep replace suffix)		\
 		   envz basename					\
 		   strcoll_l strxfrm_l string-inlines memrchr		\
 		   xpg-strerror strerror_l
diff --git a/string/argz-suffix.c b/string/argz-suffix.c
new file mode 100644
index 0000000..505b0f2
--- /dev/null
+++ b/string/argz-suffix.c
@@ -0,0 +1,56 @@
+/* Copyright (C) 2015 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+   Contributed by Ludovic Courtès <ludo@gnu.org>.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <argz.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+error_t
+__argz_suffix_entries (char **argz, size_t *argz_len, const char *suffix)
+
+{
+  size_t suffix_len = strlen (suffix);
+  size_t count = __argz_count (*argz, *argz_len);
+  size_t new_argz_len = *argz_len + count * suffix_len;
+  char *new_argz = malloc (new_argz_len);
+
+  if (new_argz)
+    {
+      char *p = new_argz, *entry;
+
+      for (entry = *argz;
+	   entry != NULL;
+	   entry = argz_next (*argz, *argz_len, entry))
+	{
+	  p = stpcpy (p, entry);
+	  p = stpcpy (p, suffix);
+	  p++;
+	}
+
+      free (*argz);
+      *argz = new_argz;
+      *argz_len = new_argz_len;
+
+      return 0;
+    }
+  else
+    return ENOMEM;
+}
+weak_alias (__argz_suffix_entries, argz_suffix_entries)
diff --git a/string/argz.h b/string/argz.h
index bb62a31..d276a35 100644
--- a/string/argz.h
+++ b/string/argz.h
@@ -134,6 +134,16 @@ extern error_t argz_replace (char **__restrict __argz,
 			     const char *__restrict __str,
 			     const char *__restrict __with,
 			     unsigned int *__restrict __replace_count);
+
+/* Suffix each entry of ARGZ & ARGZ_LEN with SUFFIX.  Return 0 on success,
+   and ENOMEN if memory cannot be allocated.  */
+extern error_t __argz_suffix_entries (char **__restrict __argz,
+				      size_t *__restrict __argz_len,
+				      const char *__restrict __suffix);
+extern error_t argz_suffix_entries (char **__restrict __argz,
+				    size_t *__restrict __argz_len,
+				    const char *__restrict __suffix);
+

 /* Returns the next entry in ARGZ & ARGZ_LEN after ENTRY, or NULL if there
    are no more.  If entry is NULL, then the first entry is returned.  This


code:
Fix symbol demangling for GCC 5, as reported at:

  https://github.com/google/glog/issues/14

Patch from:

  https://github.com/google/glog/pull/50

From b1639e3014996fbc7635870e013559c54e7e3b2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mart=C3=ADnez=20Moreno?= <ender@debian.org>
Date: Thu, 13 Aug 2015 09:31:26 -0700
Subject: [PATCH] Fix ABI demangling for the GCC 5.x case.

When glog is compiled with gcc-5.2 in cxx11 ABI mode, it barfs about unmangled symbols.  This patches it getting inspiration from binutils and demangle.cc itself, although it may be totally wrong or maybe have to use ParseAbiTag in more places.  I haven't read the spec for the symbols, though.

This patch makes the demangle unit test pass correctly.
---
 src/demangle.cc | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/demangle.cc b/src/demangle.cc
index e858181..0f0c831 100644
--- a/src/demangle.cc
+++ b/src/demangle.cc
@@ -439,6 +439,7 @@ static bool ParseExprPrimary(State *state);
 static bool ParseLocalName(State *state);
 static bool ParseDiscriminator(State *state);
 static bool ParseSubstitution(State *state);
+static bool ParseAbiTag(State *state);

 // Implementation note: the following code is a straightforward
 // translation of the Itanium C++ ABI defined in BNF with a couple of
@@ -567,6 +568,8 @@ static bool ParseNestedName(State *state) {
 static bool ParsePrefix(State *state) {
   bool has_something = false;
   while (true) {
+    if (ParseAbiTag(state))
+      continue;
     MaybeAppendSeparator(state);
     if (ParseTemplateParam(state) ||
         ParseSubstitution(state) ||
@@ -585,6 +588,22 @@ static bool ParsePrefix(State *state) {
   return true;
 }

