code:
This patch is taken from upstream.  It fixes documentation generation.
The patch has been lightly adapted to apply to the release tarball, but
the commit message was left untouched, so it refers to some changes not
included in the patch.

From 0d9a81e20238a6b72f9f5c005f1f7e9cf05f6fb9 Mon Sep 17 00:00:00 2001
From: Alec Theriault <alec.theriault@gmail.com>
Date: Sat, 27 Oct 2018 10:05:04 -0700
Subject: [PATCH] Fix documentation in `haddock-api` (#957)

* Fix misplaced Haddocks in Haddock itself

Haddock should be able to generate documentation for 'haddock-api'
again.

* Make CI check that documentation can be built.

* Add back a doc that is OK
---
 .travis.yml                               |  3 +++
 haddock-api/src/Haddock/Backends/LaTeX.hs | 10 +++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/Haddock/Backends/LaTeX.hs b/src/Haddock/Backends/LaTeX.hs
index 4e0e6eba..613c6deb 100644
--- a/src/Haddock/Backends/LaTeX.hs
+++ b/src/Haddock/Backends/LaTeX.hs
@@ -243,8 +243,8 @@ ppDocGroup lev doc = sec lev <> braces doc

 -- | Given a declaration, extract out the names being declared
 declNames :: LHsDecl DocNameI
-          -> ( LaTeX           -- ^ to print before each name in an export list
-             , [DocName]       -- ^ names being declared
+          -> ( LaTeX           --   to print before each name in an export list
+             , [DocName]       --   names being declared
              )
 declNames (L _ decl) = case decl of
   TyClD _ d  -> (empty, [tcdName d])
@@ -444,9 +444,9 @@ ppLPatSig doc docnames ty unicode
 -- arguments as needed.
 ppTypeOrFunSig :: HsType DocNameI
                -> DocForDecl DocName  -- ^ documentation
-               -> ( LaTeX             -- ^ first-line (no-argument docs only)
-                  , LaTeX             -- ^ first-line (argument docs only)
-                  , LaTeX             -- ^ type prefix (argument docs only)
+               -> ( LaTeX             --   first-line (no-argument docs only)
+                  , LaTeX             --   first-line (argument docs only)
+                  , LaTeX             --   type prefix (argument docs only)
                   )
                -> Bool                -- ^ unicode
                -> LaTeX
--
2.23.0


code:
This patch is taken and adapted from upstream.  It landed shortly after
the release of 0.31.2, and fixes eleven tests.  The patch has been
lightly adapted to apply to the release tarball, but the commit message
was left untouched, so it refers to some changes not included in the
patch.

From a8d9362d4b686074f698c04c20beea88587511a1 Mon Sep 17 00:00:00 2001
From: quasicomputational <quasicomputational@gmail.com>
Date: Sat, 1 Jun 2019 15:11:31 +0100
Subject: [PATCH] Make CI green (#345)

* AppVeyor workaround for TMP issue

https://github.com/commercialhaskell/stack/issues/3944

* Bump resolver to nightly-2018-12-12.

This has the primary benefit of moving to GHC 8.6.3 and should fix
AppVeyor.

* Add clock 0.8 as an extra-dep.

* Adapt expected output to aeson 1.4.3.0.
---
 appveyor.yml                            |  3 +++
 hpack.cabal                             | 10 +++++-----
 package.yaml                            |  2 +-
 stack.yaml                              |  5 +++--
 test/Data/Aeson/Config/FromValueSpec.hs |  2 +-
 test/Data/Aeson/Config/TypesSpec.hs     |  2 +-
 test/EndToEndSpec.hs                    |  8 ++++----
 test/Hpack/ConfigSpec.hs                |  2 +-
 test/Hpack/Syntax/DefaultsSpec.hs       |  2 +-
 test/Hpack/Syntax/DependenciesSpec.hs   |  4 ++--
 10 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/hpack.cabal b/hpack.cabal
index fedb9a8..4db3014 100644
--- a/hpack.cabal
+++ b/hpack.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12

--- This file has been generated from package.yaml by hpack version 0.31.0.
+-- This file has been generated from package.yaml by hpack version 0.31.2.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3d060180293c32b8d0c25b710d0f419e96a6cc6ec3f95ac5e70bb77f44cbafc3
+-- hash: bd5dd178c7e9f7f7a3456d79b592ea336c41ef43c9892354c001f06659e8b901

 name:           hpack
 version:        0.31.2
@@ -31,7 +31,7 @@ library
   build-depends:
       Cabal >=2.2
     , Glob >=0.9.0
-    , aeson >=1.2.1.0
+    , aeson >=1.4.3.0
     , base >=4.9 && <5
     , bifunctors
     , bytestring
@@ -87,7 +87,7 @@ executable hpack
   build-depends:
       Cabal >=2.2
     , Glob >=0.9.0
-    , aeson >=1.2.1.0
+    , aeson >=1.4.3.0
     , base >=4.9 && <5
     , bifunctors
     , bytestring
@@ -125,7 +125,7 @@ test-suite spec
     , Glob >=0.9.0
     , HUnit >=1.6.0.0
     , QuickCheck
-    , aeson >=1.2.1.0
+    , aeson >=1.4.3.0
     , base >=4.9 && <5
     , bifunctors
     , bytestring
diff --git a/test/Data/Aeson/Config/FromValueSpec.hs b/test/Data/Aeson/Config/FromValueSpec.hs
index 33de8b7..06b3eb9 100644
--- a/test/Data/Aeson/Config/FromValueSpec.hs
+++ b/test/Data/Aeson/Config/FromValueSpec.hs
@@ -85,7 +85,7 @@ spec = do
         [yaml|
         name: "Joe"
         age: "23"
-        |] `shouldDecodeTo` left "Error while parsing $.age - expected Int, encountered String"
+        |] `shouldDecodeTo` left "Error while parsing $.age - parsing Int failed, expected Number, but encountered String"

     context "with (,)" $ do
       it "captures unrecognized fields" $ do
diff --git a/test/Data/Aeson/Config/TypesSpec.hs b/test/Data/Aeson/Config/TypesSpec.hs
index c954534..472aa42 100644
--- a/test/Data/Aeson/Config/TypesSpec.hs
+++ b/test/Data/Aeson/Config/TypesSpec.hs
@@ -13,7 +13,7 @@ spec = do
     context "List" $ do
       let
         parseError :: String -> Result (List Int)
-        parseError prefix = Left (prefix ++ " - expected Int, encountered String")
+        parseError prefix = Left (prefix ++ " - parsing Int failed, expected Number, but encountered String")

       context "when parsing single values" $ do
         it "returns the value in a singleton list" $ do
diff --git a/test/EndToEndSpec.hs b/test/EndToEndSpec.hs
index 283c72c..46389ea 100644
--- a/test/EndToEndSpec.hs
+++ b/test/EndToEndSpec.hs
@@ -285,7 +285,7 @@ spec = around_ (inTempDirectoryNamed "foo") $ do
           path: defaults.yaml
           ref: "2017"
         library: {}
-        |] `shouldFailWith` (file ++ ": Error while parsing $ - expected Object, encountered Array")
+        |] `shouldFailWith` (file ++ ": Error while parsing $ - expected Object, but encountered Array")

       it "warns on unknown fields" $ do
         let file = joinPath ["defaults", "sol", "hpack-template", "2017", "defaults.yaml"]
@@ -340,7 +340,7 @@ spec = around_ (inTempDirectoryNamed "foo") $ do
       it "rejects other values" $ do
         [i|
         version: {}
-        |] `shouldFailWith` "package.yaml: Error while parsing $.version - expected Number or String, encountered Object"
+        |] `shouldFailWith` "package.yaml: Error while parsing $.version - expected Number or String, but encountered Object"

     describe "license" $ do
       it "accepts cabal-style licenses" $ do
@@ -1363,14 +1363,14 @@ spec = around_ (inTempDirectoryNamed "foo") $ do
             then:
               dependencies: Win32
             else: null
-          |] `shouldFailWith` "package.yaml: Error while parsing $.when.else - expected Object, encountered Null"
+          |] `shouldFailWith` "package.yaml: Error while parsing $.when.else - expected Object, but encountered Null"

         it "rejects invalid conditionals" $ do
           [i|
             dependencies:
               - foo
               - 23
-          |] `shouldFailWith` "package.yaml: Error while parsing $.dependencies[1] - expected Object or String, encountered Number"
+          |] `shouldFailWith` "package.yaml: Error while parsing $.dependencies[1] - expected Object or String, but encountered Number"

         it "warns on unknown fields" $ do
           [i|
diff --git a/test/Hpack/ConfigSpec.hs b/test/Hpack/ConfigSpec.hs
index 9f4b279..69cbea1 100644
--- a/test/Hpack/ConfigSpec.hs
+++ b/test/Hpack/ConfigSpec.hs
@@ -675,7 +675,7 @@ spec = do
       it "rejects other values" $ do
         [yaml|
         23
-        |] `shouldDecodeTo` (Left "Error while parsing $ - expected Boolean or String, encountered Number" :: Result Cond)
+        |] `shouldDecodeTo` (Left "Error while parsing $ - expected Boolean or String, but encountered Number" :: Result Cond)

   describe "formatOrList" $ do
     it "formats a singleton list" $ do
diff --git a/test/Hpack/Syntax/DefaultsSpec.hs b/test/Hpack/Syntax/DefaultsSpec.hs
index 5875413..5438b7a 100644
--- a/test/Hpack/Syntax/DefaultsSpec.hs
+++ b/test/Hpack/Syntax/DefaultsSpec.hs
@@ -151,4 +151,4 @@ spec = do
         it "fails" $ do
           [yaml|
           10
-          |] `shouldDecodeTo` left "Error while parsing $ - expected Object or String, encountered Number"
+          |] `shouldDecodeTo` left "Error while parsing $ - expected Object or String, but encountered Number"
diff --git a/test/Hpack/Syntax/DependenciesSpec.hs b/test/Hpack/Syntax/DependenciesSpec.hs
index 1a83732..d95044f 100644
--- a/test/Hpack/Syntax/DependenciesSpec.hs
+++ b/test/Hpack/Syntax/DependenciesSpec.hs
@@ -125,7 +125,7 @@ spec = do
         it "rejects invalid values" $ do
           [yaml|
             hpack: []
-          |] `shouldDecodeTo` left "Error while parsing $.hpack - expected Null, Object, Number, or String, encountered Array"
+          |] `shouldDecodeTo` left "Error while parsing $.hpack - expected Null, Object, Number, or String, but encountered Array"

         context "when the constraint is a Number" $ do
           it "accepts 1" $ do
@@ -213,7 +213,7 @@ spec = do
               [yaml|
                 foo:
                   version: {}
-              |] `shouldDecodeTo` left "Error while parsing $.foo.version - expected Null, Number, or String, encountered Object"
+              |] `shouldDecodeTo` left "Error while parsing $.foo.version - expected Null, Number, or String, but encountered Object"

             it "accepts a string" $ do
               [yaml|
--
2.23.0

license: mit


code:
This patch fixes the test suite to allow any order when listing the
members of a JSON object.  Aeson (being true to the JSON specification)
does not specify an order for objects.  In practice, the order depends
on your processor architecture.

See <https://github.com/bos/aeson/issues/568> for a discussion resulting
in a similar patch fixing the Aeson tests.

See <https://github.com/fosskers/microlens-aeson/issues/1> for the
upstream bug report.

diff -ruN a/test/Test.hs b/test/Test.hs
--- a/test/Test.hs	2018-12-31 15:10:50.000000000 -0500
+++ b/test/Test.hs	2019-11-08 01:34:07.419706831 -0500
@@ -48,8 +48,10 @@
     , testCase "" $ ("{\"a\": {}, \"b\": null}" ^? key (T.pack "b") . _Object) @?= Nothing
     , testCase "" $ ("{\"a\": 100, \"b\": 200}" ^? key (T.pack "a")) @?= Just (Number 100.0)
     , testCase "" $ ("[1,2,3]" ^? key (T.pack "a")) @?= Nothing
-    , testCase "" $ ("{\"a\": 4, \"b\": 7}" ^.. members) @?= [Number 4.0,Number 7.0]
-    , testCase "" $ ("{\"a\": 4, \"b\": 7}" & members . _Number %~ (* 10)) @?= "{\"a\":40,\"b\":70}"
+    , testCase "" $ assertBool "" (let x = ("{\"a\": 4, \"b\": 7}" ^.. members)
+                                   in x == [Number 4.0,Number 7.0] || x == [Number 7.0,Number 4.0])
+    , testCase "" $ assertBool "" (let x = ("{\"a\": 4, \"b\": 7}" & members . _Number %~ (* 10))
+                                   in x == "{\"a\":40,\"b\":70}" || x == "{\"b\":70,\"a\":40}")
     , testCase "" $ ("[1,2,3]" ^? nth 1) @?= Just (Number 2.0)
     , testCase "" $ ("{\"a\": 100, \"b\": 200}" ^? nth 1) @?= Nothing
     , testCase "" $ ("[1,2,3]" & nth 1 .~ Number 20) @?= "[1,20,3]"


code:
This patch is taken from upstream.  It fixes a test to work with GHC 8.6.
The paths have been slightly altered to work with the release tarball.

See <https://github.com/simonmar/monad-par/issues/66>.

