Resolves: #1133812

- Remove gconv transliteration loadable modules support (CVE-2014-5119,
  #1133812).
- _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,
  #1133812).

glibc-fedora-pt_chown.patch

@@ -1,57 +0,0 @@
-From ee3d4021aaaeacff7cf2addcdaa48859fffba2aa Mon Sep 17 00:00:00 2001
-From: Andreas Schwab <schwab@redhat.com>
-Date: Thu, 3 Feb 2011 15:45:02 +0100
-Subject: [PATCH] Replace setuid by file capabilities
-
-* login/programs/pt_chown.c (main): Check for valid file
-descriptor instead of privileges.  Be careful to drop all
-capabilities when not needed.
-
----
- ChangeLog                 |    6 ++++++
- login/programs/pt_chown.c |   14 +++++++++-----
- 3 files changed, 16 insertions(+), 6 deletions(-)
-
---- a/login/programs/pt_chown.c
-+++ b/login/programs/pt_chown.c
-@@ -28,6 +28,7 @@
- #include <string.h>
- #include <sys/stat.h>
- #include <unistd.h>
-+#include <fcntl.h>
- #ifdef HAVE_LIBCAP
- # include <sys/capability.h>
- # include <sys/prctl.h>
-@@ -142,7 +143,7 @@ main (int argc, char *argv[])
-   uid_t uid = getuid ();
-   int remaining;
- 
--  if (argc == 1 && euid == 0)
-+  if (argc == 1 && fcntl (PTY_FILENO, F_GETFD) == 0)
-     {
- #ifdef HAVE_LIBCAP
-   /* Drop privileges.  */
-@@ -175,6 +176,13 @@ main (int argc, char *argv[])
- 
-   /* We aren't going to be using privileges, so drop them right now. */
-   setuid (uid);
-+#ifdef HAVE_LIBCAP
-+  cap_t caps = cap_init ();
-+  if (caps == NULL)
-+    error (1, errno, "cap_init");
-+  cap_set_proc (caps);
-+  cap_free (caps);
-+#endif
- 
-   /* Set locale via LC_ALL.  */
-   setlocale (LC_ALL, "");
-@@ -194,9 +202,5 @@ main (int argc, char *argv[])
-       return EXIT_FAILURE;
-     }
- 
--  /* Check if we are properly installed.  */
--  if (euid != 0)
--    error (FAIL_EXEC, 0, gettext ("needs to be installed setuid `root'"));
--
-   return EXIT_SUCCESS;
- }

glibc-rh1008299.patch

@@ -0,0 +1,46 @@
+diff --git a/malloc/malloc.c b/malloc/malloc.c
+index 3148c5f..f7718a9 100644
+--- a/malloc/malloc.c
++++ b/malloc/malloc.c
+@@ -3015,6 +3015,13 @@ __libc_memalign(size_t alignment, size_t bytes)
+   /* Otherwise, ensure that it is at least a minimum chunk size */
+   if (alignment <  MINSIZE) alignment = MINSIZE;
+ 
++  /* Check for overflow.  */
++  if (bytes > SIZE_MAX - alignment - MINSIZE)
++    {
++      __set_errno (ENOMEM);
++      return 0;
++    }
++
+   arena_get(ar_ptr, bytes + alignment + MINSIZE);
+   if(!ar_ptr)
+     return 0;
+@@ -3046,6 +3046,13 @@ __libc_valloc(size_t bytes)
+ 
+   size_t pagesz = GLRO(dl_pagesize);
+ 
++  /* Check for overflow.  */
++  if (bytes > SIZE_MAX - pagesz - MINSIZE)
++    {
++      __set_errno (ENOMEM);
++      return 0;
++    }
++
+   __malloc_ptr_t (*hook) __MALLOC_PMT ((size_t, size_t,
+ 					const __malloc_ptr_t)) =
+     force_reg (__memalign_hook);
+@@ -3082,6 +3082,13 @@ __libc_pvalloc(size_t bytes)
+   size_t page_mask = GLRO(dl_pagesize) - 1;
+   size_t rounded_bytes = (bytes + page_mask) & ~(page_mask);
+ 
++  /* Check for overflow.  */
++  if (bytes > SIZE_MAX - 2*pagesz - MINSIZE)
++    {
++      __set_errno (ENOMEM);
++      return 0;
++    }
++
+   __malloc_ptr_t (*hook) __MALLOC_PMT ((size_t, size_t,
+ 					const __malloc_ptr_t)) =
+     force_reg (__memalign_hook);

glibc-rh1133812-1.patch

@@ -0,0 +1,199 @@
+2014-08-21  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #17187]
+	* iconv/gconv_trans.c (struct known_trans, search_tree, lock,
+	trans_compare, open_translit, __gconv_translit_find):
+	Remove module loading code.
+
+diff --git a/iconv/gconv_trans.c b/iconv/gconv_trans.c
+index 1e25854..d71c029 100644
+--- a/iconv/gconv_trans.c
++++ b/iconv/gconv_trans.c
+@@ -238,181 +238,11 @@ __gconv_transliterate (struct __gconv_step *step,
+   return __GCONV_ILLEGAL_INPUT;
+ }
+ 
+-
+-/* Structure to represent results of found (or not) transliteration
+-   modules.  */
+-struct known_trans
+-{
+-  /* This structure must remain the first member.  */
+-  struct trans_struct info;
+-
+-  char *fname;
+-  void *handle;
+-  int open_count;
+-};
+-
+-
+-/* Tree with results of previous calls to __gconv_translit_find.  */
+-static void *search_tree;
+-
+-/* We modify global data.   */
+-__libc_lock_define_initialized (static, lock);
+-
+-
+-/* Compare two transliteration entries.  */
+-static int
+-trans_compare (const void *p1, const void *p2)
+-{
+-  const struct known_trans *s1 = (const struct known_trans *) p1;
+-  const struct known_trans *s2 = (const struct known_trans *) p2;
+-
+-  return strcmp (s1->info.name, s2->info.name);
+-}
+-
+-
+-/* Open (maybe reopen) the module named in the struct.  Get the function
+-   and data structure pointers we need.  */
+-static int
+-open_translit (struct known_trans *trans)
+-{
+-  __gconv_trans_query_fct queryfct;
+-
+-  trans->handle = __libc_dlopen (trans->fname);
+-  if (trans->handle == NULL)
+-    /* Not available.  */
+-    return 1;
+-
+-  /* Find the required symbol.  */
+-  queryfct = __libc_dlsym (trans->handle, "gconv_trans_context");
+-  if (queryfct == NULL)
+-    {
+-      /* We cannot live with that.  */
+-    close_and_out:
+-      __libc_dlclose (trans->handle);
+-      trans->handle = NULL;
+-      return 1;
+-    }
+-
+-  /* Get the context.  */
+-  if (queryfct (trans->info.name, &trans->info.csnames, &trans->info.ncsnames)
+-      != 0)
+-    goto close_and_out;
+-
+-  /* Of course we also have to have the actual function.  */
+-  trans->info.trans_fct = __libc_dlsym (trans->handle, "gconv_trans");
+-  if (trans->info.trans_fct == NULL)
+-    goto close_and_out;
+-
+-  /* Now the optional functions.  */
+-  trans->info.trans_init_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_init");
+-  trans->info.trans_context_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_context");
+-  trans->info.trans_end_fct =
+-    __libc_dlsym (trans->handle, "gconv_trans_end");
+-
+-  trans->open_count = 1;
+-
+-  return 0;
+-}
+-
+-
+ int
+ internal_function
+ __gconv_translit_find (struct trans_struct *trans)
+ {
+-  struct known_trans **found;
+-  const struct path_elem *runp;
+-  int res = 1;
+-
+-  /* We have to have a name.  */
+-  assert (trans->name != NULL);
+-
+-  /* Acquire the lock.  */
+-  __libc_lock_lock (lock);
+-
+-  /* See whether we know this module already.  */
+-  found = __tfind (trans, &search_tree, trans_compare);
+-  if (found != NULL)
+-    {
+-      /* Is this module available?  */
+-      if ((*found)->handle != NULL)
+-	{
+-	  /* Maybe we have to reopen the file.  */
+-	  if ((*found)->handle != (void *) -1)
+-	    /* The object is not unloaded.  */
+-	    res = 0;
+-	  else if (open_translit (*found) == 0)
+-	    {
+-	      /* Copy the data.  */
+-	      *trans = (*found)->info;
+-	      (*found)->open_count++;
+-	      res = 0;
+-	    }
+-	}
+-    }
+-  else
+-    {
+-      size_t name_len = strlen (trans->name) + 1;
+-      int need_so = 0;
+-      struct known_trans *newp;
+-
+-      /* We have to continue looking for the module.  */
+-      if (__gconv_path_elem == NULL)
+-	__gconv_get_path ();
+-
+-      /* See whether we have to append .so.  */
+-      if (name_len <= 4 || memcmp (&trans->name[name_len - 4], ".so", 3) != 0)
+-	need_so = 1;
+-
+-      /* Create a new entry.  */
+-      newp = (struct known_trans *) malloc (sizeof (struct known_trans)
+-					    + (__gconv_max_path_elem_len
+-					       + name_len + 3)
+-					    + name_len);
+-      if (newp != NULL)
+-	{
+-	  char *cp;
+-
+-	  /* Clear the struct.  */
+-	  memset (newp, '\0', sizeof (struct known_trans));
+-
+-	  /* Store a copy of the module name.  */
+-	  newp->info.name = cp = (char *) (newp + 1);
+-	  cp = __mempcpy (cp, trans->name, name_len);
+-
+-	  newp->fname = cp;
+-
+-	  /* Search in all the directories.  */
+-	  for (runp = __gconv_path_elem; runp->name != NULL; ++runp)
+-	    {
+-	      cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name),
+-			      trans->name, name_len);
+-	      if (need_so)
+-		memcpy (cp, ".so", sizeof (".so"));
+-
+-	      if (open_translit (newp) == 0)
+-		{
+-		  /* We found a module.  */
+-		  res = 0;
+-		  break;
+-		}
+-	    }
+-
+-	  if (res)
+-	    newp->fname = NULL;
+-
+-	  /* In any case we'll add the entry to our search tree.  */
+-	  if (__tsearch (newp, &search_tree, trans_compare) == NULL)
+-	    {
+-	      /* Yickes, this should not happen.  Unload the object.  */
+-	      res = 1;
+-	      /* XXX unload here.  */
+-	    }
+-	}
+-    }
+-
+-  __libc_lock_unlock (lock);
+-
+-  return res;
++  /* This function always fails.  Transliteration module loading is
++     not implemented.  */
++  return 1;
+ }
+-- 
+1.9.3
+

glibc-rh1133812-2.patch

@@ -0,0 +1,631 @@
+commit 585367266923156ac6fb789939a923641ba5aaf4
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed May 28 14:05:03 2014 +0200
+
+    manual: Update the locale documentation
+
+commit 4e8f95a0df7c2300b830ec12c0ae1e161bc8a8a3
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Mon May 12 15:24:12 2014 +0200
+
+    _nl_find_locale: Improve handling of crafted locale names [BZ #17137]
+    
+    Prevent directory traversal in locale-related environment variables
+    (CVE-2014-0475).
+
+commit d183645616b0533b3acee28f1a95570bffbdf50f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed May 28 14:41:52 2014 +0200
+
+    setlocale: Use the heap for the copy of the locale argument
+    
+    This avoids alloca calls with potentially large arguments.
+
+diff -pruN glibc-2.18/locale/findlocale.c glibc-2.18.patched/locale/findlocale.c
+--- glibc-2.18/locale/findlocale.c	2013-08-11 04:22:55.000000000 +0530
++++ glibc-2.18.patched/locale/findlocale.c	2014-08-26 16:14:50.403253778 +0530
+@@ -17,6 +17,7 @@
+    <http://www.gnu.org/licenses/>.  */
+ 
+ #include <assert.h>
++#include <errno.h>
+ #include <locale.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -57,6 +58,45 @@ struct loaded_l10nfile *_nl_locale_file_
+ 
+ const char _nl_default_locale_path[] attribute_hidden = LOCALEDIR;
+ 
++/* Checks if the name is actually present, that is, not NULL and not
++   empty.  */
++static inline int
++name_present (const char *name)
++{
++  return name != NULL && name[0] != '\0';
++}
++
++/* Checks that the locale name neither extremely long, nor contains a
++   ".." path component (to prevent directory traversal).  */
++static inline int
++valid_locale_name (const char *name)
++{
++  /* Not set.  */
++  size_t namelen = strlen (name);
++  /* Name too long.  The limit is arbitrary and prevents stack overflow
++     issues later.  */
++  if (__glibc_unlikely (namelen > 255))
++    return 0;
++  /* Directory traversal attempt.  */
++  static const char slashdot[4] = {'/', '.', '.', '/'};
++  if (__glibc_unlikely (memmem (name, namelen,
++				slashdot, sizeof (slashdot)) != NULL))
++    return 0;
++  if (namelen == 2 && __glibc_unlikely (name[0] == '.' && name [1] == '.'))
++    return 0;
++  if (namelen >= 3
++      && __glibc_unlikely (((name[0] == '.'
++			     && name[1] == '.'
++			     && name[2] == '/')
++			    || (name[namelen - 3] == '/'
++				&& name[namelen - 2] == '.'
++				&& name[namelen - 1] == '.'))))
++    return 0;
++  /* If there is a slash in the name, it must start with one.  */
++  if (__glibc_unlikely (memchr (name, '/', namelen) != NULL) && name[0] != '/')
++    return 0;
++  return 1;
++}
+ 
+ struct __locale_data *
+ internal_function
+@@ -65,7 +105,7 @@ _nl_find_locale (const char *locale_path
+ {
+   int mask;
+   /* Name of the locale for this category.  */
+-  char *loc_name;
++  char *loc_name = (char *) *name;
+   const char *language;
+   const char *modifier;
+   const char *territory;
+@@ -73,31 +113,39 @@ _nl_find_locale (const char *locale_path
+   const char *normalized_codeset;
+   struct loaded_l10nfile *locale_file;
+ 
+-  if ((*name)[0] == '\0')
++  if (loc_name[0] == '\0')
+     {
+       /* The user decides which locale to use by setting environment
+ 	 variables.  */
+-      *name = getenv ("LC_ALL");
+-      if (*name == NULL || (*name)[0] == '\0')
+-	*name = getenv (_nl_category_names.str
++      loc_name = getenv ("LC_ALL");
++      if (!name_present (loc_name))
++	loc_name = getenv (_nl_category_names.str
+ 			+ _nl_category_name_idxs[category]);
+-      if (*name == NULL || (*name)[0] == '\0')
+-	*name = getenv ("LANG");
++      if (!name_present (loc_name))
++	loc_name = getenv ("LANG");
++      if (!name_present (loc_name))
++	loc_name = (char *) _nl_C_name;
+     }
+ 
+-  if (*name == NULL || (*name)[0] == '\0'
+-      || (__builtin_expect (__libc_enable_secure, 0)
+-	  && strchr (*name, '/') != NULL))
+-    *name = (char *) _nl_C_name;
++  /* We used to fall back to the C locale if the name contains a slash
++     character '/', but we now check for directory traversal in
++     valid_locale_name, so this is no longer necessary.  */
+ 
+-  if (__builtin_expect (strcmp (*name, _nl_C_name), 1) == 0
+-      || __builtin_expect (strcmp (*name, _nl_POSIX_name), 1) == 0)
++  if (__builtin_expect (strcmp (loc_name, _nl_C_name), 1) == 0
++      || __builtin_expect (strcmp (loc_name, _nl_POSIX_name), 1) == 0)
+     {
+       /* We need not load anything.  The needed data is contained in
+ 	 the library itself.  */
+       *name = (char *) _nl_C_name;
+       return _nl_C[category];
+     }
++  else if (!valid_locale_name (loc_name))
++    {
++      __set_errno (EINVAL);
++      return NULL;
++    }
++
++  *name = loc_name;
+ 
+   /* We really have to load some data.  First we try the archive,
+      but only if there was no LOCPATH environment variable specified.  */
+diff -pruN glibc-2.18/locale/setlocale.c glibc-2.18.patched/locale/setlocale.c
+--- glibc-2.18/locale/setlocale.c	2013-08-11 04:22:55.000000000 +0530
++++ glibc-2.18.patched/locale/setlocale.c	2014-08-26 16:14:50.401253764 +0530
+@@ -272,6 +272,8 @@ setlocale (int category, const char *loc
+ 	 of entries of the form `CATEGORY=VALUE'.  */
+       const char *newnames[__LC_LAST];
+       struct __locale_data *newdata[__LC_LAST];
++      /* Copy of the locale argument, for in-place splitting.  */
++      char *locale_copy = NULL;
+ 
+       /* Set all name pointers to the argument name.  */
+       for (category = 0; category < __LC_LAST; ++category)
+@@ -281,7 +283,13 @@ setlocale (int category, const char *loc
+       if (__builtin_expect (strchr (locale, ';') != NULL, 0))
+ 	{
+ 	  /* This is a composite name.  Make a copy and split it up.  */
+-	  char *np = strdupa (locale);
++	  locale_copy = strdup (locale);
++	  if (__glibc_unlikely (locale_copy == NULL))
++	    {
++	      __libc_rwlock_unlock (__libc_setlocale_lock);
++	      return NULL;
++	    }
++	  char *np = locale_copy;
+ 	  char *cp;
+ 	  int cnt;
+ 
+@@ -299,6 +307,7 @@ setlocale (int category, const char *loc
+ 		{
+ 		error_return:
+ 		  __libc_rwlock_unlock (__libc_setlocale_lock);
++		  free (locale_copy);
+ 
+ 		  /* Bogus category name.  */
+ 		  ERROR_RETURN;
+@@ -391,8 +400,9 @@ setlocale (int category, const char *loc
+       /* Critical section left.  */
+       __libc_rwlock_unlock (__libc_setlocale_lock);
+ 
+-      /* Free the resources (the locale path variable).  */
++      /* Free the resources.  */
+       free (locale_path);
++      free (locale_copy);
+ 
+       return composite;
+     }
+diff -pruN glibc-2.18/localedata/Makefile glibc-2.18.patched/localedata/Makefile
+--- glibc-2.18/localedata/Makefile	2014-08-26 16:15:22.656474571 +0530
++++ glibc-2.18.patched/localedata/Makefile	2014-08-26 16:14:50.403253778 +0530
+@@ -77,7 +77,7 @@ locale_test_suite := tst_iswalnum tst_is
+ 
+ tests = $(locale_test_suite) tst-digits tst-setlocale bug-iconv-trans \
+ 	tst-leaks tst-mbswcs6 tst-xlocale1 tst-xlocale2 bug-usesetlocale \
+-	tst-strfmon1 tst-sscanf bug-setlocale1 tst-setlocale2
++	tst-strfmon1 tst-sscanf bug-setlocale1 tst-setlocale2 tst-setlocale3
+ ifeq (yes,$(build-shared))
+ ifneq (no,$(PERL))
+ tests: $(objpfx)mtrace-tst-leaks
+diff -pruN glibc-2.18/localedata/tst-setlocale3.c glibc-2.18.patched/localedata/tst-setlocale3.c
+--- glibc-2.18/localedata/tst-setlocale3.c	1970-01-01 05:30:00.000000000 +0530
++++ glibc-2.18.patched/localedata/tst-setlocale3.c	2014-08-26 16:14:50.403253778 +0530
+@@ -0,0 +1,203 @@
++/* Regression test for setlocale invalid environment variable handling.
++   Copyright (C) 2014 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <locale.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++/* The result of setlocale may be overwritten by subsequent calls, so
++   this wrapper makes a copy.  */
++static char *
++setlocale_copy (int category, const char *locale)
++{
++  const char *result = setlocale (category, locale);
++  if (result == NULL)
++    return NULL;
++  return strdup (result);
++}
++
++static char *de_locale;
++
++static void
++setlocale_fail (const char *envstring)
++{
++  setenv ("LC_CTYPE", envstring, 1);
++  if (setlocale (LC_CTYPE, "") != NULL)
++    {
++      printf ("unexpected setlocale success for \"%s\" locale\n", envstring);
++      exit (1);
++    }
++  const char *newloc = setlocale (LC_CTYPE, NULL);
++  if (strcmp (newloc, de_locale) != 0)
++    {
++      printf ("failed setlocale call \"%s\" changed locale to \"%s\"\n",
++	      envstring, newloc);
++      exit (1);
++    }
++}
++
++static void
++setlocale_success (const char *envstring)
++{
++  setenv ("LC_CTYPE", envstring, 1);
++  char *newloc = setlocale_copy (LC_CTYPE, "");
++  if (newloc == NULL)
++    {
++      printf ("setlocale for \"%s\": %m\n", envstring);
++      exit (1);
++    }
++  if (strcmp (newloc, de_locale) == 0)
++    {
++      printf ("setlocale with LC_CTYPE=\"%s\" left locale at \"%s\"\n",
++	      envstring, de_locale);
++      exit (1);
++    }
++  if (setlocale (LC_CTYPE, de_locale) == NULL)
++    {
++      printf ("restoring locale \"%s\" with LC_CTYPE=\"%s\": %m\n",
++	      de_locale, envstring);
++      exit (1);
++    }
++  char *newloc2 = setlocale_copy (LC_CTYPE, newloc);
++  if (newloc2 == NULL)
++    {
++      printf ("restoring locale \"%s\" following \"%s\": %m\n",
++	      newloc, envstring);
++      exit (1);
++    }
++  if (strcmp (newloc, newloc2) != 0)
++    {
++      printf ("representation of locale \"%s\" changed from \"%s\" to \"%s\"",
++	      envstring, newloc, newloc2);
++      exit (1);
++    }
++  free (newloc);
++  free (newloc2);
++
++  if (setlocale (LC_CTYPE, de_locale) == NULL)
++    {
++      printf ("restoring locale \"%s\" with LC_CTYPE=\"%s\": %m\n",
++	      de_locale, envstring);
++      exit (1);
++    }
++}
++
++/* Checks that a known-good locale still works if LC_ALL contains a
++   value which should be ignored.  */
++static void
++setlocale_ignore (const char *to_ignore)
++{
++  const char *fr_locale = "fr_FR.UTF-8";
++  setenv ("LC_CTYPE", fr_locale, 1);
++  char *expected_locale = setlocale_copy (LC_CTYPE, "");
++  if (expected_locale == NULL)
++    {
++      printf ("setlocale with LC_CTYPE=\"%s\" failed: %m\n", fr_locale);
++      exit (1);
++    }
++  if (setlocale (LC_CTYPE, de_locale) == NULL)
++    {
++      printf ("failed to restore locale: %m\n");
++      exit (1);
++    }
++  unsetenv ("LC_CTYPE");
++
++  setenv ("LC_ALL", to_ignore, 1);
++  setenv ("LC_CTYPE", fr_locale, 1);
++  const char *actual_locale = setlocale (LC_CTYPE, "");
++  if (actual_locale == NULL)
++    {
++      printf ("setlocale with LC_ALL, LC_CTYPE=\"%s\" failed: %m\n",
++	      fr_locale);
++      exit (1);
++    }
++  if (strcmp (actual_locale, expected_locale) != 0)
++    {
++      printf ("setlocale under LC_ALL failed: got \"%s\", expected \"%s\"\n",
++	      actual_locale, expected_locale);
++      exit (1);
++    }
++  unsetenv ("LC_CTYPE");
++  setlocale_success (fr_locale);
++  unsetenv ("LC_ALL");
++  free (expected_locale);
++}
++
++static int
++do_test (void)
++{
++  /* The glibc test harness sets this environment variable
++     uncondionally.  */
++  unsetenv ("LC_ALL");
++
++  de_locale = setlocale_copy (LC_CTYPE, "de_DE.UTF-8");
++  if (de_locale == NULL)
++    {
++      printf ("setlocale (LC_CTYPE, \"de_DE.UTF-8\"): %m\n");
++      return 1;
++    }
++  setlocale_success ("C");
++  setlocale_success ("en_US.UTF-8");
++  setlocale_success ("/en_US.UTF-8");
++  setlocale_success ("//en_US.UTF-8");
++  setlocale_ignore ("");
++
++  setlocale_fail ("does-not-exist");
++  setlocale_fail ("/");
++  setlocale_fail ("/../localedata/en_US.UTF-8");
++  setlocale_fail ("en_US.UTF-8/");
++  setlocale_fail ("en_US.UTF-8/..");
++  setlocale_fail ("en_US.UTF-8/../en_US.UTF-8");
++  setlocale_fail ("../localedata/en_US.UTF-8");
++  {
++    size_t large_length = 1024;
++    char *large_name = malloc (large_length + 1);
++    if (large_name == NULL)
++      {
++	puts ("malloc failure");
++	return 1;
++      }
++    memset (large_name, '/', large_length);
++    const char *suffix = "en_US.UTF-8";
++    strcpy (large_name + large_length - strlen (suffix), suffix);
++    setlocale_fail (large_name);
++    free (large_name);
++  }
++  {
++    size_t huge_length = 64 * 1024 * 1024;
++    char *huge_name = malloc (huge_length + 1);
++    if (huge_name == NULL)
++      {
++	puts ("malloc failure");
++	return 1;
++      }
++    memset (huge_name, 'X', huge_length);
++    huge_name[huge_length] = '\0';
++    /* Construct a composite locale specification. */
++    const char *prefix = "LC_CTYPE=de_DE.UTF-8;LC_TIME=";
++    memcpy (huge_name, prefix, strlen (prefix));
++    setlocale_fail (huge_name);
++    free (huge_name);
++  }
++
++  return 0;
++}
++
++#define TEST_FUNCTION do_test ()
++#include "../test-skeleton.c"
+diff -pruN glibc-2.18/manual/locale.texi glibc-2.18.patched/manual/locale.texi
+--- glibc-2.18/manual/locale.texi	2013-08-11 04:22:55.000000000 +0530
++++ glibc-2.18.patched/manual/locale.texi	2014-08-26 16:14:50.404253785 +0530
+@@ -29,6 +29,7 @@ will follow the conventions preferred by
+ * Setting the Locale::          How a program specifies the locale
+                                  with library functions.
+ * Standard Locales::            Locale names available on all systems.
++* Locale Names::                Format of system-specific locale names.
+ * Locale Information::          How to access the information for the locale.
+ * Formatting Numbers::          A dedicated function to format numbers.
+ * Yes-or-No Questions::         Check a Response against the locale.
+@@ -99,14 +100,16 @@ locale named @samp{espana-castellano} to
+ most of Spain.
+ 
+ The set of locales supported depends on the operating system you are
+-using, and so do their names.  We can't make any promises about what
+-locales will exist, except for one standard locale called @samp{C} or
+-@samp{POSIX}.  Later we will describe how to construct locales.
+-@comment (@pxref{Building Locale Files}).
++using, and so do their names, except that the standard locale called
++@samp{C} or @samp{POSIX} always exist.  @xref{Locale Names}.
++
++In order to force the system to always use the default locale, the
++user can set the @code{LC_ALL} environment variable to @samp{C}.
+ 
+ @cindex combining locales
+-A user also has the option of specifying different locales for different
+-purposes---in effect, choosing a mixture of multiple locales.
++A user also has the option of specifying different locales for
++different purposes---in effect, choosing a mixture of multiple
++locales.  @xref{Locale Categories}.
+ 
+ For example, the user might specify the locale @samp{espana-castellano}
+ for most purposes, but specify the locale @samp{usa-english} for
+@@ -120,7 +123,7 @@ which locales apply.  However, the user
+ for a particular subset of those purposes.
+ 
+ @node Locale Categories, Setting the Locale, Choosing Locale, Locales
+-@section Categories of Activities that Locales Affect
++@section Locale Categories
+ @cindex categories for locales
+ @cindex locale categories
+ 
+@@ -128,7 +131,11 @@ The purposes that locales serve are grou
+ that a user or a program can choose the locale for each category
+ independently.  Here is a table of categories; each name is both an
+ environment variable that a user can set, and a macro name that you can
+-use as an argument to @code{setlocale}.
++use as the first argument to @code{setlocale}.
++
++The contents of the environment variable (or the string in the second
++argument to @code{setlocale}) has to be a valid locale name.
++@xref{Locale Names}.
+ 
+ @vtable @code
+ @comment locale.h
+@@ -172,7 +179,7 @@ for affirmative and negative responses.
+ @comment locale.h
+ @comment ISO
+ @item LC_ALL
+-This is not an environment variable; it is only a macro that you can use
++This is not a category; it is only a macro that you can use
+ with @code{setlocale} to set a single locale for all purposes.  Setting
+ this environment variable overwrites all selections by the other
+ @code{LC_*} variables or @code{LANG}.
+@@ -225,13 +232,7 @@ The symbols in this section are defined
+ @comment ISO
+ @deftypefun {char *} setlocale (int @var{category}, const char *@var{locale})
+ The function @code{setlocale} sets the current locale for category
+-@var{category} to @var{locale}.  A list of all the locales the system
+-provides can be created by running
+-
+-@pindex locale
+-@smallexample
+-  locale -a
+-@end smallexample
++@var{category} to @var{locale}.
+ 
+ If @var{category} is @code{LC_ALL}, this specifies the locale for all
+ purposes.  The other possible values of @var{category} specify an
+@@ -256,10 +257,9 @@ is passed in as @var{locale} parameter.
+ 
+ When you read the current locale for category @code{LC_ALL}, the value
+ encodes the entire combination of selected locales for all categories.
+-In this case, the value is not just a single locale name.  In fact, we
+-don't make any promises about what it looks like.  But if you specify
+-the same ``locale name'' with @code{LC_ALL} in a subsequent call to
+-@code{setlocale}, it restores the same combination of locale selections.
++If you specify the same ``locale name'' with @code{LC_ALL} in a
++subsequent call to @code{setlocale}, it restores the same combination
++of locale selections.
+ 
+ To be sure you can use the returned string encoding the currently selected
+ locale at a later time, you must make a copy of the string.  It is not
+@@ -275,20 +275,15 @@ for @var{category}.
+ If a nonempty string is given for @var{locale}, then the locale of that
+ name is used if possible.
+ 
++The effective locale name (either the second argument to
++@code{setlocale}, or if the argument is an empty string, the name
++obtained from the process environment) must be valid locale name.
++@xref{Locale Names}.
++
+ If you specify an invalid locale name, @code{setlocale} returns a null
+ pointer and leaves the current locale unchanged.
+ @end deftypefun
+ 
+-The path used for finding locale data can be set using the
+-@code{LOCPATH} environment variable. The default path for finding
+-locale data is system specific.  It is computed from the value given
+-as the prefix while configuring the C library.  This value normally is
+-@file{/usr} or @file{/}.  For the former the complete path is:
+-
+-@smallexample
+-/usr/lib/locale
+-@end smallexample
+-
+ Here is an example showing how you might use @code{setlocale} to
+ temporarily switch to a new locale.
+ 
+@@ -328,7 +323,7 @@ locale categories, and future versions o
+ portability, assume that any symbol beginning with @samp{LC_} might be
+ defined in @file{locale.h}.
+ 
+-@node Standard Locales, Locale Information, Setting the Locale, Locales
++@node Standard Locales, Locale Names, Setting the Locale, Locales
+ @section Standard Locales
+ 
+ The only locale names you can count on finding on all operating systems
+@@ -362,7 +357,94 @@ with the environment, rather than trying
+ locale explicitly by name.  Remember, different machines might have
+ different sets of locales installed.
+ 
+-@node Locale Information, Formatting Numbers, Standard Locales, Locales
++@node Locale Names, Locale Information, Standard Locales, Locales
++@section Locale Names
++
++The following command prints a list of locales supported by the
++system:
++
++@pindex locale
++@smallexample
++  locale -a
++@end smallexample
++
++@strong{Portability Note:} With the notable exception of the standard
++locale names @samp{C} and @samp{POSIX}, locale names are
++system-specific.
++
++Most locale names follow XPG syntax and consist of up to four parts:
++
++@smallexample
++@var{language}[_@var{territory}[.@var{codeset}]][@@@var{modifier}]
++@end smallexample
++
++Beside the first part, all of them are allowed to be missing.  If the
++full specified locale is not found, less specific ones are looked for.
++The various parts will be stripped off, in the following order:
++
++@enumerate
++@item
++codeset
++@item
++normalized codeset
++@item
++territory
++@item
++modifier
++@end enumerate
++
++For example, the locale name @samp{de_AT.iso885915@@euro} denotes a
++German-language locale for use in Austria, using the ISO-8859-15
++(Latin-9) character set, and with the Euro as the currency symbol.
++
++In addition to locale names which follow XPG syntax, systems may
++provide aliases such as @samp{german}.  Both categories of names must
++not contain the slash character @samp{/}.
++
++If the locale name starts with a slash @samp{/}, it is treated as a
++path relative to the configured locale directories; see @code{LOCPATH}
++below.  The specified path must not contain a component @samp{..}, or
++the name is invalid, and @code{setlocale} will fail.
++
++@strong{Portability Note:} POSIX suggests that if a locale name starts
++with a slash @samp{/}, it is resolved as an absolute path.  However,
++@theglibc{} treats it as a relative path under the directories listed
++in @code{LOCPATH} (or the default locale directory if @code{LOCPATH}
++is unset).
++
++Locale names which are longer than an implementation-defined limit are
++invalid and cause @code{setlocale} to fail.
++
++As a special case, locale names used with @code{LC_ALL} can combine
++several locales, reflecting different locale settings for different
++categories.  For example, you might want to use a U.S. locale with ISO
++A4 paper format, so you set @code{LANG} to @samp{en_US.UTF-8}, and
++@code{LC_PAPER} to @samp{de_DE.UTF-8}.  In this case, the
++@code{LC_ALL}-style combined locale name is
++
++@smallexample
++LC_CTYPE=en_US.UTF-8;LC_TIME=en_US.UTF-8;LC_PAPER=de_DE.UTF-8;@dots{}
++@end smallexample
++
++followed by other category settings not shown here.
++
++@vindex LOCPATH
++The path used for finding locale data can be set using the
++@code{LOCPATH} environment variable.  This variable lists the
++directories in which to search for locale definitions, separated by a
++colon @samp{:}.
++
++The default path for finding locale data is system specific.  A typical
++value for the @code{LOCPATH} default is:
++
++@smallexample
++/usr/share/locale
++@end smallexample
++
++The value of @code{LOCPATH} is ignored by privileged programs for
++security reasons, and only the default directory is used.
++
++@node Locale Information, Formatting Numbers, Locale Names, Locales
+ @section Accessing Locale Information
+ 
+ There are several ways to access locale information.  The simplest