+// <abi-tag>          ::= B <source-name>
+static bool ParseAbiTag(State *state) {
+  State copy = *state;
+
+  Append(state, "[", 1);
+  if (ParseOneCharToken(state, 'B') &&
+      ParseSourceName(state))
+  {
+    Append(state, "]", 1);
+    return true;
+  }
+
+  *state = copy;
+  return false;
+}
+
 // <unqualified-name> ::= <operator-name>
 //                    ::= <ctor-dtor-name>
 //                    ::= <source-name>


code:
This patch was taken from Nixpkgs.

From 616381bc25b0e90198683fb049f994e82d467d96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sat, 13 May 2017 02:45:49 +0200
Subject: [PATCH] Don't use hardcoded /sbin, /usr/bin etc. paths. Fixes
 #1450546.

Instead, rely on programs to be in PATH, as gluster already
does in many places across its code base.

Change-Id: Id21152fe42f5b67205d8f1571b0656c4d5f74246
---
 contrib/fuse-lib/mount-common.c               |  8 ++++----
 xlators/mgmt/glusterd/src/glusterd-ganesha.c  |  6 +++---
 xlators/mgmt/glusterd/src/glusterd-quota.c    |  6 +++---
 xlators/mgmt/glusterd/src/glusterd-snapshot.c |  4 ++--
 xlators/mgmt/glusterd/src/glusterd-utils.c    | 14 +-------------
 5 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/contrib/fuse-lib/mount-common.c b/contrib/fuse-lib/mount-common.c
index e9f80fe81..6380dd867 100644
--- a/contrib/fuse-lib/mount-common.c
+++ b/contrib/fuse-lib/mount-common.c
@@ -255,16 +255,16 @@ fuse_mnt_umount (const char *progname, const char *abs_mnt,
                         exit (1);
                 }
 #ifdef GF_LINUX_HOST_OS
-                execl ("/bin/umount", "/bin/umount", "-i", rel_mnt,
+                execl ("umount", "umount", "-i", rel_mnt,
                        lazy ? "-l" : NULL, NULL);
-                GFFUSE_LOGERR ("%s: failed to execute /bin/umount: %s",
+                GFFUSE_LOGERR ("%s: failed to execute umount: %s",
                                progname, strerror (errno));
 #elif __NetBSD__
                 /* exitting the filesystem causes the umount */
                 exit (0);
 #else
-                execl ("/sbin/umount", "/sbin/umount", "-f", rel_mnt, NULL);
-                GFFUSE_LOGERR ("%s: failed to execute /sbin/umount: %s",
+                execl ("umount", "umount", "-f", rel_mnt, NULL);
+                GFFUSE_LOGERR ("%s: failed to execute umount: %s",
                                progname, strerror (errno));
 #endif /* GF_LINUX_HOST_OS */
                 exit (1);
diff --git a/xlators/mgmt/glusterd/src/glusterd-quota.c b/xlators/mgmt/glusterd/src/glusterd-quota.c
index 0e6629cf0..fcb4738b7 100644
--- a/xlators/mgmt/glusterd/src/glusterd-quota.c
+++ b/xlators/mgmt/glusterd/src/glusterd-quota.c
@@ -30,7 +30,7 @@

