<div dir="ltr">I was asking you about the CVE number (but I realize it was already merged in other branches with wrong number so maybe it will be less confusing use the same in Dizzy)<div><br></div><div>And "please merge" was informal</div><div>Acked-by: Martin Jansa <<a href="mailto:Martin.Jansa@gmail.com">Martin.Jansa@gmail.com</a>></div><div><br></div><div>after testing this series in our Dizzy based builds.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 3, 2016 at 9:35 PM, akuster@mvista <span dir="ltr"><<a href="mailto:akuster@mvista.com" target="_blank">akuster@mvista.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 3/3/16 12:16 AM, Martin Jansa wrote:<br>
> On Sun, Feb 28, 2016 at 10:53:34AM -0800, Armin Kuster wrote:<br>
>> From: Armin Kuster <<a href="mailto:akuster@mvista.com">akuster@mvista.com</a>><br>
><br>
> I think this is 2014-9761 not 2015-9761<br>
><br>
> But other than that please merge this series.<br>
<br>
</span>Are you asking me? I don't have write perms.<br>
<br>
- armin<br>
<div class="HOEnZb"><div class="h5">><br>
>> A stack overflow vulnerability was found in nan* functions that could cause<br>
>> applications which process long strings with the nan function to crash or,<br>
>> potentially, execute arbitrary code.<br>
>><br>
>> (From OE-Core rev: fd3da8178c8c06b549dbc19ecec40e98ab934d49)<br>
>><br>
>> Signed-off-by: Armin Kuster <<a href="mailto:akuster@mvista.com">akuster@mvista.com</a>><br>
>> Signed-off-by: Robert Yang <<a href="mailto:liezhi.yang@windriver.com">liezhi.yang@windriver.com</a>><br>
>> Signed-off-by: Richard Purdie <<a href="mailto:richard.purdie@linuxfoundation.org">richard.purdie@linuxfoundation.org</a>><br>
>> Signed-off-by: Armin Kuster <<a href="mailto:akuster@mvista.com">akuster@mvista.com</a>><br>
>> Signed-off-by: Richard Purdie <<a href="mailto:richard.purdie@linuxfoundation.org">richard.purdie@linuxfoundation.org</a>><br>
>> Signed-off-by: Armin Kuster <<a href="mailto:akuster808@gmail.com">akuster808@gmail.com</a>><br>
>> ---<br>
>> .../recipes-core/glibc/glibc/CVE-2015-9761_1.patch | 1039 ++++++++++++++++++++<br>
>> .../recipes-core/glibc/glibc/CVE-2015-9761_2.patch | 388 ++++++++<br>
>> meta/recipes-core/glibc/<a href="http://glibc_2.20.bb" rel="noreferrer" target="_blank">glibc_2.20.bb</a> | 2 +<br>
>> 3 files changed, 1429 insertions(+)<br>
>> create mode 100644 meta/recipes-core/glibc/glibc/CVE-2015-9761_1.patch<br>
>> create mode 100644 meta/recipes-core/glibc/glibc/CVE-2015-9761_2.patch<br>
>><br>
>> diff --git a/meta/recipes-core/glibc/glibc/CVE-2015-9761_1.patch b/meta/recipes-core/glibc/glibc/CVE-2015-9761_1.patch<br>
>> new file mode 100644<br>
>> index 0000000..3aca913<br>
>> --- /dev/null<br>
>> +++ b/meta/recipes-core/glibc/glibc/CVE-2015-9761_1.patch<br>
>> @@ -0,0 +1,1039 @@<br>
>> +From e02cabecf0d025ec4f4ddee290bdf7aadb873bb3 Mon Sep 17 00:00:00 2001<br>
>> +From: Joseph Myers <<a href="mailto:joseph@codesourcery.com">joseph@codesourcery.com</a>><br>
>> +Date: Tue, 24 Nov 2015 22:24:52 +0000<br>
>> +Subject: [PATCH] Refactor strtod parsing of NaN payloads.<br>
>> +<br>
>> +The nan* functions handle their string argument by constructing a<br>
>> +NAN(...) string on the stack as a VLA and passing it to strtod<br>
>> +functions.<br>
>> +<br>
>> +This approach has problems discussed in bug 16961 and bug 16962: the<br>
>> +stack usage is unbounded, and it gives incorrect results in certain<br>
>> +cases where the argument is not a valid n-char-sequence.<br>
>> +<br>
>> +The natural fix for both issues is to refactor the NaN payload parsing<br>
>> +out of strtod into a separate function that the nan* functions can<br>
>> +call directly, so that no temporary string needs constructing on the<br>
>> +stack at all. This patch does that refactoring in preparation for<br>
>> +fixing those bugs (but without actually using the new functions from<br>
>> +nan* - which will also require exporting them from libc at version<br>
>> +GLIBC_PRIVATE). This patch is not intended to change any user-visible<br>
>> +behavior, so no tests are added (fixes for the above bugs will of<br>
>> +course add tests for them).<br>
>> +<br>
>> +This patch builds on my recent fixes for strtol and strtod issues in<br>
>> +Turkish locales. Given those fixes, the parsing of NaN payloads is<br>
>> +locale-independent; thus, the new functions do not need to take a<br>
>> +locale_t argument.<br>
>> +<br>
>> +Tested for x86_64, x86, mips64 and powerpc.<br>
>> +<br>
>> + * stdlib/strtod_nan.c: New file.<br>
>> + * stdlib/strtod_nan_double.h: Likewise.<br>
>> + * stdlib/strtod_nan_float.h: Likewise.<br>
>> + * stdlib/strtod_nan_main.c: Likewise.<br>
>> + * stdlib/strtod_nan_narrow.h: Likewise.<br>
>> + * stdlib/strtod_nan_wide.h: Likewise.<br>
>> + * stdlib/strtof_nan.c: Likewise.<br>
>> + * stdlib/strtold_nan.c: Likewise.<br>
>> + * sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h: Likewise.<br>
>> + * sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h: Likewise.<br>
>> + * sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h: Likewise.<br>
>> + * wcsmbs/wcstod_nan.c: Likewise.<br>
>> + * wcsmbs/wcstof_nan.c: Likewise.<br>
>> + * wcsmbs/wcstold_nan.c: Likewise.<br>
>> + * stdlib/Makefile (routines): Add strtof_nan, strtod_nan and<br>
>> + strtold_nan.<br>
>> + * wcsmbs/Makefile (routines): Add wcstod_nan, wcstold_nan and<br>
>> + wcstof_nan.<br>
>> + * include/stdlib.h (__strtof_nan): Declare and use<br>
>> + libc_hidden_proto.<br>
>> + (__strtod_nan): Likewise.<br>
>> + (__strtold_nan): Likewise.<br>
>> + (__wcstof_nan): Likewise.<br>
>> + (__wcstod_nan): Likewise.<br>
>> + (__wcstold_nan): Likewise.<br>
>> + * include/wchar.h (____wcstoull_l_internal): Declare.<br>
>> + * stdlib/strtod_l.c: Do not include <ieee754.h>.<br>
>> + (____strtoull_l_internal): Remove declaration.<br>
>> + (STRTOF_NAN): Define macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + (STRTOULL): Likewise.<br>
>> + (____STRTOF_INTERNAL): Use STRTOF_NAN to parse NaN payload.<br>
>> + * stdlib/strtof_l.c (____strtoull_l_internal): Remove declaration.<br>
>> + (STRTOF_NAN): Define macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + * sysdeps/ieee754/ldbl-128/strtold_l.c (STRTOF_NAN): Define macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + * sysdeps/ieee754/ldbl-128ibm/strtold_l.c (STRTOF_NAN): Define<br>
>> + macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + * sysdeps/ieee754/ldbl-64-128/strtold_l.c (STRTOF_NAN): Define<br>
>> + macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + * sysdeps/ieee754/ldbl-96/strtold_l.c (STRTOF_NAN): Define macro.<br>
>> + (SET_MANTISSA): Remove macro.<br>
>> + * wcsmbs/wcstod_l.c (____wcstoull_l_internal): Remove declaration.<br>
>> + * wcsmbs/wcstof_l.c (____wcstoull_l_internal): Likewise.<br>
>> + * wcsmbs/wcstold_l.c (____wcstoull_l_internal): Likewise.<br>
>> +<br>
>> +Upstream-Status: Backport<br>
>> +CVE: CVE-2015-9761 patch #1<br>
>> +[Yocto # 8980]<br>
>> +<br>
>> +<a href="https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e02cabecf0d025ec4f4ddee290bdf7aadb873bb3" rel="noreferrer" target="_blank">https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e02cabecf0d025ec4f4ddee290bdf7aadb873bb3</a><br>
>> +<br>
>> +Signed-off-by: Armin Kuster <<a href="mailto:akuster@mvista.com">akuster@mvista.com</a>><br>
>> +<br>
>> +---<br>
>> + ChangeLog | 49 ++++++++++++++++++<br>
>> + include/stdlib.h | 18 +++++++<br>
>> + include/wchar.h | 3 ++<br>
>> + stdlib/Makefile | 1 +<br>
>> + stdlib/strtod_l.c | 48 ++++--------------<br>
>> + stdlib/strtod_nan.c | 24 +++++++++<br>
>> + stdlib/strtod_nan_double.h | 30 +++++++++++<br>
>> + stdlib/strtod_nan_float.h | 29 +++++++++++<br>
>> + stdlib/strtod_nan_main.c | 63 ++++++++++++++++++++++++<br>
>> + stdlib/strtod_nan_narrow.h | 22 +++++++++<br>
>> + stdlib/strtod_nan_wide.h | 22 +++++++++<br>
>> + stdlib/strtof_l.c | 11 +----<br>
>> + stdlib/strtof_nan.c | 24 +++++++++<br>
>> + stdlib/strtold_nan.c | 30 +++++++++++<br>
>> + sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h | 33 +++++++++++++<br>
>> + sysdeps/ieee754/ldbl-128/strtold_l.c | 13 +----<br>
>> + sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h | 30 +++++++++++<br>
>> + sysdeps/ieee754/ldbl-128ibm/strtold_l.c | 10 +---<br>
>> + sysdeps/ieee754/ldbl-64-128/strtold_l.c | 13 +----<br>
>> + sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h | 30 +++++++++++<br>
>> + sysdeps/ieee754/ldbl-96/strtold_l.c | 10 +---<br>
>> + wcsmbs/Makefile | 1 +<br>
>> + wcsmbs/wcstod_l.c | 3 --<br>
>> + wcsmbs/wcstod_nan.c | 23 +++++++++<br>
>> + wcsmbs/wcstof_l.c | 3 --<br>
>> + wcsmbs/wcstof_nan.c | 23 +++++++++<br>
>> + wcsmbs/wcstold_l.c | 3 --<br>
>> + wcsmbs/wcstold_nan.c | 30 +++++++++++<br>
>> + 28 files changed, 504 insertions(+), 95 deletions(-)<br>
>> + create mode 100644 stdlib/strtod_nan.c<br>
>> + create mode 100644 stdlib/strtod_nan_double.h<br>
>> + create mode 100644 stdlib/strtod_nan_float.h<br>
>> + create mode 100644 stdlib/strtod_nan_main.c<br>
>> + create mode 100644 stdlib/strtod_nan_narrow.h<br>
>> + create mode 100644 stdlib/strtod_nan_wide.h<br>
>> + create mode 100644 stdlib/strtof_nan.c<br>
>> + create mode 100644 stdlib/strtold_nan.c<br>
>> + create mode 100644 sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h<br>
>> + create mode 100644 sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h<br>
>> + create mode 100644 sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h<br>
>> + create mode 100644 wcsmbs/wcstod_nan.c<br>
>> + create mode 100644 wcsmbs/wcstof_nan.c<br>
>> + create mode 100644 wcsmbs/wcstold_nan.c<br>
>> +<br>
>> +Index: git/include/stdlib.h<br>
>> +===================================================================<br>
>> +--- git.orig/include/stdlib.h<br>
>> ++++ git/include/stdlib.h<br>
>> +@@ -203,6 +203,24 @@ libc_hidden_proto (strtoll)<br>
>> + libc_hidden_proto (strtoul)<br>
>> + libc_hidden_proto (strtoull)<br>
>> +<br>
>> ++extern float __strtof_nan (const char *, char **, char) internal_function;<br>
>> ++extern double __strtod_nan (const char *, char **, char) internal_function;<br>
>> ++extern long double __strtold_nan (const char *, char **, char)<br>
>> ++ internal_function;<br>
>> ++extern float __wcstof_nan (const wchar_t *, wchar_t **, wchar_t)<br>
>> ++ internal_function;<br>
>> ++extern double __wcstod_nan (const wchar_t *, wchar_t **, wchar_t)<br>
>> ++ internal_function;<br>
>> ++extern long double __wcstold_nan (const wchar_t *, wchar_t **, wchar_t)<br>
>> ++ internal_function;<br>
>> ++<br>
>> ++libc_hidden_proto (__strtof_nan)<br>
>> ++libc_hidden_proto (__strtod_nan)<br>
>> ++libc_hidden_proto (__strtold_nan)<br>
>> ++libc_hidden_proto (__wcstof_nan)<br>
>> ++libc_hidden_proto (__wcstod_nan)<br>
>> ++libc_hidden_proto (__wcstold_nan)<br>
>> ++<br>
>> + extern char *__ecvt (double __value, int __ndigit, int *__restrict __decpt,<br>
>> + int *__restrict __sign);<br>
>> + extern char *__fcvt (double __value, int __ndigit, int *__restrict __decpt,<br>
>> +Index: git/include/wchar.h<br>
>> +===================================================================<br>
>> +--- git.orig/include/wchar.h<br>
>> ++++ git/include/wchar.h<br>
>> +@@ -52,6 +52,9 @@ extern unsigned long long int __wcstoull<br>
>> + __restrict __endptr,<br>
>> + int __base,<br>
>> + int __group) __THROW;<br>
>> ++extern unsigned long long int ____wcstoull_l_internal (const wchar_t *,<br>
>> ++ wchar_t **, int, int,<br>
>> ++ __locale_t);<br>
>> + libc_hidden_proto (__wcstof_internal)<br>
>> + libc_hidden_proto (__wcstod_internal)<br>
>> + libc_hidden_proto (__wcstold_internal)<br>
>> +Index: git/stdlib/Makefile<br>
>> +===================================================================<br>
>> +--- git.orig/stdlib/Makefile<br>
>> ++++ git/stdlib/Makefile<br>
>> +@@ -51,6 +51,7 @@ routines-y := \<br>
>> + strtol_l strtoul_l strtoll_l strtoull_l \<br>
>> + strtof strtod strtold \<br>
>> + strtof_l strtod_l strtold_l \<br>
>> ++ strtof_nan strtod_nan strtold_nan \<br>
>> + system canonicalize \<br>
>> + a64l l64a \<br>
>> + getsubopt xpg_basename \<br>
>> +Index: git/stdlib/strtod_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/stdlib/strtod_l.c<br>
>> ++++ git/stdlib/strtod_l.c<br>
>> +@@ -21,8 +21,6 @@<br>
>> + #include <xlocale.h><br>
>> +<br>
>> + extern double ____strtod_l_internal (const char *, char **, int, __locale_t);<br>
>> +-extern unsigned long long int ____strtoull_l_internal (const char *, char **,<br>
>> +- int, int, __locale_t);<br>
>> +<br>
>> + /* Configuration part. These macros are defined by `strtold.c',<br>
>> + `strtof.c', `wcstod.c', `wcstold.c', and `wcstof.c' to produce the<br>
>> +@@ -34,27 +32,20 @@ extern unsigned long long int ____strtou<br>
>> + # ifdef USE_WIDE_CHAR<br>
>> + # define STRTOF wcstod_l<br>