From e20f81c8060208e4fb038e8f0e0668b41d72a6fb Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@debian.org>
Date: Sat, 31 Aug 2019 14:12:34 -0400
Subject: [PATCH] Use a case statement instead of pattern-matching in
 case_test_diamond

This avoids the need for a MonadFail instance.  Closes #66
---
 monad-par/tests/ParTests_shared.hs | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/tests/ParTests_shared.hs b/tests/ParTests_shared.hs
index 31f438d..b2de50c 100644
--- a/tests/ParTests_shared.hs
+++ b/tests/ParTests_shared.hs
@@ -109,12 +109,15 @@ case_test_diamond :: Assertion
 case_test_diamond = 9 @=? (m :: Int)
  where
   m = runPar $ do
-      [a,b,c,d] <- sequence [new,new,new,new]
-      fork $ do x <- get a; put b (x+1)
-      fork $ do x <- get a; put c (x+2)
-      fork $ do x <- get b; y <- get c; put d (x+y)
-      fork $ do put a 3
-      get d
+      abcd <- sequence [new,new,new,new]
+      case abcd of
+          [a,b,c,d] -> do
+              fork $ do x <- get a; put b (x+1)
+              fork $ do x <- get a; put c (x+2)
+              fork $ do x <- get b; y <- get c; put d (x+y)
+              fork $ do put a 3
+              get d
+          _ -> error "Oops"

 -- | Violate IVar single-assignment:
 --
--
2.23.0


code:
This patch is taken from upstream.  It fixes two HTML tests that are broken
due to using a Skylighting version greater than or equal to 0.8.2.

From 968d2046a3cb6db661673be580660ac402753c34 Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Sun, 14 Jul 2019 10:48:14 -0700
Subject: [PATCH] Update test for new skylighting.

---
 test/lhs-test.html     | 13 ++++++-------
 test/lhs-test.html+lhs | 13 ++++++-------
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/test/lhs-test.html b/test/lhs-test.html
index 6685555f4..446dd3d95 100644
--- a/test/lhs-test.html
+++ b/test/lhs-test.html
@@ -12,19 +12,18 @@
       div.column{display: inline-block; vertical-align: top; width: 50%;}
   </style>
   <style>
-code.sourceCode > span { display: inline-block; line-height: 1.25; }
+pre > code.sourceCode { white-space: pre; position: relative; }
+pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
+pre > code.sourceCode > span:empty { height: 1.2em; }
 code.sourceCode > span { color: inherit; text-decoration: inherit; }
-code.sourceCode > span:empty { height: 1.2em; }
-.sourceCode { overflow: visible; }
-code.sourceCode { white-space: pre; position: relative; }
 div.sourceCode { margin: 1em 0; }
 pre.sourceCode { margin: 0; }
 @media screen {
 div.sourceCode { overflow: auto; }
 }
 @media print {
-code.sourceCode { white-space: pre-wrap; }
-code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+pre > code.sourceCode { white-space: pre-wrap; }
+pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
 }
 pre.numberSource code
   { counter-reset: source-line 0; }
@@ -44,7 +43,7 @@ pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa;  padding-le
 div.sourceCode
   {   }
 @media screen {
-code.sourceCode > span > a:first-child::before { text-decoration: underline; }
+pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
 }
 code span.al { color: #ff0000; font-weight: bold; } /* Alert */
 code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
diff --git a/test/lhs-test.html+lhs b/test/lhs-test.html+lhs
index e57dfc105..a5cdb0245 100644
--- a/test/lhs-test.html+lhs
+++ b/test/lhs-test.html+lhs
@@ -12,19 +12,18 @@
       div.column{display: inline-block; vertical-align: top; width: 50%;}
   </style>
   <style>
-code.sourceCode > span { display: inline-block; line-height: 1.25; }
+pre > code.sourceCode { white-space: pre; position: relative; }
+pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
+pre > code.sourceCode > span:empty { height: 1.2em; }
 code.sourceCode > span { color: inherit; text-decoration: inherit; }
-code.sourceCode > span:empty { height: 1.2em; }
-.sourceCode { overflow: visible; }
-code.sourceCode { white-space: pre; position: relative; }
 div.sourceCode { margin: 1em 0; }
 pre.sourceCode { margin: 0; }
 @media screen {
 div.sourceCode { overflow: auto; }
 }
 @media print {
-code.sourceCode { white-space: pre-wrap; }
-code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+pre > code.sourceCode { white-space: pre-wrap; }
+pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
 }
 pre.numberSource code
   { counter-reset: source-line 0; }
@@ -44,7 +43,7 @@ pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa;  padding-le
 div.sourceCode
   {   }
 @media screen {
-code.sourceCode > span > a:first-child::before { text-decoration: underline; }
+pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
 }
 code span.al { color: #ff0000; font-weight: bold; } /* Alert */
 code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
--
2.23.0


code:
This patch is taken from upstream.  It fixes a LaTeX test that is broken due
to using a Skylighting version greater than or equal to 0.8.1.1.

From 2cd1c7b30f200d18f1f1bdef1671369e1ad303ed Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Thu, 13 Jun 2019 19:33:52 -0700
Subject: [PATCH] Update test for skylighting 0.8.1.1.

---
 test/lhs-test.latex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/lhs-test.latex b/test/lhs-test.latex
index 0442db5ca..a456995a3 100644
--- a/test/lhs-test.latex
+++ b/test/lhs-test.latex
@@ -94,9 +94,9 @@ return a single value:

 \begin{Shaded}
 \begin{Highlighting}[]
-\OtherTok{unsplit ::}\NormalTok{ (}\DataTypeTok{Arrow}\NormalTok{ a) }\OtherTok{=>}\NormalTok{ (b }\OtherTok{->}\NormalTok{ c }\OtherTok{->}\NormalTok{ d) }\OtherTok{->}\NormalTok{ a (b, c) d}
+\OtherTok{unsplit ::}\NormalTok{ (}\DataTypeTok{Arrow}\NormalTok{ a) }\OtherTok{=>}\NormalTok{ (b }\OtherTok{{-}>}\NormalTok{ c }\OtherTok{{-}>}\NormalTok{ d) }\OtherTok{{-}>}\NormalTok{ a (b, c) d}
 \NormalTok{unsplit }\OtherTok{=}\NormalTok{ arr }\OperatorTok{.} \FunctionTok{uncurry}
-          \CommentTok{-- arr (\textbackslash{}op (x,y) -> x `op` y)}
+          \CommentTok{{-}{-} arr (\textbackslash{}op (x,y) {-}> x \textasciigrave{}op\textasciigrave{} y)}
 \end{Highlighting}
 \end{Shaded}

--
2.23.0


code:
Do not attempt to dlopen PIE objects, which was disallowed with glibc 2.30.

https://gitlab.haskell.org/ghc/ghc/issues/17952
https://sourceware.org/bugzilla/show_bug.cgi?id=24323

Patch submitted upstream:
https://gitlab.haskell.org/ghc/ghc/-/merge_requests/2947

diff --git a/testsuite/tests/dynlibs/Makefile b/testsuite/tests/dynlibs/Makefile
--- a/testsuite/tests/dynlibs/Makefile
+++ b/testsuite/tests/dynlibs/Makefile
@@ -60,6 +60,4 @@ T5373:
 .PHONY: T13702
 T13702:
 	'$(TEST_HC)' -v0 -dynamic -rdynamic -fPIC -pie T13702.hs
-	'$(TEST_HC)' -v0 -dynamic T13702a.hs
-	./T13702  # first make sure executable itself works
-	./T13702a # then try dynamically loading it as library
+	./T13702
diff --git a/testsuite/tests/dynlibs/T13702.hs b/testsuite/tests/dynlibs/T13702.hs
--- a/testsuite/tests/dynlibs/T13702.hs
+++ b/testsuite/tests/dynlibs/T13702.hs
@@ -2,8 +2,3 @@

 main :: IO ()
 main = putStrLn "hello world"
-
-foreign export ccall "hello" hello :: IO ()
-
-hello :: IO ()
-hello = putStrLn "hello world again"
diff --git a/testsuite/tests/dynlibs/T13702.stdout b/testsuite/tests/dynlibs/T13702.stdout
--- a/testsuite/tests/dynlibs/T13702.stdout
+++ b/testsuite/tests/dynlibs/T13702.stdout
@@ -1,2 +1 @@
 hello world
-hello world again
diff --git a/testsuite/tests/dynlibs/T13702a.hs b/testsuite/tests/dynlibs/T13702a.hs
deleted file mode 100644
--- a/testsuite/tests/dynlibs/T13702a.hs
+++ /dev/null
@@ -1,12 +0,0 @@
-{-# LANGUAGE ForeignFunctionInterface #-}
-
-import Foreign
-import System.Posix.DynamicLinker
-
-main :: IO ()
-main = do
-    dl <- dlopen "./T13702" [RTLD_NOW]
-    funptr <- dlsym dl "hello" :: IO (FunPtr (IO ()))
-    mkAction funptr
-
-foreign import ccall "dynamic" mkAction :: FunPtr (IO ()) -> IO ()


code:
This patch makes emission of /CreationDate and /ModDate headers optional.

If the environment variable GS_GENERATE_UUIDS is set to "0" or "no", it will
not write out the "/ID" field (if that's permissible).

Upstream does not want to do this.

See: https://bugs.ghostscript.com/show_bug.cgi?id=698208
diff --git a/orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c b/bb/gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c
index 0fb067e..b342e2c 100644
--- orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c
+++ gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c
@@ -305,6 +305,9 @@ pdf_initialize_ids(gx_device_pdf * pdev)
      * date and time, rather than (for example) %%CreationDate from the
      * PostScript file.  We think this is wrong, but we do the same.
      */
+    if (!getenv("GS_GENERATE_UUIDS") ||
+        (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") != 0 &&
+         strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") != 0))
     {
         struct tm tms;
         time_t t;


code:
This patch makes the "/ID" field optional.

If the environment variable GS_GENERATE_UUIDS is set to "0" or "no", it will
not write out the "/ID" field (if that's permissible).

Upstream does not want to do this.

See: https://bugs.ghostscript.com/show_bug.cgi?id=698208
diff -ur orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c
--- orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c	2017-07-09 23:30:28.960479189 +0200
+++ gnu-ghostscript-9.14.0/devices/vector/gdevpdf.c	2017-07-09 23:34:34.306524488 +0200
@@ -1810,8 +1810,11 @@
      * +1 for the linearisation dict and +1 for the primary hint stream.
      */
     linear_params->FirsttrailerOffset = gp_ftell(linear_params->Lin_File.file);
-    gs_sprintf(LDict, "\ntrailer\n<</Size %ld/Info %d 0 R/Root %d 0 R/ID[%s%s]/Prev %d>>\nstartxref\r\n0\n%%%%EOF\n        \n",
-        linear_params->LastResource + 3, pdev->ResourceUsage[linear_params->Info_id].NewObjectNumber, pdev->ResourceUsage[linear_params->Catalog_id].NewObjectNumber, fileID, fileID, 0);
+    gs_sprintf(LDict, "\ntrailer\n<</Size %ld/Info %d 0 R/Root %d 0 R",
+        linear_params->LastResource + 3, pdev->ResourceUsage[linear_params->Info_id].NewObjectNumber, pdev->ResourceUsage[linear_params->Catalog_id].NewObjectNumber);
+    if (pdev->OwnerPassword.size > 0 || !(!getenv("GS_GENERATE_UUIDS") || (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") != 0 && strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") != 0))) /* ID is mandatory when encrypting */
+        gs_sprintf(LDict, "/ID[%s%s]", fileID, fileID);
+    gs_sprintf(LDict, "/Prev %d>>\nstartxref\r\n0\n%%%%EOF\n        \n", 0);
     gp_fwrite(LDict, strlen(LDict), 1, linear_params->Lin_File.file);

     /* Write document catalog (Part 4) */
@@ -2346,8 +2349,11 @@
     if (code != 0)
         return_error(gs_error_ioerror);

-    gs_sprintf(LDict, "\ntrailer\n<</Size %ld/Info %d 0 R/Root %d 0 R/ID[%s%s]/Prev %"PRId64">>\nstartxref\r\n0\n%%%%EOF\n",
-        linear_params->LastResource + 3, pdev->ResourceUsage[linear_params->Info_id].NewObjectNumber, pdev->ResourceUsage[linear_params->Catalog_id].NewObjectNumber, fileID, fileID, mainxref);
+    gs_sprintf(LDict, "\ntrailer\n<</Size %ld/Info %d 0 R/Root %d 0 R",
+        linear_params->LastResource + 3, pdev->ResourceUsage[linear_params->Info_id].NewObjectNumber, pdev->ResourceUsage[linear_params->Catalog_id].NewObjectNumber);
+    if (pdev->OwnerPassword.size > 0 || !(!getenv("GS_GENERATE_UUIDS") || (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") != 0 || strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") != 0))) /* ID is mandatory when encrypting */
+        gs_sprintf(LDict, "/ID[%s%s]", fileID, fileID);
+    gs_sprintf(LDict, "/Prev %"PRId64">>\nstartxref\r\n0\n%%%%EOF\n", mainxref);
     gp_fwrite(LDict, strlen(LDict), 1, linear_params->sfile);

     code = gp_fseek(linear_params->sfile, pdev->ResourceUsage[HintStreamObj].LinearisedOffset, SEEK_SET);
@@ -3012,10 +3018,12 @@
             stream_puts(s, "trailer\n");
             pprintld3(s, "<< /Size %ld /Root %ld 0 R /Info %ld 0 R\n",
                   pdev->next_id, Catalog_id, Info_id);
-            stream_puts(s, "/ID [");
-            psdf_write_string(pdev->strm, pdev->fileID, sizeof(pdev->fileID), 0);
-            psdf_write_string(pdev->strm, pdev->fileID, sizeof(pdev->fileID), 0);
-            stream_puts(s, "]\n");
+            if (pdev->OwnerPassword.size > 0 || !(!getenv("GS_GENERATE_UUIDS") || (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") != 0 || strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") != 0))) { /* ID is mandatory when encrypting */
+                stream_puts(s, "/ID [");
+                psdf_write_string(pdev->strm, pdev->fileID, sizeof(pdev->fileID), 0);
+                psdf_write_string(pdev->strm, pdev->fileID, sizeof(pdev->fileID), 0);
+                stream_puts(s, "]\n");
+            }
             if (pdev->OwnerPassword.size > 0) {
                 pprintld1(s, "/Encrypt %ld 0 R ", Encrypt_id);
             }


code:
This patch makes the UUIDs in the XMP header optional, depending on the
setting of the environment variable GS_GENERATE_UUIDS.

If the environment variable GS_GENERATE_UUIDS is set to "0" or "no", it will
not write out the Document UUID field and also will write the Instance ID
field value as "".

Upstream does not want to do this.