 #ifndef _PATH_SETFATTR
 # ifdef GF_LINUX_HOST_OS
-#  define _PATH_SETFATTR "/usr/bin/setfattr"
+#  define _PATH_SETFATTR "setfattr"
 # endif
 # ifdef __NetBSD__
 #  define _PATH_SETFATTR "/usr/pkg/bin/setfattr"
@@ -335,7 +335,7 @@ _glusterd_quota_initiate_fs_crawl (glusterd_conf_t *priv,

                 if (type == GF_QUOTA_OPTION_TYPE_ENABLE ||
                     type == GF_QUOTA_OPTION_TYPE_ENABLE_OBJECTS)
-                        runner_add_args (&runner, "/usr/bin/find", ".", NULL);
+                        runner_add_args (&runner, "find", ".", NULL);

                 else if (type == GF_QUOTA_OPTION_TYPE_DISABLE) {

@@ -351,7 +351,7 @@ _glusterd_quota_initiate_fs_crawl (glusterd_conf_t *priv,
                                          VIRTUAL_QUOTA_XATTR_CLEANUP_KEY, "1",
                                          "{}", "\\", ";", NULL);
 #else
-                        runner_add_args (&runner, "/usr/bin/find", ".",
+                        runner_add_args (&runner, "find", ".",
                                          "-exec", _PATH_SETFATTR, "-n",
                                          VIRTUAL_QUOTA_XATTR_CLEANUP_KEY, "-v",
                                          "1", "{}", "\\", ";", NULL);
diff --git a/xlators/mgmt/glusterd/src/glusterd-snapshot.c b/xlators/mgmt/glusterd/src/glusterd-snapshot.c
index da0152366..f0d135350 100644
--- a/xlators/mgmt/glusterd/src/glusterd-snapshot.c
+++ b/xlators/mgmt/glusterd/src/glusterd-snapshot.c
@@ -121,7 +121,7 @@ glusterd_build_snap_device_path (char *device, char *snapname,
         }

         runinit (&runner);
-        runner_add_args (&runner, "/sbin/lvs", "--noheadings", "-o", "vg_name",
+        runner_add_args (&runner, "lvs", "--noheadings", "-o", "vg_name",
                          device, NULL);
         runner_redir (&runner, STDOUT_FILENO, RUN_PIPE);
         snprintf (msg, sizeof (msg), "Get volume group for device %s", device);
@@ -1982,7 +1982,7 @@ glusterd_is_thinp_brick (char *device, uint32_t *op_errno)

         runinit (&runner);

-        runner_add_args (&runner, "/sbin/lvs", "--noheadings", "-o", "pool_lv",
+        runner_add_args (&runner, "lvs", "--noheadings", "-o", "pool_lv",
                          device, NULL);
         runner_redir (&runner, STDOUT_FILENO, RUN_PIPE);
         runner_log (&runner, this->name, GF_LOG_DEBUG, msg);
diff --git a/xlators/mgmt/glusterd/src/glusterd-utils.c b/xlators/mgmt/glusterd/src/glusterd-utils.c
index 51db13df0..6fa7b92f9 100644
--- a/xlators/mgmt/glusterd/src/glusterd-utils.c
+++ b/xlators/mgmt/glusterd/src/glusterd-utils.c
@@ -6027,7 +6027,6 @@ static struct fs_info {
         char *fs_tool_pattern;
         char *fs_tool_pkg;
 } glusterd_fs[] = {
-        /* some linux have these in /usr/sbin/and others in /sbin/? */
         { "xfs", "xfs_info", NULL, "isize=", "xfsprogs" },
         { "ext3", "tune2fs", "-l", "Inode size:", "e2fsprogs" },
         { "ext4", "tune2fs", "-l", "Inode size:", "e2fsprogs" },
@@ -6048,7 +6047,6 @@ glusterd_add_inode_size_to_dict (dict_t *dict, int count)
         char           *trail             = NULL;
         runner_t        runner            = {0, };
         struct fs_info *fs                = NULL;
-        char            fs_tool_name[256] = {0, };
         static dict_t  *cached_fs         = NULL;

         memset (key, 0, sizeof (key));
@@ -6085,17 +6083,7 @@ glusterd_add_inode_size_to_dict (dict_t *dict, int count)
                                 cur_word = "N/A";
                                 goto cached;
                         }
-
-                        snprintf (fs_tool_name, sizeof (fs_tool_name),
-                                  "/usr/sbin/%s", fs->fs_tool_name);
-                        if (sys_access (fs_tool_name, R_OK|X_OK) == 0)
-                                runner_add_arg (&runner, fs_tool_name);
-                        else {
-                                snprintf (fs_tool_name, sizeof (fs_tool_name),
-                                          "/sbin/%s", fs->fs_tool_name);
-                                if (sys_access (fs_tool_name, R_OK|X_OK) == 0)
-                                        runner_add_arg (&runner, fs_tool_name);
-                        }
+                        runner_add_arg (&runner, fs->fs_tool_name);
                         break;
                 }
         }
--
2.12.0