>> + # define __STRTOF __wcstod_l<br>
>> ++# define STRTOF_NAN __wcstod_nan<br>
>> + # else<br>
>> + # define STRTOF strtod_l<br>
>> + # define __STRTOF __strtod_l<br>
>> ++# define STRTOF_NAN __strtod_nan<br>
>> + # endif<br>
>> + # define MPN2FLOAT __mpn_construct_double<br>
>> + # define FLOAT_HUGE_VAL HUGE_VAL<br>
>> +-# define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ieee754_double u; \<br>
>> +- u.d = (flt); \<br>
>> +- u.ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> +- u.ieee_nan.mantissa1 = (mant); \<br>
>> +- if ((u.ieee.mantissa0 | u.ieee.mantissa1) != 0) \<br>
>> +- (flt) = u.d; \<br>
>> +- } while (0)<br>
>> + #endif<br>
>> + /* End of configuration part. */<br>
>> +<br>
>> + #include <ctype.h><br>
>> + #include <errno.h><br>
>> + #include <float.h><br>
>> +-#include <ieee754.h><br>
>> + #include "../locale/localeinfo.h"<br>
>> + #include <locale.h><br>
>> + #include <math.h><br>
>> +@@ -105,7 +96,6 @@ extern unsigned long long int ____strtou<br>
>> + # define TOLOWER_C(Ch) __towlower_l ((Ch), _nl_C_locobj_ptr)<br>
>> + # define STRNCASECMP(S1, S2, N) \<br>
>> + __wcsncasecmp_l ((S1), (S2), (N), _nl_C_locobj_ptr)<br>
>> +-# define STRTOULL(S, E, B) ____wcstoull_l_internal ((S), (E), (B), 0, loc)<br>
>> + #else<br>
>> + # define STRING_TYPE char<br>
>> + # define CHAR_TYPE char<br>
>> +@@ -117,7 +107,6 @@ extern unsigned long long int ____strtou<br>
>> + # define TOLOWER_C(Ch) __tolower_l ((Ch), _nl_C_locobj_ptr)<br>
>> + # define STRNCASECMP(S1, S2, N) \<br>
>> + __strncasecmp_l ((S1), (S2), (N), _nl_C_locobj_ptr)<br>
>> +-# define STRTOULL(S, E, B) ____strtoull_l_internal ((S), (E), (B), 0, loc)<br>
>> + #endif<br>
>> +<br>
>> +<br>
>> +@@ -668,33 +657,14 @@ ____STRTOF_INTERNAL (nptr, endptr, group<br>
>> + if (*cp == L_('('))<br>
>> + {<br>
>> + const STRING_TYPE *startp = cp;<br>
>> +- do<br>
>> +- ++cp;<br>
>> +- while ((*cp >= L_('0') && *cp <= L_('9'))<br>
>> +- || ({ CHAR_TYPE lo = TOLOWER (*cp);<br>
>> +- lo >= L_('a') && lo <= L_('z'); })<br>
>> +- || *cp == L_('_'));<br>
>> +-<br>
>> +- if (*cp != L_(')'))<br>
>> +- /* The closing brace is missing. Only match the NAN<br>
>> +- part. */<br>
>> +- cp = startp;<br>
>> ++ STRING_TYPE *endp;<br>
>> ++ retval = STRTOF_NAN (cp + 1, &endp, L_(')'));<br>
>> ++ if (*endp == L_(')'))<br>
>> ++ /* Consume the closing parenthesis. */<br>
>> ++ cp = endp + 1;<br>
>> + else<br>
>> +- {<br>
>> +- /* This is a system-dependent way to specify the<br>
>> +- bitmask used for the NaN. We expect it to be<br>
>> +- a number which is put in the mantissa of the<br>
>> +- number. */<br>
>> +- STRING_TYPE *endp;<br>
>> +- unsigned long long int mant;<br>
>> +-<br>
>> +- mant = STRTOULL (startp + 1, &endp, 0);<br>
>> +- if (endp == cp)<br>
>> +- SET_MANTISSA (retval, mant);<br>
>> +-<br>
>> +- /* Consume the closing brace. */<br>
>> +- ++cp;<br>
>> +- }<br>
>> ++ /* Only match the NAN part. */<br>
>> ++ cp = startp;<br>
>> + }<br>
>> +<br>
>> + if (endptr != NULL)<br>
>> +Index: git/stdlib/strtod_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan.c<br>
>> +@@ -0,0 +1,24 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Narrow<br>
>> ++ strings, double.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <strtod_nan_narrow.h><br>
>> ++#include <strtod_nan_double.h><br>
>> ++<br>
>> ++#define STRTOD_NAN __strtod_nan<br>
>> ++#include <strtod_nan_main.c><br>
>> +Index: git/stdlib/strtod_nan_double.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan_double.h<br>
>> +@@ -0,0 +1,30 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. For double.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define FLOAT double<br>
>> ++#define SET_MANTISSA(flt, mant) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ union ieee754_double u; \<br>
>> ++ u.d = (flt); \<br>
>> ++ u.ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> ++ u.ieee_nan.mantissa1 = (mant); \<br>
>> ++ if ((u.ieee.mantissa0 | u.ieee.mantissa1) != 0) \<br>
>> ++ (flt) = u.d; \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> +Index: git/stdlib/strtod_nan_float.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan_float.h<br>
>> +@@ -0,0 +1,29 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. For float.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define FLOAT float<br>
>> ++#define SET_MANTISSA(flt, mant) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ union ieee754_float u; \<br>
>> ++ u.f = (flt); \<br>
>> ++ u.ieee_nan.mantissa = (mant); \<br>
>> ++ if (u.ieee.mantissa != 0) \<br>
>> ++ (flt) = u.f; \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> +Index: git/stdlib/strtod_nan_main.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan_main.c<br>
>> +@@ -0,0 +1,63 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <ieee754.h><br>
>> ++#include <locale.h><br>
>> ++#include <math.h><br>
>> ++#include <stdlib.h><br>
>> ++#include <wchar.h><br>
>> ++<br>
>> ++<br>
>> ++/* If STR starts with an optional n-char-sequence as defined by ISO C<br>
>> ++ (a sequence of ASCII letters, digits and underscores), followed by<br>
>> ++ ENDC, return a NaN whose payload is set based on STR. Otherwise,<br>
>> ++ return a default NAN. If ENDPTR is not NULL, set *ENDPTR to point<br>
>> ++ to the character after the initial n-char-sequence. */<br>
>> ++<br>
>> ++internal_function<br>
>> ++FLOAT<br>
>> ++STRTOD_NAN (const STRING_TYPE *str, STRING_TYPE **endptr, STRING_TYPE endc)<br>
>> ++{<br>
>> ++ const STRING_TYPE *cp = str;<br>
>> ++<br>
>> ++ while ((*cp >= L_('0') && *cp <= L_('9'))<br>
>> ++ || (*cp >= L_('A') && *cp <= L_('Z'))<br>
>> ++ || (*cp >= L_('a') && *cp <= L_('z'))<br>
>> ++ || *cp == L_('_'))<br>
>> ++ ++cp;<br>
>> ++<br>
>> ++ FLOAT retval = NAN;<br>
>> ++ if (*cp != endc)<br>
>> ++ goto out;<br>
>> ++<br>
>> ++ /* This is a system-dependent way to specify the bitmask used for<br>
>> ++ the NaN. We expect it to be a number which is put in the<br>
>> ++ mantissa of the number. */<br>
>> ++ STRING_TYPE *endp;<br>
>> ++ unsigned long long int mant;<br>
>> ++<br>
>> ++ mant = STRTOULL (str, &endp, 0);<br>
>> ++ if (endp == cp)<br>
>> ++ SET_MANTISSA (retval, mant);<br>
>> ++<br>
>> ++ out:<br>
>> ++ if (endptr != NULL)<br>
>> ++ *endptr = (STRING_TYPE *) cp;<br>
>> ++ return retval;<br>
>> ++}<br>
>> ++libc_hidden_def (STRTOD_NAN)<br>
>> +Index: git/stdlib/strtod_nan_narrow.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan_narrow.h<br>