See: https://bugs.ghostscript.com/show_bug.cgi?id=698208
diff -ur orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdfe.c aa/gnu-ghostscript-9.14.0/devices/vector/gdevpdfe.c
--- orig/gnu-ghostscript-9.14.0/devices/vector/gdevpdfe.c	2017-07-09 23:30:28.960479189 +0200
+++ gnu-ghostscript-9.14.0/devices/vector/gdevpdfe.c	2017-07-10 01:04:12.252478276 +0200
@@ -620,7 +620,7 @@
         return code;

     /* PDF/A XMP reference recommends setting UUID to empty. If not empty must be a URI */
-    if (pdev->PDFA != 0)
+    if (pdev->PDFA != 0 || (getenv("GS_GENERATE_UUIDS") && (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") == 0 || strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") == 0)))
         instance_uuid[0] = 0x00;

     cre_date_time_len = pdf_get_docinfo_item(pdev, "/CreationDate", cre_date_time, sizeof(cre_date_time));
@@ -720,14 +720,17 @@
             pdf_xml_tag_close(s, "rdf:Description");
             pdf_xml_newline(s);

-            pdf_xml_tag_open_beg(s, "rdf:Description");
-            pdf_xml_copy(s, " rdf:about=\"\"");
-            pdf_xml_attribute_name(s, "xmlns:xapMM");
-            pdf_xml_attribute_value(s, "http://ns.adobe.com/xap/1.0/mm/");
-            pdf_xml_attribute_name(s, "xapMM:DocumentID");
-            pdf_xml_attribute_value(s, document_uuid);
-            pdf_xml_tag_end_empty(s);
-            pdf_xml_newline(s);
+            if (!getenv("GS_GENERATE_UUIDS") || (strcasecmp(getenv("GS_GENERATE_UUIDS"), "0") != 0 && strcasecmp(getenv("GS_GENERATE_UUIDS"), "no") != 0))
+            {
+                pdf_xml_tag_open_beg(s, "rdf:Description");
+                pdf_xml_copy(s, " rdf:about=\"\"");
+                pdf_xml_attribute_name(s, "xmlns:xapMM");
+                pdf_xml_attribute_value(s, "http://ns.adobe.com/xap/1.0/mm/");
+                pdf_xml_attribute_name(s, "xapMM:DocumentID");
+                pdf_xml_attribute_value(s, document_uuid);
+                pdf_xml_tag_end_empty(s);
+                pdf_xml_newline(s);
+            }

             pdf_xml_tag_open_beg(s, "rdf:Description");
             pdf_xml_copy(s, " rdf:about=\"\"");


code:
* On i686 floating-point roundoff errors could sometimes cause this check to
  fail depending on the elapsed microseconds.  Improve rounding by adding a
  fractional bit.

--- glib-2.40.0/glib/tests/timer.c	2014-03-05 08:05:42.000000000 -0600
+++ glib-2.40.0/glib/tests/timer.c	2014-07-10 16:33:12.746862822 -0500
@@ -35,7 +35,7 @@
   elapsed = g_timer_elapsed (timer, &micros);

   g_assert_cmpfloat (elapsed, <, 1.0);
-  g_assert_cmpuint (micros, ==, ((guint64)(elapsed * 1e6)) % 1000000);
+  g_assert_cmpuint (micros, ==, ((guint64)(elapsed * 1e6 + 0.5)) % 1000000);

   g_timer_destroy (timer);
 }


code:
These commits are cherry-picked from the "release/2.27/master" branch.

https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.27/master

Currently, we have the following (with NEWS and ChangeLog entries omitted).

56170e064e2b21ce204f0817733e92f1730541ea
516fa6080481a1433c173320b1c1432868e1e38a
f36553bf6a4f69070f99badbdab5802b43e6e211
7c6304182b9f422b782ace1cdd3efbde056aec36
78a90c2f74a2012dd3eff302189e47ff6779a757
1e52d8e65a58c49a48549053a1b89c06240e0c6c
55ad82e45c313454de657931898e974a7a036cad

From 56170e064e2b21ce204f0817733e92f1730541ea Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenko@redhat.com>
Date: Wed, 7 Feb 2018 13:53:10 +0100
Subject: [PATCH] Linux: use reserved name __key in pkey_get [BZ #22797]

_key is not reserved name and we should avoid using that. It seems that
it was simple typo when pkey_* was implemented.

(cherry picked from commit 388ff7bd0d57d7061fdd39a2f26f65687e8058da)

diff --git a/sysdeps/unix/sysv/linux/bits/mman-shared.h b/sysdeps/unix/sysv/linux/bits/mman-shared.h
index 7715e680ca..d15ba95c9d 100644
--- a/sysdeps/unix/sysv/linux/bits/mman-shared.h
+++ b/sysdeps/unix/sysv/linux/bits/mman-shared.h
@@ -61,7 +61,7 @@ int pkey_set (int __key, unsigned int __access_rights) __THROW;

 /* Return the access rights for the current thread for KEY, which must
    have been allocated using pkey_alloc.  */
-int pkey_get (int _key) __THROW;
+int pkey_get (int __key) __THROW;

 /* Free an allocated protection key, which must have been allocated
    using pkey_alloc.  */

From 516fa6080481a1433c173320b1c1432868e1e38a Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Fri, 29 Dec 2017 23:19:32 +0000
Subject: [PATCH] linux/aarch64: sync sys/ptrace.h with Linux 4.15 [BZ #22433]

Remove compat-specific constants that were never exported by kernel
headers under these names.  Before linux commit v3.7-rc1~16^2~1 they
were exported with COMPAT_ prefix, and since that commit they are not
exported at all.

* sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h (__ptrace_request):
Remove arm-specific PTRACE_GET_THREAD_AREA, PTRACE_GETHBPREGS,
and PTRACE_SETHBPREGS.

(cherry picked from commit 2fd4bbaa1446f1be700e10c526cf585a796c4991)

diff --git a/sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h b/sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h
index 4be45b95ff..444edbb702 100644
--- a/sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h
+++ b/sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h
@@ -78,18 +78,10 @@ enum __ptrace_request
   PTRACE_DETACH = 17,
 #define PT_DETACH PTRACE_DETACH

-  PTRACE_GET_THREAD_AREA = 22,
-
   /* Continue and stop at the next entry to or return from syscall.  */
   PTRACE_SYSCALL = 24,
 #define PT_SYSCALL PTRACE_SYSCALL

-  /* Get all hardware breakpoint registers.  */
-  PTRACE_GETHBPREGS = 29,
-
-  /* Set all hardware breakpoint registers.  */
-  PTRACE_SETHBPREGS = 30,
-
   /* Set ptrace filter options.  */
   PTRACE_SETOPTIONS = 0x4200,
 #define PT_SETOPTIONS PTRACE_SETOPTIONS

From f36553bf6a4f69070f99badbdab5802b43e6e211 Mon Sep 17 00:00:00 2001
From: Mike FABIAN <mfabian@redhat.com>
Date: Mon, 19 Feb 2018 21:59:30 +0100
Subject: [PATCH] =?UTF-8?q?Add=20missing=20=E2=80=9Creorder-end=E2=80=9D?=
 =?UTF-8?q?=20in=20LC=5FCOLLATE=20of=20et=5FEE=20[BZ=20#22517]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

	[BZ #22517]
	* localedata/locales/et_EE (LC_COLLATE): add missing “reorder-end”

(cherry picked from commit 7ec5f9465e732e668d0dc94ac078ba68056d6d0a)

diff --git a/localedata/locales/et_EE b/localedata/locales/et_EE
index 9cb55b568f..bab7493c98 100644
--- a/localedata/locales/et_EE
+++ b/localedata/locales/et_EE
@@ -103,6 +103,8 @@ reorder-after <w>
 <U00FC> <u-diaresis>;<BAS>;<MIN>;IGNORE % ü
 <U00DC> <u-diaresis>;<BAS>;<CAP>;IGNORE % Ü

+reorder-end
+
 END LC_COLLATE

 LC_CTYPE

From 7c6304182b9f422b782ace1cdd3efbde056aec36 Mon Sep 17 00:00:00 2001
From: DJ Delorie <dj@redhat.com>
Date: Thu, 1 Mar 2018 23:20:45 -0500
Subject: [PATCH] [BZ #22342] Fix netgroup cache keys.

Unlike other nscd caches, the netgroup cache contains two types of
records - those for "iterate through a netgroup" (i.e. setnetgrent())
and those for "is this user in this netgroup" (i.e. innetgr()),
i.e. full and partial records.  The timeout code assumes these records
have the same key for the group name, so that the collection of records
that is "this netgroup" can be expired as a unit.

However, the keys are not the same, as the in-netgroup key is generated
by nscd rather than being passed to it from elsewhere, and is generated
without the trailing NUL.  All other keys have the trailing NUL, and as
noted in the linked BZ, debug statements confirm that two keys for the
same netgroup are added to the cache with two different lengths.

The result of this is that as records in the cache expire, the purge
code only cleans out one of the two types of entries, resulting in
stale, possibly incorrect, and possibly inconsistent cache data.

The patch simply includes the existing NUL in the computation for the
key length ('key' points to the char after the NUL, and 'group' to the
first char of the group, so 'key-group' includes the first char to the
NUL, inclusive).

	[BZ #22342]
	* nscd/netgroupcache.c (addinnetgrX): Include trailing NUL in
	key value.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit 1c81d55fc4b07b51adf68558ba74ce975153e580)

diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index b832c9315f..2f187b208c 100644
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -480,7 +480,7 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
 {
   const char *group = key;
   key = (char *) rawmemchr (key, '\0') + 1;
-  size_t group_len = key - group - 1;
+  size_t group_len = key - group;
   const char *host = *key++ ? key : NULL;
   if (host != NULL)
     key = (char *) rawmemchr (key, '\0') + 1;

From 78a90c2f74a2012dd3eff302189e47ff6779a757 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@linux-m68k.org>
Date: Fri, 2 Mar 2018 23:07:14 +0100
Subject: [PATCH] Fix multiple definitions of __nss_*_database (bug 22918)

(cherry picked from commit eaf6753f8aac33a36deb98c1031d1bad7b593d2d)

diff --git a/nscd/gai.c b/nscd/gai.c
index d081747797..576fd0045b 100644
--- a/nscd/gai.c
+++ b/nscd/gai.c
@@ -45,3 +45,6 @@
 #ifdef HAVE_LIBIDN
 # include <libidn/idn-stub.c>
 #endif
+
+/* Some variables normally defined in libc.  */
+service_user *__nss_hosts_database attribute_hidden;
diff --git a/nss/nsswitch.c b/nss/nsswitch.c
index d5e655974f..b0f0c11a3e 100644
--- a/nss/nsswitch.c
+++ b/nss/nsswitch.c
@@ -62,7 +62,7 @@ static service_library *nss_new_service (name_database *database,

 /* Declare external database variables.  */
 #define DEFINE_DATABASE(name)						      \
-  extern service_user *__nss_##name##_database attribute_hidden;	      \
+  service_user *__nss_##name##_database attribute_hidden;		      \
   weak_extern (__nss_##name##_database)
 #include "databases.def"
 #undef DEFINE_DATABASE
diff --git a/nss/nsswitch.h b/nss/nsswitch.h
index eccb535ef5..63573b9ebc 100644
--- a/nss/nsswitch.h
+++ b/nss/nsswitch.h
@@ -226,10 +226,10 @@ libc_hidden_proto (__nss_hostname_digits_dots)
 #define MAX_NR_ADDRS    48

 /* Prototypes for __nss_*_lookup2 functions.  */
-#define DEFINE_DATABASE(arg)				    \
-  service_user *__nss_##arg##_database attribute_hidden;    \
-  int __nss_##arg##_lookup2 (service_user **, const char *, \
-			     const char *, void **);	    \
+#define DEFINE_DATABASE(arg)						      \
+  extern service_user *__nss_##arg##_database attribute_hidden;		      \
+  int __nss_##arg##_lookup2 (service_user **, const char *,		      \
+			     const char *, void **);			      \
   libc_hidden_proto (__nss_##arg##_lookup2)
 #include "databases.def"
 #undef DEFINE_DATABASE
diff --git a/posix/tst-rfc3484-2.c b/posix/tst-rfc3484-2.c
index f509534ca9..8c64ac59ff 100644
--- a/posix/tst-rfc3484-2.c
+++ b/posix/tst-rfc3484-2.c
@@ -58,6 +58,7 @@ _res_hconf_init (void)
 #undef	USE_NSCD
 #include "../sysdeps/posix/getaddrinfo.c"

+service_user *__nss_hosts_database attribute_hidden;

 /* This is the beginning of the real test code.  The above defines
    (among other things) the function rfc3484_sort.  */
diff --git a/posix/tst-rfc3484-3.c b/posix/tst-rfc3484-3.c
index ae44087a10..1c61aaf844 100644
--- a/posix/tst-rfc3484-3.c
+++ b/posix/tst-rfc3484-3.c
@@ -58,6 +58,7 @@ _res_hconf_init (void)
 #undef	USE_NSCD
 #include "../sysdeps/posix/getaddrinfo.c"

+service_user *__nss_hosts_database attribute_hidden;

 /* This is the beginning of the real test code.  The above defines
    (among other things) the function rfc3484_sort.  */
diff --git a/posix/tst-rfc3484.c b/posix/tst-rfc3484.c
index 7f191abbbc..8f45848e44 100644
--- a/posix/tst-rfc3484.c
+++ b/posix/tst-rfc3484.c
@@ -58,6 +58,7 @@ _res_hconf_init (void)
 #undef	USE_NSCD
 #include "../sysdeps/posix/getaddrinfo.c"

+service_user *__nss_hosts_database attribute_hidden;

 /* This is the beginning of the real test code.  The above defines
    (among other things) the function rfc3484_sort.  */

From 1e52d8e65a58c49a48549053a1b89c06240e0c6c Mon Sep 17 00:00:00 2001
From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Fri, 17 Nov 2017 16:04:29 -0200
Subject: [PATCH] i386: Fix i386 sigaction sa_restorer initialization
 (BZ#21269)

This patch fixes the i386 sa_restorer field initialization for sigaction
syscall for kernel with vDSO.  As described in bug report, i386 Linux
(and compat on x86_64) interprets SA_RESTORER clear with nonzero
sa_restorer as a request for stack switching if the SS segment is 'funny'.
This means that anything that tries to mix glibc's signal handling with
segmentation (for instance through modify_ldt syscall) is randomly broken
depending on what values lands in sa_restorer.

