musl 1.1.13 released

musl 1.1.13 released

[Rich Felker]

This release adds support for out-of-tree builds, search domains in
resolv.conf, VDSO-accelerated clock_gettime on MIPS, and building
SMP-safe/ready SH binaries for the open-hardware J2. Performance of
atomics and synchronization primitives has been greatly improved on
most "ll/sc model" RISC archs. Regex BRE now supports the widely-used
extensions \|, \+, and \? and larger regular expressions are now
supported. A number of minor application and toolchain compatibility
improvements have also been made, including changes which reduce the
risk of assembler and linker bugs leading to malfunctioning binaries.

Two potentially dangerous bugs have been fixed: a single-byte heap
overflow in getdelim and a pointer indexing error in dynamic TLS
allocation. Other bugs fixed include various issues in parsing and
error handling for resolv.conf and related files, incorrect error
return values for some functions, and failures to accept null pointer
arguments in some functions for which they have defined behavior. Some
arch-specific bugs affecting ARM, MIPS, and SH/FDPIC have also been
fixed.

http://www.musl-libc.org/releases/musl-1.1.13.tar.gz
http://www.musl-libc.org/releases/musl-1.1.13.tar.gz.asc

Special thanks to musl's release sponsors (patreon.com/musl):

* Jonathan Barronville
* Neal Gompa
* Les Aker
* Kelsey Hightower
* Hurricane Labs (hurricanelabs.com)
* Justin Cormack
* The Midipix Project (midipix.org)

Re: musl 1.1.13 released

[Rich Felker]

[-- Attachment #1: Type: text/plain, Size: 1537 bytes --]

On Mon, Feb 15, 2016 at 11:35:28PM -0500, Rich Felker wrote:
> This release adds support for out-of-tree builds, search domains in
> resolv.conf, VDSO-accelerated clock_gettime on MIPS, and building
> SMP-safe/ready SH binaries for the open-hardware J2. Performance of
> atomics and synchronization primitives has been greatly improved on
> most "ll/sc model" RISC archs. Regex BRE now supports the widely-used
> extensions \|, \+, and \? and larger regular expressions are now
> supported. A number of minor application and toolchain compatibility
> improvements have also been made, including changes which reduce the
> risk of assembler and linker bugs leading to malfunctioning binaries.
> 
> Two potentially dangerous bugs have been fixed: a single-byte heap
> overflow in getdelim and a pointer indexing error in dynamic TLS
> allocation. Other bugs fixed include various issues in parsing and
> error handling for resolv.conf and related files, incorrect error
> return values for some functions, and failures to accept null pointer
> arguments in some functions for which they have defined behavior. Some
> arch-specific bugs affecting ARM, MIPS, and SH/FDPIC have also been
> fixed.
> 
> http://www.musl-libc.org/releases/musl-1.1.13.tar.gz
> http://www.musl-libc.org/releases/musl-1.1.13.tar.gz.asc

It's been found that this release has a fairly significant regression
caused by fixing a bug in fwrite's return value. Users should apply
the attached patch to avoid problems with puts("") and fputs("",f)
malfunctioning.

Rich

[-- Attachment #2: 0001-fix-assumption-in-fputs-that-fwrite-returning-0-impl.patch --]
[-- Type: text/plain, Size: 1136 bytes --]

From 10a17dfbad2c267d885817abc9c7589fc7ff630b Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Tue, 16 Feb 2016 13:26:16 -0500
Subject: [PATCH] fix assumption in fputs that fwrite returning 0 implies an
 error

internally, the idiom of passing nmemb=1 to fwrite and interpreting
the return value of fwrite (which is necessarily 0 or 1) as
failure/success is fairly widely used. this is not correct, however,
when the size argument is unknown and may be zero, since C requires
fwrite to return 0 in that special case. previously fwrite always
returned nmemb on success, but this was changed for conformance with
ISO C by commit 500c6886c654fd45e4926990fee2c61d816be197.
---
 src/stdio/fputs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/stdio/fputs.c b/src/stdio/fputs.c
index 4737f44..1cf344f 100644
--- a/src/stdio/fputs.c
+++ b/src/stdio/fputs.c
@@ -3,7 +3,8 @@
 
 int fputs(const char *restrict s, FILE *restrict f)
 {
-	return (int)fwrite(s, strlen(s), 1, f) - 1;
+	size_t l = strlen(s);
+	return (fwrite(s, 1, l, f)==l) - 1;
 }
 
 weak_alias(fputs, fputs_unlocked);
-- 
1.8.1.rc1

Re: musl 1.1.13 released

[Anthony G. Basile]