glibc-rh1133812-3.patch

@@ -0,0 +1,474 @@
+commit 2bf1804182cc4bd671193587c8d5e3de45a9618e
+Author: Joseph Myers <joseph@codesourcery.com>
+Date:   Wed Jun 4 23:37:25 2014 +0000
+
+    Include LOCPATH in default test environment.
+    
+    Tests run using the default $(make-test-out) automatically get
+    GCONV_PATH and LC_ALL set, whether or not those environment variables
+    are actually needed for the individual test.  However, they do not get
+    LOCPATH set, meaning that a large number of tests have -ENV settings
+    just to set LOCPATH.
+    
+    This patch moves LOCPATH into the default environment used for all
+    tests, on the principle that like GCONV_PATH any settings needed to
+    use files associated with the newly built library, rather than any old
+    installed files, are appropriate to use by default.
+    
+    A further motivation is that various tests using .sh files also set
+    some combination of LC_ALL, GCONV_PATH and LOCPATH.  Preferably .sh
+    files should also use the default environment with any additions
+    required for the individual test.  Now, it was suggested in
+    <https://sourceware.org/ml/libc-alpha/2014-05/msg00715.html> that
+    various Makefile variables used in testing should be derived by
+    composing the -before-env and -after-env variables used when explicit
+    environment settings are required.  With such a change, it's also
+    natural for those variables to include the default settings (via some
+    intermediate makefile variable also used in make-test-out).
+    
+    Because some .sh files only set variables that correspond to the
+    default settings, or a subset thereof, and this applies to more of the
+    .sh files once LOCPATH is in the default settings, doing so reduces
+    the size of a revised version of
+    <https://sourceware.org/ml/libc-alpha/2014-05/msg00596.html>: scripts
+    only needing the (expanded) default settings will not need to receive
+    the separate -before-env and -after-env variables, only the single
+    variable they do at present.  So moving LOCPATH into the default
+    settings can reduce churn caused by subsequent patches.
+    
+    Tested x86_64 and x86.
+    
+    	* Rules (make-test-out): Include
+    	LOCPATH=$(common-objpfx)localedata in default environment.
+    	* debug/Makefile (tst-chk1-ENV): Remove variable.
+    	(tst-chk2-ENV): Likewise.
+    	(tst-chk3-ENV): Likewise.
+    	(tst-chk4-ENV): Likewise.
+    	(tst-chk5-ENV): Likewise.
+    	(tst-chk6-ENV): Likewise.
+    	(tst-lfschk1-ENV): Likewise.
+    	(tst-lfschk2-ENV): Likewise.
+    	(tst-lfschk3-ENV): Likewise.
+    	(tst-lfschk4-ENV): Likewise.
+    	(tst-lfschk5-ENV): Likewise.
+    	(tst-lfschk6-ENV): Likewise.
+    	* iconvdata/Makefile (bug-iconv6-ENV): Likewise.
+    	(tst-iconv7-ENV): Likewise.
+    	* intl/Makefile (LOCPATH-ENV): Likewise.
+    	(tst-codeset-ENV): Likewise.
+    	(tst-gettext3-ENV): Likewise.
+    	(tst-gettext5-ENV): Likewise.
+    	* libio/Makefile (tst-widetext-ENV): Don't set LOCPATH.
+    	(tst-fopenloc-ENV): Likewise.
+    	(tst-fgetws-ENV): Remove variable.
+    	(tst-ungetwc1-ENV): Likewise.
+    	(tst-ungetwc2-ENV): Likewise.
+    	(bug-ungetwc2-ENV): Likewise.
+    	(tst-swscanf-ENV): Likewise.
+    	(bug-ftell-ENV): Likewise.
+    	(tst-fgetwc-ENV): Likewise.
+    	(tst-fseek-ENV): Likewise.
+    	(tst-ftell-partial-wide-ENV): Likewise.
+    	(tst-ftell-active-handler-ENV): Likewise.
+    	(tst-ftell-append-ENV): Likewise.
+    	* posix/Makefile (tst-fnmatch-ENV): Likewise.
+    	(tst-regexloc-ENV): Likewise.
+    	(bug-regex1-ENV): Likewise.
+    	(tst-regex-ENV): Likewise.
+    	(tst-regex2-ENV): Likewise.
+    	(bug-regex5-ENV): Likewise.
+    	(bug-regex6-ENV): Likewise.
+    	(bug-regex17-ENV): Likewise.
+    	(bug-regex18-ENV): Likewise.
+    	(bug-regex19-ENV): Likewise.
+    	(bug-regex20-ENV): Likewise.
+    	(bug-regex22-ENV): Likewise.
+    	(bug-regex23-ENV): Likewise.
+    	(bug-regex25-ENV): Likewise.
+    	(bug-regex26-ENV): Likewise.
+    	(bug-regex30-ENV): Likewise.
+    	(bug-regex32-ENV): Likewise.
+    	(bug-regex33-ENV): Likewise.
+    	(bug-regex34-ENV): Likewise.
+    	(bug-regex35-ENV): Likewise.
+    	(tst-rxspencer-ENV): Likewise.
+    	(tst-rxspencer-no-utf8-ENV): Likewise.
+    	* stdio-common/Makefile (tst-sprintf-ENV): Likewise.
+    	(tst-sscanf-ENV): Likewise.
+    	(tst-swprintf-ENV): Likewise.
+    	(tst-swscanf-ENV): Likewise.
+    	(test-vfprintf-ENV): Likewise.
+    	(scanf13-ENV): Likewise.
+    	(bug14-ENV): Likewise.
+    	(tst-grouping-ENV): Likewise.
+    	* stdlib/Makefile (tst-strtod-ENV): Likewise.
+    	(tst-strtod3-ENV): Likewise.
+    	(tst-strtod4-ENV): Likewise.
+    	(tst-strtod5-ENV): Likewise.
+    	(testmb2-ENV): Likewise./
+    	* string/Makefile (tst-strxfrm-ENV): Likewise.
+    	(tst-strxfrm2-ENV): Likewise.
+    	(bug-strcoll1-ENV): Likewise.
+    	(test-strcasecmp-ENV): Likewise.
+    	(test-strncasecmp-ENV): Likewise.
+    	* time/Makefile (tst-strptime-ENV): Likewise.
+    	(tst-ftime_l-ENV): Likewise.
+    	* wcsmbs/Makefile (tst-btowc-ENV): Likewise.
+    	(tst-mbrtowc-ENV): Likewise.
+    	(tst-wcrtomb-ENV): Likewise.
+    	(tst-mbrtowc2-ENV): Likewise.
+    	(tst-c16c32-1-ENV): Likewise.
+    	(tst-mbsnrtowcs-ENV): Likewise.
+    
+    localedata/ChangeLog:
+    	* Makefile (TEST_MBWC_ENV): Remove variable.
+    	(tst_iswalnum-ENV): Likewise.
+    	(tst_iswalpha-ENV): Likewise.
+    	(tst_iswcntrl-ENV): Likewise.
+    	(tst_iswctype-ENV): Likewise.
+    	(tst_iswdigit-ENV): Likewise.
+    	(tst_iswgraph-ENV): Likewise.
+    	(tst_iswlower-ENV): Likewise.
+    	(tst_iswprint-ENV): Likewise.
+    	(tst_iswpunct-ENV): Likewise.
+    	(tst_iswspace-ENV): Likewise.
+    	(tst_iswupper-ENV): Likewise.
+    	(tst_iswxdigit-ENV): Likewise.
+    	(tst_mblen-ENV): Likewise.
+    	(tst_mbrlen-ENV): Likewise.
+    	(tst_mbrtowc-ENV): Likewise.
+    	(tst_mbsrtowcs-ENV): Likewise.
+    	(tst_mbstowcs-ENV): Likewise.
+    	(tst_mbtowc-ENV): Likewise.
+    	(tst_strcoll-ENV): Likewise.
+    	(tst_strfmon-ENV): Likewise.
+    	(tst_strxfrm-ENV): Likewise.
+    	(tst_swscanf-ENV): Likewise.
+    	(tst_towctrans-ENV): Likewise.
+    	(tst_towlower-ENV): Likewise.
+    	(tst_towupper-ENV): Likewise.
+    	(tst_wcrtomb-ENV): Likewise.
+    	(tst_wcscat-ENV): Likewise.
+    	(tst_wcschr-ENV): Likewise.
+    	(tst_wcscmp-ENV): Likewise.
+    	(tst_wcscoll-ENV): Likewise.
+    	(tst_wcscpy-ENV): Likewise.
+    	(tst_wcscspn-ENV): Likewise.
+    	(tst_wcslen-ENV): Likewise.
+    	(tst_wcsncat-ENV): Likewise.
+    	(tst_wcsncmp-ENV): Likewise.
+    	(tst_wcsncpy-ENV): Likewise.
+    	(tst_wcspbrk-ENV): Likewise.
+    	(tst_wcsrtombs-ENV): Likewise.
+    	(tst_wcsspn-ENV): Likewise.
+    	(tst_wcsstr-ENV): Likewise.
+    	(tst_wcstod-ENV): Likewise.
+    	(tst_wcstok-ENV): Likewise.
+    	(tst_wcstombs-ENV): Likewise.
+    	(tst_wcswidth-ENV): Likewise.
+    	(tst_wcsxfrm-ENV): Likewise.
+    	(tst_wctob-ENV): Likewise.
+    	(tst_wctomb-ENV): Likewise.
+    	(tst_wctrans-ENV): Likewise.
+    	(tst_wctype-ENV): Likewise.
+    	(tst_wcwidth-ENV): Likewise.
+    	(tst-digits-ENV): Likewise.
+    	(tst-mbswcs6-ENV): Likewise.
+    	(tst-xlocale1-ENV): Likewise.
+    	(tst-xlocale2-ENV): Likewise.
+    	(tst-strfmon1-ENV): Likewise.
+    	(tst-strptime-ENV): Likewise.
+    	(tst-setlocale-ENV): Don't set LOCPATH.
+    	(bug-iconv-trans-ENV): Remove variable.
+    	(tst-sscanf-ENV): Likewise.
+    	(tst-leaks-ENV): Don't set LOCPATH.
+    	(bug-setlocale1-ENV): Remove variable.
+    	(bug-setlocale1-static-ENV): Likewise.
+    	(tst-setlocale2-ENV): Likewise.
+
+diff --git a/Rules b/Rules
+index feb304d..9f1a445 100644
+--- a/Rules
++++ b/Rules
+@@ -191,7 +191,8 @@ ifneq "$(strip $(tests) $(xtests) $(test-srcs))" ""
+ # from the test programs and whatever input files are present.
+ 
+ make-test-out = $(test-wrapper-env) \
+-		GCONV_PATH=$(common-objpfx)iconvdata LC_ALL=C \
++		GCONV_PATH=$(common-objpfx)iconvdata \
++		LOCPATH=$(common-objpfx)localedata LC_ALL=C \
+ 		$($*-ENV) $(host-built-program-cmd) $($*-ARGS)
+ $(objpfx)%-bp.out: %.input $(objpfx)%-bp
+ 	$(make-test-out) > $@ < $(word 1,$^)
+diff --git a/debug/Makefile b/debug/Makefile
+index b599a22..c284c51 100644
+--- a/debug/Makefile
++++ b/debug/Makefile
+@@ -109,18 +109,6 @@ CFLAGS-tst-lfschk3.c = -Wno-format
+ CFLAGS-tst-lfschk4.cc = -Wno-format
+ CFLAGS-tst-lfschk5.cc = -Wno-format
+ CFLAGS-tst-lfschk6.cc = -Wno-format
+-tst-chk1-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-chk2-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-chk3-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-chk4-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-chk5-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-chk6-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk1-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk2-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk3-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk4-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk5-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-lfschk6-ENV = LOCPATH=$(common-objpfx)localedata
+ LDLIBS-tst-chk4 = -lstdc++
+ LDLIBS-tst-chk5 = -lstdc++
+ LDLIBS-tst-chk6 = -lstdc++
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index 074d330..d98b6bd 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -73,9 +73,6 @@ tests += bug-iconv3
+ endif
+ 
+ test-srcs := tst-table-from tst-table-to
+-
+-bug-iconv6-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-iconv7-ENV = LOCPATH=$(common-objpfx)localedata
+ endif
+ 
+ # No code here is in libc.so.
+diff --git a/intl/Makefile b/intl/Makefile
+index f11449d..10051f6 100644
+--- a/intl/Makefile
++++ b/intl/Makefile
+@@ -118,11 +118,6 @@ CFLAGS-tst-gettext4.c = -DOBJPFX=\"$(objpfx)\"
+ CFLAGS-tst-gettext5.c = -DOBJPFX=\"$(objpfx)\"
+ CFLAGS-tst-gettext6.c = -DOBJPFX=\"$(objpfx)\"
+ 
+-LOCPATH-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-codeset-ENV = $(LOCPATH-ENV)
+-tst-gettext3-ENV = $(LOCPATH-ENV)
+-tst-gettext5-ENV = $(LOCPATH-ENV)
+-
+ ifeq ($(have-thread-library),yes)
+ ifeq (yes,$(build-shared))
+ $(addprefix $(objpfx),$(multithread-test-srcs)): $(shared-thread-library)
+diff --git a/libio/Makefile b/libio/Makefile
+index b324ccc..4552360 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -148,17 +148,8 @@ CFLAGS-tst_putwc.c = -DOBJPFX=\"$(objpfx)\"
+ 
+ tst_wprintf2-ARGS = "Some Text"
+ 
+-tst-widetext-ENV = LOCPATH=$(common-objpfx)localedata LANGUAGE=C
+-tst-fopenloc-ENV = LOCPATH=$(common-objpfx)localedata \
+-		   MALLOC_TRACE=$(objpfx)tst-fopenloc.mtrace
+-tst-fgetws-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-ungetwc1-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-ungetwc2-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-ungetwc2-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-swscanf-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-ftell-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-fgetwc-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-fseek-ENV = LOCPATH=$(common-objpfx)localedata
++tst-widetext-ENV = LANGUAGE=C
++tst-fopenloc-ENV = MALLOC_TRACE=$(objpfx)tst-fopenloc.mtrace
+ 
+ generated = tst-fopenloc.mtrace tst-fopenloc.check
+ 
+diff --git a/localedata/Makefile b/localedata/Makefile
+index d7ab445..20da00c 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -215,79 +215,13 @@
+ 		     $(addprefix --prefix=,$(install_root)) $$locale; \
+ 	echo ' done'; \
+ 
+-# The mbwc-tests need some environment setup to find the locale data files
+-TEST_MBWC_ENV:= LOCPATH=$(common-objpfx)localedata
+-tst_iswalnum-ENV = $(TEST_MBWC_ENV)
+-tst_iswalpha-ENV = $(TEST_MBWC_ENV)
+-tst_iswcntrl-ENV = $(TEST_MBWC_ENV)
+-tst_iswctype-ENV = $(TEST_MBWC_ENV)
+-tst_iswdigit-ENV = $(TEST_MBWC_ENV)
+-tst_iswgraph-ENV = $(TEST_MBWC_ENV)
+-tst_iswlower-ENV = $(TEST_MBWC_ENV)
+-tst_iswprint-ENV = $(TEST_MBWC_ENV)
+-tst_iswpunct-ENV = $(TEST_MBWC_ENV)
+-tst_iswspace-ENV = $(TEST_MBWC_ENV)
+-tst_iswupper-ENV = $(TEST_MBWC_ENV)
+-tst_iswxdigit-ENV = $(TEST_MBWC_ENV)
+-tst_mblen-ENV = $(TEST_MBWC_ENV)
+-tst_mbrlen-ENV = $(TEST_MBWC_ENV)
+-tst_mbrtowc-ENV = $(TEST_MBWC_ENV)
+-tst_mbsrtowcs-ENV = $(TEST_MBWC_ENV)
+-tst_mbstowcs-ENV = $(TEST_MBWC_ENV)
+-tst_mbtowc-ENV = $(TEST_MBWC_ENV)
+-tst_strcoll-ENV = $(TEST_MBWC_ENV)
+-tst_strfmon-ENV = $(TEST_MBWC_ENV)
+-tst_strxfrm-ENV = $(TEST_MBWC_ENV)
+-tst_swscanf-ENV = $(TEST_MBWC_ENV)
+-tst_towctrans-ENV = $(TEST_MBWC_ENV)
+-tst_towlower-ENV = $(TEST_MBWC_ENV)
+-tst_towupper-ENV = $(TEST_MBWC_ENV)
+-tst_wcrtomb-ENV = $(TEST_MBWC_ENV)
+-tst_wcscat-ENV = $(TEST_MBWC_ENV)
+-tst_wcschr-ENV = $(TEST_MBWC_ENV)
+-tst_wcscmp-ENV = $(TEST_MBWC_ENV)
+-tst_wcscoll-ENV = $(TEST_MBWC_ENV)
+-tst_wcscpy-ENV = $(TEST_MBWC_ENV)
+-tst_wcscspn-ENV = $(TEST_MBWC_ENV)
+-tst_wcslen-ENV = $(TEST_MBWC_ENV)
+-tst_wcsncat-ENV = $(TEST_MBWC_ENV)
+-tst_wcsncmp-ENV = $(TEST_MBWC_ENV)
+-tst_wcsncpy-ENV = $(TEST_MBWC_ENV)
+-tst_wcspbrk-ENV = $(TEST_MBWC_ENV)
+-tst_wcsrtombs-ENV = $(TEST_MBWC_ENV)
+-tst_wcsspn-ENV = $(TEST_MBWC_ENV)
+-tst_wcsstr-ENV = $(TEST_MBWC_ENV)
+-tst_wcstod-ENV = $(TEST_MBWC_ENV)
+-tst_wcstok-ENV = $(TEST_MBWC_ENV)
+-tst_wcstombs-ENV = $(TEST_MBWC_ENV)
+-tst_wcswidth-ENV = $(TEST_MBWC_ENV)
+-tst_wcsxfrm-ENV = $(TEST_MBWC_ENV)
+-tst_wctob-ENV = $(TEST_MBWC_ENV)
+-tst_wctomb-ENV = $(TEST_MBWC_ENV)
+-tst_wctrans-ENV = $(TEST_MBWC_ENV)
+-tst_wctype-ENV = $(TEST_MBWC_ENV)
+-tst_wcwidth-ENV = $(TEST_MBWC_ENV)
+-tst-digits-ENV = $(TEST_MBWC_ENV)
+-tst-mbswcs6-ENV = $(TEST_MBWC_ENV)
+-tst-xlocale1-ENV = $(TEST_MBWC_ENV)
+-tst-xlocale2-ENV = $(TEST_MBWC_ENV)
+-tst-strfmon1-ENV = $(TEST_MBWC_ENV)
+-tst-strptime-ENV = $(TEST_MBWC_ENV)
++tst-setlocale-ENV = LC_ALL=ja_JP.EUC-JP
+ 
+-tst-setlocale-ENV = LOCPATH=$(common-objpfx)localedata LC_ALL=ja_JP.EUC-JP
+-
+-bug-iconv-trans-ENV = LOCPATH=$(common-objpfx)localedata
+-
+-tst-sscanf-ENV = LOCPATH=$(common-objpfx)localedata
+-