The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
more specifically in do_multicpu_tests function.  The main changes are:

  - C11 atomics instead of plain access.

  - Remove x86_64 support which simplifies the syscall handling and fallbacks.

  - Replicate only the test required to trigger the issue.

Checked on i686-linux-gnu.

	[BZ #21269]
	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
	sa_restorer for vDSO case.
	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.

(cherry picked from commit 68448be208ee06e76665918b37b0a57e3e00c8b4)

diff --git a/sysdeps/unix/sysv/linux/i386/Makefile b/sysdeps/unix/sysv/linux/i386/Makefile
index 4080b8c966..da716e2c1b 100644
--- a/sysdeps/unix/sysv/linux/i386/Makefile
+++ b/sysdeps/unix/sysv/linux/i386/Makefile
@@ -3,6 +3,9 @@ default-abi := 32

 ifeq ($(subdir),misc)
 sysdep_routines += ioperm iopl vm86
+
+tests += tst-bz21269
+$(objpfx)tst-bz21269: $(shared-thread-library)
 endif

 ifeq ($(subdir),elf)
diff --git a/sysdeps/unix/sysv/linux/i386/sigaction.c b/sysdeps/unix/sysv/linux/i386/sigaction.c
index a5eb9e0d3e..177ff60ee6 100644
--- a/sysdeps/unix/sysv/linux/i386/sigaction.c
+++ b/sysdeps/unix/sysv/linux/i386/sigaction.c
@@ -42,7 +42,6 @@ extern void restore_rt (void) asm ("__restore_rt") attribute_hidden;
 #endif
 extern void restore (void) asm ("__restore") attribute_hidden;

-
 /* If ACT is not NULL, change the action for SIG to *ACT.
    If OACT is not NULL, put the old action for SIG in *OACT.  */
 int
@@ -65,6 +64,8 @@ __libc_sigaction (int sig, const struct sigaction *act, struct sigaction *oact)
 	  kact.sa_restorer = ((act->sa_flags & SA_SIGINFO)
 			      ? &restore_rt : &restore);
 	}
+      else
+	kact.sa_restorer = NULL;
     }

   /* XXX The size argument hopefully will have to be changed to the
diff --git a/sysdeps/unix/sysv/linux/i386/tst-bz21269.c b/sysdeps/unix/sysv/linux/i386/tst-bz21269.c
new file mode 100644
index 0000000000..353e36507d
--- /dev/null
+++ b/sysdeps/unix/sysv/linux/i386/tst-bz21269.c
@@ -0,0 +1,233 @@
+/* Test for i386 sigaction sa_restorer handling (BZ#21269)
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/* This is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
+   more specifically in do_multicpu_tests function.  The main changes
+   are:
+
+   - C11 atomics instead of plain access.
+   - Remove x86_64 support which simplifies the syscall handling
+     and fallbacks.
+   - Replicate only the test required to trigger the issue for the
+     BZ#21269.  */
+
+#include <stdatomic.h>
+
+#include <asm/ldt.h>
+#include <linux/futex.h>
+
+#include <setjmp.h>
+#include <signal.h>
+#include <errno.h>
+#include <sys/syscall.h>
+#include <sys/mman.h>
+
+#include <support/xunistd.h>
+#include <support/check.h>
+#include <support/xthread.h>
+
+static int
+xset_thread_area (struct user_desc *u_info)
+{
+  long ret = syscall (SYS_set_thread_area, u_info);
+  TEST_VERIFY_EXIT (ret == 0);
+  return ret;
+}
+
+static void
+xmodify_ldt (int func, const void *ptr, unsigned long bytecount)
+{
+  TEST_VERIFY_EXIT (syscall (SYS_modify_ldt, 1, ptr, bytecount) == 0);
+}
+
+static int
+futex (int *uaddr, int futex_op, int val, void *timeout, int *uaddr2,
+	int val3)
+{
+  return syscall (SYS_futex, uaddr, futex_op, val, timeout, uaddr2, val3);
+}
+
+static void
+xsethandler (int sig, void (*handler)(int, siginfo_t *, void *), int flags)
+{
+  struct sigaction sa = { 0 };
+  sa.sa_sigaction = handler;
+  sa.sa_flags = SA_SIGINFO | flags;
+  TEST_VERIFY_EXIT (sigemptyset (&sa.sa_mask) == 0);
+  TEST_VERIFY_EXIT (sigaction (sig, &sa, 0) == 0);
+}
+
+static jmp_buf jmpbuf;
+
+static void
+sigsegv_handler (int sig, siginfo_t *info, void *ctx_void)
+{
+  siglongjmp (jmpbuf, 1);
+}
+
+/* Points to an array of 1024 ints, each holding its own index.  */
+static const unsigned int *counter_page;
+static struct user_desc *low_user_desc;
+static struct user_desc *low_user_desc_clear; /* Used to delete GDT entry.  */
+static int gdt_entry_num;
+
+static void
+setup_counter_page (void)
+{
+  long page_size = sysconf (_SC_PAGE_SIZE);
+  TEST_VERIFY_EXIT (page_size > 0);
+  unsigned int *page = xmmap (NULL, page_size, PROT_READ | PROT_WRITE,
+			      MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1);
+  for (int i = 0; i < (page_size / sizeof (unsigned int)); i++)
+    page[i] = i;
+  counter_page = page;
+}
+
+static void
+setup_low_user_desc (void)
+{
+  low_user_desc = xmmap (NULL, 2 * sizeof (struct user_desc),
+			 PROT_READ | PROT_WRITE,
+			 MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1);
+
+  low_user_desc->entry_number    = -1;
+  low_user_desc->base_addr       = (unsigned long) &counter_page[1];
+  low_user_desc->limit           = 0xffff;
+  low_user_desc->seg_32bit       = 1;
+  low_user_desc->contents        = 0;
+  low_user_desc->read_exec_only  = 0;
+  low_user_desc->limit_in_pages  = 1;
+  low_user_desc->seg_not_present = 0;
+  low_user_desc->useable         = 0;
+
+  xset_thread_area (low_user_desc);
+
+  low_user_desc_clear = low_user_desc + 1;
+  low_user_desc_clear->entry_number = gdt_entry_num;
+  low_user_desc_clear->read_exec_only = 1;
+  low_user_desc_clear->seg_not_present = 1;
+}
+
+/* Possible values of futex:
+   0: thread is idle.
+   1: thread armed.
+   2: thread should clear LDT entry 0.
+   3: thread should exit.  */
+static atomic_uint ftx;
+
+static void *
+threadproc (void *ctx)
+{
+  while (1)
+    {
+      futex ((int *) &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
+      while (atomic_load (&ftx) != 2)
+	{
+	  if (atomic_load (&ftx) >= 3)
+	    return NULL;
+	}
+
+      /* clear LDT entry 0.  */
+      const struct user_desc desc = { 0 };
+      xmodify_ldt (1, &desc, sizeof (desc));
+
+      /* If ftx == 2, set it to zero,  If ftx == 100, quit.  */
+      if (atomic_fetch_add (&ftx, -2) != 2)
+	return NULL;
+    }
+}
+
+
+/* As described in testcase, for historical reasons x86_32 Linux (and compat
+   on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a
+   request for stack switching if the SS segment is 'funny' (this is default
+   scenario for vDSO system).  This means that anything that tries to mix
+   signal handling with segmentation should explicit clear the sa_restorer.
+
+   This testcase check if sigaction in fact does it by changing the local
+   descriptor table (LDT) through the modify_ldt syscall and triggering
+   a synchronous segfault on iret fault by trying to install an invalid
+   segment.  With a correct zeroed sa_restorer it should not trigger an
+   'real' SEGSEGV and allows the siglongjmp in signal handler.  */
+
+static int
+do_test (void)
+{
+  setup_counter_page ();
+  setup_low_user_desc ();
+
+  pthread_t thread;
+  unsigned short orig_ss;
+
+  xsethandler (SIGSEGV, sigsegv_handler, 0);
+  /* 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults.  */
+  xsethandler (SIGILL, sigsegv_handler, 0);
+
+  thread = xpthread_create (0, threadproc, 0);
+
+  asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
+
+  for (int i = 0; i < 5; i++)
+    {
+      if (sigsetjmp (jmpbuf, 1) != 0)
+	continue;
+
+      /* Make sure the thread is ready after the last test. */
+      while (atomic_load (&ftx) != 0)
+	;
+
+      struct user_desc desc = {
+	.entry_number       = 0,
+	.base_addr          = 0,
+	.limit              = 0xffff,
+	.seg_32bit          = 1,
+	.contents           = 0,
+	.read_exec_only     = 0,
+	.limit_in_pages     = 1,
+	.seg_not_present    = 0,
+	.useable            = 0
+      };
+
+      xmodify_ldt (0x11, &desc, sizeof (desc));
+
+      /* Arm the thread.  */
+      ftx = 1;
+      futex ((int*) &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+      asm volatile ("mov %0, %%ss" : : "r" (0x7));
+
+      /* Fire up thread modify_ldt call.  */
+      atomic_store (&ftx, 2);
+
+      while (atomic_load (&ftx) != 0)
+	;
+
+      /* On success, modify_ldt will segfault us synchronously and we will
+	 escape via siglongjmp.  */
+      support_record_failure ();
+    }
+
+  atomic_store (&ftx, 100);
+  futex ((int*) &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+  xpthread_join (thread);
+
+  return 0;
+}
+
+#include <support/test-driver.c>

From 55ad82e45c313454de657931898e974a7a036cad Mon Sep 17 00:00:00 2001
From: Andrew Senkevich <andrew.n.senkevich@gmail.com>
Date: Fri, 23 Mar 2018 16:19:45 +0100
Subject: [PATCH] Fix i386 memmove issue (bug 22644).

	[BZ #22644]
	* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
	branch conditions.
	* string/test-memmove.c (do_test2): New testcase.

(cherry picked from commit cd66c0e584c6d692bc8347b5e72723d02b8a8ada)

diff --git a/string/test-memmove.c b/string/test-memmove.c
index edc7a4c3bf..64e3651ba4 100644
--- a/string/test-memmove.c
+++ b/string/test-memmove.c
@@ -24,6 +24,7 @@
 # define TEST_NAME "memmove"
 #endif
 #include "test-string.h"
+#include <support/test-driver.h>

 char *simple_memmove (char *, const char *, size_t);

@@ -245,6 +246,60 @@ do_random_tests (void)
     }
 }

+static void
+do_test2 (void)
+{
+  size_t size = 0x20000000;
+  uint32_t * large_buf;
+
+  large_buf = mmap ((void*) 0x70000000, size, PROT_READ | PROT_WRITE,
+		    MAP_PRIVATE | MAP_ANON, -1, 0);
+
+  if (large_buf == MAP_FAILED)
+    error (EXIT_UNSUPPORTED, errno, "Large mmap failed");
+
+  if ((uintptr_t) large_buf > 0x80000000 - 128
+      || 0x80000000 - (uintptr_t) large_buf > 0x20000000)
+    {
+      error (0, 0, "Large mmap allocated improperly");
+      ret = EXIT_UNSUPPORTED;
+      munmap ((void *) large_buf, size);
+      return;
+    }
+
+  size_t bytes_move = 0x80000000 - (uintptr_t) large_buf;
+  size_t arr_size = bytes_move / sizeof (uint32_t);
+  size_t i;
+
+  FOR_EACH_IMPL (impl, 0)
+    {
+      for (i = 0; i < arr_size; i++)
+        large_buf[i] = (uint32_t) i;
+
+      uint32_t * dst = &large_buf[33];
+
+#ifdef TEST_BCOPY
+      CALL (impl, (char *) large_buf, (char *) dst, bytes_move);
+#else
+      CALL (impl, (char *) dst, (char *) large_buf, bytes_move);
+#endif
+
+      for (i = 0; i < arr_size; i++)
+	{
+	  if (dst[i] != (uint32_t) i)
+	    {
+	      error (0, 0,
+		     "Wrong result in function %s dst \"%p\" src \"%p\" offset \"%zd\"",
+		     impl->name, dst, large_buf, i);
+	      ret = 1;
+	      break;
+	    }
+	}
+    }
+
+  munmap ((void *) large_buf, size);
+}
+
 int
 test_main (void)
 {
@@ -284,6 +339,9 @@ test_main (void)
     }

   do_random_tests ();
+
+  do_test2 ();
+
   return ret;
 }

diff --git a/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S b/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S
index 9c3bbe7e17..9aa17de99c 100644
--- a/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S
+++ b/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S
@@ -72,7 +72,7 @@ ENTRY (MEMCPY)
 	cmp	%edx, %eax

 # ifdef USE_AS_MEMMOVE
-	jg	L(check_forward)
+	ja	L(check_forward)

 L(mm_len_0_or_more_backward):
 /* Now do checks for lengths. We do [0..16], [16..32], [32..64], [64..128]
@@ -81,7 +81,7 @@ L(mm_len_0_or_more_backward):
 	jbe	L(mm_len_0_16_bytes_backward)

 	cmpl	$32, %ecx
-	jg	L(mm_len_32_or_more_backward)
+	ja	L(mm_len_32_or_more_backward)

 /* Copy [0..32] and return.  */
 	movdqu	(%eax), %xmm0
@@ -92,7 +92,7 @@ L(mm_len_0_or_more_backward):

 L(mm_len_32_or_more_backward):
 	cmpl	$64, %ecx
-	jg	L(mm_len_64_or_more_backward)
+	ja	L(mm_len_64_or_more_backward)

 /* Copy [0..64] and return.  */
 	movdqu	(%eax), %xmm0
@@ -107,7 +107,7 @@ L(mm_len_32_or_more_backward):