>> +@@ -0,0 +1,22 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Narrow strings.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define STRING_TYPE char<br>
>> ++#define L_(Ch) Ch<br>
>> ++#define STRTOULL(S, E, B) ____strtoull_l_internal ((S), (E), (B), 0, \<br>
>> ++ _nl_C_locobj_ptr)<br>
>> +Index: git/stdlib/strtod_nan_wide.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtod_nan_wide.h<br>
>> +@@ -0,0 +1,22 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Wide strings.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define STRING_TYPE wchar_t<br>
>> ++#define L_(Ch) L##Ch<br>
>> ++#define STRTOULL(S, E, B) ____wcstoull_l_internal ((S), (E), (B), 0, \<br>
>> ++ _nl_C_locobj_ptr)<br>
>> +Index: git/stdlib/strtof_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/stdlib/strtof_l.c<br>
>> ++++ git/stdlib/strtof_l.c<br>
>> +@@ -20,26 +20,19 @@<br>
>> + #include <xlocale.h><br>
>> +<br>
>> + extern float ____strtof_l_internal (const char *, char **, int, __locale_t);<br>
>> +-extern unsigned long long int ____strtoull_l_internal (const char *, char **,<br>
>> +- int, int, __locale_t);<br>
>> +<br>
>> + #define FLOAT float<br>
>> + #define FLT FLT<br>
>> + #ifdef USE_WIDE_CHAR<br>
>> + # define STRTOF wcstof_l<br>
>> + # define __STRTOF __wcstof_l<br>
>> ++# define STRTOF_NAN __wcstof_nan<br>
>> + #else<br>
>> + # define STRTOF strtof_l<br>
>> + # define __STRTOF __strtof_l<br>
>> ++# define STRTOF_NAN __strtof_nan<br>
>> + #endif<br>
>> + #define MPN2FLOAT __mpn_construct_float<br>
>> + #define FLOAT_HUGE_VAL HUGE_VALF<br>
>> +-#define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ieee754_float u; \<br>
>> +- u.f = (flt); \<br>
>> +- u.ieee_nan.mantissa = (mant); \<br>
>> +- if (u.ieee.mantissa != 0) \<br>
>> +- (flt) = u.f; \<br>
>> +- } while (0)<br>
>> +<br>
>> + #include "strtod_l.c"<br>
>> +Index: git/stdlib/strtof_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtof_nan.c<br>
>> +@@ -0,0 +1,24 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Narrow<br>
>> ++ strings, float.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <strtod_nan_narrow.h><br>
>> ++#include <strtod_nan_float.h><br>
>> ++<br>
>> ++#define STRTOD_NAN __strtof_nan<br>
>> ++#include <strtod_nan_main.c><br>
>> +Index: git/stdlib/strtold_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/stdlib/strtold_nan.c<br>
>> +@@ -0,0 +1,30 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Narrow<br>
>> ++ strings, long double.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <math.h><br>
>> ++<br>
>> ++/* This function is unused if long double and double have the same<br>
>> ++ representation. */<br>
>> ++#ifndef __NO_LONG_DOUBLE_MATH<br>
>> ++# include <strtod_nan_narrow.h><br>
>> ++# include <strtod_nan_ldouble.h><br>
>> ++<br>
>> ++# define STRTOD_NAN __strtold_nan<br>
>> ++# include <strtod_nan_main.c><br>
>> ++#endif<br>
>> +Index: git/sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h<br>
>> +@@ -0,0 +1,33 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. For ldbl-128.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define FLOAT long double<br>
>> ++#define SET_MANTISSA(flt, mant) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ union ieee854_long_double u; \<br>
>> ++ u.d = (flt); \<br>
>> ++ u.ieee_nan.mantissa0 = 0; \<br>
>> ++ u.ieee_nan.mantissa1 = 0; \<br>
>> ++ u.ieee_nan.mantissa2 = (mant) >> 32; \<br>
>> ++ u.ieee_nan.mantissa3 = (mant); \<br>
>> ++ if ((u.ieee.mantissa0 | u.ieee.mantissa1 \<br>
>> ++ | u.ieee.mantissa2 | u.ieee.mantissa3) != 0) \<br>
>> ++ (flt) = u.d; \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> +Index: git/sysdeps/ieee754/ldbl-128/strtold_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/sysdeps/ieee754/ldbl-128/strtold_l.c<br>
>> ++++ git/sysdeps/ieee754/ldbl-128/strtold_l.c<br>
>> +@@ -25,22 +25,13 @@<br>
>> + #ifdef USE_WIDE_CHAR<br>
>> + # define STRTOF wcstold_l<br>
>> + # define __STRTOF __wcstold_l<br>
>> ++# define STRTOF_NAN __wcstold_nan<br>
>> + #else<br>
>> + # define STRTOF strtold_l<br>
>> + # define __STRTOF __strtold_l<br>
>> ++# define STRTOF_NAN __strtold_nan<br>
>> + #endif<br>
>> + #define MPN2FLOAT __mpn_construct_long_double<br>
>> + #define FLOAT_HUGE_VAL HUGE_VALL<br>
>> +-#define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ieee854_long_double u; \<br>
>> +- u.d = (flt); \<br>
>> +- u.ieee_nan.mantissa0 = 0; \<br>
>> +- u.ieee_nan.mantissa1 = 0; \<br>
>> +- u.ieee_nan.mantissa2 = (mant) >> 32; \<br>
>> +- u.ieee_nan.mantissa3 = (mant); \<br>
>> +- if ((u.ieee.mantissa0 | u.ieee.mantissa1 \<br>
>> +- | u.ieee.mantissa2 | u.ieee.mantissa3) != 0) \<br>
>> +- (flt) = u.d; \<br>
>> +- } while (0)<br>
>> +<br>
>> + #include <strtod_l.c><br>
>> +Index: git/sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h<br>
>> +@@ -0,0 +1,30 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. For ldbl-128ibm.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define FLOAT long double<br>
>> ++#define SET_MANTISSA(flt, mant) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ union ibm_extended_long_double u; \<br>
>> ++ u.ld = (flt); \<br>
>> ++ u.d[0].ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> ++ u.d[0].ieee_nan.mantissa1 = (mant); \<br>
>> ++ if ((u.d[0].ieee.mantissa0 | u.d[0].ieee.mantissa1) != 0) \<br>
>> ++ (flt) = u.ld; \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> +Index: git/sysdeps/ieee754/ldbl-128ibm/strtold_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/sysdeps/ieee754/ldbl-128ibm/strtold_l.c<br>
>> ++++ git/sysdeps/ieee754/ldbl-128ibm/strtold_l.c<br>
>> +@@ -30,25 +30,19 @@ extern long double ____new_wcstold_l (co<br>
>> + # define STRTOF __new_wcstold_l<br>
>> + # define __STRTOF ____new_wcstold_l<br>
>> + # define ____STRTOF_INTERNAL ____wcstold_l_internal<br>
>> ++# define STRTOF_NAN __wcstold_nan<br>
>> + #else<br>
>> + extern long double ____new_strtold_l (const char *, char **, __locale_t);<br>
>> + # define STRTOF __new_strtold_l<br>
>> + # define __STRTOF ____new_strtold_l<br>
>> + # define ____STRTOF_INTERNAL ____strtold_l_internal<br>
>> ++# define STRTOF_NAN __strtold_nan<br>
>> + #endif<br>
>> + extern __typeof (__STRTOF) STRTOF;<br>
>> + libc_hidden_proto (__STRTOF)<br>
>> + libc_hidden_proto (STRTOF)<br>
>> + #define MPN2FLOAT __mpn_construct_long_double<br>
>> + #define FLOAT_HUGE_VAL HUGE_VALL<br>