+-tst-leaks-ENV = MALLOC_TRACE=$(objpfx)tst-leaks.mtrace \
+-		LOCPATH=$(common-objpfx)localedata
++tst-leaks-ENV = MALLOC_TRACE=$(objpfx)tst-leaks.mtrace
+ $(objpfx)mtrace-tst-leaks: $(objpfx)tst-leaks.out
+ 	$(common-objpfx)malloc/mtrace $(objpfx)tst-leaks.mtrace > $@
+ 
+-bug-setlocale1-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-setlocale1-ARGS = $(common-objpfx)
+-tst-setlocale2-ENV = LOCPATH=$(common-objpfx)localedata
+ 
+ $(objdir)/iconvdata/gconv-modules:
+ 	$(MAKE) -C ../iconvdata subdir=iconvdata $@
+diff --git a/posix/Makefile b/posix/Makefile
+index 328c2c5..3d75971 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -203,27 +203,7 @@ tst-dir-ARGS = `pwd` `cd $(common-objdir)/$(subdir); pwd` `cd $(common-objdir);
+ tst-chmod-ARGS = $(objdir)
+ tst-vfork3-ARGS = --test-dir=$(objpfx)
+ 
+-tst-fnmatch-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-regexloc-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex1-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-regex-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-regex2-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex5-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex6-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex17-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex18-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex19-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex20-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex22-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex23-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex25-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex26-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex30-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex32-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex33-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-regex34-ENV = LOCPATH=$(common-objpfx)localedata
+ tst-rxspencer-ARGS = --utf8 rxspencer/tests
+-tst-rxspencer-ENV = LOCPATH=$(common-objpfx)localedata
+ tst-pcre-ARGS = PCRE.tests
+ tst-boost-ARGS = BOOST.tests
+ bug-glob1-ARGS = "$(objpfx)"
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index f179eab..5f8e534 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -118,13 +118,6 @@ CFLAGS-scanf17.c = -I../libio -I../stdlib -I../wcsmbs -I../time -I../string \
+ 
+ # We know the test has a format string problem.
+ CFLAGS-tst-sprintf.c = -Wno-format
+-tst-sprintf-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-sscanf-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-swprintf-ENV = LOCPATH=$(common-objpfx)localedata
+-test-vfprintf-ENV = LOCPATH=$(common-objpfx)localedata
+-scanf13-ENV = LOCPATH=$(common-objpfx)localedata
+-bug14-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-grouping-ENV = LOCPATH=$(common-objpfx)localedata
+ 
+ CPPFLAGS += $(libio-mtsafe)
+ 
+diff --git a/stdlib/Makefile b/stdlib/Makefile
+index d7a562f..0fdf7cc 100644
+--- a/stdlib/Makefile
++++ b/stdlib/Makefile
+@@ -123,11 +123,6 @@ include ../Rules
+ # Testdir has to be named stdlib and needs to be writable
+ test-canon-ARGS = --test-dir=${common-objpfx}stdlib
+ 
+-tst-strtod-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-strtod3-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-strtod4-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-strtod5-ENV = LOCPATH=$(common-objpfx)localedata
+-testmb2-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-fmtmsg1-ENV = SEV_LEVEL=foo,11,newsev
+ 
+ # Run a test on the header files we use.
+diff --git a/string/Makefile b/string/Makefile
+index 5a76872..70b9c19 100644
+--- a/string/Makefile
++++ b/string/Makefile
+@@ -67,9 +67,6 @@ include ../Rules
+ tester-ENV = LANGUAGE=C
+ inl-tester-ENV = LANGUAGE=C
+ noinl-tester-ENV = LANGUAGE=C
+-tst-strxfrm-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-strxfrm2-ENV = LOCPATH=$(common-objpfx)localedata
+-bug-strcoll1-ENV = LOCPATH=$(common-objpfx)localedata
+ CFLAGS-inl-tester.c = -fno-builtin
+ CFLAGS-noinl-tester.c = -fno-builtin
+ CFLAGS-tst-strlen.c = -fno-builtin
+diff --git a/time/Makefile b/time/Makefile
+index b7f3dba..a07c041 100644
+--- a/time/Makefile
++++ b/time/Makefile
+@@ -55,7 +55,4 @@ CFLAGS-test_time.c = -Wno-format
+ tst-getdate-ENV= DATEMSK=datemsk TZDIR=${common-objpfx}timezone/testdata
+ test_time-ARGS= EST5EDT CST
+ 
+-tst-strptime-ENV = LOCPATH=${common-objpfx}localedata
+-tst-ftime_l-ENV = LOCPATH=${common-objpfx}localedata
+-
+ bug-getdate1-ARGS = ${objpfx}bug-getdate1-fmt
+diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile
+index 197ca7d..42843a6 100644
+--- a/wcsmbs/Makefile
++++ b/wcsmbs/Makefile
+@@ -80,10 +80,3 @@ CPPFLAGS += $(libio-mtsafe)
+ 
+ # We need to find the default version of strtold_l in stdlib.
+ CPPFLAGS-wcstold_l.c = -I../stdlib
+-
+-tst-btowc-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-mbrtowc-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-wcrtomb-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-mbrtowc2-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-c16c32-1-ENV = LOCPATH=$(common-objpfx)localedata
+-tst-mbsnrtowcs-ENV = LOCPATH=$(common-objpfx)localedata
+--- glibc-2.17-c758a686/localedata/Makefile	2014-08-26 21:38:56.564751630 +0530
++++ glibc-2.17-c758a686/localedata/Makefile.new	2014-08-26 21:40:16.596223207 +0530

glibc-rh731833-rtkaio-2.patch

@@ -0,0 +1,11 @@
+diff -pruN glibc-2.17-c758a686/rtkaio/sysdeps/unix/sysv/linux/kaio_suspend.c glibc-2.17-c758a686.new/rtkaio/sysdeps/unix/sysv/linux/kaio_suspend.c
+--- glibc-2.17-c758a686/rtkaio/sysdeps/unix/sysv/linux/kaio_suspend.c	2011-10-19 16:34:41.000000000 +0530
++++ glibc-2.17-c758a686.new/rtkaio/sysdeps/unix/sysv/linux/kaio_suspend.c	2013-08-16 10:22:30.457609558 +0530
+@@ -59,6 +59,7 @@ struct clparam
+ 
+ 
+ static void
++__attribute__ ((noinline))
+ cleanup (void *arg)
+ {
+ #ifdef DONT_NEED_AIO_MISC_COND

glibc-rh731833-rtkaio.patch

@@ -0,0 +1,31 @@
+diff -pruN glibc-2.17-c758a686/rtkaio/Makefile glibc-2.17-c758a686.new/rtkaio/Makefile
+--- glibc-2.17-c758a686/rtkaio/Makefile	2011-10-19 16:34:41.000000000 +0530
++++ glibc-2.17-c758a686.new/rtkaio/Makefile	2013-08-13 18:23:21.064888432 +0530
+@@ -55,7 +55,7 @@ extra-libs-others := $(extra-libs)
+ 
+ include $(..)Makeconfig
+ 
+-ifeq (yesyes,$(build-shared)$(elf))
++ifeq (yes,$(build-shared))
+ generated += librt.so$(librt.so-version)
+ 
+ $(objpfx)librt.so$(librt.so-version): $(objpfx)librtkaio.so; $(make-link)
+@@ -73,7 +73,7 @@ CPPFLAGS-librtkaio += -DIS_IN_librt=1 -I
+ 
+ rpath-dirs := $(patsubst rt,rtkaio,$(rpath-dirs))
+ 
+-ifeq (yesyes,$(build-shared)$(elf))
++ifeq (yes,$(build-shared))
+ others: $(objpfx)librt.so$(librt.so-version)
+ endif
+ 
+@@ -81,8 +81,7 @@ endif
+ # This ensures they will load libc.so for needed symbols if loaded by
+ # a statically-linked program that hasn't already loaded it.
+ $(objpfx)librtkaio.so: $(common-objpfx)libc.so $(common-objpfx)libc_nonshared.a \
+-		   $(shared-thread-library) \
+-		   $(if $(filter yes,$(elf)), $(elfobjdir)/ld.so)
++		   $(shared-thread-library) $(elfobjdir)/ld.so
+ 
+ ifeq (yes,$(build-shared))
+ $(addprefix $(objpfx),$(tests)): $(objpfx)librtkaio.so $(shared-thread-library)

glibc-rh892777.patch

@@ -0,0 +1,61 @@
+diff -Nrup a/nis/yp_xdr.c b/nis/yp_xdr.c
+--- a/nis/yp_xdr.c	2012-12-24 22:02:13.000000000 -0500
++++ b/nis/yp_xdr.c	2013-04-17 15:26:50.168999686 -0400
+@@ -32,6 +32,14 @@
+ #include <rpcsvc/yp.h>
+ #include <rpcsvc/ypclnt.h>
+ 
++/* The specification suggests 1024 as a maximum length of all fields, 
++   but current linux systems usually don't use any limits. So, to stay 
++   as much compatible as possible with recent linux systems we choose 
++   limits large enough to avoid problems. */
++
++#define XDRMAXNAME 1024
++#define XDRMAXRECORD 16 * 1024 * 1024
++
+ bool_t
+ xdr_ypstat (XDR *xdrs, ypstat *objp)
+ {
+@@ -49,21 +57,21 @@ libnsl_hidden_def (xdr_ypxfrstat)
+ bool_t
+ xdr_domainname (XDR *xdrs, domainname *objp)
+ {
+-  return xdr_string (xdrs, objp, YPMAXDOMAIN);
++  return xdr_string (xdrs, objp, XDRMAXNAME);
+ }
+ libnsl_hidden_def (xdr_domainname)
+ 
+ bool_t
+ xdr_mapname (XDR *xdrs, mapname *objp)
+ {
+-  return xdr_string (xdrs, objp, YPMAXMAP);
++  return xdr_string (xdrs, objp, XDRMAXNAME);
+ }
+ libnsl_hidden_def (xdr_mapname)
+ 
+ bool_t
+ xdr_peername (XDR *xdrs, peername *objp)
+ {
+-  return xdr_string (xdrs, objp, YPMAXPEER);
++  return xdr_string (xdrs, objp, XDRMAXNAME);
+ }
+ libnsl_hidden_def (xdr_peername)
+ 
+@@ -71,7 +79,7 @@ bool_t
+ xdr_keydat (XDR *xdrs, keydat *objp)
+ {
+   return xdr_bytes (xdrs, (char **) &objp->keydat_val,
+-		    (u_int *) &objp->keydat_len, YPMAXRECORD);
++		    (u_int *) &objp->keydat_len, XDRMAXRECORD);
+ }
+ libnsl_hidden_def (xdr_keydat)
+ 
+@@ -79,7 +87,7 @@ bool_t
+ xdr_valdat (XDR *xdrs, valdat *objp)
+ {
+   return xdr_bytes (xdrs, (char **) &objp->valdat_val,
+-		    (u_int *) &objp->valdat_len, YPMAXRECORD);
++		    (u_int *) &objp->valdat_len, XDRMAXRECORD);
+ }
+ libnsl_hidden_def (xdr_valdat)
+ 

glibc-rh905877.patch

@@ -0,0 +1,154 @@
+#
+# Backported from upstream.
+#
+# commit a445af0bc722d620afed7683cd320c0e4c7c6059
+# Author: Andreas Schwab <schwab@suse.de>
+# Date:   Tue Jan 29 14:45:15 2013 +0100
+#
+#    Fix buffer overrun in regexp matcher
+#
+# ChangeLog/
+# 2013-02-12  Andreas Schwab  <schwab@suse.de>
+# 
+#	[BZ #15078]
+#	* posix/regexec.c (extend_buffers): Add parameter min_len.
+#	(check_matching): Pass minimum needed length.
+#	(clean_state_log_if_needed): Likewise.
+#	(get_subexp): Likewise.
+#	* posix/Makefile (tests): Add bug-regex34.
+#	(bug-regex34-ENV): Define.
+#	* posix/bug-regex34.c: New file.
+#
+--- glibc-2.17-c758a686/posix/Makefile	2012-12-24 22:02:13.000000000 -0500
++++ glibc-2.17-c758a686/posix/Makefile	2013-03-17 15:30:13.121068666 -0400
+@@ -86,7 +86,7 @@
+ 		   tst-rfc3484-3 \
+ 		   tst-getaddrinfo3 tst-fnmatch2 tst-cpucount tst-cpuset \
+ 		   bug-getopt1 bug-getopt2 bug-getopt3 bug-getopt4 \
+-		   bug-getopt5 tst-getopt_long1
++		   bug-getopt5 tst-getopt_long1 bug-regex34
+ xtests		:= bug-ga2
+ ifeq (yes,$(build-shared))
+ test-srcs	:= globtest
+@@ -195,6 +195,7 @@
+ bug-regex30-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-regex32-ENV = LOCPATH=$(common-objpfx)localedata
+ bug-regex33-ENV = LOCPATH=$(common-objpfx)localedata
++bug-regex34-ENV = LOCPATH=$(common-objpfx)localedata
+ tst-rxspencer-ARGS = --utf8 rxspencer/tests
+ tst-rxspencer-ENV = LOCPATH=$(common-objpfx)localedata
+ tst-pcre-ARGS = PCRE.tests
+diff --git a/posix/bug-regex34.c b/posix/bug-regex34.c
+new file mode 100644
+index 0000000..bb3b613
+--- /dev/null
++++ b/posix/bug-regex34.c
+@@ -0,0 +1,46 @@
++/* Test re_search with multi-byte characters in UTF-8.
++   Copyright (C) 2013 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#define _GNU_SOURCE 1
++#include <stdio.h>
++#include <string.h>
++#include <locale.h>
++#include <regex.h>
++
++static int
++do_test (void)
++{
++  struct re_pattern_buffer r;
++  /* ကျွန်ုပ်x */
++  const char *s = "\xe1\x80\x80\xe1\x80\xbb\xe1\x80\xbd\xe1\x80\x94\xe1\x80\xba\xe1\x80\xaf\xe1\x80\x95\xe1\x80\xbax";
++
++  if (setlocale (LC_ALL, "en_US.UTF-8") == NULL)
++    {
++      puts ("setlocale failed");
++      return 1;
++    }
++  memset (&r, 0, sizeof (r));
++
++  re_compile_pattern ("[^x]x", 5, &r);
++  /* This was triggering a buffer overflow.  */
++  re_search (&r, s, strlen (s), 0, strlen (s), 0);
++  return 0;
++}
++
++#define TEST_FUNCTION do_test ()
++#include "../test-skeleton.c"
+diff --git a/posix/regexec.c b/posix/regexec.c
+index 7f2de85..5ca2bf6 100644
+--- a/posix/regexec.c
++++ b/posix/regexec.c
+@@ -197,7 +197,7 @@ static int group_nodes_into_DFAstates (const re_dfa_t *dfa,
+ static int check_node_accept (const re_match_context_t *mctx,
+ 			      const re_token_t *node, int idx)
+      internal_function;
+-static reg_errcode_t extend_buffers (re_match_context_t *mctx)
++static reg_errcode_t extend_buffers (re_match_context_t *mctx, int min_len)
+      internal_function;
+ 
+ /* Entry point for POSIX code.  */
+@@ -1160,7 +1160,7 @@ check_matching (re_match_context_t *mctx, int fl_longest_match,
+ 	  || (BE (next_char_idx >= mctx->input.valid_len, 0)
+ 	      && mctx->input.valid_len < mctx->input.len))
+ 	{
+-	  err = extend_buffers (mctx);
++	  err = extend_buffers (mctx, next_char_idx + 1);
+ 	  if (BE (err != REG_NOERROR, 0))
+ 	    {
+ 	      assert (err == REG_ESPACE);
+@@ -1738,7 +1738,7 @@ clean_state_log_if_needed (re_match_context_t *mctx, int next_state_log_idx)
+ 	  && mctx->input.valid_len < mctx->input.len))
+     {
+       reg_errcode_t err;
+-      err = extend_buffers (mctx);
++      err = extend_buffers (mctx, next_state_log_idx + 1);
+       if (BE (err != REG_NOERROR, 0))
+ 	return err;
+     }
+@@ -2792,7 +2792,7 @@ get_subexp (re_match_context_t *mctx, int bkref_node, int bkref_str_idx)
+ 		  if (bkref_str_off >= mctx->input.len)
+ 		    break;
+ 
+-		  err = extend_buffers (mctx);
++		  err = extend_buffers (mctx, bkref_str_off + 1);
+ 		  if (BE (err != REG_NOERROR, 0))
+ 		    return err;
+ 
+@@ -4102,7 +4102,7 @@ check_node_accept (const re_match_context_t *mctx, const re_token_t *node,
+ 
+ static reg_errcode_t
+ internal_function __attribute_warn_unused_result__
+-extend_buffers (re_match_context_t *mctx)
++extend_buffers (re_match_context_t *mctx, int min_len)
+ {
+   reg_errcode_t ret;
+   re_string_t *pstr = &mctx->input;
+@@ -4111,8 +4111,10 @@ extend_buffers (re_match_context_t *mctx)
+   if (BE (INT_MAX / 2 / sizeof (re_dfastate_t *) <= pstr->bufs_len, 0))
+     return REG_ESPACE;
+ 
+-  /* Double the lengthes of the buffers.  */
+-  ret = re_string_realloc_buffers (pstr, MIN (pstr->len, pstr->bufs_len * 2));
++  /* Double the lengthes of the buffers, but allocate at least MIN_LEN.  */
++  ret = re_string_realloc_buffers (pstr,
++				   MAX (min_len,
++					MIN (pstr->len, pstr->bufs_len * 2)));
+   if (BE (ret != REG_NOERROR, 0))
+     return ret;
+ 