 L(mm_len_64_or_more_backward):
 	cmpl	$128, %ecx
-	jg	L(mm_len_128_or_more_backward)
+	ja	L(mm_len_128_or_more_backward)

 /* Copy [0..128] and return.  */
 	movdqu	(%eax), %xmm0
@@ -132,7 +132,7 @@ L(mm_len_128_or_more_backward):
 	add	%ecx, %eax
 	cmp	%edx, %eax
 	movl	SRC(%esp), %eax
-	jle	L(forward)
+	jbe	L(forward)
 	PUSH (%esi)
 	PUSH (%edi)
 	PUSH (%ebx)
@@ -269,7 +269,7 @@ L(check_forward):
 	add	%edx, %ecx
 	cmp	%eax, %ecx
 	movl	LEN(%esp), %ecx
-	jle	L(forward)
+	jbe	L(forward)

 /* Now do checks for lengths. We do [0..16], [0..32], [0..64], [0..128]
 	separately.  */


code:
This patch is taken from debian's glibc package (generate-supported.mk).
It install the localedata/SUPPORTED file of the glibc. This file lists
all the supported locales of the glibc.

diff --git a/localedata/Makefile.old b/localedata/Makefile
index 34877c0..a61d9b9 100644
--- a/localedata/Makefile.old
+++ b/localedata/Makefile
@@ -91,7 +91,8 @@ endif
 # Files to install.
 install-others := $(addprefix $(inst_i18ndir)/, \
 			      $(addsuffix .gz, $(charmaps)) \
-			      $(locales))
+			      $(locales)) \
+                   $(inst_i18ndir)/SUPPORTED

 tests: $(objdir)/iconvdata/gconv-modules

@@ -195,6 +196,14 @@ endif

 include SUPPORTED

+$(inst_i18ndir)/SUPPORTED: SUPPORTED $(+force)
+	for locale in $(SUPPORTED-LOCALES); do \
+		[ $$locale = true ] && continue; \
+		echo $$locale | sed 's,/, ,' >> LOCALES; \
+	done
+	$(make-target-directory)
+	$(INSTALL_DATA) LOCALES $@
+
 INSTALL-SUPPORTED-LOCALES=$(addprefix install-, $(SUPPORTED-LOCALES))

 # Sometimes the whole collection of locale files should be installed.


code:
This file contains fixes from the "release/2.28/master" branch:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.28/master

Currently we have these commits (sans tests and ChangeLog updates):
7f11842e7483da7aa9fa3031be122021978ef600
726e1554ce4db5e35af41cb0110c54c5e1232054
4b25485f03158959cff45379eecc1d73c7dcdd11
d05b05d1570ba3ae354a2f5a3cfeefb373b09979
bfcfa22589f2b4277a65e60c6b736b6bbfbd87d0
2f498f3d140ab5152bd784df2be7af7d9c5e63ed

diff --git a/htl/Versions b/htl/Versions
index 6a63a1b8a1..c5a616da10 100644
--- a/htl/Versions
+++ b/htl/Versions
@@ -150,6 +150,8 @@ libpthread {
     __cthread_keycreate;
     __cthread_getspecific;
     __cthread_setspecific;
+    __pthread_getspecific;
+    __pthread_setspecific;
     __pthread_getattr_np;
     __pthread_attr_getstack;
   }

diff --git a/sysdeps/htl/pt-getspecific.c b/sysdeps/htl/pt-getspecific.c
index a0227a67f6..64ddf9551a 100644
--- a/sysdeps/htl/pt-getspecific.c
+++ b/sysdeps/htl/pt-getspecific.c
@@ -36,3 +36,4 @@ __pthread_getspecific (pthread_key_t key)
   return self->thread_specifics[key];
 }
 strong_alias (__pthread_getspecific, pthread_getspecific);
+hidden_def (__pthread_getspecific)
diff --git a/sysdeps/htl/pt-setspecific.c b/sysdeps/htl/pt-setspecific.c
index a46a12f157..02aff417ef 100644
--- a/sysdeps/htl/pt-setspecific.c
+++ b/sysdeps/htl/pt-setspecific.c
@@ -48,3 +48,4 @@ __pthread_setspecific (pthread_key_t key, const void *value)
   return 0;
 }
 strong_alias (__pthread_setspecific, pthread_setspecific);
+hidden_def (__pthread_setspecific)
diff --git a/sysdeps/htl/pthreadP.h b/sysdeps/htl/pthreadP.h
index 132ac1718e..71c2fcd9c6 100644
--- a/sysdeps/htl/pthreadP.h
+++ b/sysdeps/htl/pthreadP.h
@@ -68,6 +68,8 @@ struct __pthread_cancelation_handler **___pthread_get_cleanup_stack (void) attri

 #if IS_IN (libpthread)
 hidden_proto (__pthread_key_create)
+hidden_proto (__pthread_getspecific)
+hidden_proto (__pthread_setspecific)
 hidden_proto (_pthread_mutex_init)
 #endif

diff --git a/sysdeps/unix/sysv/linux/getdents64.c b/sysdeps/unix/sysv/linux/getdents64.c
index 3bde0cf4f0..bc140b5a7f 100644
--- a/sysdeps/unix/sysv/linux/getdents64.c
+++ b/sysdeps/unix/sysv/linux/getdents64.c
@@ -33,41 +33,80 @@ strong_alias (__getdents64, __getdents)
 # include <shlib-compat.h>

 # if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
-# include <olddirent.h>
+#  include <olddirent.h>
+#  include <unistd.h>

-/* kernel definition of as of 3.2.  */
-struct compat_linux_dirent
+static ssize_t
+handle_overflow (int fd, __off64_t offset, ssize_t count)
 {
-  /* Both d_ino and d_off are compat_ulong_t which are defined in all
-     architectures as 'u32'.  */
-  uint32_t        d_ino;
-  uint32_t        d_off;
-  unsigned short  d_reclen;
-  char            d_name[1];
-};
+  /* If this is the first entry in the buffer, we can report the
+     error.  */
+  if (count == 0)
+    {
+      __set_errno (EOVERFLOW);
+      return -1;
+    }
+
+  /* Otherwise, seek to the overflowing entry, so that the next call
+     will report the error, and return the data read so far..  */
+  if (__lseek64 (fd, offset, SEEK_SET) != 0)
+    return -1;
+  return count;
+}

 ssize_t
 __old_getdents64 (int fd, char *buf, size_t nbytes)
 {
-  ssize_t retval = INLINE_SYSCALL_CALL (getdents, fd, buf, nbytes);
+  /* We do not move the individual directory entries.  This is only
+     possible if the target type (struct __old_dirent64) is smaller
+     than the source type.  */
+  _Static_assert (offsetof (struct __old_dirent64, d_name)
+		  <= offsetof (struct dirent64, d_name),
+		  "__old_dirent64 is larger than dirent64");
+  _Static_assert (__alignof__ (struct __old_dirent64)
+		  <= __alignof__ (struct dirent64),
+		  "alignment of __old_dirent64 is larger than dirent64");

-  /* The kernel added the d_type value after the name.  Change this now.  */
-  if (retval != -1)
+  ssize_t retval = INLINE_SYSCALL_CALL (getdents64, fd, buf, nbytes);
+  if (retval > 0)
     {
-      union
-      {
-	struct compat_linux_dirent k;
-	struct dirent u;
-      } *kbuf = (void *) buf;
-
-      while ((char *) kbuf < buf + retval)
+      char *p = buf;
+      char *end = buf + retval;
+      while (p < end)
 	{
-	  char d_type = *((char *) kbuf + kbuf->k.d_reclen - 1);
-	  memmove (kbuf->u.d_name, kbuf->k.d_name,
-		   strlen (kbuf->k.d_name) + 1);
-	  kbuf->u.d_type = d_type;
+	  struct dirent64 *source = (struct dirent64 *) p;
+
+	  /* Copy out the fixed-size data.  */
+	  __ino_t ino = source->d_ino;
+	  __off64_t offset = source->d_off;
+	  unsigned int reclen = source->d_reclen;
+	  unsigned char type = source->d_type;
+
+	  /* Check for ino_t overflow.  */
+	  if (__glibc_unlikely (ino != source->d_ino))
+	    return handle_overflow (fd, offset, p - buf);
+
+	  /* Convert to the target layout.  Use a separate struct and
+	     memcpy to side-step aliasing issues.  */
+	  struct __old_dirent64 result;
+	  result.d_ino = ino;
+	  result.d_off = offset;
+	  result.d_reclen = reclen;
+	  result.d_type = type;
+
+	  /* Write the fixed-sized part of the result to the
+	     buffer.  */
+	  size_t result_name_offset = offsetof (struct __old_dirent64, d_name);
+	  memcpy (p, &result, result_name_offset);
+
+	  /* Adjust the position of the name if necessary.  Copy
+	     everything until the end of the record, including the
+	     terminating NUL byte.  */
+	  if (result_name_offset != offsetof (struct dirent64, d_name))
+	    memmove (p + result_name_offset, source->d_name,
+		     reclen - offsetof (struct dirent64, d_name));

-	  kbuf = (void *) ((char *) kbuf + kbuf->k.d_reclen);
+	  p += reclen;
 	}
      }
   return retval;

diff --git a/misc/error.c b/misc/error.c
index b4e8b6c938..03378e2f2a 100644
--- a/misc/error.c
+++ b/misc/error.c
@@ -319,6 +319,7 @@ error (int status, int errnum, const char *message, ...)

   va_start (args, message);
   error_tail (status, errnum, message, args);
+  va_end (args);

 #ifdef _LIBC
   _IO_funlockfile (stderr);
@@ -390,6 +391,7 @@ error_at_line (int status, int errnum, const char *file_name,

   va_start (args, message);
   error_tail (status, errnum, message, args);
+  va_end (args);

 #ifdef _LIBC
   _IO_funlockfile (stderr);

diff --git a/nscd/nscd_conf.c b/nscd/nscd_conf.c
index 265a02434d..7293b795b6 100644
--- a/nscd/nscd_conf.c
+++ b/nscd/nscd_conf.c
@@ -190,7 +190,10 @@ nscd_parse_file (const char *fname, struct database_dyn dbs[lastdb])
 	  if (!arg1)
 	    error (0, 0, _("Must specify user name for server-user option"));
 	  else
-	    server_user = xstrdup (arg1);
+	    {
+	      free ((char *) server_user);
+	      server_user = xstrdup (arg1);
+	    }
 	}
       else if (strcmp (entry, "stat-user") == 0)
 	{
@@ -198,6 +201,7 @@ nscd_parse_file (const char *fname, struct database_dyn dbs[lastdb])
 	    error (0, 0, _("Must specify user name for stat-user option"));
 	  else
 	    {
+	      free ((char *) stat_user);
 	      stat_user = xstrdup (arg1);

 	      struct passwd *pw = getpwnam (stat_user);

diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
index cfd34b66b9..35b0bfc5d2 100644
--- a/nss/nss_files/files-alias.c
+++ b/nss/nss_files/files-alias.c
@@ -221,6 +221,13 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
 			{
 			  while (! feof_unlocked (listfile))
 			    {
+			      if (room_left < 2)
+				{
+				  free (old_line);
+				  fclose (listfile);
+				  goto no_more_room;
+				}
+
 			      first_unused[room_left - 1] = '\xff';
 			      line = fgets_unlocked (first_unused, room_left,
 						     listfile);
@@ -229,6 +236,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
 			      if (first_unused[room_left - 1] != '\xff')
 				{
 				  free (old_line);
+				  fclose (listfile);
 				  goto no_more_room;
 				}

@@ -256,6 +264,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
 						       + __alignof__ (char *)))
 					{
 					  free (old_line);
+					  fclose (listfile);
 					  goto no_more_room;
 					}
 				      room_left -= ((first_unused - cp)


code:
This file tracks updates from the "release/2.29/master" branch:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.29/master

Abridged commits are appended to this file.

From ec894251ef11723d10df04fcfd7bd2030c6e43ff Mon Sep 17 00:00:00 2001
From: Carlos O'Donell <carlos@redhat.com>
Date: Mon, 21 Jan 2019 22:50:12 -0500
Subject: [PATCH] nptl: Fix pthread_rwlock_try*lock stalls (Bug 23844)
diff --git a/nptl/pthread_rwlock_tryrdlock.c b/nptl/pthread_rwlock_tryrdlock.c
index 368862ff07..2f94f17f36 100644
--- a/nptl/pthread_rwlock_tryrdlock.c
+++ b/nptl/pthread_rwlock_tryrdlock.c
@@ -94,15 +94,22 @@ __pthread_rwlock_tryrdlock (pthread_rwlock_t *rwlock)
       /* Same as in __pthread_rwlock_rdlock_full:
 	 We started the read phase, so we are also responsible for
 	 updating the write-phase futex.  Relaxed MO is sufficient.
-	 Note that there can be no other reader that we have to wake
-	 because all other readers will see the read phase started by us
-	 (or they will try to start it themselves); if a writer started
-	 the read phase, we cannot have started it.  Furthermore, we
-	 cannot discard a PTHREAD_RWLOCK_FUTEX_USED flag because we will
-	 overwrite the value set by the most recent writer (or the readers
-	 before it in case of explicit hand-over) and we know that there
-	 are no waiting readers.  */
-      atomic_store_relaxed (&rwlock->__data.__wrphase_futex, 0);
+	 We have to do the same steps as a writer would when handing over the
+	 read phase to use because other readers cannot distinguish between
+	 us and the writer.
+	 Note that __pthread_rwlock_tryrdlock callers will not have to be
+	 woken up because they will either see the read phase started by us
+	 or they will try to start it themselves; however, callers of
+	 __pthread_rwlock_rdlock_full just increase the reader count and then
+	 check what state the lock is in, so they cannot distinguish between
+	 us and a writer that acquired and released the lock in the
+	 meantime.  */
+      if ((atomic_exchange_relaxed (&rwlock->__data.__wrphase_futex, 0)
+	  & PTHREAD_RWLOCK_FUTEX_USED) != 0)
+	{
+	  int private = __pthread_rwlock_get_private (rwlock);
+	  futex_wake (&rwlock->__data.__wrphase_futex, INT_MAX, private);
+	}
     }