>> +-# define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ibm_extended_long_double u; \<br>
>> +- u.ld = (flt); \<br>
>> +- u.d[0].ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> +- u.d[0].ieee_nan.mantissa1 = (mant); \<br>
>> +- if ((u.d[0].ieee.mantissa0 | u.d[0].ieee.mantissa1) != 0) \<br>
>> +- (flt) = u.ld; \<br>
>> +- } while (0)<br>
>> +<br>
>> + #include <strtod_l.c><br>
>> +<br>
>> +Index: git/sysdeps/ieee754/ldbl-64-128/strtold_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/sysdeps/ieee754/ldbl-64-128/strtold_l.c<br>
>> ++++ git/sysdeps/ieee754/ldbl-64-128/strtold_l.c<br>
>> +@@ -30,28 +30,19 @@ extern long double ____new_wcstold_l (co<br>
>> + # define STRTOF __new_wcstold_l<br>
>> + # define __STRTOF ____new_wcstold_l<br>
>> + # define ____STRTOF_INTERNAL ____wcstold_l_internal<br>
>> ++# define STRTOF_NAN __wcstold_nan<br>
>> + #else<br>
>> + extern long double ____new_strtold_l (const char *, char **, __locale_t);<br>
>> + # define STRTOF __new_strtold_l<br>
>> + # define __STRTOF ____new_strtold_l<br>
>> + # define ____STRTOF_INTERNAL ____strtold_l_internal<br>
>> ++# define STRTOF_NAN __strtold_nan<br>
>> + #endif<br>
>> + extern __typeof (__STRTOF) STRTOF;<br>
>> + libc_hidden_proto (__STRTOF)<br>
>> + libc_hidden_proto (STRTOF)<br>
>> + #define MPN2FLOAT __mpn_construct_long_double<br>
>> + #define FLOAT_HUGE_VAL HUGE_VALL<br>
>> +-#define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ieee854_long_double u; \<br>
>> +- u.d = (flt); \<br>
>> +- u.ieee_nan.mantissa0 = 0; \<br>
>> +- u.ieee_nan.mantissa1 = 0; \<br>
>> +- u.ieee_nan.mantissa2 = (mant) >> 32; \<br>
>> +- u.ieee_nan.mantissa3 = (mant); \<br>
>> +- if ((u.ieee.mantissa0 | u.ieee.mantissa1 \<br>
>> +- | u.ieee.mantissa2 | u.ieee.mantissa3) != 0) \<br>
>> +- (flt) = u.d; \<br>
>> +- } while (0)<br>
>> +<br>
>> + #include <strtod_l.c><br>
>> +<br>
>> +Index: git/sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h<br>
>> +@@ -0,0 +1,30 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. For ldbl-96.<br>
>> ++ Copyright (C) 1997-2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#define FLOAT long double<br>
>> ++#define SET_MANTISSA(flt, mant) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ union ieee854_long_double u; \<br>
>> ++ u.d = (flt); \<br>
>> ++ u.ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> ++ u.ieee_nan.mantissa1 = (mant); \<br>
>> ++ if ((u.ieee.mantissa0 | u.ieee.mantissa1) != 0) \<br>
>> ++ (flt) = u.d; \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> +Index: git/sysdeps/ieee754/ldbl-96/strtold_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/sysdeps/ieee754/ldbl-96/strtold_l.c<br>
>> ++++ git/sysdeps/ieee754/ldbl-96/strtold_l.c<br>
>> +@@ -25,19 +25,13 @@<br>
>> + #ifdef USE_WIDE_CHAR<br>
>> + # define STRTOF wcstold_l<br>
>> + # define __STRTOF __wcstold_l<br>
>> ++# define STRTOF_NAN __wcstold_nan<br>
>> + #else<br>
>> + # define STRTOF strtold_l<br>
>> + # define __STRTOF __strtold_l<br>
>> ++# define STRTOF_NAN __strtold_nan<br>
>> + #endif<br>
>> + #define MPN2FLOAT __mpn_construct_long_double<br>
>> + #define FLOAT_HUGE_VAL HUGE_VALL<br>
>> +-#define SET_MANTISSA(flt, mant) \<br>
>> +- do { union ieee854_long_double u; \<br>
>> +- u.d = (flt); \<br>
>> +- u.ieee_nan.mantissa0 = (mant) >> 32; \<br>
>> +- u.ieee_nan.mantissa1 = (mant); \<br>
>> +- if ((u.ieee.mantissa0 | u.ieee.mantissa1) != 0) \<br>
>> +- (flt) = u.d; \<br>
>> +- } while (0)<br>
>> +<br>
>> + #include <stdlib/strtod_l.c><br>
>> +Index: git/wcsmbs/Makefile<br>
>> +===================================================================<br>
>> +--- git.orig/wcsmbs/Makefile<br>
>> ++++ git/wcsmbs/Makefile<br>
>> +@@ -39,6 +39,7 @@ routines-$(OPTION_POSIX_C_LANG_WIDE_CHAR<br>
>> + wcstol wcstoul wcstoll wcstoull wcstod wcstold wcstof \<br>
>> + wcstol_l wcstoul_l wcstoll_l wcstoull_l \<br>
>> + wcstod_l wcstold_l wcstof_l \<br>
>> ++ wcstod_nan wcstold_nan wcstof_nan \<br>
>> + wcscoll wcsxfrm \<br>
>> + wcwidth wcswidth \<br>
>> + wcscoll_l wcsxfrm_l \<br>
>> +Index: git/wcsmbs/wcstod_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/wcsmbs/wcstod_l.c<br>
>> ++++ git/wcsmbs/wcstod_l.c<br>
>> +@@ -23,9 +23,6 @@<br>
>> +<br>
>> + extern double ____wcstod_l_internal (const wchar_t *, wchar_t **, int,<br>
>> + __locale_t);<br>
>> +-extern unsigned long long int ____wcstoull_l_internal (const wchar_t *,<br>
>> +- wchar_t **, int, int,<br>
>> +- __locale_t);<br>
>> +<br>
>> + #define USE_WIDE_CHAR 1<br>
>> +<br>
>> +Index: git/wcsmbs/wcstod_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/wcsmbs/wcstod_nan.c<br>
>> +@@ -0,0 +1,23 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Wide strings, double.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include "../stdlib/strtod_nan_wide.h"<br>
>> ++#include "../stdlib/strtod_nan_double.h"<br>
>> ++<br>
>> ++#define STRTOD_NAN __wcstod_nan<br>
>> ++#include "../stdlib/strtod_nan_main.c"<br>
>> +Index: git/wcsmbs/wcstof_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/wcsmbs/wcstof_l.c<br>
>> ++++ git/wcsmbs/wcstof_l.c<br>
>> +@@ -25,8 +25,5 @@<br>
>> +<br>
>> + extern float ____wcstof_l_internal (const wchar_t *, wchar_t **, int,<br>
>> + __locale_t);<br>
>> +-extern unsigned long long int ____wcstoull_l_internal (const wchar_t *,<br>
>> +- wchar_t **, int, int,<br>
>> +- __locale_t);<br>
>> +<br>
>> + #include <stdlib/strtof_l.c><br>
>> +Index: git/wcsmbs/wcstof_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/wcsmbs/wcstof_nan.c<br>
>> +@@ -0,0 +1,23 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Wide strings, float.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include "../stdlib/strtod_nan_wide.h"<br>
>> ++#include "../stdlib/strtod_nan_float.h"<br>
>> ++<br>
>> ++#define STRTOD_NAN __wcstof_nan<br>
>> ++#include "../stdlib/strtod_nan_main.c"<br>
>> +Index: git/wcsmbs/wcstold_l.c<br>
>> +===================================================================<br>
>> +--- git.orig/wcsmbs/wcstold_l.c<br>
>> ++++ git/wcsmbs/wcstold_l.c<br>
>> +@@ -24,8 +24,5 @@<br>
>> +<br>
>> + extern long double ____wcstold_l_internal (const wchar_t *, wchar_t **, int,<br>
>> + __locale_t);<br>
>> +-extern unsigned long long int ____wcstoull_l_internal (const wchar_t *,<br>
>> +- wchar_t **, int, int,<br>
>> +- __locale_t);<br>
>> +<br>
>> + #include <strtold_l.c><br>
>> +Index: git/wcsmbs/wcstold_nan.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/wcsmbs/wcstold_nan.c<br>