code:
# HG changeset patch
# User Torbjorn Granlund <tege@gmplib.org>
# Date 1396602422 -7200
# Node ID 676e2d0f0e4dd301a7066079d2c9326c25c34a40
# Parent  0194a75b56b21a9196626430af86c5bd9110c42d
Conditionalise ARM asm on !__thumb__.

diff -r 0194a75b56b2 -r 676e2d0f0e4d mpn/generic/div_qr_1n_pi1.c
--- a/mpn/generic/div_qr_1n_pi1.c	Thu Apr 03 23:58:51 2014 +0200
+++ b/mpn/generic/div_qr_1n_pi1.c	Fri Apr 04 11:07:02 2014 +0200
@@ -130,7 +130,7 @@
 	     "%2" ((UDItype)(a0)), "r" ((UDItype)(b0)) __CLOBBER_CC)
 #endif

-#if defined (__arm__) && W_TYPE_SIZE == 32
+#if defined (__arm__) && !defined (__thumb__) && W_TYPE_SIZE == 32
 #define add_mssaaaa(m, sh, sl, ah, al, bh, bl)				\
   __asm__ (  "adds	%2, %5, %6\n\t"					\
 	     "adcs	%1, %3, %4\n\t"					\


code:
Skip a test that randomly fails on ARMv7: <http://bugs.gnu.org/21620>.

--- a/tests/mpz/reuse.c
+++ b/tests/mpz/reuse.c
@@ -213,6 +213,7 @@ main (int argc, char **argv)
   mpz_t bs;
   unsigned long bsi, size_range;

+  exit (77);					  /* skip */
   tests_start ();
   TESTS_REPS (reps, argv, argc);


code:
Fix compatibility with libical 3.0.

Patch copied from Arch Linux:
https://git.archlinux.org/svntogit/packages.git/tree/trunk/gnome-todo-3.26.2-libical-3.0.patch?h=packages/gnome-todo

diff -up gnome-todo-3.26.2/src/gtd-task.c.libical-3.0 gnome-todo-3.26.2/src/gtd-task.c
--- gnome-todo-3.26.2/src/gtd-task.c.libical-3.0	2017-11-08 14:53:53.484294926 +0100
+++ gnome-todo-3.26.2/src/gtd-task.c	2017-11-08 14:53:57.208294874 +0100
@@ -778,7 +778,7 @@ gtd_task_set_complete (GtdTask  *task,
           dt->minute = g_date_time_get_minute (now);
           dt->second = g_date_time_get_seconds (now);
           dt->is_date = 0;
-          dt->is_utc = 1;
+          dt->zone = icaltimezone_get_utc_timezone ();

           /* convert timezone
            *


code:
Gnome-tweak-tool does not look at GSETTINGS_SCHEMA_PATH or XDG_DATA_DIRS, it
assumes that schemas are installed in one global directory
(GSETTINGS_SCHEMA_DIR/gsettingsschemadir).

Guix/GuixSD uses a different directory for every gir package and has
packages pick-up files using XDG_DATA_DIRS.

