glibc: bump version for post-2.28 security fixes

Fixes the following security vulnerability:

  CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
  denial of service due to resource exhaustion when processing getaddrinfo
  calls with crafted host names.  Reported by Guido Vranken.

Adhemerval Zanella (2):
      Fix misreported errno on preadv2/pwritev2 (BZ#23579)
      x86: Fix Haswell CPU string flags (BZ#23709)

Alexandra Hájková (1):
      Add an additional test to resolv/tst-resolv-network.c

Andreas Schwab (2):
      Fix stack overflow in tst-setcontext9 (bug 23717)
      libanl: properly cleanup if first helper thread creation failed (bug 22927)

DJ Delorie (2):
      malloc: tcache double free check
      malloc: tcache double free check

Florian Weimer (9):
      conform: XFAIL siginfo_t si_band test on sparc64
      stdlib/test-bz22786: Avoid spurious test failures using alias mappings
      stdlib/test-bz22786: Avoid memory leaks in the test itself
      support_blob_repeat: Call mkstemp directory for the backing file
      stdlib/tst-strtod-overflow: Switch to support_blob_repeat
      nscd: Fix use-after-free in addgetnetgrentX [BZ #23520]
      support: Print timestamps in timeout handler
      Revert "malloc: tcache double free check" [BZ #23907]
      CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]

H.J. Lu (2):
      i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK [BZ #23716]
      Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]

Ilya Yu. Malakhov (1):
      signal: Use correct type for si_band in siginfo_t [BZ #23562]

Istvan Kurucsai (1):
      malloc: Additional checks for unsorted bin integrity I.

Joseph Myers (2):
      Update syscall-names.list for Linux 4.18.
      Update kernel version in syscall-names.list to 4.19.

Moritz Eckert (1):
      malloc: Mitigate null-byte overflow attacks

Paul Eggert (1):
      Fix tzfile low-memory assertion failure

Paul Pluzhnikov (2):
      Fix BZ#23400 (creating temporary files in source tree), and undefined behavior in test.
      [BZ #20271] Add newlines in __libc_fatal calls.

Pochang Chen (1):
      malloc: Verify size of top chunk.

Rafal Luzynski (1):
      kl_GL: Fix spelling of Sunday, should be "sapaat" (bug 20209).

Stefan Liebler (2):
      Fix race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP [BZ #23275]
      Test stdlib/test-bz22786 exits now with unsupported if malloc fails.

Szabolcs Nagy (2):
      i64: fix missing exp2f, log2f and powf symbols in libm.a [BZ #23822]
      Increase timeout of libio/tst-readline