   return 0;
diff --git a/nptl/pthread_rwlock_trywrlock.c b/nptl/pthread_rwlock_trywrlock.c
index fd37a71ce4..fae475cc70 100644
--- a/nptl/pthread_rwlock_trywrlock.c
+++ b/nptl/pthread_rwlock_trywrlock.c
@@ -46,8 +46,15 @@ __pthread_rwlock_trywrlock (pthread_rwlock_t *rwlock)
 	  &rwlock->__data.__readers, &r,
 	  r | PTHREAD_RWLOCK_WRPHASE | PTHREAD_RWLOCK_WRLOCKED))
 	{
+	  /* We have become the primary writer and we cannot have shared
+	     the PTHREAD_RWLOCK_FUTEX_USED flag with someone else, so we
+	     can simply enable blocking (see full wrlock code).  */
 	  atomic_store_relaxed (&rwlock->__data.__writers_futex, 1);
-	  atomic_store_relaxed (&rwlock->__data.__wrphase_futex, 1);
+	  /* If we started a write phase, we need to enable readers to
+	     wait.  If we did not, we must not change it because other threads
+	     may have set the PTHREAD_RWLOCK_FUTEX_USED in the meantime.  */
+	  if ((r & PTHREAD_RWLOCK_WRPHASE) == 0)
+	    atomic_store_relaxed (&rwlock->__data.__wrphase_futex, 1);
 	  atomic_store_relaxed (&rwlock->__data.__cur_writer,
 	      THREAD_GETMEM (THREAD_SELF, tid));
 	  return 0;
diff --git a/support/Makefile b/support/Makefile
index 432cf2fe6c..c15b93647c 100644
--- a/support/Makefile
+++ b/support/Makefile
@@ -129,6 +129,7 @@ libsupport-routines = \
   xpthread_mutexattr_settype \
   xpthread_once \
   xpthread_rwlock_init \
+  xpthread_rwlock_destroy \
   xpthread_rwlock_rdlock \
   xpthread_rwlock_unlock \
   xpthread_rwlock_wrlock \
diff --git a/support/xpthread_rwlock_destroy.c b/support/xpthread_rwlock_destroy.c
new file mode 100644
index 0000000000..6d6e953569
--- /dev/null
+++ b/support/xpthread_rwlock_destroy.c
@@ -0,0 +1,26 @@
+/* pthread_rwlock_destroy with error checking.
+   Copyright (C) 2019 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <support/xthread.h>
+
+void
+xpthread_rwlock_destroy (pthread_rwlock_t *rwlock)
+{
+  xpthread_check_return ("pthread_rwlock_destroy",
+                         pthread_rwlock_destroy (rwlock));
+}
diff --git a/support/xthread.h b/support/xthread.h
index 47c23235f3..9fe1f68b3b 100644
--- a/support/xthread.h
+++ b/support/xthread.h
@@ -84,6 +84,7 @@ void xpthread_rwlockattr_setkind_np (pthread_rwlockattr_t *attr, int pref);
 void xpthread_rwlock_wrlock (pthread_rwlock_t *rwlock);
 void xpthread_rwlock_rdlock (pthread_rwlock_t *rwlock);
 void xpthread_rwlock_unlock (pthread_rwlock_t *rwlock);
+void xpthread_rwlock_destroy (pthread_rwlock_t *rwlock);

 __END_DECLS

From 44113a8ba24af23d7bbb174f9087a6b83a76289a Mon Sep 17 00:00:00 2001
From: Stefan Liebler <stli@linux.ibm.com>
Date: Thu, 7 Feb 2019 15:18:36 +0100
Subject: [PATCH] Add compiler barriers around modifications of the robust
 mutex list for pthread_mutex_trylock. [BZ #24180]
diff --git a/nptl/pthread_mutex_trylock.c b/nptl/pthread_mutex_trylock.c
index 8fe43b8f0f..bf2869eca2 100644
--- a/nptl/pthread_mutex_trylock.c
+++ b/nptl/pthread_mutex_trylock.c
@@ -94,6 +94,9 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
     case PTHREAD_MUTEX_ROBUST_ADAPTIVE_NP:
       THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending,
 		     &mutex->__data.__list.__next);
+      /* We need to set op_pending before starting the operation.  Also
+	 see comments at ENQUEUE_MUTEX.  */
+      __asm ("" ::: "memory");

       oldval = mutex->__data.__lock;
       do
@@ -119,7 +122,12 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	      /* But it is inconsistent unless marked otherwise.  */
 	      mutex->__data.__owner = PTHREAD_MUTEX_INCONSISTENT;

+	      /* We must not enqueue the mutex before we have acquired it.
+		 Also see comments at ENQUEUE_MUTEX.  */
+	      __asm ("" ::: "memory");
 	      ENQUEUE_MUTEX (mutex);
+	      /* We need to clear op_pending after we enqueue the mutex.  */
+	      __asm ("" ::: "memory");
 	      THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 	      /* Note that we deliberately exist here.  If we fall
@@ -135,6 +143,8 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	      int kind = PTHREAD_MUTEX_TYPE (mutex);
 	      if (kind == PTHREAD_MUTEX_ROBUST_ERRORCHECK_NP)
 		{
+		  /* We do not need to ensure ordering wrt another memory
+		     access.  Also see comments at ENQUEUE_MUTEX. */
 		  THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending,
 				 NULL);
 		  return EDEADLK;
@@ -142,6 +152,8 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)

 	      if (kind == PTHREAD_MUTEX_ROBUST_RECURSIVE_NP)
 		{
+		  /* We do not need to ensure ordering wrt another memory
+		     access.  */
 		  THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending,
 				 NULL);

@@ -160,6 +172,9 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 							id, 0);
 	  if (oldval != 0 && (oldval & FUTEX_OWNER_DIED) == 0)
 	    {
+	      /* We haven't acquired the lock as it is already acquired by
+		 another owner.  We do not need to ensure ordering wrt another
+		 memory access.  */
 	      THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 	      return EBUSY;
@@ -173,13 +188,20 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	      if (oldval == id)
 		lll_unlock (mutex->__data.__lock,
 			    PTHREAD_ROBUST_MUTEX_PSHARED (mutex));
+	      /* FIXME This violates the mutex destruction requirements.  See
+		 __pthread_mutex_unlock_full.  */
 	      THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);
 	      return ENOTRECOVERABLE;
 	    }
 	}
       while ((oldval & FUTEX_OWNER_DIED) != 0);

+      /* We must not enqueue the mutex before we have acquired it.
+	 Also see comments at ENQUEUE_MUTEX.  */
+      __asm ("" ::: "memory");
       ENQUEUE_MUTEX (mutex);
+      /* We need to clear op_pending after we enqueue the mutex.  */
+      __asm ("" ::: "memory");
       THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

       mutex->__data.__owner = id;
@@ -211,10 +233,15 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	}

 	if (robust)
-	  /* Note: robust PI futexes are signaled by setting bit 0.  */
-	  THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending,
-			 (void *) (((uintptr_t) &mutex->__data.__list.__next)
-				   | 1));
+	  {
+	    /* Note: robust PI futexes are signaled by setting bit 0.  */
+	    THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending,
+			   (void *) (((uintptr_t) &mutex->__data.__list.__next)
+				     | 1));
+	    /* We need to set op_pending before starting the operation.  Also
+	       see comments at ENQUEUE_MUTEX.  */
+	    __asm ("" ::: "memory");
+	  }

 	oldval = mutex->__data.__lock;

@@ -223,12 +250,16 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	  {
 	    if (kind == PTHREAD_MUTEX_ERRORCHECK_NP)
 	      {
+		/* We do not need to ensure ordering wrt another memory
+		   access.  */
 		THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);
 		return EDEADLK;
 	      }

 	    if (kind == PTHREAD_MUTEX_RECURSIVE_NP)
 	      {
+		/* We do not need to ensure ordering wrt another memory
+		   access.  */
 		THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 		/* Just bump the counter.  */
@@ -250,6 +281,9 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	  {
 	    if ((oldval & FUTEX_OWNER_DIED) == 0)
 	      {
+		/* We haven't acquired the lock as it is already acquired by
+		   another owner.  We do not need to ensure ordering wrt another
+		   memory access.  */
 		THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 		return EBUSY;
@@ -270,6 +304,9 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	    if (INTERNAL_SYSCALL_ERROR_P (e, __err)
 		&& INTERNAL_SYSCALL_ERRNO (e, __err) == EWOULDBLOCK)
 	      {
+		/* The kernel has not yet finished the mutex owner death.
+		   We do not need to ensure ordering wrt another memory
+		   access.  */
 		THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 		return EBUSY;
@@ -287,7 +324,12 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 	    /* But it is inconsistent unless marked otherwise.  */
 	    mutex->__data.__owner = PTHREAD_MUTEX_INCONSISTENT;

+	    /* We must not enqueue the mutex before we have acquired it.
+	       Also see comments at ENQUEUE_MUTEX.  */
+	    __asm ("" ::: "memory");
 	    ENQUEUE_MUTEX (mutex);
+	    /* We need to clear op_pending after we enqueue the mutex.  */
+	    __asm ("" ::: "memory");
 	    THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);

 	    /* Note that we deliberately exit here.  If we fall
@@ -310,13 +352,20 @@ __pthread_mutex_trylock (pthread_mutex_t *mutex)
 						  PTHREAD_ROBUST_MUTEX_PSHARED (mutex)),
 			      0, 0);

+	    /* To the kernel, this will be visible after the kernel has
+	       acquired the mutex in the syscall.  */
 	    THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);
 	    return ENOTRECOVERABLE;
 	  }

 	if (robust)
 	  {
+	    /* We must not enqueue the mutex before we have acquired it.
+	       Also see comments at ENQUEUE_MUTEX.  */
+	    __asm ("" ::: "memory");
 	    ENQUEUE_MUTEX_PI (mutex);
+	    /* We need to clear op_pending after we enqueue the mutex.  */
+	    __asm ("" ::: "memory");
 	    THREAD_SETMEM (THREAD_SELF, robust_head.list_op_pending, NULL);
 	  }

From c096b008d2671028c21ac8cf01f18a2083e73c44 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Fri, 8 Feb 2019 12:54:41 +0100
Subject: [PATCH] nptl: Avoid fork handler lock for async-signal-safe fork [BZ
 #24161]
--- a/nptl/register-atfork.c
+++ b/nptl/register-atfork.c
@@ -107,13 +107,14 @@ __unregister_atfork (void *dso_handle)
 }

 void
-__run_fork_handlers (enum __run_fork_handler_type who)
+__run_fork_handlers (enum __run_fork_handler_type who, _Bool do_locking)
 {
   struct fork_handler *runp;

   if (who == atfork_run_prepare)
     {
-      lll_lock (atfork_lock, LLL_PRIVATE);
+      if (do_locking)
+	lll_lock (atfork_lock, LLL_PRIVATE);
       size_t sl = fork_handler_list_size (&fork_handlers);
       for (size_t i = sl; i > 0; i--)
 	{
@@ -133,7 +134,8 @@ __run_fork_handlers (enum __run_fork_handler_type who)
 	  else if (who == atfork_run_parent && runp->parent_handler)
 	    runp->parent_handler ();
 	}
-      lll_unlock (atfork_lock, LLL_PRIVATE);
+      if (do_locking)
+	lll_unlock (atfork_lock, LLL_PRIVATE);
     }
 }

diff --git a/sysdeps/nptl/fork.c b/sysdeps/nptl/fork.c
index bd68f18b45..14b69a6f89 100644
--- a/sysdeps/nptl/fork.c
+++ b/sysdeps/nptl/fork.c
@@ -55,7 +55,7 @@ __libc_fork (void)
      but our current fork implementation is not.  */
   bool multiple_threads = THREAD_GETMEM (THREAD_SELF, header.multiple_threads);

-  __run_fork_handlers (atfork_run_prepare);
+  __run_fork_handlers (atfork_run_prepare, multiple_threads);

   /* If we are not running multiple threads, we do not have to
      preserve lock state.  If fork runs from a signal handler, only
@@ -134,7 +134,7 @@ __libc_fork (void)
       __rtld_lock_initialize (GL(dl_load_lock));

       /* Run the handlers registered for the child.  */
-      __run_fork_handlers (atfork_run_child);
+      __run_fork_handlers (atfork_run_child, multiple_threads);
     }
   else
     {
@@ -149,7 +149,7 @@ __libc_fork (void)
 	}

       /* Run the handlers registered for the parent.  */
-      __run_fork_handlers (atfork_run_parent);
+      __run_fork_handlers (atfork_run_parent, multiple_threads);
     }

   return pid;
diff --git a/sysdeps/nptl/fork.h b/sysdeps/nptl/fork.h
index a1c3b26b68..99ed76034b 100644
--- a/sysdeps/nptl/fork.h
+++ b/sysdeps/nptl/fork.h
@@ -52,10 +52,12 @@ enum __run_fork_handler_type
    - atfork_run_child: run all the CHILD_HANDLER and unlocks the internal
 		       lock.
    - atfork_run_parent: run all the PARENT_HANDLER and unlocks the internal
-			lock.  */
-extern void __run_fork_handlers (enum __run_fork_handler_type who)
-  attribute_hidden;
+			lock.
+
+   Perform locking only if DO_LOCKING.  */
+extern void __run_fork_handlers (enum __run_fork_handler_type who,
+				 _Bool do_locking) attribute_hidden;

 /* C library side function to register new fork handlers.  */
 extern int __register_atfork (void (*__prepare) (void),

From 067fc32968b601493f4b247a3ac00caeea3f3d61 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Fri, 15 Feb 2019 21:27:01 +0100
Subject: [PATCH] nptl: Fix invalid Systemtap probe in pthread_join [BZ #24211]
diff --git a/nptl/pthread_join_common.c b/nptl/pthread_join_common.c
index ecb78ffba5..366feb376b 100644
--- a/nptl/pthread_join_common.c
+++ b/nptl/pthread_join_common.c
@@ -86,6 +86,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
       pthread_cleanup_pop (0);
     }