Upstream ticket: https://bugzilla.gnome.org/show_bug.cgi?id=764537
janneke@gnu.org

--- gnome-tweak-tool-3.18.1.orig/gtweak/gsettings.py	2015-04-08 15:21:32.000000000 +0200
+++ gnome-tweak-tool-3.18.1/gtweak/gsettings.py	2016-04-03 11:26:38.658482704 +0200
@@ -16,7 +16,8 @@
 # along with gnome-tweak-tool.  If not, see <http://www.gnu.org/licenses/>.

 import logging
-import os.path
+import os
+import sys
 import xml.dom.minidom
 import gettext

@@ -31,6 +32,13 @@
 class GSettingsMissingError(Exception):
     pass

+def file_from_path(path, file_name):
+    for dir in path:
+        f = os.path.join(dir, file_name)
+        if os.path.exists(f):
+            return f
+    return None
+
 class _GSettingsSchema:
     def __init__(self, schema_name, schema_dir=None, schema_filename=None, **options):
         if not schema_dir:
@@ -38,9 +46,14 @@
         if not schema_filename:
             schema_filename = schema_name + ".gschema.xml"

+        schema_prefix = os.path.join('glib-2.0', 'schemas')
         schema_path = os.path.join(schema_dir, schema_filename)
         if not os.path.exists(schema_path):
-            logging.critical("Could not find schema %s" % schema_path)
+            schema_path = file_from_path(os.environ.get ('GSETTINGS_SCHEMA_PATH', '').split(os.path.pathsep), schema_filename)
+        if not (schema_path and os.path.exists(schema_path)):
+            schema_path = file_from_path(os.environ.get ('XDG_DATA_DIRS', '').split(os.path.pathsep), os.path.join(schema_prefix, schema_filename))
+        if not (schema_path and os.path.exists(schema_path)):
+            logging.critical("Could not find schema %s" % schema_filename)
             assert(False)

         self._schema_name = schema_name


code:
test-stress-options.scm does not exist, and test-qof passes when run in the
build directory after the gnucash build.

diff -ur gnucash-3.3.old/gnucash/report/standard-reports/test/CMakeLists.txt gnucash-3.3/gnucash/report/standard-reports/test/CMakeLists.txt
--- gnucash-3.3.old/gnucash/report/standard-reports/test/CMakeLists.txt	2018-10-04 09:29:00.916641417 -0400
+++ gnucash-3.3/gnucash/report/standard-reports/test/CMakeLists.txt	2018-10-04 09:30:52.962504860 -0400
@@ -13,10 +13,6 @@
   test-income-gst.scm
 )

-set(scm_test_with_textual_ports_SOURCES
-    test-stress-options.scm
-)
-
 set(GUILE_DEPENDS
   scm-gnc-module
   scm-app-utils
@@ -31,9 +27,6 @@

 if (HAVE_SRFI64)
   gnc_add_scheme_tests("${scm_test_with_srfi64_SOURCES}")
-  if (HAVE_TEXT_PORTS)
-    gnc_add_scheme_tests("${scm_test_with_textual_ports_SOURCES}")
-  endif (HAVE_TEXT_PORTS)
 endif (HAVE_SRFI64)

 gnc_add_scheme_tests("${scm_test_standard_reports_SOURCES}")
diff -ur gnucash-3.3.old/libgnucash/engine/test/CMakeLists.txt gnucash-3.3/libgnucash/engine/test/CMakeLists.txt
--- gnucash-3.3.old/libgnucash/engine/test/CMakeLists.txt	2018-10-04 09:29:00.876640751 -0400
+++ gnucash-3.3/libgnucash/engine/test/CMakeLists.txt	2018-10-05 10:46:22.542962546 -0400
@@ -54,8 +54,6 @@
 # This test does not run on Win32
 if (NOT WIN32)
   set(SOURCES ${test_qof_SOURCES} ${CMAKE_SOURCE_DIR}/common/test-core/unittest-support.c)
-  add_engine_test(test-qof "${SOURCES}")
-  target_compile_definitions(test-qof PRIVATE TESTPROG=test_qof)

   set(SOURCES ${test_engine_SOURCES} ${CMAKE_SOURCE_DIR}/common/test-core/unittest-support.c)
   add_engine_test(test-engine "${SOURCES}")


code:
After wrapping gnc-fq-check and gnc-fq-helper we can no longer execute them
with perl, so execute them directly instead.