>> +@@ -0,0 +1,30 @@<br>
>> ++/* Convert string for NaN payload to corresponding NaN. Wide strings,<br>
>> ++ long double.<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <math.h><br>
>> ++<br>
>> ++/* This function is unused if long double and double have the same<br>
>> ++ representation. */<br>
>> ++#ifndef __NO_LONG_DOUBLE_MATH<br>
>> ++# include "../stdlib/strtod_nan_wide.h"<br>
>> ++# include <strtod_nan_ldouble.h><br>
>> ++<br>
>> ++# define STRTOD_NAN __wcstold_nan<br>
>> ++# include "../stdlib/strtod_nan_main.c"<br>
>> ++#endif<br>
>> +Index: git/ChangeLog<br>
>> +===================================================================<br>
>> +--- git.orig/ChangeLog<br>
>> ++++ git/ChangeLog<br>
>> +@@ -1,3 +1,57 @@<br>
>> ++2015-11-24 Joseph Myers <<a href="mailto:joseph@codesourcery.com">joseph@codesourcery.com</a>><br>
>> ++<br>
>> ++ * stdlib/strtod_nan.c: New file.<br>
>> ++ * stdlib/strtod_nan_double.h: Likewise.<br>
>> ++ * stdlib/strtod_nan_float.h: Likewise.<br>
>> ++ * stdlib/strtod_nan_main.c: Likewise.<br>
>> ++ * stdlib/strtod_nan_narrow.h: Likewise.<br>
>> ++ * stdlib/strtod_nan_wide.h: Likewise.<br>
>> ++ * stdlib/strtof_nan.c: Likewise.<br>
>> ++ * stdlib/strtold_nan.c: Likewise.<br>
>> ++ * sysdeps/ieee754/ldbl-128/strtod_nan_ldouble.h: Likewise.<br>
>> ++ * sysdeps/ieee754/ldbl-128ibm/strtod_nan_ldouble.h: Likewise.<br>
>> ++ * sysdeps/ieee754/ldbl-96/strtod_nan_ldouble.h: Likewise.<br>
>> ++ * wcsmbs/wcstod_nan.c: Likewise.<br>
>> ++ * wcsmbs/wcstof_nan.c: Likewise.<br>
>> ++ * wcsmbs/wcstold_nan.c: Likewise.<br>
>> ++ * stdlib/Makefile (routines): Add strtof_nan, strtod_nan and<br>
>> ++ strtold_nan.<br>
>> ++ * wcsmbs/Makefile (routines): Add wcstod_nan, wcstold_nan and<br>
>> ++ wcstof_nan.<br>
>> ++ * include/stdlib.h (__strtof_nan): Declare and use<br>
>> ++ libc_hidden_proto.<br>
>> ++ (__strtod_nan): Likewise.<br>
>> ++ (__strtold_nan): Likewise.<br>
>> ++ (__wcstof_nan): Likewise.<br>
>> ++ (__wcstod_nan): Likewise.<br>
>> ++ (__wcstold_nan): Likewise.<br>
>> ++ * include/wchar.h (____wcstoull_l_internal): Declare.<br>
>> ++ * stdlib/strtod_l.c: Do not include <ieee754.h>.<br>
>> ++ (____strtoull_l_internal): Remove declaration.<br>
>> ++ (STRTOF_NAN): Define macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ (STRTOULL): Likewise.<br>
>> ++ (____STRTOF_INTERNAL): Use STRTOF_NAN to parse NaN payload.<br>
>> ++ * stdlib/strtof_l.c (____strtoull_l_internal): Remove declaration.<br>
>> ++ (STRTOF_NAN): Define macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ * sysdeps/ieee754/ldbl-128/strtold_l.c (STRTOF_NAN): Define macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ * sysdeps/ieee754/ldbl-128ibm/strtold_l.c (STRTOF_NAN): Define<br>
>> ++ macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ * sysdeps/ieee754/ldbl-64-128/strtold_l.c (STRTOF_NAN): Define<br>
>> ++ macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ * sysdeps/ieee754/ldbl-96/strtold_l.c (STRTOF_NAN): Define macro.<br>
>> ++ (SET_MANTISSA): Remove macro.<br>
>> ++ * wcsmbs/wcstod_l.c (____wcstoull_l_internal): Remove declaration.<br>
>> ++ * wcsmbs/wcstof_l.c (____wcstoull_l_internal): Likewise.<br>
>> ++ * wcsmbs/wcstold_l.c (____wcstoull_l_internal): Likewise.<br>
>> ++<br>
>> ++ [BZ #19266]<br>
>> ++ * stdlib/strtod_l.c (____STRTOF_INTERNAL): Check directly for<br>
>> ++ upper case and lower case letters inside NAN(), not using TOLOWER.<br>
>> + 2015-08-08 Paul Pluzhnikov <<a href="mailto:ppluzhnikov@google.com">ppluzhnikov@google.com</a>><br>
>> +<br>
>> + [BZ #17905]<br>
>> diff --git a/meta/recipes-core/glibc/glibc/CVE-2015-9761_2.patch b/meta/recipes-core/glibc/glibc/CVE-2015-9761_2.patch<br>
>> new file mode 100644<br>
>> index 0000000..0df5e50<br>
>> --- /dev/null<br>
>> +++ b/meta/recipes-core/glibc/glibc/CVE-2015-9761_2.patch<br>
>> @@ -0,0 +1,388 @@<br>
>> +From 8f5e8b01a1da2a207228f2072c934fa5918554b8 Mon Sep 17 00:00:00 2001<br>
>> +From: Joseph Myers <<a href="mailto:joseph@codesourcery.com">joseph@codesourcery.com</a>><br>
>> +Date: Fri, 4 Dec 2015 20:36:28 +0000<br>
>> +Subject: [PATCH] Fix nan functions handling of payload strings (bug 16961, bug<br>
>> + 16962).<br>
>> +<br>
>> +The nan, nanf and nanl functions handle payload strings by doing e.g.:<br>
>> +<br>
>> + if (tagp[0] != '\0')<br>
>> + {<br>
>> + char buf[6 + strlen (tagp)];<br>
>> + sprintf (buf, "NAN(%s)", tagp);<br>
>> + return strtod (buf, NULL);<br>
>> + }<br>
>> +<br>
>> +This is an unbounded stack allocation based on the length of the<br>
>> +argument. Furthermore, if the argument starts with an n-char-sequence<br>
>> +followed by ')', that n-char-sequence is wrongly treated as<br>
>> +significant for determining the payload of the resulting NaN, when ISO<br>
>> +C says the call should be equivalent to strtod ("NAN", NULL), without<br>
>> +being affected by that initial n-char-sequence. This patch fixes both<br>
>> +those problems by using the __strtod_nan etc. functions recently<br>
>> +factored out of strtod etc. for that purpose, with those functions<br>
>> +being exported from libc at version GLIBC_PRIVATE.<br>
>> +<br>
>> +Tested for x86_64, x86, mips64 and powerpc.<br>
>> +<br>
>> + [BZ #16961]<br>
>> + [BZ #16962]<br>
>> + * math/s_nan.c (__nan): Use __strtod_nan instead of constructing a<br>
>> + string on the stack for strtod.<br>
>> + * math/s_nanf.c (__nanf): Use __strtof_nan instead of constructing<br>
>> + a string on the stack for strtof.<br>
>> + * math/s_nanl.c (__nanl): Use __strtold_nan instead of<br>
>> + constructing a string on the stack for strtold.<br>
>> + * stdlib/Versions (libc): Add __strtof_nan, __strtod_nan and<br>
>> + __strtold_nan to GLIBC_PRIVATE.<br>
>> + * math/test-nan-overflow.c: New file.<br>
>> + * math/test-nan-payload.c: Likewise.<br>
>> + * math/Makefile (tests): Add test-nan-overflow and<br>
>> + test-nan-payload.<br>
>> +<br>
>> +Upstream-Status: Backport<br>
>> +CVE: CVE-2015-9761 patch #2<br>
>> +[Yocto # 8980]<br>
>> +<br>
>> +<a href="https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8f5e8b01a1da2a207228f2072c934fa5918554b8" rel="noreferrer" target="_blank">https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8f5e8b01a1da2a207228f2072c934fa5918554b8</a><br>
>> +<br>
>> +Signed-off-by: Armin Kuster <<a href="mailto:akuster@mvista.com">akuster@mvista.com</a>><br>
>> +<br>
>> +---<br>