+  void *pd_result = pd->result;
   if (__glibc_likely (result == 0))
     {
       /* We mark the thread as terminated and as joined.  */
@@ -93,7 +94,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,

       /* Store the return value if the caller is interested.  */
       if (thread_return != NULL)
-	*thread_return = pd->result;
+	*thread_return = pd_result;

       /* Free the TCB.  */
       __free_tcb (pd);
@@ -101,7 +102,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
   else
     pd->joinid = NULL;

-  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);
+  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd_result);

   return result;
 }

From bc6f839fb4066be83272c735e662850af2595777 Mon Sep 17 00:00:00 2001
From: Stefan Liebler <stli@linux.ibm.com>
Date: Wed, 13 Mar 2019 10:45:35 +0100
Subject: [PATCH] Fix output of LD_SHOW_AUXV=1.
diff --git a/elf/dl-sysdep.c b/elf/dl-sysdep.c
index 5f6c679a3f..5d19b100b2 100644
--- a/elf/dl-sysdep.c
+++ b/elf/dl-sysdep.c
@@ -328,14 +328,9 @@ _dl_show_auxv (void)
       assert (AT_NULL == 0);
       assert (AT_IGNORE == 1);

-      if (av->a_type == AT_HWCAP || av->a_type == AT_HWCAP2
-	  || AT_L1I_CACHEGEOMETRY || AT_L1D_CACHEGEOMETRY
-	  || AT_L2_CACHEGEOMETRY || AT_L3_CACHEGEOMETRY)
-	{
-	  /* These are handled in a special way per platform.  */
-	  if (_dl_procinfo (av->a_type, av->a_un.a_val) == 0)
-	    continue;
-	}
+      /* Some entries are handled in a special way per platform.  */
+      if (_dl_procinfo (av->a_type, av->a_un.a_val) == 0)
+	continue;

       if (idx < sizeof (auxvars) / sizeof (auxvars[0])
 	  && auxvars[idx].form != unknown)
diff --git a/sysdeps/powerpc/dl-procinfo.h b/sysdeps/powerpc/dl-procinfo.h
index f542f7318f..dfc3b33a72 100644
--- a/sysdeps/powerpc/dl-procinfo.h
+++ b/sysdeps/powerpc/dl-procinfo.h
@@ -225,7 +225,7 @@ _dl_procinfo (unsigned int type, unsigned long int word)
 	break;
       }
     default:
-      /* This should not happen.  */
+      /* Fallback to generic output mechanism.  */
       return -1;
     }
    _dl_printf ("\n");
diff --git a/sysdeps/sparc/dl-procinfo.h b/sysdeps/sparc/dl-procinfo.h
index 282b8c5117..64ee267fc7 100644
--- a/sysdeps/sparc/dl-procinfo.h
+++ b/sysdeps/sparc/dl-procinfo.h
@@ -31,8 +31,8 @@ _dl_procinfo (unsigned int type, unsigned long int word)
 {
   int i;

-  /* Fallback to unknown output mechanism.  */
-  if (type == AT_HWCAP2)
+  /* Fallback to generic output mechanism.  */
+  if (type != AT_HWCAP)
     return -1;

   _dl_printf ("AT_HWCAP:   ");
diff --git a/sysdeps/unix/sysv/linux/arm/dl-procinfo.h b/sysdeps/unix/sysv/linux/arm/dl-procinfo.h
index 66c00297b7..05c62c8687 100644
--- a/sysdeps/unix/sysv/linux/arm/dl-procinfo.h
+++ b/sysdeps/unix/sysv/linux/arm/dl-procinfo.h
@@ -67,7 +67,7 @@ _dl_procinfo (unsigned int type, unsigned long int word)
 	break;
       }
     default:
-      /* This should not happen.  */
+      /* Fallback to generic output mechanism.  */
       return -1;
     }
   _dl_printf ("\n");
diff --git a/sysdeps/unix/sysv/linux/i386/dl-procinfo.h b/sysdeps/unix/sysv/linux/i386/dl-procinfo.h
index 22b43431bc..0585cdaa9c 100644
--- a/sysdeps/unix/sysv/linux/i386/dl-procinfo.h
+++ b/sysdeps/unix/sysv/linux/i386/dl-procinfo.h
@@ -30,8 +30,8 @@ _dl_procinfo (unsigned int type, unsigned long int word)
      in the kernel sources.  */
   int i;

-  /* Fallback to unknown output mechanism.  */
-  if (type == AT_HWCAP2)
+  /* Fallback to generic output mechanism.  */
+  if (type != AT_HWCAP)
     return -1;

   _dl_printf ("AT_HWCAP:   ");
diff --git a/sysdeps/unix/sysv/linux/s390/dl-procinfo.h b/sysdeps/unix/sysv/linux/s390/dl-procinfo.h
index 19329a335b..d67fde368f 100644
--- a/sysdeps/unix/sysv/linux/s390/dl-procinfo.h
+++ b/sysdeps/unix/sysv/linux/s390/dl-procinfo.h
@@ -32,8 +32,8 @@ _dl_procinfo (unsigned int type, unsigned long int word)
      in the kernel sources.  */
   int i;

-  /* Fallback to unknown output mechanism.  */
-  if (type == AT_HWCAP2)
+  /* Fallback to generic output mechanism.  */
+  if (type != AT_HWCAP)
     return -1;

   _dl_printf ("AT_HWCAP:   ");

From e28ad442e73b00ae2047d89c8cc7f9b2a0de5436 Mon Sep 17 00:00:00 2001
From: TAMUKI Shoichi <tamuki@linet.gr.jp>
Date: Sat, 2 Mar 2019 21:00:28 +0900
Subject: [PATCH] ja_JP: Change the offset for Taisho gan-nen from 2 to 1 [BZ
 #24162]
diff --git a/localedata/locales/ja_JP b/localedata/locales/ja_JP
index 1fd2fee44b..9bfbb2bb9b 100644
--- a/localedata/locales/ja_JP
+++ b/localedata/locales/ja_JP
@@ -14951,7 +14951,7 @@ era	"+:2:1990//01//01:+*:<U5E73><U6210>:%EC%Ey<U5E74>";/
 	"+:2:1927//01//01:1989//01//07:<U662D><U548C>:%EC%Ey<U5E74>";/
 	"+:1:1926//12//25:1926//12//31:<U662D><U548C>:%EC<U5143><U5E74>";/
 	"+:2:1913//01//01:1926//12//24:<U5927><U6B63>:%EC%Ey<U5E74>";/
-	"+:2:1912//07//30:1912//12//31:<U5927><U6B63>:%EC<U5143><U5E74>";/
+	"+:1:1912//07//30:1912//12//31:<U5927><U6B63>:%EC<U5143><U5E74>";/
 	"+:6:1873//01//01:1912//07//29:<U660E><U6CBB>:%EC%Ey<U5E74>";/
 	"+:1:0001//01//01:1872//12//31:<U897F><U66A6>:%EC%Ey<U5E74>";/
 	"+:1:-0001//12//31:-*:<U7D00><U5143><U524D>:%EC%Ey<U5E74>"

From 0941350c20a52447e53c5169354408e3db591f73 Mon Sep 17 00:00:00 2001
From: TAMUKI Shoichi <tamuki@linet.gr.jp>
Date: Tue, 2 Apr 2019 16:46:55 +0900
Subject: [PATCH] ja_JP locale: Add entry for the new Japanese era [BZ #22964]
diff --git a/localedata/locales/ja_JP b/localedata/locales/ja_JP
index 9bfbb2bb9b..c64aaaff55 100644
--- a/localedata/locales/ja_JP
+++ b/localedata/locales/ja_JP
@@ -14946,7 +14946,9 @@ am_pm	"<U5348><U524D>";"<U5348><U5F8C>"

 t_fmt_ampm "%p%I<U6642>%M<U5206>%S<U79D2>"

-era	"+:2:1990//01//01:+*:<U5E73><U6210>:%EC%Ey<U5E74>";/
+era	"+:2:2020//01//01:+*:<U4EE4><U548C>:%EC%Ey<U5E74>";/
+	"+:1:2019//05//01:2019//12//31:<U4EE4><U548C>:%EC<U5143><U5E74>";/
+	"+:2:1990//01//01:2019//04//30:<U5E73><U6210>:%EC%Ey<U5E74>";/
 	"+:1:1989//01//08:1989//12//31:<U5E73><U6210>:%EC<U5143><U5E74>";/
 	"+:2:1927//01//01:1989//01//07:<U662D><U548C>:%EC%Ey<U5E74>";/
 	"+:1:1926//12//25:1926//12//31:<U662D><U548C>:%EC<U5143><U5E74>";/

From 52b7cd6e9a701bb203023d56e84551943dc6a4c0 Mon Sep 17 00:00:00 2001
From: Adam Maris <amaris@redhat.com>
Date: Thu, 14 Mar 2019 16:51:16 -0400
Subject: [PATCH] malloc: Check for large bin list corruption when inserting
 unsorted chunk
diff --git a/malloc/malloc.c b/malloc/malloc.c
index feaf7ee0bf..ce771375b6 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3876,10 +3876,14 @@ _int_malloc (mstate av, size_t bytes)
                         {
                           victim->fd_nextsize = fwd;
                           victim->bk_nextsize = fwd->bk_nextsize;
+                          if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
+                            malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
                           fwd->bk_nextsize = victim;
                           victim->bk_nextsize->fd_nextsize = victim;
                         }
                       bck = fwd->bk;
+                      if (bck->fd != fwd)
+                        malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
                     }
                 }
               else

From c6177be4b92d5d7df50a785652d1912db511423e Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Wed, 15 May 2019 17:09:05 +0200
Subject: [PATCH] Fix crash in _IO_wfile_sync (bug 20568)
diff --git a/libio/wfileops.c b/libio/wfileops.c
index 78f20486e5..bab2ba4892 100644
--- a/libio/wfileops.c
+++ b/libio/wfileops.c
@@ -508,11 +508,12 @@ _IO_wfile_sync (FILE *fp)
 	     generate the wide characters up to the current reading
 	     position.  */
 	  int nread;
-
+	  size_t wnread = (fp->_wide_data->_IO_read_ptr
+			   - fp->_wide_data->_IO_read_base);
 	  fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
 	  nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state,
 					      fp->_IO_read_base,
-					      fp->_IO_read_end, delta);
+					      fp->_IO_read_end, wnread);
 	  fp->_IO_read_ptr = fp->_IO_read_base + nread;
 	  delta = -(fp->_IO_read_end - fp->_IO_read_base - nread);
 	}

From e3f828b8bd6e21922da8be8dee35edef09382d8d Mon Sep 17 00:00:00 2001
From: Mark Wielaard <mark@klomp.org>
Date: Wed, 15 May 2019 17:14:01 +0200
Subject: [PATCH] dlfcn: Guard __dlerror_main_freeres with __libc_once_get
 (once) [BZ#24476]
diff --git a/dlfcn/dlerror.c b/dlfcn/dlerror.c
index 27376582d0..ca42c126c1 100644
--- a/dlfcn/dlerror.c
+++ b/dlfcn/dlerror.c
@@ -72,9 +72,16 @@ __dlerror (void)
   __libc_once (once, init);

   /* Get error string.  */
-  result = (struct dl_action_result *) __libc_getspecific (key);
-  if (result == NULL)
-    result = &last_result;
+  if (static_buf != NULL)
+    result = static_buf;
+  else
+    {
+      /* init () has been run and we don't use the static buffer.
+	 So we have a valid key.  */
+      result = (struct dl_action_result *) __libc_getspecific (key);
+      if (result == NULL)
+	result = &last_result;
+    }

   /* Test whether we already returned the string.  */
   if (result->returned != 0)
@@ -230,13 +237,19 @@ free_key_mem (void *mem)
 void
 __dlerror_main_freeres (void)
 {
-  void *mem;
   /* Free the global memory if used.  */
   check_free (&last_result);
-  /* Free the TSD memory if used.  */
-  mem = __libc_getspecific (key);
-  if (mem != NULL)
-    free_key_mem (mem);
+
+  if (__libc_once_get (once) && static_buf == NULL)
+    {
+      /* init () has been run and we don't use the static buffer.
+	 So we have a valid key.  */
+      void *mem;
+      /* Free the TSD memory if used.  */
+      mem = __libc_getspecific (key);
+      if (mem != NULL)
+	free_key_mem (mem);
+    }
 }

 struct dlfcn_hook *_dlfcn_hook __attribute__((nocommon));

From 95d66fecaabbc92ab53027e808f0fc1929c9f21a Mon Sep 17 00:00:00 2001
From: Wilco Dijkstra <wdijkstr@arm.com>
Date: Fri, 10 May 2019 16:38:21 +0100
Subject: [PATCH] Fix tcache count maximum (BZ #24531)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index ce771375b6..0abd653be2 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2919,6 +2919,8 @@ typedef struct tcache_perthread_struct
   tcache_entry *entries[TCACHE_MAX_BINS];
 } tcache_perthread_struct;

+#define MAX_TCACHE_COUNT 127	/* Maximum value of counts[] entries.  */
+
 static __thread bool tcache_shutting_down = false;
 static __thread tcache_perthread_struct *tcache = NULL;

@@ -5124,8 +5126,11 @@ static inline int
 __always_inline
 do_set_tcache_count (size_t value)
 {
-  LIBC_PROBE (memory_tunable_tcache_count, 2, value, mp_.tcache_count);
-  mp_.tcache_count = value;
+  if (value <= MAX_TCACHE_COUNT)
+    {
+      LIBC_PROBE (memory_tunable_tcache_count, 2, value, mp_.tcache_count);
+      mp_.tcache_count = value;
+    }
   return 1;
 }