diff -ur gnucash-3.2.old/libgnucash/scm/price-quotes.scm gnucash-3.2/libgnucash/scm/price-quotes.scm
--- gnucash-3.2.old/libgnucash/scm/price-quotes.scm	2018-09-15 00:48:33.718389646 -0400
+++ gnucash-3.2/libgnucash/scm/price-quotes.scm	2018-09-15 13:51:49.249862724 -0400
@@ -74,7 +74,7 @@
     (define (start-program)
       (if (not (string-null? gnc:*finance-quote-check*))
           (set! program (gnc-spawn-process-async
-                         (list "perl" "-w" gnc:*finance-quote-check*) #t))))
+                         (list gnc:*finance-quote-check*) #t))))

     (define (get-sources)
       (if (not (null? program))
@@ -158,7 +158,7 @@
     (define (start-quoter)
       (if (not (string-null? gnc:*finance-quote-helper*))
           (set! quoter (gnc-spawn-process-async
-                        (list "perl" "-w" gnc:*finance-quote-helper*) #t))))
+                        (list gnc:*finance-quote-helper*) #t))))

     (define (get-quotes)
       (if (not (null? quoter))


code:
FIXME: The static test fails with an error such as:

/tmp/guix-build-gnutls-3.5.13.drv-0/ccOnGPmc.o: In function `main':
c.29617.tmp.c:(.text+0x5): undefined reference to `gnutls_global_init'
collect2: error: ld returned 1 exit status
FAIL pkgconfig.sh (exit status: 1)

diff --git a/tests/pkgconfig.sh b/tests/pkgconfig.sh
index 6bd4e62f9..05aab8278 100755
--- a/tests/pkgconfig.sh
+++ b/tests/pkgconfig.sh
@@ -57,11 +57,7 @@ echo "Trying dynamic linking with:"
 echo "  * flags: $(${PKGCONFIG} --libs gnutls)"
 echo "  * common: ${COMMON}"
 echo "  * lib: ${CFLAGS}"
-cc ${TMPFILE} -o ${TMPFILE_O} $(${PKGCONFIG} --libs gnutls) $(${PKGCONFIG} --cflags gnutls) ${COMMON}
-
-echo ""
-echo "Trying static linking with $(${PKGCONFIG} --libs --static gnutls)"
-cc ${TMPFILE} -o ${TMPFILE_O} $(${PKGCONFIG} --static --libs gnutls) $(${PKGCONFIG} --cflags gnutls) ${COMMON}
+gcc ${TMPFILE} -o ${TMPFILE_O} $(${PKGCONFIG} --libs gnutls) $(${PKGCONFIG} --cflags gnutls) ${COMMON}

 rm -f ${TMPFILE} ${TMPFILE_O}


code:
Version 3.5.11 added a test to check that the default trust store is readable.
It does not exist in the build environment, so pretend everything is fine.

diff a/tests/trust-store.c b/tests/trust-store.c
--- a/tests/trust-store.c
+++ b/tests/trust-store.c
@@ -61,7 +61,7 @@
 	} else if (ret < 0) {
 		fail("error loading system trust store: %s\n", gnutls_strerror(ret));
 	} else if (ret == 0) {
-		fail("no certificates were found in system trust store!\n");
+		success("no trust store in the Guix build environment!\n");
 	}

 	gnutls_certificate_free_credentials(x509_cred);


code:
# Names of libraries included in typelib files are opened by dlopen.  Here we
# add the full path.
#
# This patch was provided by Luca Bruno <lucabru@src.gnome.org>  for
# 'gobject-introspection' 1.40.0 in Nix.
--- ./giscanner/utils.py.orig	2014-08-14 22:05:05.055334080 +0200
+++ ./giscanner/utils.py	2014-08-14 22:05:24.687497334 +0200
@@ -110,17 +110,11 @@
     if dlname is None:
         return None

-    # Darwin uses absolute paths where possible; since the libtool files never
-    # contain absolute paths, use the libdir field
-    if platform.system() == 'Darwin':
-        dlbasename = os.path.basename(dlname)
-        libdir = _extract_libdir_field(la_file)
-        if libdir is None:
-            return dlbasename
-        return libdir + '/' + dlbasename
-    # From the comments in extract_libtool(), older libtools had
-    # a path rather than the raw dlname
-    return os.path.basename(dlname)
+    dlbasename = os.path.basename(dlname)
+    libdir = _extract_libdir_field(la_file)
+    if libdir is None:
+        return dlbasename
+    return libdir + '/' + dlbasename

 def extract_libtool(la_file):


code:
Use gcc as the default C compiler if CC is not set.