glibc-rh947892.patch

@@ -0,0 +1,50 @@
+commit 1cef1b19089528db11f221e938f60b9b048945d7
+Author: Andreas Schwab <schwab@suse.de>
+Date:   Thu Mar 21 15:50:27 2013 +0100
+
+    Fix stack overflow in getaddrinfo with many results
+
+diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
+index d95c2d1..2309281 100644
+--- a/sysdeps/posix/getaddrinfo.c
++++ b/sysdeps/posix/getaddrinfo.c
+@@ -2489,11 +2489,27 @@ getaddrinfo (const char *name, const char *service,
+       __typeof (once) old_once = once;
+       __libc_once (once, gaiconf_init);
+       /* Sort results according to RFC 3484.  */
+-      struct sort_result results[nresults];
+-      size_t order[nresults];
++      struct sort_result *results;
++      size_t *order;
+       struct addrinfo *q;
+       struct addrinfo *last = NULL;
+       char *canonname = NULL;
++      bool malloc_results;
++
++      malloc_results
++	= !__libc_use_alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      if (malloc_results)
++	{
++	  results = malloc (nresults * (sizeof (*results) + sizeof (size_t)));
++	  if (results == NULL)
++	    {
++	      __free_in6ai (in6ai);
++	      return EAI_MEMORY;
++	    }
++	}
++      else
++	results = alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      order = (size_t *) (results + nresults);
+ 
+       /* Now we definitely need the interface information.  */
+       if (! check_pf_called)
+@@ -2664,6 +2680,9 @@ getaddrinfo (const char *name, const char *service,
+ 
+       /* Fill in the canonical name into the new first entry.  */
+       p->ai_canonname = canonname;
++
++      if (malloc_results)
++	free (results);
+     }
+ 
+   __free_in6ai (in6ai);

glibc-rh950093.patch

@@ -0,0 +1,327 @@
+#
+# All patches are from upstream and provide support for correct lib
+# directory for AArch64.
+#
+# From 37bf2f1f983e37c0d87a1e34cd3d8a228ead5e16 Mon Sep 17 00:00:00 2001
+# From: Andreas Schwab <schwab@suse.de>
+# Date: Thu, 4 Apr 2013 12:22:22 -0400
+# Subject: [PATCH 2/4] Add support for rtld directory different from slib
+#  directory
+# 
+# ---
+#  ChangeLog         | 15 +++++++++++++++
+#  Makeconfig        | 10 ++++++++--
+#  Makerules         |  4 ++--
+#  config.make.in    |  1 +
+#  configure         |  2 ++
+#  configure.in      |  1 +
+#  elf/Makefile      | 11 ++++++-----
+#  scripts/rellns-sh | 17 +++++++++++++++--
+#  8 files changed, 50 insertions(+), 11 deletions(-)
+# 
+# From 937dd2d4a5da7d51b87261b037e22dfca05face7 Mon Sep 17 00:00:00 2001
+# From: Marcus Shawcroft <marcus.shawcroft@linaro.org>
+# Date: Thu, 4 Apr 2013 12:26:55 -0400
+# Subject: [PATCH 4/4] Correct missed use of $(rtlddir).
+# 
+# ---
+#  ChangeLog | 4 ++++
+#  Makerules | 2 +-
+#  2 files changed, 5 insertions(+), 1 deletion(-)
+# 
+# From bcce68c6dc678b443e7f140d664ba1fa49c0ceaa Mon Sep 17 00:00:00 2001
+# From: Andreas Schwab <schwab@suse.de>
+# Date: Thu, 4 Apr 2013 12:23:43 -0400
+# Subject: [PATCH 3/4] aarch64: Move rtld link to /lib
+# 
+# ---
+#  ports/ChangeLog.aarch64                            | 6 ++++++
+#  ports/sysdeps/unix/sysv/linux/aarch64/configure    | 1 +
+#  ports/sysdeps/unix/sysv/linux/aarch64/configure.in | 1 +
+#  3 files changed, 8 insertions(+)
+# 
+# From 05bc48a20b8c20574bc59a048750f0dd77fd6e23 Mon Sep 17 00:00:00 2001
+# From: Andreas Schwab <schwab@suse.de>
+# Date: Thu, 4 Apr 2013 12:02:53 -0400
+# Subject: [PATCH 1/4] aarch64: use lib64 as default lib and slib directory
+# 
+# ---
+#  ports/ChangeLog.aarch64                            |  6 ++++++
+#  ports/sysdeps/unix/sysv/linux/aarch64/configure    | 13 +++++++++++++
+#  ports/sysdeps/unix/sysv/linux/aarch64/configure.in | 12 ++++++++++++
+#  3 files changed, 31 insertions(+)
+# 
+# commit 446737706c186b33529a2c07fcb6f0cc10b2d1ea
+# Author: Andreas Schwab <schwab@suse.de>
+# Date:   Tue Mar 19 10:13:46 2013 +0100
+#
+#    s390x: Move rtld link to /lib
+#
+diff -urN glibc-2.17-c758a686.orig/config.make.in glibc-2.17-c758a686/config.make.in
+--- glibc-2.17-c758a686.orig/config.make.in	2013-10-28 10:56:39.996320904 -0400
++++ glibc-2.17-c758a686/config.make.in	2013-10-28 10:56:57.773317467 -0400
+@@ -11,6 +11,7 @@
+ datadir = @datadir@
+ libdir = @libdir@
+ slibdir = @libc_cv_slibdir@
++rtlddir = @libc_cv_rtlddir@
+ localedir = @libc_cv_localedir@
+ sysconfdir = @libc_cv_sysconfdir@
+ libexecdir = @libexecdir@
+diff -urN glibc-2.17-c758a686.orig/configure glibc-2.17-c758a686/configure
+--- glibc-2.17-c758a686.orig/configure	2013-10-28 10:56:39.935320916 -0400
++++ glibc-2.17-c758a686/configure	2013-10-28 10:56:57.775317467 -0400
+@@ -594,6 +594,7 @@
+ libc_cv_localstatedir
+ libc_cv_sysconfdir
+ libc_cv_localedir
++libc_cv_rtlddir
+ libc_cv_slibdir
+ old_glibc_headers
+ use_nscd
+@@ -7600,6 +7601,7 @@
+ 
+ 
+ 
++
+ 
+ 
+ 
+diff -urN glibc-2.17-c758a686.orig/configure.in glibc-2.17-c758a686/configure.in
+--- glibc-2.17-c758a686.orig/configure.in	2013-10-28 10:56:39.902320923 -0400
++++ glibc-2.17-c758a686/configure.in	2013-10-28 10:56:57.776317467 -0400
+@@ -2127,6 +2127,7 @@
+ AC_SUBST(old_glibc_headers)
+ 
+ AC_SUBST(libc_cv_slibdir)
++AC_SUBST(libc_cv_rtlddir)
+ AC_SUBST(libc_cv_localedir)
+ AC_SUBST(libc_cv_sysconfdir)
+ AC_SUBST(libc_cv_localstatedir)
+diff -urN glibc-2.17-c758a686.orig/elf/Makefile glibc-2.17-c758a686/elf/Makefile
+--- glibc-2.17-c758a686.orig/elf/Makefile	2013-10-28 10:56:40.127320879 -0400
++++ glibc-2.17-c758a686/elf/Makefile	2013-10-28 10:56:57.776317467 -0400
+@@ -66,7 +66,7 @@
+ ifeq (yes,$(build-shared))
+ extra-objs	= $(all-rtld-routines:%=%.os) soinit.os sofini.os interp.os
+ generated	+= librtld.os dl-allobjs.os ld.so ldd
+-install-others	= $(inst_slibdir)/$(rtld-installed-name)
++install-others = $(inst_rtlddir)/$(rtld-installed-name)
+ install-bin-script = ldd
+ endif
+ 
+@@ -341,7 +341,7 @@
+ 	  | $(AWK) '($$7 ~ /^UND(|EF)$$/ && $$1 != "0:" && $$4 != "REGISTER") { print; p=1 } END { exit p != 0 }'
+ 
+ # interp.c exists just to get this string into the libraries.
+-CFLAGS-interp.c = -D'RUNTIME_LINKER="$(slibdir)/$(rtld-installed-name)"' \
++CFLAGS-interp.c = -D'RUNTIME_LINKER="$(rtlddir)/$(rtld-installed-name)"' \
+ 		  -DNOT_IN_libc=1
+ $(objpfx)interp.os: $(common-objpfx)config.make
+ 
+@@ -373,18 +373,19 @@
+ 	$(make-target-directory)
+ 	$(do-install-program)
+ 
+-$(inst_slibdir)/$(rtld-installed-name): \
++$(inst_rtlddir)/$(rtld-installed-name): \
+   $(inst_slibdir)/$(rtld-version-installed-name) \
+   $(inst_slibdir)/libc-$(version).so
++	$(make-target-directory)
+ 	$(make-shlib-link)
+ 
+ # Special target called by parent to install just the dynamic linker.
+ .PHONY: ldso_install
+-ldso_install: $(inst_slibdir)/$(rtld-installed-name)
++ldso_install: $(inst_rtlddir)/$(rtld-installed-name)
+ endif
+ 
+ 
+-common-ldd-rewrite = -e 's%@RTLD@%$(slibdir)/$(rtld-installed-name)%g' \
++common-ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \
+ 		     -e 's%@VERSION@%$(version)%g' \
+ 		     -e 's|@PKGVERSION@|$(PKGVERSION)|g' \
+ 		     -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|g'
+diff -urN glibc-2.17-c758a686.orig/Makeconfig glibc-2.17-c758a686/Makeconfig
+--- glibc-2.17-c758a686.orig/Makeconfig	2013-10-28 10:56:40.434320820 -0400
++++ glibc-2.17-c758a686/Makeconfig	2013-10-28 10:56:57.772317467 -0400
+@@ -148,12 +148,18 @@
+ endif
+ inst_libdir = $(install_root)$(libdir)
+ 
+-# Where to install the shared library and dynamic linker.
++# Where to install the shared library.
+ ifndef slibdir
+ slibdir = $(exec_prefix)/lib
+ endif
+ inst_slibdir = $(install_root)$(slibdir)
+ 
++# Where to install the dynamic linker.
++ifndef rtlddir
++rtlddir = $(slibdir)
++endif
++inst_rtlddir = $(install_root)$(rtlddir)
++
+ # Prefix to put on files installed in $(libdir).  For libraries `libNAME.a',
+ # the prefix is spliced between `lib' and the name, so the linker switch
+ # `-l$(libprefix)NAME' finds the library; for other files the prefix is
+@@ -443,7 +449,7 @@
+ endif
+ ifndef config-LDFLAGS
+ ifeq (yes,$(build-shared))
+-config-LDFLAGS = -Wl,-dynamic-linker=$(slibdir)/$(rtld-installed-name)
++config-LDFLAGS = -Wl,-dynamic-linker=$(rtlddir)/$(rtld-installed-name)
+ endif
+ endif
+ ifndef link-libc
+diff -urN glibc-2.17-c758a686.orig/Makerules glibc-2.17-c758a686/Makerules
+--- glibc-2.17-c758a686.orig/Makerules	2013-10-28 10:56:39.928320918 -0400
++++ glibc-2.17-c758a686/Makerules	2013-10-28 10:56:57.777317467 -0400
+@@ -873,7 +873,7 @@
+ symbolic-link-prog := $(common-objpfx)elf/sln
+ symbolic-link-list := $(common-objpfx)elf/symlink.list
+ define make-shlib-link
+-echo $(<F) $@ >> $(symbolic-link-list)
++echo `$(..)scripts/rellns-sh -p $< $@` $@ >> $(symbolic-link-list)
+ endef
+ else # cross-compiling
+ # We need a definition that can be used by elf/Makefile's install rules.
+@@ -883,7 +883,7 @@
+ ifndef make-shlib-link
+ define make-shlib-link
+ rm -f $@
+-$(LN_S) $(<F) $@
++$(LN_S) `$(..)scripts/rellns-sh -p $< $@` $@
+ endef
+ endif
+ 
+@@ -937,7 +937,7 @@
+ 	 cat $<; \
+ 	 echo 'GROUP ( $(slibdir)/libc.so$(libc.so-version)' \
+ 	      '$(libdir)/$(patsubst %,$(libtype.oS),$(libprefix)$(libc-name))'\
+-	      ' AS_NEEDED (' $(slibdir)/$(rtld-installed-name) ') )' \
++	      ' AS_NEEDED (' $(rtlddir)/$(rtld-installed-name) ') )' \
+ 	) > $@.new
+ 	mv -f $@.new $@
+ 
+diff -urN glibc-2.17-c758a686.orig/ports/sysdeps/unix/sysv/linux/aarch64/configure glibc-2.17-c758a686/ports/sysdeps/unix/sysv/linux/aarch64/configure
+--- glibc-2.17-c758a686.orig/ports/sysdeps/unix/sysv/linux/aarch64/configure	2013-10-28 10:56:39.873320928 -0400
++++ glibc-2.17-c758a686/ports/sysdeps/unix/sysv/linux/aarch64/configure	2013-10-28 10:57:26.270311964 -0400
+@@ -1,3 +1,17 @@
+ # This file is generated from configure.in by Autoconf.  DO NOT EDIT!
++ # Local configure fragment for sysdeps/unix/sysv/linux/aarch64.
+ 
+ arch_minimum_kernel=3.7.0
++
++test -n "$libc_cv_slibdir" ||
++case "$prefix" in
++  /usr | /usr/)
++    libc_cv_slibdir="/lib64"
++    libc_cv_rtlddir="/lib"
++    if test "$libdir" = '${exec_prefix}/lib'; then
++      libdir='${exec_prefix}/lib64';
++      # Locale data can be shared between 32bit and 64bit libraries
++      libc_cv_localedir='${exec_prefix}/lib/locale'
++    fi
++    ;;
++esac
+diff -urN glibc-2.17-c758a686.orig/ports/sysdeps/unix/sysv/linux/aarch64/configure.in glibc-2.17-c758a686/ports/sysdeps/unix/sysv/linux/aarch64/configure.in
+--- glibc-2.17-c758a686.orig/ports/sysdeps/unix/sysv/linux/aarch64/configure.in	2013-10-28 10:56:39.873320928 -0400
++++ glibc-2.17-c758a686/ports/sysdeps/unix/sysv/linux/aarch64/configure.in	2013-10-28 10:57:49.162307556 -0400
+@@ -2,3 +2,16 @@
+ # Local configure fragment for sysdeps/unix/sysv/linux/aarch64.
+ 
+ arch_minimum_kernel=3.7.0
++
++test -n "$libc_cv_slibdir" ||
++case "$prefix" in
++  /usr | /usr/)
++    libc_cv_slibdir="/lib64"
++    libc_cv_rtlddir="/lib"
++    if test "$libdir" = '${exec_prefix}/lib'; then
++      libdir='${exec_prefix}/lib64';
++      # Locale data can be shared between 32bit and 64bit libraries
++      libc_cv_localedir='${exec_prefix}/lib/locale'
++    fi
++    ;;
++esac
+diff -urN glibc-2.17-c758a686.orig/scripts/rellns-sh glibc-2.17-c758a686/scripts/rellns-sh
+--- glibc-2.17-c758a686.orig/scripts/rellns-sh	2013-10-28 10:56:40.081320888 -0400
++++ glibc-2.17-c758a686/scripts/rellns-sh	2013-10-28 10:56:57.776317467 -0400
+@@ -16,8 +16,17 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program; if not, see <http://www.gnu.org/licenses/>.
+ 
++# With -p, instead of creating the link print the computed relative link
++# name.
++do_print=false
++case $1 in
++  -p)
++    do_print=true
++    shift
++    ;;
++esac
+ if test $# -ne 2; then
+-  echo "Usage: rellns SOURCE DEST" >&2
++  echo "Usage: rellns [-p] SOURCE DEST" >&2
+   exit 1
+ fi
+ 
+@@ -70,4 +79,8 @@
+   from=`echo $from | sed 's%^[^/]*/*%%'`
+ done
+ 
+-ln -s $rfrom$to $2
++if $do_print; then
++  echo "$rfrom$to"
++else
++  ln -s $rfrom$to $2
++fi
+diff --git a/sysdeps/gnu/configure b/sysdeps/gnu/configure
+index 26327ca..70aaa90 100644
+--- a/sysdeps/gnu/configure
++++ b/sysdeps/gnu/configure
+@@ -9,12 +9,17 @@
+ case "$prefix" in
+ /usr | /usr/)
+   # 64-bit libraries on bi-arch platforms go in /lib64 instead of /lib.
+-  # Allow earlier configure scripts to handle libc_cv_slibdir, libdir,
+-  # and libc_cv_localedir.
++  # Allow earlier configure scripts to handle libc_cv_slibdir,
++  # libc_cv_rtlddir, libdir, and libc_cv_localedir.
+   test -n "$libc_cv_slibdir" || \
+   case $machine in
+   sparc/sparc64 | x86_64* | powerpc/powerpc64 | s390/s390-64)
+     libc_cv_slibdir=/lib64
++    case $machine in
++    s390/s390-64)
++      libc_cv_rtlddir=/lib
++      ;;
++    esac
+     if test "$libdir" = '${exec_prefix}/lib'; then
+       libdir='${exec_prefix}/lib64';
+       # Locale data can be shared between 32bit and 64bit libraries
+diff --git a/sysdeps/gnu/configure.in b/sysdeps/gnu/configure.in
+index b8fd74c..ce251df 100644
+--- a/sysdeps/gnu/configure.in
++++ b/sysdeps/gnu/configure.in
+@@ -9,12 +9,17 @@ GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory.
+ case "$prefix" in
+ /usr | /usr/)
+   # 64-bit libraries on bi-arch platforms go in /lib64 instead of /lib.
+-  # Allow earlier configure scripts to handle libc_cv_slibdir, libdir,
+-  # and libc_cv_localedir.
++  # Allow earlier configure scripts to handle libc_cv_slibdir,
++  # libc_cv_rtlddir, libdir, and libc_cv_localedir.
+   test -n "$libc_cv_slibdir" || \
+   case $machine in
+   sparc/sparc64 | x86_64* | powerpc/powerpc64 | s390/s390-64)
+     libc_cv_slibdir=/lib64
++    case $machine in
++    s390/s390-64)
++      libc_cv_rtlddir=/lib
++      ;;
++    esac
+     if test "$libdir" = '${exec_prefix}/lib'; then
+       libdir='${exec_prefix}/lib64';
+       # Locale data can be shared between 32bit and 64bit libraries