>> + ChangeLog | 17 +++++++<br>
>> + NEWS | 6 +++<br>
>> + math/Makefile | 3 +-<br>
>> + math/s_nan.c | 9 +---<br>
>> + math/s_nanf.c | 9 +---<br>
>> + math/s_nanl.c | 9 +---<br>
>> + math/test-nan-overflow.c | 66 +++++++++++++++++++++++++<br>
>> + math/test-nan-payload.c | 122 +++++++++++++++++++++++++++++++++++++++++++++++<br>
>> + stdlib/Versions | 1 +<br>
>> + 9 files changed, 217 insertions(+), 25 deletions(-)<br>
>> + create mode 100644 math/test-nan-overflow.c<br>
>> + create mode 100644 math/test-nan-payload.c<br>
>> +<br>
>> +Index: git/ChangeLog<br>
>> +===================================================================<br>
>> +--- git.orig/ChangeLog<br>
>> ++++ git/ChangeLog<br>
>> +@@ -1,3 +1,20 @@<br>
>> ++2015-12-04 Joseph Myers <<a href="mailto:joseph@codesourcery.com">joseph@codesourcery.com</a>><br>
>> ++<br>
>> ++ [BZ #16961]<br>
>> ++ [BZ #16962]<br>
>> ++ * math/s_nan.c (__nan): Use __strtod_nan instead of constructing a<br>
>> ++ string on the stack for strtod.<br>
>> ++ * math/s_nanf.c (__nanf): Use __strtof_nan instead of constructing<br>
>> ++ a string on the stack for strtof.<br>
>> ++ * math/s_nanl.c (__nanl): Use __strtold_nan instead of<br>
>> ++ constructing a string on the stack for strtold.<br>
>> ++ * stdlib/Versions (libc): Add __strtof_nan, __strtod_nan and<br>
>> ++ __strtold_nan to GLIBC_PRIVATE.<br>
>> ++ * math/test-nan-overflow.c: New file.<br>
>> ++ * math/test-nan-payload.c: Likewise.<br>
>> ++ * math/Makefile (tests): Add test-nan-overflow and<br>
>> ++ test-nan-payload.<br>
>> ++<br>
>> + 2015-11-24 Joseph Myers <<a href="mailto:joseph@codesourcery.com">joseph@codesourcery.com</a>><br>
>> +<br>
>> + * stdlib/strtod_nan.c: New file.<br>
>> +Index: git/NEWS<br>
>> +===================================================================<br>
>> +--- git.orig/NEWS<br>
>> ++++ git/NEWS<br>
>> +@@ -7,6 +7,12 @@ using `glibc' in the "product" field.<br>
>> +<br>
>> + Version 2.21<br>
>> +<br>
>> ++Security related changes:<br>
>> ++<br>
>> ++* The nan, nanf and nanl functions no longer have unbounded stack usage<br>
>> ++ depending on the length of the string passed as an argument to the<br>
>> ++ functions. Reported by Joseph Myers.<br>
>> ++<br>
>> + * The following bugs are resolved with this release:<br>
>> +<br>
>> + 6652, 10672, 12674, 12847, 12926, 13862, 14132, 14138, 14171, 14498,<br>
>> +Index: git/math/s_nan.c<br>
>> +===================================================================<br>
>> +--- git.orig/math/s_nan.c<br>
>> ++++ git/math/s_nan.c<br>
>> +@@ -28,14 +28,7 @@<br>
>> + double<br>
>> + __nan (const char *tagp)<br>
>> + {<br>
>> +- if (tagp[0] != '\0')<br>
>> +- {<br>
>> +- char buf[6 + strlen (tagp)];<br>
>> +- sprintf (buf, "NAN(%s)", tagp);<br>
>> +- return strtod (buf, NULL);<br>
>> +- }<br>
>> +-<br>
>> +- return NAN;<br>
>> ++ return __strtod_nan (tagp, NULL, 0);<br>
>> + }<br>
>> + weak_alias (__nan, nan)<br>
>> + #ifdef NO_LONG_DOUBLE<br>
>> +Index: git/math/s_nanf.c<br>
>> +===================================================================<br>
>> +--- git.orig/math/s_nanf.c<br>
>> ++++ git/math/s_nanf.c<br>
>> +@@ -28,13 +28,6 @@<br>
>> + float<br>
>> + __nanf (const char *tagp)<br>
>> + {<br>
>> +- if (tagp[0] != '\0')<br>
>> +- {<br>
>> +- char buf[6 + strlen (tagp)];<br>
>> +- sprintf (buf, "NAN(%s)", tagp);<br>
>> +- return strtof (buf, NULL);<br>
>> +- }<br>
>> +-<br>
>> +- return NAN;<br>
>> ++ return __strtof_nan (tagp, NULL, 0);<br>
>> + }<br>
>> + weak_alias (__nanf, nanf)<br>
>> +Index: git/math/s_nanl.c<br>
>> +===================================================================<br>
>> +--- git.orig/math/s_nanl.c<br>
>> ++++ git/math/s_nanl.c<br>
>> +@@ -28,13 +28,6 @@<br>
>> + long double<br>
>> + __nanl (const char *tagp)<br>
>> + {<br>
>> +- if (tagp[0] != '\0')<br>
>> +- {<br>
>> +- char buf[6 + strlen (tagp)];<br>
>> +- sprintf (buf, "NAN(%s)", tagp);<br>
>> +- return strtold (buf, NULL);<br>
>> +- }<br>
>> +-<br>
>> +- return NAN;<br>
>> ++ return __strtold_nan (tagp, NULL, 0);<br>
>> + }<br>
>> + weak_alias (__nanl, nanl)<br>
>> +Index: git/math/test-nan-overflow.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/math/test-nan-overflow.c<br>
>> +@@ -0,0 +1,66 @@<br>
>> ++/* Test nan functions stack overflow (bug 16962).<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <math.h><br>
>> ++#include <stdio.h><br>
>> ++#include <string.h><br>
>> ++#include <sys/resource.h><br>
>> ++<br>
>> ++#define STACK_LIM 1048576<br>
>> ++#define STRING_SIZE (2 * STACK_LIM)<br>
>> ++<br>
>> ++static int<br>
>> ++do_test (void)<br>
>> ++{<br>
>> ++ int result = 0;<br>
>> ++ struct rlimit lim;<br>
>> ++ getrlimit (RLIMIT_STACK, &lim);<br>
>> ++ lim.rlim_cur = STACK_LIM;<br>
>> ++ setrlimit (RLIMIT_STACK, &lim);<br>
>> ++ char *nanstr = malloc (STRING_SIZE);<br>
>> ++ if (nanstr == NULL)<br>
>> ++ {<br>
>> ++ puts ("malloc failed, cannot test");<br>
>> ++ return 77;<br>
>> ++ }<br>
>> ++ memset (nanstr, '0', STRING_SIZE - 1);<br>
>> ++ nanstr[STRING_SIZE - 1] = 0;<br>
>> ++#define NAN_TEST(TYPE, FUNC) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ char *volatile p = nanstr; \<br>
>> ++ volatile TYPE v = FUNC (p); \<br>
>> ++ if (isnan (v)) \<br>
>> ++ puts ("PASS: " #FUNC); \<br>
>> ++ else \<br>
>> ++ { \<br>
>> ++ puts ("FAIL: " #FUNC); \<br>
>> ++ result = 1; \<br>
>> ++ } \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> ++ NAN_TEST (float, nanf);<br>
>> ++ NAN_TEST (double, nan);<br>
>> ++#ifndef NO_LONG_DOUBLE<br>
>> ++ NAN_TEST (long double, nanl);<br>
>> ++#endif<br>
>> ++ return result;<br>
>> ++}<br>
>> ++<br>
>> ++#define TEST_FUNCTION do_test ()<br>
>> ++#include "../test-skeleton.c"<br>
>> +Index: git/math/test-nan-payload.c<br>
>> +===================================================================<br>
>> +--- /dev/null<br>
>> ++++ git/math/test-nan-payload.c<br>
>> +@@ -0,0 +1,122 @@<br>
>> ++/* Test nan functions payload handling (bug 16961).<br>
>> ++ Copyright (C) 2015 Free Software Foundation, Inc.<br>
>> ++ This file is part of the GNU C Library.<br>
>> ++<br>
>> ++ The GNU C Library is free software; you can redistribute it and/or<br>
>> ++ modify it under the terms of the GNU Lesser General Public<br>
>> ++ License as published by the Free Software Foundation; either<br>
>> ++ version 2.1 of the License, or (at your option) any later version.<br>
>> ++<br>