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

diff --git a/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch b/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch
deleted file mode 100644 (file)
index febcd36..0000000
--- a/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 4a06ceea33ecc220bbfe264d8f1e74de2f04e90d Mon Sep 17 00:00:00 2001
-From: Martin Jansa <Martin.Jansa@gmail.com>
-Date: Tue, 2 Oct 2018 15:38:43 +0000
-Subject: [PATCH] sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O
- [BZ #19444]
-
-* with -O, -O1, -Os it fails with:
-
-In file included from ../soft-fp/soft-fp.h:318,
-                 from ../sysdeps/ieee754/soft-fp/s_fdiv.c:28:
-../sysdeps/ieee754/soft-fp/s_fdiv.c: In function '__fdiv':
-../soft-fp/op-2.h:98:25: error: 'R_f1' may be used uninitialized in this function [-Werror=maybe-uninitialized]
-        X##_f0 = (X##_f1 << (_FP_W_TYPE_SIZE - (N)) | X##_f0 >> (N) \
-                         ^~
-../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f1' was declared here
-   FP_DECL_D (R);
-              ^
-../soft-fp/op-2.h:37:36: note: in definition of macro '_FP_FRAC_DECL_2'
-   _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT
-                                    ^
-../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL'
- # define FP_DECL_D(X)  _FP_DECL (2, X)
-                        ^~~~~~~~
-../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D'
-   FP_DECL_D (R);
-   ^~~~~~~~~
-../soft-fp/op-2.h:101:17: error: 'R_f0' may be used uninitialized in this function [-Werror=maybe-uninitialized]
-       : (X##_f0 << (_FP_W_TYPE_SIZE - (N))) != 0)); \
-                 ^~
-../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f0' was declared here
-   FP_DECL_D (R);
-              ^
-../soft-fp/op-2.h:37:14: note: in definition of macro '_FP_FRAC_DECL_2'
-   _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT
-              ^
-../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL'
- # define FP_DECL_D(X)  _FP_DECL (2, X)
-                        ^~~~~~~~
-../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D'
-   FP_DECL_D (R);
-   ^~~~~~~~~
-
-Build tested with Yocto for ARM, AARCH64, X86, X86_64, PPC, MIPS, MIPS64
-with -O, -O1, -Os.
-For AARCH64 it needs one more fix in locale for -Os.
-
-       [BZ #19444]
-       * sysdeps/ieee754/soft-fp/s_fdiv.c: Include <libc-diag.h> and use
-       DIAG_PUSH_NEEDS_COMMENT, DIAG_IGNORE_NEEDS_COMMENT and
-       DIAG_POP_NEEDS_COMMENT to disable -Wmaybe-uninitialized.
-
-
-Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
----
- sysdeps/ieee754/soft-fp/s_fdiv.c | 12 ++++++++++++
- 1 files changed, 12 insertions(+)
-
-diff --git a/sysdeps/ieee754/soft-fp/s_fdiv.c b/sysdeps/ieee754/soft-fp/s_fdiv.c
-index 341339f5ed..7a15cbeee6 100644
---- a/sysdeps/ieee754/soft-fp/s_fdiv.c
-+++ b/sysdeps/ieee754/soft-fp/s_fdiv.c
-@@ -25,6 +25,16 @@
- #undef fdivl
- 
- #include <math-narrow.h>
-+#include <libc-diag.h>
-+
-+/* R_f[01] are not set in cases where they are not used in packing,
-+   but the compiler does not see that they are set in all cases where
-+   they are used, resulting in warnings that they may be used
-+   uninitialized.  The location of the warning differs in different
-+   versions of GCC, it may be where R is defined using a macro or it
-+   may be where the macro is defined.  This happens only with -O1.  */
-+DIAG_PUSH_NEEDS_COMMENT;
-+DIAG_IGNORE_NEEDS_COMMENT (8, "-Wmaybe-uninitialized");
- #include <soft-fp.h>
- #include <single.h>
- #include <double.h>
-@@ -53,4 +63,6 @@ __fdiv (double x, double y)
-   CHECK_NARROW_DIV (ret, x, y);
-   return ret;
- }
-+DIAG_POP_NEEDS_COMMENT;
-+
- libm_alias_float_double (div)
--- 
-2.17.0
-

diff --git a/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/glibc.hash b/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/glibc.hash
deleted file mode 100644 (file)
index a95c990..0000000
--- a/package/glibc/glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab/glibc.hash
+++ /dev/null
@@ -1,7 +0,0 @@
-# Locally calculated (fetched from Github)
-sha256  6e88cea4002efa7f78d86ea5e98eb92ed423d5a35068751517c4f00f56b8666c  glibc-glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab.tar.gz
-
-# Hashes for license files
-sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
-sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING.LIB
-sha256  35bdb41dc0bcb10702ddacbd51ec4c0fe6fb3129f734e8c85fc02e4d3eb0ce3f  LICENSES