glibc-rh952799.patch

@@ -0,0 +1,181 @@
+#
+# Red Hat BZ:
+# https://bugzilla.redhat.com/show_bug.cgi?id=816647
+#
+# ChangeLog
+#
+#2013-04-30  Patsy Franklin  <pfrankli@redhat.com>
+#
+#	* iconv/gconv_cache.c (find_module): Demangle init_fct before 
+#	checking for NULL. Mangle __btowc_fct if init_fct is non-NULL.
+#	* iconv/gconv_db.c (free_derivation): Check that __shlib_handle 
+#	is non-NULL before demangling the end_fct.  Check for NULL
+#	end_fct after demangling.
+#	(__gconv_release_step): Demangle the end_fct before checking 
+#	it for NULL.   Remove assert on __shlibc_handle != NULL.
+#	(gen_steps): Don't check btowc_fct for NULL before mangling.  
+#	Demangle init_fct before checking for NULL.
+#	(increment_counter): Likewise
+#	* gconv_dl.c (__gconv_find_shlib): Don't check init_fct or
+#	end_fct for NULL before mangling.
+#	* wcsmbs/btowc.c (__btowc): Demangle btowc_fct before checking
+#	for NULL.
+#
+diff -Nrup a/iconv/gconv_cache.c b/iconv/gconv_cache.c
+--- a/iconv/gconv_cache.c	2012-12-24 22:02:13.000000000 -0500
++++ b/iconv/gconv_cache.c	2013-04-30 11:34:20.112389987 -0400
+@@ -207,17 +207,16 @@ find_module (const char *directory, cons
+       result->__data = NULL;
+ 
+       /* Call the init function.  */
+-      if (result->__init_fct != NULL)
+-	{
+-	  __gconv_init_fct init_fct = result->__init_fct;
++      __gconv_init_fct init_fct = result->__init_fct;
+ #ifdef PTR_DEMANGLE
+-	  PTR_DEMANGLE (init_fct);
++      PTR_DEMANGLE (init_fct);
+ #endif
++      if (init_fct != NULL)
++	{
+ 	  status = DL_CALL_FCT (init_fct, (result));
+ 
+ #ifdef PTR_MANGLE
+-	  if (result->__btowc_fct != NULL)
+-	    PTR_MANGLE (result->__btowc_fct);
++	  PTR_MANGLE (result->__btowc_fct);
+ #endif
+ 	}
+     }
+diff -Nrup a/iconv/gconv_db.c b/iconv/gconv_db.c
+--- a/iconv/gconv_db.c	2012-12-24 22:02:13.000000000 -0500
++++ b/iconv/gconv_db.c	2013-04-30 11:32:42.700592914 -0400
+@@ -179,16 +179,15 @@ free_derivation (void *p)
+   size_t cnt;
+ 
+   for (cnt = 0; cnt < deriv->nsteps; ++cnt)
+-    if (deriv->steps[cnt].__counter > 0
+-	&& deriv->steps[cnt].__end_fct != NULL)
++    if ((deriv->steps[cnt].__counter > 0)
++	&& (deriv->steps[cnt].__shlib_handle != NULL))
+       {
+-	assert (deriv->steps[cnt].__shlib_handle != NULL);
+-
+ 	__gconv_end_fct end_fct = deriv->steps[cnt].__end_fct;
+ #ifdef PTR_DEMANGLE
+ 	PTR_DEMANGLE (end_fct);
+ #endif
+-	DL_CALL_FCT (end_fct, (&deriv->steps[cnt]));
++	if (end_fct != NULL)
++	  DL_CALL_FCT (end_fct, (&deriv->steps[cnt]));
+       }
+ 
+   /* Free the name strings.  */
+@@ -212,16 +211,12 @@ __gconv_release_step (struct __gconv_ste
+   if (step->__shlib_handle != NULL && --step->__counter == 0)
+     {
+       /* Call the destructor.  */
+-      if (step->__end_fct != NULL)
+-	{
+-	  assert (step->__shlib_handle != NULL);
+-
+-	  __gconv_end_fct end_fct = step->__end_fct;
++	__gconv_end_fct end_fct = step->__end_fct;
+ #ifdef PTR_DEMANGLE
+-	  PTR_DEMANGLE (end_fct);
++	PTR_DEMANGLE (end_fct);
+ #endif
+-	  DL_CALL_FCT (end_fct, (step));
+-	}
++      if (end_fct != NULL)
++	DL_CALL_FCT (end_fct, (step));
+ 
+ #ifndef STATIC_GCONV
+       /* Release the loaded module.  */
+@@ -293,13 +288,11 @@ gen_steps (struct derivation_step *best,
+ 
+ 	      /* Call the init function.  */
+ 	      __gconv_init_fct init_fct = result[step_cnt].__init_fct;
+-	      if (init_fct != NULL)
+-		{
+-		  assert (result[step_cnt].__shlib_handle != NULL);
+-
+ # ifdef PTR_DEMANGLE
+-		  PTR_DEMANGLE (init_fct);
++	      PTR_DEMANGLE (init_fct);
+ # endif
++	      if (init_fct != NULL)
++		{
+ 		  status = DL_CALL_FCT (init_fct, (&result[step_cnt]));
+ 
+ 		  if (__builtin_expect (status, __GCONV_OK) != __GCONV_OK)
+@@ -312,8 +305,7 @@ gen_steps (struct derivation_step *best,
+ 		    }
+ 
+ # ifdef PTR_MANGLE
+-		  if (result[step_cnt].__btowc_fct != NULL)
+-		    PTR_MANGLE (result[step_cnt].__btowc_fct);
++		  PTR_MANGLE (result[step_cnt].__btowc_fct);
+ # endif
+ 		}
+ 	    }
+@@ -393,16 +385,15 @@ increment_counter (struct __gconv_step *
+ 
+ 	  /* Call the init function.  */
+ 	  __gconv_init_fct init_fct = step->__init_fct;
+-	  if (init_fct != NULL)
+-	    {
+ #ifdef PTR_DEMANGLE
+-	      PTR_DEMANGLE (init_fct);
++	  PTR_DEMANGLE (init_fct);
+ #endif
++	  if (init_fct != NULL)
++	    {
+ 	      DL_CALL_FCT (init_fct, (step));
+ 
+ #ifdef PTR_MANGLE
+-	      if (step->__btowc_fct != NULL)
+-		PTR_MANGLE (step->__btowc_fct);
++	      PTR_MANGLE (step->__btowc_fct);
+ #endif
+ 	    }
+ 	}
+diff -Nrup a/iconv/gconv_dl.c b/iconv/gconv_dl.c
+--- a/iconv/gconv_dl.c	2012-12-24 22:02:13.000000000 -0500
++++ b/iconv/gconv_dl.c	2013-04-30 11:32:42.701592922 -0400
+@@ -132,10 +132,8 @@ __gconv_find_shlib (const char *name)
+ 
+ #ifdef PTR_MANGLE
+ 		  PTR_MANGLE (found->fct);
+-		  if (found->init_fct != NULL)
+-		    PTR_MANGLE (found->init_fct);
+-		  if (found->end_fct !=  NULL)
+-		    PTR_MANGLE (found->end_fct);
++		  PTR_MANGLE (found->init_fct);
++		  PTR_MANGLE (found->end_fct);
+ #endif
+ 
+ 		  /* We have succeeded in loading the shared object.  */
+diff -Nrup a/wcsmbs/btowc.c b/wcsmbs/btowc.c
+--- a/wcsmbs/btowc.c	2012-12-24 22:02:13.000000000 -0500
++++ b/wcsmbs/btowc.c	2013-04-30 11:32:42.701592922 -0400
+@@ -47,15 +47,15 @@ __btowc (c)
+   /* Get the conversion functions.  */
+   fcts = get_gconv_fcts (_NL_CURRENT_DATA (LC_CTYPE));
+   __gconv_btowc_fct btowc_fct = fcts->towc->__btowc_fct;
++#ifdef PTR_DEMANGLE
++  if (fcts->towc->__shlib_handle != NULL)
++    PTR_DEMANGLE (btowc_fct);
++#endif
+ 
+   if (__builtin_expect (fcts->towc_nsteps == 1, 1)
+       && __builtin_expect (btowc_fct != NULL, 1))
+     {
+       /* Use the shortcut function.  */
+-#ifdef PTR_DEMANGLE
+-      if (fcts->towc->__shlib_handle != NULL)
+-	PTR_DEMANGLE (btowc_fct);
+-#endif
+       return DL_CALL_FCT (btowc_fct, (fcts->towc, (unsigned char) c));
+     }
+   else

glibc-rh958652.patch

@@ -0,0 +1,69 @@
+commit 3d04f5db20c8f0d1ba3881b5f5373586a18cf188
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Tue May 21 21:54:41 2013 +0530
+
+    Set EAI_SYSTEM only when h_errno is NETDB_INTERNAL
+    
+    Fixes BZ #15339.
+    
+    NSS_STATUS_UNAVAIL may mean that a necessary input resource is not
+    available.  This could occur in a number of cases including when the
+    network is down, system runs out of file descriptors, etc.  The
+    correct differentiator in such a case is the h_errno, which gives the
+    nature of failure.  In case of failures other than a simple 'not
+    found', we set h_errno as NETDB_INTERNAL and let errno be the
+    identifier for the exact error.
+
+diff --git a/nss/getXXbyYY_r.c b/nss/getXXbyYY_r.c
+index 44d00f4..33e63d4 100644
+--- a/nss/getXXbyYY_r.c
++++ b/nss/getXXbyYY_r.c
+@@ -287,10 +287,10 @@ done:
+ #endif
+   *result = status == NSS_STATUS_SUCCESS ? resbuf : NULL;
+ #ifdef NEED_H_ERRNO
+-  if (status == NSS_STATUS_UNAVAIL)
+-    /* Either we failed to lookup the functions or the functions themselves
+-       had a system error.  Set NETDB_INTERNAL here to let the caller know
+-       that the errno may have the real reason for failure.  */
++  if (status == NSS_STATUS_UNAVAIL && !any_service && errno != ENOENT)
++    /* This happens when we weren't able to use a service for reasons other
++       than the module not being found.  In such a case, we'd want to tell the
++       caller that errno has the real reason for failure.  */
+       *h_errnop = NETDB_INTERNAL;
+   else if (status != NSS_STATUS_SUCCESS && !any_service)
+     /* We were not able to use any service.  */
+diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
+index ab135ad..7bb3ded 100644
+--- a/sysdeps/posix/getaddrinfo.c
++++ b/sysdeps/posix/getaddrinfo.c
+@@ -1036,7 +1036,15 @@ gaih_inet (const char *name, const struct gaih_service *service,
+ 			}
+ 		    }
+ 		  else
+-		    status = NSS_STATUS_UNAVAIL;
++		    {
++		      status = NSS_STATUS_UNAVAIL;
++		      /* Could not load any of the lookup functions.  Indicate
++		         an internal error if the failure was due to a system
++			 error other than the file not being found.  We use the
++			 errno from the last failed callback.  */
++		      if (errno != 0 && errno != ENOENT)
++			__set_h_errno (NETDB_INTERNAL);
++		    }
+ 		}
+ 
+ 	      if (nss_next_action (nip, status) == NSS_ACTION_RETURN)
+@@ -1050,7 +1058,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
+ 
+ 	  _res.options |= old_res_options & RES_USE_INET6;
+ 
+-	  if (status == NSS_STATUS_UNAVAIL)
++	  if (h_errno == NETDB_INTERNAL)
+ 	    {
+ 	      result = GAIH_OKIFUNSPEC | -EAI_SYSTEM;
+ 	      goto free_and_return;
+_______________________________________________
+glibc mailing list
+glibc@lists.fedoraproject.org
+https://admin.fedoraproject.org/mailman/listinfo/glibc

glibc-rh959034.patch

@@ -0,0 +1,80 @@
+2013-05-03  Carlos O'Donell  <carlos at redhat.com>
+
+	* intl/dcigettext.c (DCIGETTEXT): Skip translating if _nl_find_msg returns -1.
+	(_nl_find_msg): Return -1 if recursive call returned -1. If newmem is null
+	return -1.
+	* intl/loadmsgcat.c (_nl_load_domain): If _nl_find_msg returns -1 abort
+	loading the domain.
+
+diff --git a/intl/dcigettext.c b/intl/dcigettext.c
+index 110307b..f4aa215 100644
+--- a/intl/dcigettext.c
++++ b/intl/dcigettext.c
+@@ -638,6 +638,11 @@ DCIGETTEXT (domainname, msgid1, msgid2, plural, n, category)
+ 		  retval = _nl_find_msg (domain->successor[cnt], binding,
+ 					 msgid1, 1, &retlen);
+ 
++		  /* Resource problems are not fatal, instead we return no
++		     translation.  */
++		  if (__builtin_expect (retval == (char *) -1, 0))
++		    goto no_translation;
++
+ 		  if (retval != NULL)
+ 		    {
+ 		      domain = domain->successor[cnt];
+@@ -941,6 +946,11 @@ _nl_find_msg (domain_file, domainbinding, msgid, convert, lengthp)
+ 	    nullentry =
+ 	      _nl_find_msg (domain_file, domainbinding, "", 0, &nullentrylen);
+ 
++	    /* Resource problems are fatal.  If we continue onwards we will
++	       only attempt to calloc a new conv_tab and fail later.  */
++	    if (__builtin_expect (nullentry == (char *) -1, 0))
++	      return (char *) -1;
++
+ 	    if (nullentry != NULL)
+ 	      {
+ 		const char *charsetstr;
+@@ -1170,10 +1180,14 @@ _nl_find_msg (domain_file, domainbinding, msgid, convert, lengthp)
+ 		      freemem_size = INITIAL_BLOCK_SIZE;
+ 		      newmem = (transmem_block_t *) malloc (freemem_size);
+ # ifdef _LIBC
+-		      /* Add the block to the list of blocks we have to free
+-			 at some point.  */
+-		      newmem->next = transmem_list;
+-		      transmem_list = newmem;
++		      if (newmem != NULL)
++			{
++			  /* Add the block to the list of blocks we have to free
++			     at some point.  */
++			  newmem->next = transmem_list;
++			  transmem_list = newmem;
++			}
++		      /* Fall through and return -1.  */
+ # endif
+ 		    }
+ 		  if (__builtin_expect (newmem == NULL, 0))
+diff --git a/intl/loadmsgcat.c b/intl/loadmsgcat.c
+index e4b7b38..ac90ed1 100644
+--- a/intl/loadmsgcat.c
++++ b/intl/loadmsgcat.c
+@@ -1237,7 +1237,7 @@ _nl_load_domain (domain_file, domainbinding)
+     default:
+       /* This is an invalid revision.  */
+     invalid:
+-      /* This is an invalid .mo file.  */
++      /* This is an invalid .mo file or we ran out of resources.  */
+       free (domain->malloced);
+ #ifdef HAVE_MMAP
+       if (use_mmap)
+@@ -1257,6 +1257,11 @@ _nl_load_domain (domain_file, domainbinding)
+ 
+   /* Get the header entry and look for a plural specification.  */
+   nullentry = _nl_find_msg (domain_file, domainbinding, "", 0, &nullentrylen);
++  if (__builtin_expect (nullentry == (char *) -1, 0))
++    {
++      __libc_rwlock_fini (domain->conversions_lock);
++      goto invalid;
++    }
+   EXTRACT_PLURAL_EXPRESSION (nullentry, &domain->plural, &domain->nplurals);
+ 
+  out:

glibc-rh966259.patch

@@ -0,0 +1,55 @@
+commit 96945714ec61951cc748da2b4b8a80cf02127ee9
+Author: Jeff Law <law@redhat.com>
+Date:   Thu May 23 13:28:00 2013 -0600
+
+           [BZ #14256]
+            * manual/errno.texi (ESTALE): Update to account for more than
+            just NFS file systems.
+            * sysdeps/gnu/errlist.c: Regenerated.
+
+diff --git a/manual/errno.texi b/manual/errno.texi
+index 2a3c004..6c9fa86 100644
+--- a/manual/errno.texi
++++ b/manual/errno.texi
+@@ -739,13 +739,14 @@ The user's disk quota was exceeded.
+ @end deftypevr
+ 
+ @comment errno.h
+-@comment BSD: Stale NFS file handle
++@comment BSD: Stale file handle
+ @deftypevr Macro int ESTALE
+ @comment errno 70 @c DO NOT REMOVE
+-Stale NFS file handle.  This indicates an internal confusion in the NFS
+-system which is due to file system rearrangements on the server host.
+-Repairing this condition usually requires unmounting and remounting
+-the NFS file system on the local host.
++Stale file handle.  This indicates an internal confusion in the
++file system which is due to file system rearrangements on the server host
++for NFS file systems or corruption in other file systems.
++Repairing this condition usually requires unmounting, possibly repairing
++and remounting the file system.
+ @end deftypevr
+ 
+ @comment errno.h
+diff --git a/sysdeps/gnu/errlist.c b/sysdeps/gnu/errlist.c
+index e3d2faf..bbd45f2 100644
+--- a/sysdeps/gnu/errlist.c
++++ b/sysdeps/gnu/errlist.c
+@@ -780,11 +780,12 @@ TRANS The user's disk quota was exceeded. */
+ #endif
+ #ifdef ESTALE
+ /*
+-TRANS Stale NFS file handle.  This indicates an internal confusion in the NFS
+-TRANS system which is due to file system rearrangements on the server host.
+-TRANS Repairing this condition usually requires unmounting and remounting
+-TRANS the NFS file system on the local host. */
+-    [ERR_REMAP (ESTALE)] = N_("Stale NFS file handle"),
++TRANS Stale file handle.  This indicates an internal confusion in the
++TRANS file system which is due to file system rearrangements on the server host
++TRANS for NFS file systems or corruption in other file systems.
++TRANS Repairing this condition usually requires unmounting, possibly repairing
++TRANS and remounting the file system. */
++    [ERR_REMAP (ESTALE)] = N_("Stale file handle"),
+ # if ESTALE > ERR_MAX
+ # undef ERR_MAX
+ # define ERR_MAX ESTALE

glibc-rh970865.patch

@@ -0,0 +1,24 @@
+diff -pruN glibc-2.18/rtkaio/tst-aiod2.c glibc-2.18.new/rtkaio/tst-aiod2.c
+--- glibc-2.18/rtkaio/tst-aiod2.c	2013-08-22 14:53:31.326806349 +0530
++++ glibc-2.18.new/rtkaio/tst-aiod2.c	2013-08-22 14:53:05.474807462 +0530
+@@ -25,7 +25,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include "tst-aiod.h"
+-
++#include <pthread.h>
+ 
+ static pthread_barrier_t b;
+ 
+diff -pruN glibc-2.18/rtkaio/tst-aiod3.c glibc-2.18.new/rtkaio/tst-aiod3.c
+--- glibc-2.18/rtkaio/tst-aiod3.c	2013-08-22 14:53:31.326806349 +0530
++++ glibc-2.18.new/rtkaio/tst-aiod3.c	2013-08-22 14:53:12.796807147 +0530
+@@ -24,7 +24,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include "tst-aiod.h"
+-
++#include <pthread.h>
+ 
+ static pthread_barrier_t b;
+ 

glibc-rh977870.patch

@@ -0,0 +1,67 @@
+commit d755bba40f880c01ced8740a26fecc85534454b9
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Wed Apr 3 10:56:45 2013 +0530
+
+    Preserve errno across _PC_CHOWN_RESTRICTED call on XFS
+    
+    Fix BZ #15305.
+    
+    On kernel versions earlier than 2.6.29, the Linux kernel exported a
+    sysctl called restrict_chown for xfs, which could be used to allow
+    chown to users other than the owner.  2.6.29 removed this support,
+    causing the open_not_cancel_2 to fail and thus modify errno.  The fix
+    is to save and restore errno so that the caller sees it as unmodified.
+    
+    Additionally, since the code to check the sysctl is not useful on
+    newer kernels, we add an ifdef so that in future the code block gets
+    rmeoved completely.
+
+diff --git a/sysdeps/unix/sysv/linux/kernel-features.h b/sysdeps/unix/sysv/linux/kernel-features.h
+index 8fdff7e..ccd4c59 100644
+--- a/sysdeps/unix/sysv/linux/kernel-features.h
++++ b/sysdeps/unix/sysv/linux/kernel-features.h
+@@ -221,3 +221,9 @@
+ #if defined __x86_64__ && __LINUX_KERNEL_VERSION >= 0x030100
+ # define __ASSUME_GETCPU_SYSCALL	1
+ #endif
++
++/* 2.6.29 removed the XFS restricted_chown sysctl, so it is pointless looking
++   for it in newer kernels.  */
++#if __LINUX_KERNEL_VERSION >= 0x02061d
++# define __ASSUME_XFS_RESTRICTED_CHOWN 1
++#endif
+diff --git a/sysdeps/unix/sysv/linux/pathconf.c b/sysdeps/unix/sysv/linux/pathconf.c
+index de91a45..723d234 100644
+--- a/sysdeps/unix/sysv/linux/pathconf.c
++++ b/sysdeps/unix/sysv/linux/pathconf.c
+@@ -289,11 +289,16 @@ __statfs_chown_restricted (int result, const struct statfs *fsbuf)
+       return -1;
+     }
+ 
++#if __ASSUME_XFS_RESTRICTED_CHOWN
++  return 1;
++#else
+   int fd;
++  int save_errno;
+   long int retval = 1;
+   switch (fsbuf->f_type)
+     {
+     case XFS_SUPER_MAGIC:
++      save_errno = errno;
+       /* Read the value from /proc/sys/fs/xfs/restrict_chown.  If we cannot
+ 	 read it default to assume the restriction is in place.  */
+       fd = open_not_cancel_2 ("/proc/sys/fs/xfs/restrict_chown", O_RDONLY);
+@@ -306,6 +311,7 @@ __statfs_chown_restricted (int result, const struct statfs *fsbuf)
+ 
+ 	  close_not_cancel_no_status (fd);
+ 	}
++      __set_errno (save_errno);
+       break;
+ 
+     default:
+@@ -313,4 +319,5 @@ __statfs_chown_restricted (int result, const struct statfs *fsbuf)
+     }
+ 
+   return retval;
++#endif
+ }

glibc-rh977872.patch

@@ -0,0 +1,268 @@
+commit adbb8027be47b3295367019b2f45863ea3d6c727
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Thu Mar 7 12:15:08 2013 +0530
+
+    Remove PIPE_BUF Linux-specific code
+    
+    Fixes BZ #12723
+    
+    The variable pipe buffer size does nothing to the value of PIPE_BUF,
+    since the number of bytes that are atomically written is still
+    PIPE_BUF on Linux.
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 2cacd21..658c47e 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -86,7 +86,8 @@ tests		:= tstgetopt testfnm runtests runptests	     \
+ 		   tst-rfc3484-3 \
+ 		   tst-getaddrinfo3 tst-fnmatch2 tst-cpucount tst-cpuset \
+ 		   bug-getopt1 bug-getopt2 bug-getopt3 bug-getopt4 \
+-		   bug-getopt5 tst-getopt_long1 bug-regex34
++		   bug-getopt5 tst-getopt_long1 bug-regex34 \
++		   tst-pathconf
+ xtests		:= bug-ga2
+ ifeq (yes,$(build-shared))
+ test-srcs	:= globtest
+diff --git a/posix/tst-pathconf.c b/posix/tst-pathconf.c
+new file mode 100644
+index 0000000..7627a24
+--- /dev/null
++++ b/posix/tst-pathconf.c
+@@ -0,0 +1,176 @@
++/* Test that values of pathconf and fpathconf are consistent for a file.
++   Copyright (C) 2013 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <fcntl.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <unistd.h>
++
++
++static void prepare (void);
++#define PREPARE(argc, argv) prepare ()
++
++static int do_test (void);
++#define TEST_FUNCTION do_test ()
++
++#include "../test-skeleton.c"
++
++static int dir_fd;
++static char *dirbuf;
++
++static void
++prepare (void)
++{
++  size_t test_dir_len = strlen (test_dir);
++  static const char dir_name[] = "/tst-pathconf.XXXXXX";
++
++  size_t dirbuflen = test_dir_len + sizeof (dir_name);
++  dirbuf = malloc (dirbuflen);
++  if (dirbuf == NULL)
++    {
++      puts ("Out of memory");
++      exit (1);
++    }
++
++  snprintf (dirbuf, dirbuflen, "%s%s", test_dir, dir_name);
++  if (mkdtemp (dirbuf) == NULL)
++    {
++      printf ("Cannot create temporary directory: %s\n", strerror (errno));
++      exit (1);
++    }
++
++  add_temp_file (dirbuf);
++
++  dir_fd = open (dirbuf, O_RDONLY);
++  if (dir_fd == -1)
++    {
++      printf ("Cannot open directory: %s\n", strerror (errno));
++      exit (1);
++    }
++}
++
++
++static int
++do_test (void)
++{
++  int ret = 0;
++  static const char *fifo_name = "some-fifo";
++
++  size_t filenamelen = strlen (dirbuf) + strlen (fifo_name) + 2;
++  char *filename = malloc (filenamelen);
++
++  snprintf (filename, filenamelen, "%s/%s", dirbuf, fifo_name);
++
++  /* Create a fifo in the directory.  */
++  int e = mkfifo (filename, 0777);
++  if (e == -1)
++    {
++      printf ("fifo creation failed (%s)\n", strerror (errno));
++      ret = 1;
++      goto out_nofifo;
++    }
++
++  long dir_pathconf = pathconf (dirbuf, _PC_PIPE_BUF);
++
++  if (dir_pathconf < 0)
++    {
++      printf ("pathconf on directory failed: %s\n", strerror (errno));
++      ret = 1;
++      goto out_nofifo;
++    }
++
++  long fifo_pathconf = pathconf (filename, _PC_PIPE_BUF);
++
++  if (fifo_pathconf < 0)
++    {
++      printf ("pathconf on file failed: %s\n", strerror (errno));
++      ret = 1;
++      goto out_nofifo;
++    }
++
++  int fifo = open (filename, O_RDONLY | O_NONBLOCK);
++
++  if (fifo < 0)
++    {
++      printf ("fifo open failed (%s)\n", strerror (errno));
++      ret = 1;
++      goto out_nofifo;
++    }
++
++  long dir_fpathconf = fpathconf (dir_fd, _PC_PIPE_BUF);
++
++  if (dir_fpathconf < 0)
++    {
++      printf ("fpathconf on directory failed: %s\n", strerror (errno));
++      ret = 1;
++      goto out;
++    }
++
++  long fifo_fpathconf = fpathconf (fifo, _PC_PIPE_BUF);
++
++  if (fifo_fpathconf < 0)
++    {
++      printf ("fpathconf on file failed: %s\n", strerror (errno));
++      ret = 1;
++      goto out;
++    }
++
++  if (fifo_pathconf != fifo_fpathconf)
++    {
++      printf ("fifo pathconf (%ld) != fifo fpathconf (%ld)\n", fifo_pathconf,
++	      fifo_fpathconf);
++      ret = 1;
++      goto out;
++    }
++
++  if (dir_pathconf != fifo_pathconf)
++    {
++      printf ("directory pathconf (%ld) != fifo pathconf (%ld)\n",
++	      dir_pathconf, fifo_pathconf);
++      ret = 1;
++      goto out;
++    }
++
++  if (dir_fpathconf != fifo_fpathconf)
++    {
++      printf ("directory fpathconf (%ld) != fifo fpathconf (%ld)\n",
++	      dir_fpathconf, fifo_fpathconf);
++      ret = 1;
++      goto out;
++    }
++
++out:
++  close (fifo);
++out_nofifo:
++  close (dir_fd);
++
++  if (unlink (filename) != 0)
++    {
++      printf ("Could not remove fifo (%s)\n", strerror (errno));
++      ret = 1;
++    }
++
++  if (rmdir (dirbuf) != 0)
++    {
++      printf ("Could not remove directory (%s)\n", strerror (errno));
++      ret = 1;
++    }
++
++  return ret;
++}
+diff --git a/sysdeps/unix/sysv/linux/fpathconf.c b/sysdeps/unix/sysv/linux/fpathconf.c
+index c971644..e8c4dc9 100644
+--- a/sysdeps/unix/sysv/linux/fpathconf.c
++++ b/sysdeps/unix/sysv/linux/fpathconf.c
+@@ -33,7 +33,6 @@ __fpathconf (fd, name)
+      int name;
+ {
+   struct statfs fsbuf;
+-  int r;
+ 
+   switch (name)
+     {
+@@ -49,12 +48,6 @@ __fpathconf (fd, name)
+     case _PC_CHOWN_RESTRICTED:
+       return __statfs_chown_restricted (__fstatfs (fd, &fsbuf), &fsbuf);
+ 
+-    case _PC_PIPE_BUF:
+-      r = __fcntl (fd, F_GETPIPE_SZ);
+-      if (r > 0)
+-	return r;
+-      /* FALLTHROUGH */
+-
+     default:
+       return posix_fpathconf (fd, name);
+     }
+diff --git a/sysdeps/unix/sysv/linux/pathconf.c b/sysdeps/unix/sysv/linux/pathconf.c
+index edc691e..de91a45 100644
+--- a/sysdeps/unix/sysv/linux/pathconf.c
++++ b/sysdeps/unix/sysv/linux/pathconf.c
+@@ -39,8 +39,6 @@ long int
+ __pathconf (const char *file, int name)
+ {
+   struct statfs fsbuf;
+-  int fd;
+-  int flags;
+ 
+   switch (name)
+     {
+@@ -56,21 +54,6 @@ __pathconf (const char *file, int name)
+     case _PC_CHOWN_RESTRICTED:
+       return __statfs_chown_restricted (__statfs (file, &fsbuf), &fsbuf);
+ 
+-    case _PC_PIPE_BUF:
+-      flags = O_RDONLY|O_NONBLOCK|O_NOCTTY;
+-#ifdef O_CLOEXEC
+-      flags |= O_CLOEXEC;
+-#endif
+-      fd = open_not_cancel_2 (file, flags);
+-      if (fd >= 0)
+-	{
+-	  long int r = __fcntl (fd, F_GETPIPE_SZ);
+-	  close_not_cancel_no_status (fd);
+-	  if (r > 0)
+-	    return r;
+-	}
+-      /* FALLTHROUGH */
+-
+     default:
+       return posix_pathconf (file, name);
+     }