>> ++ The GNU C Library is distributed in the hope that it will be useful,<br>
>> ++ but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
>> ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU<br>
>> ++ Lesser General Public License for more details.<br>
>> ++<br>
>> ++ You should have received a copy of the GNU Lesser General Public<br>
>> ++ License along with the GNU C Library; if not, see<br>
>> ++ <<a href="http://www.gnu.org/licenses/" rel="noreferrer" target="_blank">http://www.gnu.org/licenses/</a>>. */<br>
>> ++<br>
>> ++#include <float.h><br>
>> ++#include <math.h><br>
>> ++#include <stdio.h><br>
>> ++#include <stdlib.h><br>
>> ++#include <string.h><br>
>> ++<br>
>> ++/* Avoid built-in functions. */<br>
>> ++#define WRAP_NAN(FUNC, STR) \<br>
>> ++ ({ const char *volatile wns = (STR); FUNC (wns); })<br>
>> ++#define WRAP_STRTO(FUNC, STR) \<br>
>> ++ ({ const char *volatile wss = (STR); FUNC (wss, NULL); })<br>
>> ++<br>
>> ++#define CHECK_IS_NAN(TYPE, A) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ if (isnan (A)) \<br>
>> ++ puts ("PASS: " #TYPE " " #A); \<br>
>> ++ else \<br>
>> ++ { \<br>
>> ++ puts ("FAIL: " #TYPE " " #A); \<br>
>> ++ result = 1; \<br>
>> ++ } \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> ++<br>
>> ++#define CHECK_SAME_NAN(TYPE, A, B) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ if (memcmp (&(A), &(B), sizeof (A)) == 0) \<br>
>> ++ puts ("PASS: " #TYPE " " #A " = " #B); \<br>
>> ++ else \<br>
>> ++ { \<br>
>> ++ puts ("FAIL: " #TYPE " " #A " = " #B); \<br>
>> ++ result = 1; \<br>
>> ++ } \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> ++<br>
>> ++#define CHECK_DIFF_NAN(TYPE, A, B) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ if (memcmp (&(A), &(B), sizeof (A)) != 0) \<br>
>> ++ puts ("PASS: " #TYPE " " #A " != " #B); \<br>
>> ++ else \<br>
>> ++ { \<br>
>> ++ puts ("FAIL: " #TYPE " " #A " != " #B); \<br>
>> ++ result = 1; \<br>
>> ++ } \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> ++<br>
>> ++/* Cannot test payloads by memcmp for formats where NaNs have padding<br>
>> ++ bits. */<br>
>> ++#define CAN_TEST_EQ(MANT_DIG) ((MANT_DIG) != 64 && (MANT_DIG) != 106)<br>
>> ++<br>
>> ++#define RUN_TESTS(TYPE, SFUNC, FUNC, MANT_DIG) \<br>
>> ++ do \<br>
>> ++ { \<br>
>> ++ TYPE n123 = WRAP_NAN (FUNC, "123"); \<br>
>> ++ CHECK_IS_NAN (TYPE, n123); \<br>
>> ++ TYPE s123 = WRAP_STRTO (SFUNC, "NAN(123)"); \<br>
>> ++ CHECK_IS_NAN (TYPE, s123); \<br>
>> ++ TYPE n456 = WRAP_NAN (FUNC, "456"); \<br>
>> ++ CHECK_IS_NAN (TYPE, n456); \<br>
>> ++ TYPE s456 = WRAP_STRTO (SFUNC, "NAN(456)"); \<br>
>> ++ CHECK_IS_NAN (TYPE, s456); \<br>
>> ++ TYPE n123x = WRAP_NAN (FUNC, "123)"); \<br>
>> ++ CHECK_IS_NAN (TYPE, n123x); \<br>
>> ++ TYPE nemp = WRAP_NAN (FUNC, ""); \<br>
>> ++ CHECK_IS_NAN (TYPE, nemp); \<br>
>> ++ TYPE semp = WRAP_STRTO (SFUNC, "NAN()"); \<br>
>> ++ CHECK_IS_NAN (TYPE, semp); \<br>
>> ++ TYPE sx = WRAP_STRTO (SFUNC, "NAN"); \<br>
>> ++ CHECK_IS_NAN (TYPE, sx); \<br>
>> ++ if (CAN_TEST_EQ (MANT_DIG)) \<br>
>> ++ CHECK_SAME_NAN (TYPE, n123, s123); \<br>
>> ++ if (CAN_TEST_EQ (MANT_DIG)) \<br>
>> ++ CHECK_SAME_NAN (TYPE, n456, s456); \<br>
>> ++ if (CAN_TEST_EQ (MANT_DIG)) \<br>
>> ++ CHECK_SAME_NAN (TYPE, nemp, semp); \<br>
>> ++ if (CAN_TEST_EQ (MANT_DIG)) \<br>
>> ++ CHECK_SAME_NAN (TYPE, n123x, sx); \<br>
>> ++ CHECK_DIFF_NAN (TYPE, n123, n456); \<br>
>> ++ CHECK_DIFF_NAN (TYPE, n123, nemp); \<br>
>> ++ CHECK_DIFF_NAN (TYPE, n123, n123x); \<br>
>> ++ CHECK_DIFF_NAN (TYPE, n456, nemp); \<br>
>> ++ CHECK_DIFF_NAN (TYPE, n456, n123x); \<br>
>> ++ } \<br>
>> ++ while (0)<br>
>> ++<br>
>> ++static int<br>
>> ++do_test (void)<br>
>> ++{<br>
>> ++ int result = 0;<br>
>> ++ RUN_TESTS (float, strtof, nanf, FLT_MANT_DIG);<br>
>> ++ RUN_TESTS (double, strtod, nan, DBL_MANT_DIG);<br>
>> ++#ifndef NO_LONG_DOUBLE<br>
>> ++ RUN_TESTS (long double, strtold, nanl, LDBL_MANT_DIG);<br>
>> ++#endif<br>
>> ++ return result;<br>
>> ++}<br>
>> ++<br>
>> ++#define TEST_FUNCTION do_test ()<br>
>> ++#include "../test-skeleton.c"<br>
>> +Index: git/stdlib/Versions<br>
>> +===================================================================<br>
>> +--- git.orig/stdlib/Versions<br>
>> ++++ git/stdlib/Versions<br>
>> +@@ -118,5 +118,6 @@ libc {<br>
>> + # Used from other libraries<br>
>> + __libc_secure_getenv;<br>
>> + __call_tls_dtors;<br>
>> ++ __strtof_nan; __strtod_nan; __strtold_nan;<br>
>> + }<br>
>> + }<br>
>> +Index: git/math/Makefile<br>
>> +===================================================================<br>
>> +--- git.orig/math/Makefile<br>
>> ++++ git/math/Makefile<br>
>> +@@ -92,7 +92,9 @@ tests = test-matherr test-fenv atest-exp<br>
>> + test-misc test-fpucw test-fpucw-ieee tst-definitions test-tgmath \<br>
>> + test-tgmath-ret bug-nextafter bug-nexttoward bug-tgmath1 \<br>
>> + test-tgmath-int test-tgmath2 test-powl tst-CMPLX tst-CMPLX2 test-snan \<br>
>> +- test-fenv-tls test-fenv-preserve test-fenv-return $(tests-static)<br>
>> ++ test-fenv-tls test-fenv-preserve test-fenv-return \<br>
>> ++ test-nan-overflow test-nan-payload \<br>
>> ++ $(tests-static)<br>
>> + tests-static = test-fpucw-static test-fpucw-ieee-static<br>
>> + # We do the `long double' tests only if this data type is available and<br>
>> + # distinct from `double'.<br>
>> diff --git a/meta/recipes-core/glibc/<a href="http://glibc_2.20.bb" rel="noreferrer" target="_blank">glibc_2.20.bb</a> b/meta/recipes-core/glibc/<a href="http://glibc_2.20.bb" rel="noreferrer" target="_blank">glibc_2.20.bb</a><br>
>> index af568d9..d099d5d 100644<br>
>> --- a/meta/recipes-core/glibc/<a href="http://glibc_2.20.bb" rel="noreferrer" target="_blank">glibc_2.20.bb</a><br>
>> +++ b/meta/recipes-core/glibc/<a href="http://glibc_2.20.bb" rel="noreferrer" target="_blank">glibc_2.20.bb</a><br>
>> @@ -50,6 +50,8 @@ CVEPATCHES = "\<br>
>> file://CVE-2015-7547.patch \<br>
>> file://CVE-2015-8777.patch \<br>
>> file://CVE-2015-8779.patch \<br>
>> + file://CVE-2015-9761_1.patch \<br>
>> + file://CVE-2015-9761_2.patch \<br>
>> "<br>
>><br>
>> LIC_FILES_CHKSUM = "file://LICENSES;md5=e9a558e243b36d3209f380deb394b213 \<br>
>> --<br>
>> 2.3.5<br>
>><br>
>> --<br>
>> _______________________________________________<br>
>> Openembedded-core mailing list<br>
>> <a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a><br>
>> <a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
><br>
</div></div></blockquote></div><br></div>