On 2/16/16 10:16 PM, Rich Felker wrote:
> On Mon, Feb 15, 2016 at 11:35:28PM -0500, Rich Felker wrote:
>> This release adds support for out-of-tree builds, search domains in
>> resolv.conf, VDSO-accelerated clock_gettime on MIPS, and building
>> SMP-safe/ready SH binaries for the open-hardware J2. Performance of
>> atomics and synchronization primitives has been greatly improved on
>> most "ll/sc model" RISC archs. Regex BRE now supports the widely-used
>> extensions \|, \+, and \? and larger regular expressions are now
>> supported. A number of minor application and toolchain compatibility
>> improvements have also been made, including changes which reduce the
>> risk of assembler and linker bugs leading to malfunctioning binaries.
>>
>> Two potentially dangerous bugs have been fixed: a single-byte heap
>> overflow in getdelim and a pointer indexing error in dynamic TLS
>> allocation. Other bugs fixed include various issues in parsing and
>> error handling for resolv.conf and related files, incorrect error
>> return values for some functions, and failures to accept null pointer
>> arguments in some functions for which they have defined behavior. Some
>> arch-specific bugs affecting ARM, MIPS, and SH/FDPIC have also been
>> fixed.
>>
>> http://www.musl-libc.org/releases/musl-1.1.13.tar.gz
>> http://www.musl-libc.org/releases/musl-1.1.13.tar.gz.asc
> 
> It's been found that this release has a fairly significant regression
> caused by fixing a bug in fwrite's return value. Users should apply
> the attached patch to avoid problems with puts("") and fputs("",f)
> malfunctioning.
> 
> Rich
> 

Thanks I was in the middle of debugging this.  I hit it with coreutils
`yes ""` on arm.

We've had these sorts of bugs in the past.  Wouldn't it be wise to push
out a new release?  Something like musl-1.1.13.1?  I can deal with
applying the patch but pushing out a another release signals to the
community that there is an update.  Just thought.

-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197

Re: musl 1.1.13 released

[Shiz]

[-- Attachment #1: Type: text/plain, Size: 460 bytes --]


> On 19 Feb 2016, at 11:22, Anthony G. Basile <basile@opensource.dyc.edu> wrote:
> 
> We've had these sorts of bugs in the past.  Wouldn't it be wise to push
> out a new release?  Something like musl-1.1.13.1?  I can deal with
> applying the patch but pushing out a another release signals to the
> community that there is an update.  Just thought.

1.1.14 is on its way to be released soon, fixing among a few other things,
this issue.

- Shiz


[-- Attachment #2: Message signed with OpenPGP using GPGMail --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: musl 1.1.13 released

[Rich Felker]

On Fri, Feb 19, 2016 at 06:24:10PM +0100, Shiz wrote:
> 
> > On 19 Feb 2016, at 11:22, Anthony G. Basile <basile@opensource.dyc.edu> wrote:
> > 
> > We've had these sorts of bugs in the past.  Wouldn't it be wise to push
> > out a new release?  Something like musl-1.1.13.1?  I can deal with
> > applying the patch but pushing out a another release signals to the
> > community that there is an update.  Just thought.
> 
> 1.1.14 is on its way to be released soon, fixing among a few other things,
> this issue.

Yes, at least the following were noticable regressions:

- fgets/gets "" failing (and related rare issue in getopt)
- make clean/distclean nor working in unconfigured trees
- sh/fdpic dynamic linker entry point hang
- clang build failure for armhf (or arm with softfp model)

That's enough that I'm going to do another release (1.1.14) right away
and adjust the future release numbers in the roadmap.

Rich