glibc-rh977874.patch

@@ -0,0 +1,148 @@
+commit 7da6d9ed266105e0ebefd01a4b6bf08bf56257c3
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Tue Feb 26 14:24:40 2013 +0530
+
+    Fix FPE in memusagestat when malloc utilization is zero
+    
+    [BZ #15160]
+    
+    Draw graphs for heap and stack only if MAXSIZE_HEAP and MAXSIZE_STACK
+    are non-zero.
+
+diff --git a/malloc/memusagestat.c b/malloc/memusagestat.c
+index f561e0d..7bbd009 100644
+--- a/malloc/memusagestat.c
++++ b/malloc/memusagestat.c
+@@ -319,17 +319,26 @@ main (int argc, char *argv[])
+ 
+   for (line = 1; line <= 3; ++line)
+     {
+-      cnt = ((ysize - 40) * (maxsize_heap / 4 * line / heap_scale)) /
+-	(maxsize_heap / heap_scale);
+-      gdImageDashedLine (im_out, 40, ysize - 20 - cnt, xsize - 40,
+-			 ysize - 20 - cnt, red);
+-      snprintf (buf, sizeof (buf), heap_format, maxsize_heap / 4 * line /
+-		heap_scale);
+-      gdImageString (im_out, gdFontSmall, 39 - strlen (buf) * 6,
+-		     ysize - 26 - cnt, (unsigned char *) buf, red);
+-
+-      cnt2 = ((ysize - 40) * (maxsize_stack / 4 * line / stack_scale)) /
+-	(maxsize_stack / stack_scale);
++      if (maxsize_heap > 0)
++	{
++	  cnt = (((ysize - 40) * (maxsize_heap / 4 * line / heap_scale))
++		 / (maxsize_heap / heap_scale));
++	  gdImageDashedLine (im_out, 40, ysize - 20 - cnt, xsize - 40,
++			     ysize - 20 - cnt, red);
++	  snprintf (buf, sizeof (buf), heap_format,
++		    maxsize_heap / 4 * line / heap_scale);
++	  gdImageString (im_out, gdFontSmall, 39 - strlen (buf) * 6,
++			 ysize - 26 - cnt, (unsigned char *) buf, red);
++	}
++      else
++	cnt = 0;
++
++      if (maxsize_stack > 0)
++	cnt2 = (((ysize - 40) * (maxsize_stack / 4 * line / stack_scale))
++		/ (maxsize_stack / stack_scale));
++      else
++	cnt2 = 0;
++
+       if (cnt != cnt2)
+ 	gdImageDashedLine (im_out, 40, ysize - 20 - cnt2, xsize - 40,
+ 			   ysize - 20 - cnt2, green);
+@@ -372,7 +381,7 @@ main (int argc, char *argv[])
+ 				    ysize - 14, yellow);
+ 	  previously = now;
+ 
+-	  if (also_total)
++	  if (also_total && maxsize_heap > 0)
+ 	    {
+ 	      size_t new3;
+ 
+@@ -386,21 +395,27 @@ main (int argc, char *argv[])
+ 	      last_total = new3;
+ 	    }
+ 
+-	  // assert (entry.heap <= maxsize_heap);
+-	  new[0] = (ysize - 20) - ((((unsigned long long int) (ysize - 40))
+-				    * entry.heap) / maxsize_heap);
+-	  gdImageLine (im_out, 40 + ((xsize - 80) * (cnt - 1)) / total,
+-		       last_heap, 40 + ((xsize - 80) * cnt) / total, new[0],
+-		       red);
+-	  last_heap = new[0];
+-
+-	  // assert (entry.stack <= maxsize_stack);
+-	  new[1] = (ysize - 20) - ((((unsigned long long int) (ysize - 40))
+-				    * entry.stack) / maxsize_stack);
+-	  gdImageLine (im_out, 40 + ((xsize - 80) * (cnt - 1)) / total,
+-		       last_stack, 40 + ((xsize - 80) * cnt) / total, new[1],
+-		       green);
+-	  last_stack = new[1];
++	  if (maxsize_heap > 0)
++	    {
++	      new[0] = ((ysize - 20)
++			- ((((unsigned long long int) (ysize - 40))
++			    * entry.heap) / maxsize_heap));
++	      gdImageLine (im_out, 40 + ((xsize - 80) * (cnt - 1)) / total,
++			   last_heap, 40 + ((xsize - 80) * cnt) / total,
++			   new[0], red);
++	      last_heap = new[0];
++	    }
++
++	  if (maxsize_stack > 0)
++	    {
++	      new[1] = ((ysize - 20)
++			- ((((unsigned long long int) (ysize - 40))
++			    * entry.stack) / maxsize_stack));
++	      gdImageLine (im_out, 40 + ((xsize - 80) * (cnt - 1)) / total,
++			   last_stack, 40 + ((xsize - 80) * cnt) / total,
++			   new[1], green);
++	      last_stack = new[1];
++	    }
+ 	}
+ 
+       cnt = 0;
+@@ -448,7 +463,7 @@ main (int argc, char *argv[])
+ 	      next_tick += MAX (1, total / 20);
+ 	    }
+ 
+-	  if (also_total)
++	  if (also_total && maxsize_heap > 0)
+ 	    {
+ 	      size_t new3;
+ 
+@@ -459,16 +474,24 @@ main (int argc, char *argv[])
+ 	      last_total = new3;
+ 	    }
+ 
+-	  new[0] = (ysize - 20) - ((((unsigned long long int) (ysize - 40))
+-				    * entry.heap) / maxsize_heap);
+-	  gdImageLine (im_out, last_xpos, last_heap, xpos, new[0], red);
+-	  last_heap = new[0];
++	  if (maxsize_heap > 0)
++	    {
++	      new[0] = ((ysize - 20)
++			- ((((unsigned long long int) (ysize - 40))
++			    * entry.heap) / maxsize_heap));
++	      gdImageLine (im_out, last_xpos, last_heap, xpos, new[0], red);
++	      last_heap = new[0];
++	    }
+ 
+-	  // assert (entry.stack <= maxsize_stack);
+-	  new[1] = (ysize - 20) - ((((unsigned long long int) (ysize - 40))
+-				    * entry.stack) / maxsize_stack);
+-	  gdImageLine (im_out, last_xpos, last_stack, xpos, new[1], green);
+-	  last_stack = new[1];
++	  if (maxsize_stack > 0)
++	    {
++	      new[1] = ((ysize - 20)
++			- ((((unsigned long long int) (ysize - 40))
++			    * entry.stack) / maxsize_stack));
++	      gdImageLine (im_out, last_xpos, last_stack, xpos, new[1],
++			   green);
++	      last_stack = new[1];
++	    }
+ 
+ 	  last_xpos = xpos;
+ 	}

glibc-rh977875.patch

@@ -0,0 +1,96 @@
+commit abe7f530bf5c741fe6f0658da7be59d8db168f7f
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Wed Apr 10 11:31:46 2013 +0530
+
+    Accept leading and trailing spaces in getdate input string
+    
+    Fixes #15346.
+    
+    The POSIX description of getdate allows for extra spaces in the
+    getdate input string.  __getdate_r uses strptime internally, which
+    works fine with extra spaces between format strings (and hence within
+    an input string) but not with leading and trailing spaces.  So we trim
+    off the leading and trailing spaces before we pass it on to strptime.
+
+diff --git a/time/getdate.c b/time/getdate.c
+index 637dd18..eadebc3 100644
+--- a/time/getdate.c
++++ b/time/getdate.c
+@@ -25,6 +25,8 @@
+ #include <time.h>
+ #include <unistd.h>
+ #include <sys/stat.h>
++#include <ctype.h>
++#include <alloca.h>
+ 
+ #define TM_YEAR_BASE 1900
+ 
+@@ -135,6 +137,44 @@ __getdate_r (const char *string, struct tm *tp)
+   /* No threads reading this stream.  */
+   __fsetlocking (fp, FSETLOCKING_BYCALLER);
+ 
++  /* Skip leading whitespace.  */
++  while (isspace (*string))
++    string++;
++
++  size_t inlen, oldlen;
++
++  oldlen = inlen = strlen (string);
++
++  /* Skip trailing whitespace.  */
++  while (inlen > 0 && isspace (string[inlen - 1]))
++    inlen--;
++
++  char *instr = NULL;
++
++  if (inlen < oldlen)
++    {
++      bool using_malloc = false;
++
++      if (__libc_use_alloca (inlen + 1))
++	instr = alloca (inlen + 1);
++      else
++	{
++	  instr = malloc (inlen + 1);
++	  if (instr == NULL)
++	    {
++	      fclose (fp);
++	      return 6;
++	    }
++	  using_malloc = true;
++	}
++      memcpy (instr, string, inlen);
++      instr[inlen] = '\0';
++      string = instr;
++
++      if (!using_malloc)
++	instr = NULL;
++    }
++
+   line = NULL;
+   len = 0;
+   do
+@@ -159,6 +199,8 @@ __getdate_r (const char *string, struct tm *tp)
+     }
+   while (!feof_unlocked (fp));
+ 
++  free (instr);
++
+   /* Free the buffer.  */
+   free (line);
+ 
+diff --git a/time/tst-getdate.c b/time/tst-getdate.c
+index 7604e83..dc8ecf4 100644
+--- a/time/tst-getdate.c
++++ b/time/tst-getdate.c
+@@ -31,6 +31,10 @@ static const struct
+ } tests [] =
+ {
+   {"21:01:10 1999-1-31", "Universal", 0, {10, 1, 21, 31, 0, 99, 0, 0, 0}},
++  {"21:01:10    1999-1-31", "Universal", 0, {10, 1, 21, 31, 0, 99, 0, 0, 0}},
++  {"   21:01:10 1999-1-31", "Universal", 0, {10, 1, 21, 31, 0, 99, 0, 0, 0}},
++  {"21:01:10 1999-1-31   ", "Universal", 0, {10, 1, 21, 31, 0, 99, 0, 0, 0}},
++  {"    21:01:10 1999-1-31   ", "Universal", 0, {10, 1, 21, 31, 0, 99, 0, 0, 0}},
+   {"21:01:10 1999-2-28", "Universal", 0, {10, 1, 21, 28, 1, 99, 0, 0, 0}},
+   {"16:30:46 2000-2-29", "Universal", 0, {46, 30,16, 29, 1, 100, 0, 0, 0}},
+   {"01-08-2000 05:06:07", "Europe/Berlin", 0, {7, 6, 5, 1, 7, 100, 0, 0, 0}}

glibc-rh977887-2.patch

@@ -0,0 +1,337 @@
+commit 2506109403de69bd454de27835d42e6eb6ec3abc
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Wed Jun 12 10:36:48 2013 +0530
+
+    Set/restore rounding mode only when needed
+    
+    The most common use case of math functions is with default rounding
+    mode, i.e. rounding to nearest.  Setting and restoring rounding mode
+    is an unnecessary overhead for this, so I've added support for a
+    context, which does the set/restore only if the FP status needs a
+    change.  The code is written such that only x86 uses these.  Other
+    architectures should be unaffected by it, but would definitely benefit
+    if the set/restore has as much overhead relative to the rest of the
+    code, as the x86 bits do.
+    
+    Here's a summary of the performance improvement due to these
+    improvements; I've only mentioned functions that use the set/restore
+    and have benchmark inputs for x86_64:
+    
+    Before:
+    
+    cos(): ITERS:4.69335e+08: TOTAL:28884.6Mcy, MAX:4080.28cy, MIN:57.562cy, 16248.6 calls/Mcy
+    exp(): ITERS:4.47604e+08: TOTAL:28796.2Mcy, MAX:207.721cy, MIN:62.385cy, 15543.9 calls/Mcy
+    pow(): ITERS:1.63485e+08: TOTAL:28879.9Mcy, MAX:362.255cy, MIN:172.469cy, 5660.86 calls/Mcy
+    sin(): ITERS:3.89578e+08: TOTAL:28900Mcy, MAX:704.859cy, MIN:47.583cy, 13480.2 calls/Mcy
+    tan(): ITERS:7.0971e+07: TOTAL:28902.2Mcy, MAX:1357.79cy, MIN:388.58cy, 2455.55 calls/Mcy
+    
+    After:
+    
+    cos(): ITERS:6.0014e+08: TOTAL:28875.9Mcy, MAX:364.283cy, MIN:45.716cy, 20783.4 calls/Mcy
+    exp(): ITERS:5.48578e+08: TOTAL:28764.9Mcy, MAX:191.617cy, MIN:51.011cy, 19071.1 calls/Mcy
+    pow(): ITERS:1.70013e+08: TOTAL:28873.6Mcy, MAX:689.522cy, MIN:163.989cy, 5888.18 calls/Mcy
+    sin(): ITERS:4.64079e+08: TOTAL:28891.5Mcy, MAX:6959.3cy, MIN:36.189cy, 16062.8 calls/Mcy
+    tan(): ITERS:7.2354e+07: TOTAL:28898.9Mcy, MAX:1295.57cy, MIN:380.698cy, 2503.7 calls/Mcy
+    
+    So the improvements are:
+    
+    cos: 27.9089%
+    exp: 22.6919%
+    pow: 4.01564%
+    sin: 19.1585%
+    tan: 1.96086%
+    
+    The downside of the change is that it will have an adverse performance
+    impact on non-default rounding modes, but I think the tradeoff is
+    justified.
+
+diff --git a/include/fenv.h b/include/fenv.h
+index ed6d139..9f90d17 100644
+--- a/include/fenv.h
++++ b/include/fenv.h
+@@ -1,5 +1,6 @@
+ #ifndef _FENV_H
+ #include <math/fenv.h>
++#include <stdbool.h>
+ 
+ #ifndef _ISOMAC
+ /* Now define the internal interfaces.  */
+@@ -23,4 +24,13 @@ libm_hidden_proto (fetestexcept)
+ libm_hidden_proto (feclearexcept)
+ #endif
+ 
++/* Rounding mode context.  This allows functions to set/restore rounding mode
++   only when the desired rounding mode is different from the current rounding
++   mode.  */
++struct rm_ctx
++{
++  fenv_t env;
++  bool updated_status;
++};
++
+ #endif
+diff --git a/sysdeps/generic/math_private.h b/sysdeps/generic/math_private.h
+index e98360d..c0fc03d 100644
+--- a/sysdeps/generic/math_private.h
++++ b/sysdeps/generic/math_private.h
+@@ -553,35 +553,62 @@ default_libc_feupdateenv_test (fenv_t *e, int ex)
+ # define libc_feresetround_noexl libc_fesetenvl
+ #endif
+ 
++#if HAVE_RM_CTX
++/* Set/Restore Rounding Modes only when necessary.  If defined, these functions
++   set/restore floating point state only if the state needed within the lexical
++   block is different from the current state.  This saves a lot of time when
++   the floating point unit is much slower than the fixed point units.  */
++
++# ifndef libc_feresetround_noex_ctx
++#   define libc_feresetround_noex_ctx  libc_fesetenv_ctx
++# endif
++# ifndef libc_feresetround_noexf_ctx
++#   define libc_feresetround_noexf_ctx libc_fesetenvf_ctx
++# endif
++# ifndef libc_feresetround_noexl_ctx
++#   define libc_feresetround_noexl_ctx libc_fesetenvl_ctx
++# endif
++
++# ifndef libc_feholdsetround_53bit_ctx
++#   define libc_feholdsetround_53bit_ctx libc_feholdsetround_ctx
++# endif
++
++# ifndef libc_feresetround_53bit_ctx
++#   define libc_feresetround_53bit_ctx libc_feresetround_ctx
++# endif
++
++# define SET_RESTORE_ROUND_GENERIC(RM,ROUNDFUNC,CLEANUPFUNC) \
++  struct rm_ctx ctx __attribute__((cleanup(CLEANUPFUNC ## _ctx)));	      \
++  ROUNDFUNC ## _ctx (&ctx, (RM))
++#else
++# define SET_RESTORE_ROUND_GENERIC(RM, ROUNDFUNC, CLEANUPFUNC) \
++  fenv_t __libc_save_rm __attribute__((cleanup(CLEANUPFUNC)));	\
++  ROUNDFUNC (&__libc_save_rm, (RM))
++#endif
++
+ /* Save and restore the rounding mode within a lexical block.  */
+ 
+ #define SET_RESTORE_ROUND(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround)));	\
+-  libc_feholdsetround (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetround, libc_feresetround)
+ #define SET_RESTORE_ROUNDF(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetroundf)));	\
+-  libc_feholdsetroundf (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetroundf, libc_feresetroundf)
+ #define SET_RESTORE_ROUNDL(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetroundl)));	\
+-  libc_feholdsetroundl (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetroundl, libc_feresetroundl)
+ 
+ /* Save and restore the rounding mode within a lexical block, and also
+    the set of exceptions raised within the block may be discarded.  */
+ 
+ #define SET_RESTORE_ROUND_NOEX(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround_noex))); \
+-  libc_feholdsetround (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetround, libc_feresetround_noex)
+ #define SET_RESTORE_ROUND_NOEXF(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround_noexf))); \
+-  libc_feholdsetroundf (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetroundf, libc_feresetround_noexf)
+ #define SET_RESTORE_ROUND_NOEXL(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround_noexl))); \
+-  libc_feholdsetroundl (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetroundl, libc_feresetround_noexl)
+ 
+ /* Like SET_RESTORE_ROUND, but also set rounding precision to 53 bits.  */
+ #define SET_RESTORE_ROUND_53BIT(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround_53bit))); \
+-  libc_feholdsetround_53bit (&__libc_save_rm, (RM))
++  SET_RESTORE_ROUND_GENERIC (RM, libc_feholdsetround_53bit,	      \
++			     libc_feresetround_53bit)
+ 
+ #define __nan(str) \
+   (__builtin_constant_p (str) && str[0] == '\0' ? NAN : __nan (str))
+diff --git a/sysdeps/i386/fpu/fenv_private.h b/sysdeps/i386/fpu/fenv_private.h
+index 1f8336c..3998387 100644
+--- a/sysdeps/i386/fpu/fenv_private.h
++++ b/sysdeps/i386/fpu/fenv_private.h
+@@ -322,6 +322,179 @@ libc_feresetround_387 (fenv_t *e)
+ # define libc_feholdsetround_53bit	libc_feholdsetround_387_53bit
+ #endif
+ 
++/* We have support for rounding mode context.  */
++#define HAVE_RM_CTX 1
++
++static __always_inline void
++libc_feholdexcept_setround_sse_ctx (struct rm_ctx *ctx, int r)
++{
++  unsigned int mxcsr, new_mxcsr;
++  asm (STMXCSR " %0" : "=m" (*&mxcsr));
++  new_mxcsr = ((mxcsr | 0x1f80) & ~0x603f) | (r << 3);
++
++  ctx->env.__mxcsr = mxcsr;
++  if (__glibc_unlikely (mxcsr != new_mxcsr))
++    {
++      asm volatile (LDMXCSR " %0" : : "m" (*&new_mxcsr));
++      ctx->updated_status = true;
++    }
++  else
++    ctx->updated_status = false;
++}
++
++/* Unconditional since we want to overwrite any exceptions that occurred in the
++   context.  This is also why all fehold* functions unconditionally write into
++   ctx->env.  */
++static __always_inline void
++libc_fesetenv_sse_ctx (struct rm_ctx *ctx)
++{
++  libc_fesetenv_sse (&ctx->env);
++}
++
++static __always_inline void
++libc_feupdateenv_sse_ctx (struct rm_ctx *ctx)
++{
++  if (__glibc_unlikely (ctx->updated_status))
++    libc_feupdateenv_test_sse (&ctx->env, 0);
++}
++
++static __always_inline void
++libc_feholdexcept_setround_387_prec_ctx (struct rm_ctx *ctx, int r)
++{
++  libc_feholdexcept_387 (&ctx->env);
++
++  fpu_control_t cw = ctx->env.__control_word;
++  fpu_control_t old_cw = cw;
++  cw &= ~(_FPU_RC_ZERO | _FPU_EXTENDED);
++  cw |= r | 0x3f;
++
++  if (__glibc_unlikely (old_cw != cw))
++    {
++      _FPU_SETCW (cw);
++      ctx->updated_status = true;
++    }
++  else
++    ctx->updated_status = false;
++}
++
++static __always_inline void
++libc_feholdexcept_setround_387_ctx (struct rm_ctx *ctx, int r)
++{
++  libc_feholdexcept_setround_387_prec_ctx (ctx, r | _FPU_EXTENDED);
++}
++
++static __always_inline void
++libc_feholdexcept_setround_387_53bit_ctx (struct rm_ctx *ctx, int r)
++{
++  libc_feholdexcept_setround_387_prec_ctx (ctx, r | _FPU_DOUBLE);
++}
++
++static __always_inline void
++libc_feholdsetround_387_prec_ctx (struct rm_ctx *ctx, int r)
++{
++  fpu_control_t cw, new_cw;
++
++  _FPU_GETCW (cw);
++  new_cw = cw;
++  new_cw &= ~(_FPU_RC_ZERO | _FPU_EXTENDED);
++  new_cw |= r;
++
++  ctx->env.__control_word = cw;
++  if (__glibc_unlikely (new_cw != cw))
++    {
++      _FPU_SETCW (new_cw);
++      ctx->updated_status = true;
++    }
++  else
++    ctx->updated_status = false;
++}
++
++static __always_inline void
++libc_feholdsetround_387_ctx (struct rm_ctx *ctx, int r)
++{
++  libc_feholdsetround_387_prec_ctx (ctx, r | _FPU_EXTENDED);
++}
++
++static __always_inline void
++libc_feholdsetround_387_53bit_ctx (struct rm_ctx *ctx, int r)
++{
++  libc_feholdsetround_387_prec_ctx (ctx, r | _FPU_DOUBLE);
++}
++
++static __always_inline void
++libc_feholdsetround_sse_ctx (struct rm_ctx *ctx, int r)
++{
++  unsigned int mxcsr, new_mxcsr;
++
++  asm (STMXCSR " %0" : "=m" (*&mxcsr));
++  new_mxcsr = (mxcsr & ~0x6000) | (r << 3);
++
++  ctx->env.__mxcsr = mxcsr;
++  if (__glibc_unlikely (new_mxcsr != mxcsr))
++    {
++      asm volatile (LDMXCSR " %0" : : "m" (*&new_mxcsr));
++      ctx->updated_status = true;
++    }
++  else
++    ctx->updated_status = false;
++}
++
++static __always_inline void
++libc_feresetround_sse_ctx (struct rm_ctx *ctx)
++{
++  if (__glibc_unlikely (ctx->updated_status))
++    libc_feresetround_sse (&ctx->env);
++}
++
++static __always_inline void
++libc_feresetround_387_ctx (struct rm_ctx *ctx)
++{
++  if (__glibc_unlikely (ctx->updated_status))
++    _FPU_SETCW (ctx->env.__control_word);
++}
++
++static __always_inline void
++libc_feupdateenv_387_ctx (struct rm_ctx *ctx)
++{
++  if (__glibc_unlikely (ctx->updated_status))
++    libc_feupdateenv_test_387 (&ctx->env, 0);
++}
++
++#ifdef __SSE_MATH__
++# define libc_feholdexcept_setroundf_ctx libc_feholdexcept_setround_sse_ctx
++# define libc_fesetenvf_ctx		libc_fesetenv_sse_ctx
++# define libc_feupdateenvf_ctx		libc_feupdateenv_sse_ctx
++# define libc_feholdsetroundf_ctx	libc_feholdsetround_sse_ctx
++# define libc_feresetroundf_ctx		libc_feresetround_sse_ctx
++#else
++# define libc_feholdexcept_setroundf_ctx libc_feholdexcept_setround_387_ctx
++# define libc_feupdateenvf_ctx		libc_feupdateenv_387_ctx
++# define libc_feholdsetroundf_ctx	libc_feholdsetround_387_ctx
++# define libc_feresetroundf_ctx		libc_feresetround_387_ctx
++#endif /* __SSE_MATH__ */
++
++#ifdef __SSE2_MATH__
++# define libc_feholdexcept_setround_ctx	libc_feholdexcept_setround_sse_ctx
++# define libc_fesetenv_ctx		libc_fesetenv_sse_ctx
++# define libc_feupdateenv_ctx		libc_feupdateenv_sse_ctx
++# define libc_feholdsetround_ctx	libc_feholdsetround_sse_ctx
++# define libc_feresetround_ctx		libc_feresetround_sse_ctx
++#else
++# define libc_feholdexcept_setround_ctx	libc_feholdexcept_setround_387_ctx
++# define libc_feupdateenv_ctx		libc_feupdateenv_387_ctx
++# define libc_feresetround_ctx		libc_feresetround_387_ctx
++#endif /* __SSE2_MATH__ */
++
++#define libc_feholdexcept_setroundl_ctx	libc_feholdexcept_setround_387_ctx
++#define libc_feupdateenvl_ctx		libc_feupdateenv_387_ctx
++#define libc_feholdsetroundl_ctx	libc_feholdsetround_387_ctx
++#define libc_feresetroundl_ctx		libc_feresetround_387_ctx
++
++#ifndef __SSE2_MATH__
++# define libc_feholdsetround_53bit_ctx	libc_feholdsetround_387_53bit_ctx
++# define libc_feresetround_53bit_ctx	libc_feresetround_387_ctx
++#endif
++
+ #undef __mxcsr
+ 
+ #endif /* FENV_PRIVATE_H */