From 34fb5f61d3c3f4b8fc616ea259fa19168b58ecd4 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Wed, 13 Feb 2019 01:20:51 +0000
Subject: [PATCH] libio: do not attempt to free wide buffers of legacy streams
 [BZ #24228]
diff --git a/libio/genops.c b/libio/genops.c
index 2a0d9b81df..11a15549e8 100644
--- a/libio/genops.c
+++ b/libio/genops.c
@@ -789,9 +789,16 @@ _IO_unbuffer_all (void)

   for (fp = (FILE *) _IO_list_all; fp; fp = fp->_chain)
     {
+      int legacy = 0;
+
+#if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_1)
+      if (__glibc_unlikely (_IO_vtable_offset (fp) != 0))
+	legacy = 1;
+#endif
+
       if (! (fp->_flags & _IO_UNBUFFERED)
 	  /* Iff stream is un-orientated, it wasn't used. */
-	  && fp->_mode != 0)
+	  && (legacy || fp->_mode != 0))
 	{
 #ifdef _IO_MTSAFE_IO
 	  int cnt;
@@ -805,7 +812,7 @@ _IO_unbuffer_all (void)
 	      __sched_yield ();
 #endif

-	  if (! dealloc_buffers && !(fp->_flags & _IO_USER_BUF))
+	  if (! legacy && ! dealloc_buffers && !(fp->_flags & _IO_USER_BUF))
 	    {
 	      fp->_flags |= _IO_USER_BUF;

@@ -816,7 +823,7 @@ _IO_unbuffer_all (void)

 	  _IO_SETBUF (fp, NULL, 0);

-	  if (fp->_mode > 0)
+	  if (! legacy && fp->_mode > 0)
 	    _IO_wsetb (fp, NULL, NULL, 0);

 #ifdef _IO_MTSAFE_IO
@@ -827,7 +834,8 @@ _IO_unbuffer_all (void)

       /* Make sure that never again the wide char functions can be
 	 used.  */
-      fp->_mode = -1;
+      if (! legacy)
+	fp->_mode = -1;
     }

 #ifdef _IO_MTSAFE_IO


code:
This patch is taken from debian's glibc package (generate-supported.mk).
It install the localedata/SUPPORTED file of the glibc. This file lists
all the supported locales of the glibc.

diff --git a/localedata/Makefile b/localedata/Makefile
index 65079f9eb8..14818f84e0 100644
--- a/localedata/Makefile
+++ b/localedata/Makefile
@@ -169,7 +169,8 @@ endif
 # Files to install.
 install-others := $(addprefix $(inst_i18ndir)/, \
 			      $(addsuffix .gz, $(charmaps)) \
-			      $(locales))
+			      $(locales)) \
+                   $(inst_i18ndir)/SUPPORTED

 tests: $(objdir)/iconvdata/gconv-modules

@@ -380,6 +381,14 @@ endif

 include SUPPORTED

+$(inst_i18ndir)/SUPPORTED: SUPPORTED $(+force)
+	for locale in $(SUPPORTED-LOCALES); do \
+		[ $$locale = true ] && continue; \
+		echo $$locale | sed 's,/, ,' >> LOCALES; \
+	done
+	$(make-target-directory)
+	$(INSTALL_DATA) LOCALES $@
+
 INSTALL-SUPPORTED-LOCALE-ARCHIVE=$(addprefix install-archive-, $(SUPPORTED-LOCALES))
 INSTALL-SUPPORTED-LOCALE-FILES=$(addprefix install-files-, $(SUPPORTED-LOCALES))


code:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=5460617d1567657621107d895ee2dd83bc1f88f2
with ChangeLog removed

From 5460617d1567657621107d895ee2dd83bc1f88f2 Mon Sep 17 00:00:00 2001
From: Paul Pluzhnikov <ppluzhnikov@google.com>
Date: Tue, 8 May 2018 18:12:41 -0700
Subject: [PATCH] Fix BZ 22786: integer addition overflow may cause stack
 buffer overflow when realpath() input length is close to SSIZE_MAX.

2018-05-09  Paul Pluzhnikov  <ppluzhnikov@google.com>

	[BZ #22786]
	* stdlib/canonicalize.c (__realpath): Fix overflow in path length
	computation.
	* stdlib/Makefile (test-bz22786): New test.
	* stdlib/test-bz22786.c: New test.
---
 ChangeLog             |  8 +++++
 stdlib/Makefile       |  2 +-
 stdlib/canonicalize.c |  2 +-
 stdlib/test-bz22786.c | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 100 insertions(+), 2 deletions(-)
 create mode 100644 stdlib/test-bz22786.c

diff --git a/stdlib/Makefile b/stdlib/Makefile
index af1643c..1ddb1f9 100644
--- a/stdlib/Makefile
+++ b/stdlib/Makefile
@@ -84,7 +84,7 @@ tests		:= tst-strtol tst-strtod testmb testrand testsort testdiv   \
 		   tst-cxa_atexit tst-on_exit test-atexit-race 		    \
 		   test-at_quick_exit-race test-cxa_atexit-race             \
 		   test-on_exit-race test-dlclose-exit-race 		    \
-		   tst-makecontext-align
+		   tst-makecontext-align test-bz22786

 tests-internal	:= tst-strtod1i tst-strtod3 tst-strtod4 tst-strtod5i \
 		   tst-tls-atexit tst-tls-atexit-nodelete
diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c
index 4135f3f..390fb43 100644
--- a/stdlib/canonicalize.c
+++ b/stdlib/canonicalize.c
@@ -181,7 +181,7 @@ __realpath (const char *name, char *resolved)
 		extra_buf = __alloca (path_max);

 	      len = strlen (end);
-	      if ((long int) (n + len) >= path_max)
+	      if (path_max - n <= len)
 		{
 		  __set_errno (ENAMETOOLONG);
 		  goto error;
diff --git a/stdlib/test-bz22786.c b/stdlib/test-bz22786.c
new file mode 100644
index 0000000..e7837f9
--- /dev/null
+++ b/stdlib/test-bz22786.c
@@ -0,0 +1,90 @@
+/* Bug 22786: test for buffer overflow in realpath.
+   Copyright (C) 2018 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/* This file must be run from within a directory called "stdlib".  */
+
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <support/test-driver.h>
+#include <libc-diag.h>
+
+static int
+do_test (void)
+{
+  const char dir[] = "bz22786";
+  const char lnk[] = "bz22786/symlink";
+
+  rmdir (dir);
+  if (mkdir (dir, 0755) != 0 && errno != EEXIST)
+    {
+      printf ("mkdir %s: %m\n", dir);
+      return EXIT_FAILURE;
+    }
+  if (symlink (".", lnk) != 0 && errno != EEXIST)
+    {
+      printf ("symlink (%s, %s): %m\n", dir, lnk);
+      return EXIT_FAILURE;
+    }
+
+  const size_t path_len = (size_t) INT_MAX + 1;
+
+  DIAG_PUSH_NEEDS_COMMENT;
+#if __GNUC_PREREQ (7, 0)
+  /* GCC 7 warns about too-large allocations; here we need such
+     allocation to succeed for the test to work.  */
+  DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than=");
+#endif
+  char *path = malloc (path_len);
+  DIAG_POP_NEEDS_COMMENT;
+
+  if (path == NULL)
+    {
+      printf ("malloc (%zu): %m\n", path_len);
+      return EXIT_UNSUPPORTED;
+    }
+
+  /* Construct very long path = "bz22786/symlink/aaaa....."  */
+  char *p = mempcpy (path, lnk, sizeof (lnk) - 1);
+  *(p++) = '/';
+  memset (p, 'a', path_len - (path - p) - 2);
+  p[path_len - (path - p) - 1] = '\0';
+
+  /* This call crashes before the fix for bz22786 on 32-bit platforms.  */
+  p = realpath (path, NULL);
+
+  if (p != NULL || errno != ENAMETOOLONG)
+    {
+      printf ("realpath: %s (%m)", p);
+      return EXIT_FAILURE;
+    }
+
+  /* Cleanup.  */
+  unlink (lnk);
+  rmdir (dir);
+
+  return 0;
+}
+
+#define TEST_FUNCTION do_test
+#include <support/test-driver.c>
--
2.9.3


code:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e
with the ChangeLog removed

From 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Tue, 22 May 2018 10:37:59 +0200
Subject: [PATCH] Don't write beyond destination in
 __mempcpy_avx512_no_vzeroupper (bug 23196)

When compiled as mempcpy, the return value is the end of the destination
buffer, thus it cannot be used to refer to the start of it.
---
 ChangeLog                                               | 9 +++++++++
 string/test-mempcpy.c                                   | 1 +
 sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++--
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c
index c08fba8..d98ecdd 100644
--- a/string/test-mempcpy.c
+++ b/string/test-mempcpy.c
@@ -18,6 +18,7 @@
    <http://www.gnu.org/licenses/>.  */

 #define MEMCPY_RESULT(dst, len) (dst) + (len)
+#define MIN_PAGE_SIZE 131072
 #define TEST_MAIN
 #define TEST_NAME "mempcpy"
 #include "test-string.h"
diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
index 23c0f7a..effc3ac 100644
--- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
+++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
@@ -336,6 +336,7 @@ L(preloop_large):
 	vmovups	(%rsi), %zmm4
 	vmovups	0x40(%rsi), %zmm5

+	mov	%rdi, %r11
 /* Align destination for access with non-temporal stores in the loop.  */
 	mov	%rdi, %r8
 	and	$-0x80, %rdi
@@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop):
 	cmp	$256, %rdx
 	ja	L(gobble_256bytes_nt_loop)
 	sfence
-	vmovups	%zmm4, (%rax)
-	vmovups	%zmm5, 0x40(%rax)
+	vmovups	%zmm4, (%r11)
+	vmovups	%zmm5, 0x40(%r11)
 	jmp	L(check)

 L(preloop_large_bkw):
--
2.9.3


code:
Fix CVE-2019-19126:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126
https://sourceware.org/bugzilla/show_bug.cgi?id=25204

Taken from upstream:
https://sourceware.org/git/?p=glibc.git;a=commit;h=37c90e117310728a4ad1eb998c0bbe7d79c4a398

diff --git a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
index 975cbe2..df2cdfd 100644
--- a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+++ b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
@@ -31,7 +31,8 @@
    environment variable, LD_PREFER_MAP_32BIT_EXEC.  */
 #define EXTRA_LD_ENVVARS \
   case 21:								  \
-    if (memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)		  \
+    if (!__libc_enable_secure						  \
+	&& memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)		  \
       GLRO(dl_x86_cpu_features).feature[index_arch_Prefer_MAP_32BIT_EXEC] \
 	|= bit_arch_Prefer_MAP_32BIT_EXEC;				  \
     break;


code:
Fix <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7309>.

Taken from this upstream commit, sans ChangeLog updates and tests:
<https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=3f635fb43389b54f682fc9ed2acc0b2aaf4a923d>.

diff --git a/sysdeps/x86_64/memcmp.S b/sysdeps/x86_64/memcmp.S
index 1fc487caa5..1322bb3b92 100644
--- a/sysdeps/x86_64/memcmp.S
+++ b/sysdeps/x86_64/memcmp.S
@@ -21,14 +21,18 @@

 	.text
 ENTRY (memcmp)
-	test	%rdx, %rdx
+#ifdef __ILP32__
+	/* Clear the upper 32 bits.  */
+	movl	%edx, %edx
+#endif
+	test	%RDX_LP, %RDX_LP
 	jz	L(finz)
 	cmpq	$1, %rdx
-	jle	L(finr1b)
+	jbe	L(finr1b)
 	subq	%rdi, %rsi
 	movq	%rdx, %r10
 	cmpq	$32, %r10
-	jge	L(gt32)
+	jae	L(gt32)
 	/* Handle small chunks and last block of less than 32 bytes.  */
 L(small):
 	testq	$1, %r10
@@ -156,7 +160,7 @@ L(A32):
 	movq	%r11, %r10
 	andq	$-32, %r10
 	cmpq	%r10, %rdi
-        jge	L(mt16)
+        jae	L(mt16)
 	/* Pre-unroll to be ready for unrolled 64B loop.  */
 	testq	$32, %rdi
 	jz	L(A64)
@@ -178,7 +182,7 @@ L(A64):
 	movq	%r11, %r10
 	andq	$-64, %r10
 	cmpq	%r10, %rdi
-        jge	L(mt32)
+        jae	L(mt32)

 L(A64main):
 	movdqu    (%rdi,%rsi), %xmm0
@@ -216,7 +220,7 @@ L(mt32):
 	movq	%r11, %r10
 	andq	$-32, %r10
 	cmpq	%r10, %rdi
-        jge	L(mt16)
+        jae	L(mt16)

 L(A32main):
 	movdqu    (%rdi,%rsi), %xmm0
@@ -254,7 +258,7 @@ L(ATR):
 	movq	%r11, %r10
 	andq	$-32, %r10
 	cmpq	%r10, %rdi
-        jge	L(mt16)
+        jae	L(mt16)
 	testq	$16, %rdi
 	jz	L(ATR32)

@@ -325,7 +329,7 @@ L(ATR64main):
 	movq	%r11, %r10
 	andq	$-32, %r10
 	cmpq	%r10, %rdi
-        jge	L(mt16)
+        jae	L(mt16)

 L(ATR32res):
 	movdqa    (%rdi,%rsi), %xmm0


code:
Fix <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169>.

Taken from this upstream commit, sans ChangeLog updates:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=583dd860d5b833037175247230a328f0050dbfe9

diff --git a/posix/regexec.c b/posix/regexec.c
index 91d5a797b8..084b1222d9 100644
--- a/posix/regexec.c
+++ b/posix/regexec.c
@@ -1293,8 +1293,10 @@ proceed_next_node (const re_match_context_t *mctx, Idx nregs, regmatch_t *regs,
 	      else if (naccepted)
 		{
 		  char *buf = (char *) re_string_get_buffer (&mctx->input);
-		  if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
-			      naccepted) != 0)
+		  if (mctx->input.valid_len - *pidx < naccepted
+		      || (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
+				  naccepted)
+			  != 0))
 		    return -1;
 		}
 	    }