--- gobject-introspection-1.44.0.orig/giscanner/__init__.py	2014-08-04 22:37:07.000000000 +0800
+++ gobject-introspection-1.44.0/giscanner/__init__.py	2015-04-20 17:30:26.507697234 +0800
@@ -22,3 +22,5 @@
 builddir = os.environ.get('UNINSTALLED_INTROSPECTION_BUILDDIR')
 if builddir is not None:
     __path__.append(os.path.join(builddir, 'giscanner'))
+if not 'CC' in os.environ:
+    os.environ['CC'] = 'gcc'


code:
--- a/girepository/gitypelib.c.orig
+++ b/girepository/gitypelib.c
@@ -2296,7 +2296,22 @@ _g_typelib_do_dlopen (GITypelib *typelib)
         {
           GModule *module;

+          /* 'gobject-introspection' doesn't store the path of shared
+             libraries into '.typelib' and '.gir' files.  Shared
+             libraries are searched for in the dynamic linker search
+             path.  In Guix we patch 'gobject-introspection' such that
+             it stores the absolute path of shared libraries in
+             '.typelib' and '.gir' files.  Here, in order to minimize
+             side effects, we make sure that if the library is not
+             found at the indicated path location, we try with just
+             the basename and the system dynamic library
+             infrastructure, as per default behaviour of the
+             library. */
           module = load_one_shared_library (shlibs[i]);
+          if (module == NULL && g_path_is_absolute (shlibs[i]))
+            {
+              module = load_one_shared_library (g_basename(shlibs[i]));
+            }

           if (module == NULL)
             {


code:
Fix building of GPM with glibc 2.26:

https://bugs.gentoo.org/629774

Patches copied from Gentoo:

https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-libs/gpm/files/gpm-1.20.7-glibc-2.26.patch?id=1618968c56caf7f8c08823908d88dc49bb8f7649
https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-libs/gpm/files/gpm-1.20.7-sysmacros.patch?id=1618968c56caf7f8c08823908d88dc49bb8f7649

--- a/src/prog/gpm-root.y	2012-10-26 17:21:38.000000000 -0400
+++ b/src/prog/gpm-root.y	2017-09-07 20:39:51.933264063 -0400
@@ -1197,7 +1197,7 @@
    /* reap your zombies */
    childaction.sa_handler=reap_children;
 #if defined(__GLIBC__)
-   __sigemptyset(&childaction.sa_mask);
+   sigemptyset(&childaction.sa_mask);
 #else /* __GLIBC__ */
    childaction.sa_mask=0;
 #endif /* __GLIBC__ */
From b350aee4ea5785a75cb6ad770f6b768c506ebb70 Mon Sep 17 00:00:00 2001
From: Mike Frysinger <vapier@gentoo.org>
Date: Mon, 14 Mar 2016 15:39:54 -0400
Subject: [PATCH] fix building w/newer glibc

Linux C libraries are looking to disentangle sysmacros.h from the
sys/types.h include, so make sure we pull in the header when it is
found.
---
 src/daemon/open_console.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/daemon/open_console.c b/src/daemon/open_console.c
index 4d6c0af..6dd43e6 100644
--- a/src/daemon/open_console.c
+++ b/src/daemon/open_console.c
@@ -24,6 +24,10 @@
 #include <sys/types.h>              /* major()           */
 #include <sys/ioctl.h>              /* ioctl             */

+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>          /* major() w/newer glibc */
+#endif
+
 /* Linux specific (to be outsourced in gpm2 */
 #include <linux/serial.h>           /* for serial console check */
 #include <asm/ioctls.h>            /* for serial console check */
--
2.6.2