diff --git a/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch b/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch
new file mode 100644 (file)
index 0000000..febcd36
--- /dev/null
+++ b/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/0001-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch
@@ -0,0 +1,88 @@
+From 4a06ceea33ecc220bbfe264d8f1e74de2f04e90d Mon Sep 17 00:00:00 2001
+From: Martin Jansa <Martin.Jansa@gmail.com>
+Date: Tue, 2 Oct 2018 15:38:43 +0000
+Subject: [PATCH] sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O
+ [BZ #19444]
+
+* with -O, -O1, -Os it fails with:
+
+In file included from ../soft-fp/soft-fp.h:318,
+                 from ../sysdeps/ieee754/soft-fp/s_fdiv.c:28:
+../sysdeps/ieee754/soft-fp/s_fdiv.c: In function '__fdiv':
+../soft-fp/op-2.h:98:25: error: 'R_f1' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+        X##_f0 = (X##_f1 << (_FP_W_TYPE_SIZE - (N)) | X##_f0 >> (N) \
+                         ^~
+../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f1' was declared here
+   FP_DECL_D (R);
+              ^
+../soft-fp/op-2.h:37:36: note: in definition of macro '_FP_FRAC_DECL_2'
+   _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT
+                                    ^
+../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL'
+ # define FP_DECL_D(X)  _FP_DECL (2, X)
+                        ^~~~~~~~
+../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D'
+   FP_DECL_D (R);
+   ^~~~~~~~~
+../soft-fp/op-2.h:101:17: error: 'R_f0' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+       : (X##_f0 << (_FP_W_TYPE_SIZE - (N))) != 0)); \
+                 ^~
+../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f0' was declared here
+   FP_DECL_D (R);
+              ^
+../soft-fp/op-2.h:37:14: note: in definition of macro '_FP_FRAC_DECL_2'
+   _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT
+              ^
+../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL'
+ # define FP_DECL_D(X)  _FP_DECL (2, X)
+                        ^~~~~~~~
+../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D'
+   FP_DECL_D (R);
+   ^~~~~~~~~
+
+Build tested with Yocto for ARM, AARCH64, X86, X86_64, PPC, MIPS, MIPS64
+with -O, -O1, -Os.
+For AARCH64 it needs one more fix in locale for -Os.
+
+       [BZ #19444]
+       * sysdeps/ieee754/soft-fp/s_fdiv.c: Include <libc-diag.h> and use
+       DIAG_PUSH_NEEDS_COMMENT, DIAG_IGNORE_NEEDS_COMMENT and
+       DIAG_POP_NEEDS_COMMENT to disable -Wmaybe-uninitialized.
+
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+---
+ sysdeps/ieee754/soft-fp/s_fdiv.c | 12 ++++++++++++
+ 1 files changed, 12 insertions(+)
+
+diff --git a/sysdeps/ieee754/soft-fp/s_fdiv.c b/sysdeps/ieee754/soft-fp/s_fdiv.c
+index 341339f5ed..7a15cbeee6 100644
+--- a/sysdeps/ieee754/soft-fp/s_fdiv.c
++++ b/sysdeps/ieee754/soft-fp/s_fdiv.c
+@@ -25,6 +25,16 @@
+ #undef fdivl
+ 
+ #include <math-narrow.h>
++#include <libc-diag.h>
++
++/* R_f[01] are not set in cases where they are not used in packing,
++   but the compiler does not see that they are set in all cases where
++   they are used, resulting in warnings that they may be used
++   uninitialized.  The location of the warning differs in different
++   versions of GCC, it may be where R is defined using a macro or it
++   may be where the macro is defined.  This happens only with -O1.  */
++DIAG_PUSH_NEEDS_COMMENT;
++DIAG_IGNORE_NEEDS_COMMENT (8, "-Wmaybe-uninitialized");
+ #include <soft-fp.h>
+ #include <single.h>
+ #include <double.h>
+@@ -53,4 +63,6 @@ __fdiv (double x, double y)
+   CHECK_NARROW_DIV (ret, x, y);
+   return ret;
+ }
++DIAG_POP_NEEDS_COMMENT;
++
+ libm_alias_float_double (div)
+-- 
+2.17.0
+

diff --git a/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/glibc.hash b/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/glibc.hash
new file mode 100644 (file)
index 0000000..7429ab3
--- /dev/null
+++ b/package/glibc/glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa/glibc.hash
@@ -0,0 +1,7 @@
+# Locally calculated (fetched from Github)
+sha256  b070f746f932cfce107bb9be2d59ded5b44b25ddafb480c9110c52b88cc2dec1  glibc-glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa.tar.gz
+
+# Hashes for license files
+sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
+sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING.LIB
+sha256  35bdb41dc0bcb10702ddacbd51ec4c0fe6fb3129f734e8c85fc02e4d3eb0ce3f  LICENSES

diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 762c0406888afc634505bf85db4afe0d12832eea..88178d7eb9f4d4f349cac9053c9ad79f57c3e3ba 100644 (file)
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -10,7 +10,7 @@ GLIBC_SITE = $(call github,foss-for-synopsys-dwc-arc-processors,glibc,$(GLIBC_VE
 else
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master
-GLIBC_VERSION = glibc-2.28-18-g2339d6a55eb7a7e040ae888e906adc49eeb59eab
+GLIBC_VERSION = glibc-2.28-50-gb8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa
 # Upstream doesn't officially provide an https download link.
 # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
 # sometimes the connection times out. So use an unofficial github mirror.