glibc-rh977887.patch

@@ -0,0 +1,46 @@
+commit 4c60cb0c8329dd498e9cce3735e5ee6212ad28f4
+Author: Siddhesh Poyarekar <siddhesh@redhat.com>
+Date:   Wed Jun 5 13:56:19 2013 +0530
+
+    Skip modifying exception mask and flags in SET_RESTORE_ROUND_53BIT
+    
+    We only need to set/restore rounding mode to ensure correct
+    computation for non-default rounding modes.
+
+diff --git a/sysdeps/generic/math_private.h b/sysdeps/generic/math_private.h
+index 9d6ecad..e98360d 100644
+--- a/sysdeps/generic/math_private.h
++++ b/sysdeps/generic/math_private.h
+@@ -446,8 +446,8 @@ default_libc_feholdexcept_setround (fenv_t *e, int r)
+ # define libc_feholdexcept_setroundl default_libc_feholdexcept_setround
+ #endif
+ 
+-#ifndef libc_feholdexcept_setround_53bit
+-# define libc_feholdexcept_setround_53bit libc_feholdexcept_setround
++#ifndef libc_feholdsetround_53bit
++# define libc_feholdsetround_53bit libc_feholdsetround
+ #endif
+ 
+ #ifndef libc_fetestexcept
+@@ -492,8 +492,8 @@ default_libc_feupdateenv (fenv_t *e)
+ # define libc_feupdateenvl default_libc_feupdateenv
+ #endif
+ 
+-#ifndef libc_feupdateenv_53bit
+-# define libc_feupdateenv_53bit libc_feupdateenv
++#ifndef libc_feresetround_53bit
++# define libc_feresetround_53bit libc_feresetround
+ #endif
+ 
+ static __always_inline int
+@@ -580,8 +580,8 @@ default_libc_feupdateenv_test (fenv_t *e, int ex)
+ 
+ /* Like SET_RESTORE_ROUND, but also set rounding precision to 53 bits.  */
+ #define SET_RESTORE_ROUND_53BIT(RM) \
+-  fenv_t __libc_save_rm __attribute__((cleanup(libc_feupdateenv_53bit))); \
+-  libc_feholdexcept_setround_53bit (&__libc_save_rm, (RM))
++  fenv_t __libc_save_rm __attribute__((cleanup(libc_feresetround_53bit))); \
++  libc_feholdsetround_53bit (&__libc_save_rm, (RM))
+ 
+ #define __nan(str) \
+   (__builtin_constant_p (str) && str[0] == '\0' ? NAN : __nan (str))

glibc-rh984829.patch

@@ -0,0 +1,239 @@
+#* CVE-2013-2207 Incorrectly granting access to another user's pseudo-terminal
+#  has been fixed by disabling the use of pt_chown (Bugzilla #15755).
+#  Distributions can re-enable building and using pt_chown via the new configure
+#  option `--enable-pt_chown'.  Enabling the use of pt_chown carries with it
+#  considerable security risks and should only be used if the distribution
+#  understands and accepts the risks.
+#
+#2013-07-21  Siddhesh Poyarekar  <siddhesh@redhat.com>
+#	    Andreas Schwab  <schwab@suse.de>
+#	    Roland McGrath  <roland@hack.frob.com>
+#	    Joseph Myers  <joseph@codesourcery.com>
+#	    Carlos O'Donell  <carlos@redhat.com>
+#
+#	[BZ #15755]
+#	* config.h.in: Define HAVE_PT_CHOWN.
+#	* config.make.in (build-pt-chown): New variable.
+#	* configure.in (--enable-pt_chown): New configure option.
+#	* configure: Regenerate.
+#	* login/Makefile: Include Makeconfig.  Build pt_chown only if
+#	build-pt-chown is enabled.
+#	* sysdeps/unix/grantpt.c (grantpt) [HAVE_PT_CHOWN]: Spawn
+#	pt_chown to fix pty ownership.
+#	* sysdeps/unix/sysv/linux/grantpt.c [HAVE_PT_CHOWN]: Define
+#	CLOSE_ALL_FDS.
+#	* manual/install.texi (Configuring and compiling): Mention
+#	--enable-pt_chown. Add @findex for grantpt.
+#	* INSTALL: Regenerate.
+#
+diff -Nrup a/config.h.in b/config.h.in
+--- a/config.h.in	2012-12-24 22:02:13.000000000 -0500
++++ b/config.h.in	2013-07-24 00:20:07.651301252 -0400
+@@ -232,4 +232,7 @@
+ /* The ARM hard-float ABI is being used.  */
+ #undef HAVE_ARM_PCS_VFP
+ 
++/* The pt_chown binary is being built and used by grantpt.  */
++#undef HAVE_PT_CHOWN
++
+ #endif
+diff -Nrup a/config.make.in b/config.make.in
+--- a/config.make.in	2012-12-24 22:02:13.000000000 -0500
++++ b/config.make.in	2013-07-24 00:21:15.244176098 -0400
+@@ -101,6 +101,7 @@ force-install = @force_install@
+ link-obsolete-rpc = @link_obsolete_rpc@
+ build-nscd = @build_nscd@
+ use-nscd = @use_nscd@
++build-pt-chown = @build_pt_chown@
+ 
+ # Build tools.
+ CC = @CC@
+diff -Nrup a/configure b/configure
+--- a/configure	2013-07-24 00:25:10.090174244 -0400
++++ b/configure	2013-07-24 00:20:07.769174345 -0400
+@@ -653,6 +653,7 @@ multi_arch
+ base_machine
+ add_on_subdirs
+ add_ons
++build_pt_chown
+ build_nscd
+ link_obsolete_rpc
+ libc_cv_nss_crypt
+@@ -759,6 +760,7 @@ enable_obsolete_rpc
+ enable_systemtap
+ enable_build_nscd
+ enable_nscd
++enable_pt_chown
+ with_cpu
+ '
+       ac_precious_vars='build_alias
+@@ -1419,6 +1421,7 @@ Optional Features:
+   --enable-systemtap      enable systemtap static probe points [default=no]
+   --disable-build-nscd    disable building and installing the nscd daemon
+   --disable-nscd          library functions will not contact the nscd daemon
++  --enable-pt_chown       Enable building and installing pt_chown
+ 
+ Optional Packages:
+   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
+@@ -3934,6 +3937,19 @@ else
+ fi
+ 
+ 
++# Check whether --enable-pt_chown was given.
++if test "${enable_pt_chown+set}" = set; then :
++  enableval=$enable_pt_chown; build_pt_chown=$enableval
++else
++  build_pt_chown=no
++fi
++
++
++if test $build_pt_chown = yes; then
++  $as_echo "#define HAVE_PT_CHOWN 1" >>confdefs.h
++
++fi
++
+ # The way shlib-versions is used to generate soversions.mk uses a
+ # fairly simplistic model for name recognition that can't distinguish
+ # i486-pc-linux-gnu fully from i486-pc-gnu.  So we mutate a $host_os
+diff -Nrup a/configure.in b/configure.in
+--- a/configure.in	2012-12-24 22:02:13.000000000 -0500
++++ b/configure.in	2013-07-24 00:20:07.658298658 -0400
+@@ -315,6 +315,16 @@ AC_ARG_ENABLE([nscd],
+ 	      [use_nscd=$enableval],
+ 	      [use_nscd=yes])
+ 
++AC_ARG_ENABLE([pt_chown],
++	      [AS_HELP_STRING([--enable-pt_chown],
++	       [Enable building and installing pt_chown])],
++	      [build_pt_chown=$enableval],
++	      [build_pt_chown=no])
++AC_SUBST(build_pt_chown)
++if test $build_pt_chown = yes; then
++  AC_DEFINE(HAVE_PT_CHOWN)
++fi
++
+ # The way shlib-versions is used to generate soversions.mk uses a
+ # fairly simplistic model for name recognition that can't distinguish
+ # i486-pc-linux-gnu fully from i486-pc-gnu.  So we mutate a $host_os
+diff -Nrup a/INSTALL b/INSTALL
+--- a/INSTALL	2012-12-24 22:02:13.000000000 -0500
++++ b/INSTALL	2013-07-24 00:20:07.650300624 -0400
+@@ -128,6 +128,18 @@ will be used, and CFLAGS sets optimizati
+      this can be prevented though there generally is no reason since it
+      creates compatibility problems.
+ 
++`--enable-pt_chown'
++     The file `pt_chown' is a helper binary for `grantpt' (*note
++     Pseudo-Terminals: Allocation.) that is installed setuid root to
++     fix up pseudo-terminal ownership.  It is not built by default
++     because systems using the Linux kernel are commonly built with the
++     `devpts' filesystem enabled and mounted at `/dev/pts', which
++     manages pseudo-terminal ownership automatically.  By using
++     `--enable-pt_chown', you may build `pt_chown' and install it
++     setuid and owned by `root'.  The use of `pt_chown' introduces
++     additional security risks to the system and you should enable it
++     only if you understand and accept those risks.
++
+ `--build=BUILD-SYSTEM'
+ `--host=HOST-SYSTEM'
+      These options are for cross-compiling.  If you specify both
+diff -Nrup a/login/Makefile b/login/Makefile
+--- a/login/Makefile	2012-12-24 22:02:13.000000000 -0500
++++ b/login/Makefile	2013-07-24 00:20:07.660298670 -0400
+@@ -29,9 +29,15 @@ routines := getutent getutent_r getutid 
+ 
+ CFLAGS-grantpt.c = -DLIBEXECDIR='"$(libexecdir)"'
+ 
+-others = utmpdump pt_chown
++others = utmpdump
++
++include ../Makeconfig
++
++ifeq (yes,$(build-pt-chown))
++others += pt_chown
+ others-pie = pt_chown
+ install-others-programs = $(inst_libexecdir)/pt_chown
++endif
+ 
+ subdir-dirs = programs
+ vpath %.c programs
+diff -Nrup a/manual/install.texi b/manual/install.texi
+--- a/manual/install.texi	2012-12-24 22:02:13.000000000 -0500
++++ b/manual/install.texi	2013-07-24 00:20:07.662298261 -0400
+@@ -155,6 +155,20 @@ if the used tools support it.  By using 
+ prevented though there generally is no reason since it creates
+ compatibility problems.
+ 
++@pindex pt_chown
++@findex grantpt
++@item --enable-pt_chown
++The file @file{pt_chown} is a helper binary for @code{grantpt}
++(@pxref{Allocation, Pseudo-Terminals}) that is installed setuid root to
++fix up pseudo-terminal ownership.  It is not built by default because
++systems using the Linux kernel are commonly built with the @code{devpts}
++filesystem enabled and mounted at @file{/dev/pts}, which manages
++pseudo-terminal ownership automatically.  By using
++@samp{--enable-pt_chown}, you may build @file{pt_chown} and install it
++setuid and owned by @code{root}.  The use of @file{pt_chown} introduces
++additional security risks to the system and you should enable it only if
++you understand and accept those risks.
++
+ @item --build=@var{build-system}
+ @itemx --host=@var{host-system}
+ These options are for cross-compiling.  If you specify both options and
+diff -Nrup a/sysdeps/unix/grantpt.c b/sysdeps/unix/grantpt.c
+--- a/sysdeps/unix/grantpt.c	2012-12-24 22:02:13.000000000 -0500
++++ b/sysdeps/unix/grantpt.c	2013-07-24 00:20:07.663299235 -0400
+@@ -173,9 +173,10 @@ grantpt (int fd)
+   retval = 0;
+   goto cleanup;
+ 
+-  /* We have to use the helper program.  */
++  /* We have to use the helper program if it is available.  */
+  helper:;
+ 
++#ifdef HAVE_PT_CHOWN
+   pid_t pid = __fork ();
+   if (pid == -1)
+     goto cleanup;
+@@ -190,9 +191,9 @@ grantpt (int fd)
+ 	if (__dup2 (fd, PTY_FILENO) < 0)
+ 	  _exit (FAIL_EBADF);
+ 
+-#ifdef CLOSE_ALL_FDS
++# ifdef CLOSE_ALL_FDS
+       CLOSE_ALL_FDS ();
+-#endif
++# endif
+ 
+       execle (_PATH_PT_CHOWN, basename (_PATH_PT_CHOWN), NULL, NULL);
+       _exit (FAIL_EXEC);
+@@ -231,6 +232,7 @@ grantpt (int fd)
+ 	    assert(! "getpt: internal error: invalid exit code from pt_chown");
+ 	  }
+     }
++#endif
+ 
+  cleanup:
+   if (buf != _buf)
+diff -Nrup a/sysdeps/unix/sysv/linux/grantpt.c b/sysdeps/unix/sysv/linux/grantpt.c
+--- a/sysdeps/unix/sysv/linux/grantpt.c	2012-12-24 22:02:13.000000000 -0500
++++ b/sysdeps/unix/sysv/linux/grantpt.c	2013-07-24 00:20:07.664298465 -0400
+@@ -11,7 +11,7 @@
+ 
+ #include "pty-private.h"
+ 
+-
++#if HAVE_PT_CHOWN
+ /* Close all file descriptors except the one specified.  */
+ static void
+ close_all_fds (void)
+@@ -38,6 +38,7 @@ close_all_fds (void)
+       __dup2 (STDOUT_FILENO, STDERR_FILENO);
+     }
+ }
+-#define CLOSE_ALL_FDS() close_all_fds()
++# define CLOSE_ALL_FDS() close_all_fds()
++#endif
+ 
+ #include <sysdeps/unix/grantpt.c>

glibc-rh985342.patch

@@ -0,0 +1,40 @@
+#
+# Both of these change are required and alraedy upstream.
+#
+# 2013-08-28  Kyle McMartin  <kyle@redhat.com>
+#	    Carlos O'Donell  <carlos@redhat.com>
+#
+#	* sysdeps/arm/dl-machine [!RTLD_BOOTSTRAP] (elf_machine_rel):
+#	Pass GLRO(dl_hwcap) to the IFUNC resolver.
+#
+# 2013-07-02  Will Newton  <will.newton@linaro.org>
+#
+#	* sysdeps/arm/dl-machine.h (elf_machine_rela): Pass dl_hwcap
+#	to IFUNC resolver functions.
+#
+diff --git a/ports/sysdeps/arm/dl-machine.h b/ports/sysdeps/arm/dl-machine.h
+index d251527..85dba67 100644
+--- a/ports/sysdeps/arm/dl-machine.h
++++ b/ports/sysdeps/arm/dl-machine.h
+@@ -503,7 +503,7 @@ elf_machine_rel (struct link_map *map, const Elf32_Rel *reloc,
+ 	  break;
+ 	case R_ARM_IRELATIVE:
+ 	  value = map->l_addr + *reloc_addr;
+-	  value = ((Elf32_Addr (*) (void)) value) ();
++	  value = ((Elf32_Addr (*) (int)) value) (GLRO(dl_hwcap));
+ 	  *reloc_addr = value;
+ 	  break;
+ #endif
+diff --git a/ports/sysdeps/arm/dl-machine.h b/ports/sysdeps/arm/dl-machine.h
+index 4cf87a9..d251527 100644
+--- a/ports/sysdeps/arm/dl-machine.h
++++ b/ports/sysdeps/arm/dl-machine.h
+@@ -595,7 +595,7 @@ elf_machine_rela (struct link_map *map, const Elf32_Rela *reloc,
+ 	  break;
+ 	case R_ARM_IRELATIVE:
+ 	  value = map->l_addr + *reloc_addr;
+-	  value = ((Elf32_Addr (*) (void)) value) ();
++	  value = ((Elf32_Addr (*) (int)) value) (GLRO(dl_hwcap));
+ 	  *reloc_addr = value;
+ 	  break;
+ #endif

glibc-rh985625-CVE-2013-4788.patch

@@ -0,0 +1,504 @@
+#
+# Already upstream.
+# 
+# commit 0b1f8e35640f5b3f7af11764ade3ff060211c309
+# Author: Carlos O'Donell <carlos@redhat.com>
+# Date:   Mon Sep 23 01:44:38 2013 -0400
+#
+#    BZ #15754: Fix test case for ARM.
+#    
+#    Statically built binaries use __pointer_chk_guard_local,
+#    while dynamically built binaries use __pointer_chk_guard.
+#    Provide the right definition depending on the test case
+#    we are building.
+#
+# commit c61b4d41c9647a54a329aa021341c0eb032b793e
+# Author: Carlos O'Donell <carlos@redhat.com>
+# Date:   Mon Sep 23 00:52:09 2013 -0400
+#
+#    BZ #15754: CVE-2013-4788
+#    
+#    The pointer guard used for pointer mangling was not initialized for
+#    static applications resulting in the security feature being disabled.
+#    The pointer guard is now correctly initialized to a random value for
+#    static applications. Existing static applications need to be
+#    recompiled to take advantage of the fix.
+#    
+#    The test tst-ptrguard1-static and tst-ptrguard1 add regression
+#    coverage to ensure the pointer guards are sufficiently random
+#    and initialized to a default value.
+#
+#
+diff --git a/csu/libc-start.c b/csu/libc-start.c
+index e5da3ef..c898d06 100644
+--- a/csu/libc-start.c
++++ b/csu/libc-start.c
+@@ -37,6 +37,12 @@ extern void __pthread_initialize_minimal (void);
+    in thread local area.  */
+ uintptr_t __stack_chk_guard attribute_relro;
+ # endif
++# ifndef  THREAD_SET_POINTER_GUARD
++/* Only exported for architectures that don't store the pointer guard
++   value in thread local area.  */
++uintptr_t __pointer_chk_guard_local
++	attribute_relro attribute_hidden __attribute__ ((nocommon));
++# endif
+ #endif
+ 
+ #ifdef HAVE_PTR_NTHREADS
+@@ -195,6 +201,16 @@ LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
+ # else
+   __stack_chk_guard = stack_chk_guard;
+ # endif
++
++  /* Set up the pointer guard value.  */
++  uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
++							 stack_chk_guard);
++# ifdef THREAD_SET_POINTER_GUARD
++  THREAD_SET_POINTER_GUARD (pointer_chk_guard);
++# else
++  __pointer_chk_guard_local = pointer_chk_guard;
++# endif
++
+ #endif
+ 
+   /* Register the destructor of the dynamic linker if there is any.  */
+diff --git a/elf/tst-ptrguard1-static.c b/elf/tst-ptrguard1-static.c
+new file mode 100644
+index 0000000..7aff3b7
+--- /dev/null
++++ b/elf/tst-ptrguard1-static.c
+@@ -0,0 +1 @@
++#include "tst-ptrguard1.c"
+diff --git a/elf/tst-ptrguard1.c b/elf/tst-ptrguard1.c
+new file mode 100644
+index 0000000..c344a04
+--- /dev/null
++++ b/elf/tst-ptrguard1.c
+@@ -0,0 +1,202 @@
++/* Copyright (C) 2013 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <errno.h>
++#include <stdbool.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/wait.h>
++#include <stackguard-macros.h>
++#include <tls.h>
++#include <unistd.h>
++
++#ifndef POINTER_CHK_GUARD
++extern uintptr_t __pointer_chk_guard;
++# define POINTER_CHK_GUARD __pointer_chk_guard
++#endif
++
++static const char *command;
++static bool child;
++static uintptr_t ptr_chk_guard_copy;
++static bool ptr_chk_guard_copy_set;
++static int fds[2];
++
++static void __attribute__ ((constructor))
++con (void)
++{
++  ptr_chk_guard_copy = POINTER_CHK_GUARD;
++  ptr_chk_guard_copy_set = true;
++}
++
++static int
++uintptr_t_cmp (const void *a, const void *b)
++{
++  if (*(uintptr_t *) a < *(uintptr_t *) b)
++    return 1;
++  if (*(uintptr_t *) a > *(uintptr_t *) b)
++    return -1;
++  return 0;
++}
++
++static int
++do_test (void)
++{
++  if (!ptr_chk_guard_copy_set)
++    {
++      puts ("constructor has not been run");
++      return 1;
++    }
++
++  if (ptr_chk_guard_copy != POINTER_CHK_GUARD)
++    {
++      puts ("POINTER_CHK_GUARD changed between constructor and do_test");
++      return 1;
++    }
++
++  if (child)
++    {
++      write (2, &ptr_chk_guard_copy, sizeof (ptr_chk_guard_copy));
++      return 0;
++    }
++
++  if (command == NULL)
++    {
++      puts ("missing --command or --child argument");
++      return 1;
++    }
++
++#define N 16
++  uintptr_t child_ptr_chk_guards[N + 1];
++  child_ptr_chk_guards[N] = ptr_chk_guard_copy;
++  int i;
++  for (i = 0; i < N; ++i)
++    {
++      if (pipe (fds) < 0)
++	{
++	  printf ("couldn't create pipe: %m\n");
++	  return 1;
++	}
++
++      pid_t pid = fork ();
++      if (pid < 0)
++	{
++	  printf ("fork failed: %m\n");
++	  return 1;
++	}
++
++      if (!pid)
++	{
++	  if (ptr_chk_guard_copy != POINTER_CHK_GUARD)
++	    {
++	      puts ("POINTER_CHK_GUARD changed after fork");
++	      exit (1);
++	    }
++
++	  close (fds[0]);
++	  close (2);
++	  dup2 (fds[1], 2);
++	  close (fds[1]);
++
++	  system (command);
++	  exit (0);
++	}
++
++      close (fds[1]);
++
++      if (TEMP_FAILURE_RETRY (read (fds[0], &child_ptr_chk_guards[i],
++				    sizeof (uintptr_t))) != sizeof (uintptr_t))
++	{
++	  puts ("could not read ptr_chk_guard value from child");
++	  return 1;
++	}
++
++      close (fds[0]);
++
++      pid_t termpid;
++      int status;
++      termpid = TEMP_FAILURE_RETRY (waitpid (pid, &status, 0));
++      if (termpid == -1)
++	{
++	  printf ("waitpid failed: %m\n");
++	  return 1;
++	}
++      else if (termpid != pid)
++	{
++	  printf ("waitpid returned %ld != %ld\n",
++		  (long int) termpid, (long int) pid);
++	  return 1;
++	}
++      else if (!WIFEXITED (status) || WEXITSTATUS (status))
++	{
++	  puts ("child hasn't exited with exit status 0");
++	  return 1;
++	}
++    }
++
++  qsort (child_ptr_chk_guards, N + 1, sizeof (uintptr_t), uintptr_t_cmp);
++
++  /* The default pointer guard is the same as the default stack guard.
++     They are only set to default if dl_random is NULL.  */
++  uintptr_t default_guard = 0;
++  unsigned char *p = (unsigned char *) &default_guard;
++  p[sizeof (uintptr_t) - 1] = 255;
++  p[sizeof (uintptr_t) - 2] = '\n';
++  p[0] = 0;
++
++  /* Test if the pointer guard canaries are either randomized,
++     or equal to the default pointer guard value.
++     Even with randomized pointer guards it might happen
++     that the random number generator generates the same
++     values, but if that happens in more than half from
++     the 16 runs, something is very wrong.  */
++  int ndifferences = 0;
++  int ndefaults = 0;
++  for (i = 0; i < N; ++i)
++    {
++      if (child_ptr_chk_guards[i] != child_ptr_chk_guards[i+1])
++	ndifferences++;
++      else if (child_ptr_chk_guards[i] == default_guard)
++	ndefaults++;
++    }
++
++  printf ("differences %d defaults %d\n", ndifferences, ndefaults);
++
++  if (ndifferences < N / 2 && ndefaults < N / 2)
++    {
++      puts ("pointer guard values are not randomized enough");
++      puts ("nor equal to the default value");
++      return 1;
++    }
++
++  return 0;
++}
++
++#define OPT_COMMAND	10000
++#define OPT_CHILD	10001
++#define CMDLINE_OPTIONS	\
++  { "command", required_argument, NULL, OPT_COMMAND },  \
++  { "child", no_argument, NULL, OPT_CHILD },
++#define CMDLINE_PROCESS	\
++  case OPT_COMMAND:	\
++    command = optarg;	\
++    break;		\
++  case OPT_CHILD:	\
++    child = true;	\
++    break;
++#define TEST_FUNCTION do_test ()
++#include "../test-skeleton.c"
+diff --git a/ports/sysdeps/ia64/stackguard-macros.h b/ports/sysdeps/ia64/stackguard-macros.h
+index dc683c2..3907293 100644
+--- a/ports/sysdeps/ia64/stackguard-macros.h
++++ b/ports/sysdeps/ia64/stackguard-macros.h
+@@ -2,3 +2,6 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("adds %0 = -8, r13;; ld8 %0 = [%0]" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("adds %0 = -16, r13;; ld8 %0 = [%0]" : "=r" (x)); x; })
+diff --git a/ports/sysdeps/tile/stackguard-macros.h b/ports/sysdeps/tile/stackguard-macros.h
+index 589ea2b..f2e041b 100644
+--- a/ports/sysdeps/tile/stackguard-macros.h
++++ b/ports/sysdeps/tile/stackguard-macros.h
+@@ -4,11 +4,17 @@
+ # if __WORDSIZE == 64
+ #  define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("addi %0, tp, -16; ld %0, %0" : "=r" (x)); x; })
++#  define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("addi %0, tp, -24; ld %0, %0" : "=r" (x)); x; })
+ # else
+ #  define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("addi %0, tp, -8; ld4s %0, %0" : "=r" (x)); x; })
++#  define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("addi %0, tp, -12; ld4s %0, %0" : "=r" (x)); x; })
+ # endif
+ #else
+ # define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("addi %0, tp, -8; lw %0, %0" : "=r" (x)); x; })
++# define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("addi %0, tp, -12; lw %0, %0" : "=r" (x)); x; })
+ #endif
+diff --git a/sysdeps/generic/stackguard-macros.h b/sysdeps/generic/stackguard-macros.h
+index ababf65..77408c6 100644
+--- a/sysdeps/generic/stackguard-macros.h
++++ b/sysdeps/generic/stackguard-macros.h
+@@ -2,3 +2,6 @@
+ 
+ extern uintptr_t __stack_chk_guard;
+ #define STACK_CHK_GUARD __stack_chk_guard
++
++extern uintptr_t __pointer_chk_guard_local;
++#define POINTER_CHK_GUARD __pointer_chk_guard_local
+diff --git a/sysdeps/i386/stackguard-macros.h b/sysdeps/i386/stackguard-macros.h
+index 8c31e19..0397629 100644
+--- a/sysdeps/i386/stackguard-macros.h
++++ b/sysdeps/i386/stackguard-macros.h
+@@ -2,3 +2,11 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("movl %%gs:0x14, %0" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({							\
++     uintptr_t x;					\
++     asm ("movl %%gs:%c1, %0" : "=r" (x)		\
++	  : "i" (offsetof (tcbhead_t, pointer_guard)));	\
++     x;							\
++   })
+diff --git a/sysdeps/powerpc/powerpc32/stackguard-macros.h b/sysdeps/powerpc/powerpc32/stackguard-macros.h
+index 839f6a4..b3d0af8 100644
+--- a/sysdeps/powerpc/powerpc32/stackguard-macros.h
++++ b/sysdeps/powerpc/powerpc32/stackguard-macros.h
+@@ -2,3 +2,13 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("lwz %0,-28680(2)" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({												\
++     uintptr_t x;										\
++     asm ("lwz %0,%1(2)"									\
++	  : "=r" (x)										\
++	  : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))	\
++         );											\
++     x;												\
++   })
+diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
+index 9da879c..4620f96 100644
+--- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
++++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
+@@ -2,3 +2,13 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("ld %0,-28688(13)" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({												\
++     uintptr_t x;										\
++     asm ("ld %0,%1(2)"										\
++	  : "=r" (x)										\
++	  : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))	\
++         );											\
++     x;												\
++   })
+diff --git a/sysdeps/s390/s390-32/stackguard-macros.h b/sysdeps/s390/s390-32/stackguard-macros.h
+index b74c579..449e8d4 100644
+--- a/sysdeps/s390/s390-32/stackguard-macros.h
++++ b/sysdeps/s390/s390-32/stackguard-macros.h
+@@ -2,3 +2,14 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("ear %0,%%a0; l %0,0x14(%0)" : "=a" (x)); x; })
++
++/* On s390/s390x there is no unique pointer guard, instead we use the
++   same value as the stack guard.  */
++#define POINTER_CHK_GUARD \
++  ({							\
++     uintptr_t x;					\
++     asm ("ear %0,%%a0; l %0,%1(%0)"			\
++	  : "=a" (x)					\
++	  : "i" (offsetof (tcbhead_t, stack_guard)));	\
++     x;							\
++   })
+diff --git a/sysdeps/s390/s390-64/stackguard-macros.h b/sysdeps/s390/s390-64/stackguard-macros.h
+index 0cebb5f..c8270fb 100644
+--- a/sysdeps/s390/s390-64/stackguard-macros.h
++++ b/sysdeps/s390/s390-64/stackguard-macros.h
+@@ -2,3 +2,17 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("ear %0,%%a0; sllg %0,%0,32; ear %0,%%a1; lg %0,0x28(%0)" : "=a" (x)); x; })
++
++/* On s390/s390x there is no unique pointer guard, instead we use the
++   same value as the stack guard.  */
++#define POINTER_CHK_GUARD \
++  ({							\
++     uintptr_t x;					\
++     asm ("ear %0,%%a0;"				\
++	  "sllg %0,%0,32;"				\
++	  "ear %0,%%a1;"				\
++	  "lg %0,%1(%0)"				\
++	 : "=a" (x)					\
++	 : "i" (offsetof (tcbhead_t, stack_guard)));	\
++     x;							\
++   })
+diff --git a/sysdeps/sparc/sparc32/stackguard-macros.h b/sysdeps/sparc/sparc32/stackguard-macros.h
+index c0b02b0..1eef0f1 100644
+--- a/sysdeps/sparc/sparc32/stackguard-macros.h
++++ b/sysdeps/sparc/sparc32/stackguard-macros.h
+@@ -2,3 +2,6 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("ld [%%g7+0x14], %0" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("ld [%%g7+0x18], %0" : "=r" (x)); x; })
+diff --git a/sysdeps/sparc/sparc64/stackguard-macros.h b/sysdeps/sparc/sparc64/stackguard-macros.h
+index 80f0635..cc0c12c 100644
+--- a/sysdeps/sparc/sparc64/stackguard-macros.h
++++ b/sysdeps/sparc/sparc64/stackguard-macros.h
+@@ -2,3 +2,6 @@
+ 
+ #define STACK_CHK_GUARD \
+   ({ uintptr_t x; asm ("ldx [%%g7+0x28], %0" : "=r" (x)); x; })
++
++#define POINTER_CHK_GUARD \
++  ({ uintptr_t x; asm ("ldx [%%g7+0x30], %0" : "=r" (x)); x; })
+diff --git a/sysdeps/x86_64/stackguard-macros.h b/sysdeps/x86_64/stackguard-macros.h
+index d7fedb3..1948800 100644
+--- a/sysdeps/x86_64/stackguard-macros.h
++++ b/sysdeps/x86_64/stackguard-macros.h
+@@ -4,3 +4,8 @@
+   ({ uintptr_t x;						\
+      asm ("mov %%fs:%c1, %0" : "=r" (x)				\
+ 	  : "i" (offsetof (tcbhead_t, stack_guard))); x; })
++
++#define POINTER_CHK_GUARD \
++  ({ uintptr_t x;						\
++     asm ("mov %%fs:%c1, %0" : "=r" (x)				\
++	  : "i" (offsetof (tcbhead_t, pointer_guard))); x; })
+diff --git a/sysdeps/generic/stackguard-macros.h b/sysdeps/generic/stackguard-macros.h
+index 4fa3d96..b4a6b23 100644
+--- a/sysdeps/generic/stackguard-macros.h
++++ b/sysdeps/generic/stackguard-macros.h
+@@ -3,5 +3,10 @@
+ extern uintptr_t __stack_chk_guard;
+ #define STACK_CHK_GUARD __stack_chk_guard
+ 
++#ifdef PTRGUARD_LOCAL
+ extern uintptr_t __pointer_chk_guard_local;
+-#define POINTER_CHK_GUARD __pointer_chk_guard_local
++# define POINTER_CHK_GUARD __pointer_chk_guard_local
++#else
++extern uintptr_t __pointer_chk_guard;
++# define POINTER_CHK_GUARD __pointer_chk_guard
++#endif
+diff --git a/elf/Makefile b/elf/Makefile
+index aaa9534..cb8da93 100644
+--- a/elf/Makefile
++++ b/elf/Makefile
+@@ -121,7 +121,8 @@ endif
+ tests = tst-tls1 tst-tls2 tst-tls9 tst-leaks1 \
+ 	tst-array1 tst-array2 tst-array3 tst-array4 tst-array5
+ tests-static = tst-tls1-static tst-tls2-static tst-stackguard1-static \
+-	       tst-leaks1-static tst-array1-static tst-array5-static
++	       tst-leaks1-static tst-array1-static tst-array5-static \
++	       tst-ptrguard1-static
+ ifeq (yes,$(build-shared))
+ tests-static += tst-tls9-static
+ tst-tls9-static-ENV = \
+@@ -146,7 +146,7 @@
+ 	 tst-audit1 tst-audit2 tst-audit8 \
+ 	 tst-stackguard1 tst-addr1 tst-thrlock \
+ 	 tst-unique1 tst-unique2 tst-unique3 tst-unique4 \
+-	 tst-initorder tst-initorder2 tst-relsort1
++	 tst-initorder tst-initorder2 tst-relsort1 tst-ptrguard1
+ #	 reldep9
+ test-srcs = tst-pathopt
+ selinux-enabled := $(shell cat /selinux/enforce 2> /dev/null)
+@@ -1056,6 +1056,12 @@
+ tst-stackguard1-ARGS = --command "$(host-built-program-cmd) --child"
+ tst-stackguard1-static-ARGS = --command "$(objpfx)tst-stackguard1-static --child"
+ 
++tst-ptrguard1-ARGS = --command "$(host-test-program-cmd) --child"
++# When built statically, the pointer guard interface uses
++# __pointer_chk_guard_local.
++CFLAGS-tst-ptrguard1-static.c = -DPTRGUARD_LOCAL
++tst-ptrguard1-static-ARGS = --command "$(objpfx)tst-ptrguard1-static --child"
++
+ $(objpfx)tst-leaks1: $(libdl)
+ $(objpfx)tst-leaks1-mem: $(objpfx)tst-leaks1.out
+ 	$(common-objpfx)malloc/mtrace $(objpfx)tst-leaks1.mtrace > $@

glibc-rh995841.patch

@@ -0,0 +1,302 @@
+commit 91ce40854d0b7f865cf5024ef95a8026b76096f3
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Aug 16 09:38:52 2013 +0200
+
+    CVE-2013-4237, BZ #14699: Buffer overflow in readdir_r
+    
+    	* sysdeps/posix/dirstream.h (struct __dirstream): Add errcode
+    	member.
+    	* sysdeps/posix/opendir.c (__alloc_dir): Initialize errcode
+    	member.
+    	* sysdeps/posix/rewinddir.c (rewinddir): Reset errcode member.
+    	* sysdeps/posix/readdir_r.c (__READDIR_R): Enforce NAME_MAX limit.
+    	Return delayed error code.  Remove GETDENTS_64BIT_ALIGNED
+    	conditional.
+    	* sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c: Do not define
+    	GETDENTS_64BIT_ALIGNED.
+    	* sysdeps/unix/sysv/linux/i386/readdir64_r.c: Likewise.
+    	* manual/filesys.texi (Reading/Closing Directory): Document
+    	ENAMETOOLONG return value of readdir_r.  Recommend readdir more
+    	strongly.
+    	* manual/conf.texi (Limits for Files): Add portability note to
+    	NAME_MAX, PATH_MAX.
+    	(Pathconf): Add portability note for _PC_NAME_MAX, _PC_PATH_MAX.
+
+diff --git a/manual/conf.texi b/manual/conf.texi
+index 7eb8b36..c720063 100644
+--- a/manual/conf.texi
++++ b/manual/conf.texi
+@@ -1149,6 +1149,9 @@ typed ahead as input.  @xref{I/O Queues}.
+ @deftypevr Macro int NAME_MAX
+ The uniform system limit (if any) for the length of a file name component, not
+ including the terminating null character.
++
++@strong{Portability Note:} On some systems, @theglibc{} defines
++@code{NAME_MAX}, but does not actually enforce this limit.
+ @end deftypevr
+ 
+ @comment limits.h
+@@ -1157,6 +1160,9 @@ including the terminating null character.
+ The uniform system limit (if any) for the length of an entire file name (that
+ is, the argument given to system calls such as @code{open}), including the
+ terminating null character.
++
++@strong{Portability Note:} @Theglibc{} does not enforce this limit
++even if @code{PATH_MAX} is defined.
+ @end deftypevr
+ 
+ @cindex limits, pipe buffer size
+@@ -1476,6 +1482,9 @@ Inquire about the value of @code{POSIX_REC_MIN_XFER_SIZE}.
+ Inquire about the value of @code{POSIX_REC_XFER_ALIGN}.
+ @end table
+ 
++@strong{Portability Note:} On some systems, @theglibc{} does not
++enforce @code{_PC_NAME_MAX} or @code{_PC_PATH_MAX} limits.
++
+ @node Utility Limits
+ @section Utility Program Capacity Limits
+ 
+diff --git a/manual/filesys.texi b/manual/filesys.texi
+index 1df9cf2..814c210 100644
+--- a/manual/filesys.texi
++++ b/manual/filesys.texi
+@@ -444,9 +444,9 @@ symbols are declared in the header file @file{dirent.h}.
+ @comment POSIX.1
+ @deftypefun {struct dirent *} readdir (DIR *@var{dirstream})
+ This function reads the next entry from the directory.  It normally
+-returns a pointer to a structure containing information about the file.
+-This structure is statically allocated and can be rewritten by a
+-subsequent call.
++returns a pointer to a structure containing information about the
++file.  This structure is associated with the @var{dirstream} handle
++and can be rewritten by a subsequent call.
+ 
+ @strong{Portability Note:} On some systems @code{readdir} may not
+ return entries for @file{.} and @file{..}, even though these are always
+@@ -461,19 +461,61 @@ conditions are defined for this function:
+ The @var{dirstream} argument is not valid.
+ @end table
+ 
+-@code{readdir} is not thread safe.  Multiple threads using
+-@code{readdir} on the same @var{dirstream} may overwrite the return
+-value.  Use @code{readdir_r} when this is critical.
++To distinguish between an end-of-directory condition or an error, you
++must set @code{errno} to zero before calling @code{readdir}.  To avoid
++entering an infinite loop, you should stop reading from the directory
++after the first error.
++
++In POSIX.1-2008, @code{readdir} is not thread-safe.  In @theglibc{}
++implementation, it is safe to call @code{readdir} concurrently on
++different @var{dirstream}s, but multiple threads accessing the same
++@var{dirstream} result in undefined behavior.  @code{readdir_r} is a
++fully thread-safe alternative, but suffers from poor portability (see
++below).  It is recommended that you use @code{readdir}, with external
++locking if multiple threads access the same @var{dirstream}.
+ @end deftypefun
+ 
+ @comment dirent.h
+ @comment GNU
+ @deftypefun int readdir_r (DIR *@var{dirstream}, struct dirent *@var{entry}, struct dirent **@var{result})
+-This function is the reentrant version of @code{readdir}.  Like
+-@code{readdir} it returns the next entry from the directory.  But to
+-prevent conflicts between simultaneously running threads the result is
+-not stored in statically allocated memory.  Instead the argument
+-@var{entry} points to a place to store the result.
++This function is a version of @code{readdir} which performs internal
++locking.  Like @code{readdir} it returns the next entry from the
++directory.  To prevent conflicts between simultaneously running
++threads the result is stored inside the @var{entry} object.
++
++@strong{Portability Note:} It is recommended to use @code{readdir}
++instead of @code{readdir_r} for the following reasons:
++
++@itemize @bullet
++@item
++On systems which do not define @code{NAME_MAX}, it may not be possible
++to use @code{readdir_r} safely because the caller does not specify the
++length of the buffer for the directory entry.
++
++@item
++On some systems, @code{readdir_r} cannot read directory entries with
++very long names.  If such a name is encountered, @theglibc{}
++implementation of @code{readdir_r} returns with an error code of
++@code{ENAMETOOLONG} after the final directory entry has been read.  On
++other systems, @code{readdir_r} may return successfully, but the
++@code{d_name} member may not be NUL-terminated or may be truncated.
++
++@item
++POSIX-1.2008 does not guarantee that @code{readdir} is thread-safe,
++even when access to the same @var{dirstream} is serialized.  But in
++current implementations (including @theglibc{}), it is safe to call
++@code{readdir} concurrently on different @var{dirstream}s, so there is
++no need to use @code{readdir_r} in most multi-threaded programs.  In
++the rare case that multiple threads need to read from the same
++@var{dirstream}, it is still better to use @code{readdir} and external
++synchronization.
++
++@item
++It is expected that future versions of POSIX will obsolete
++@code{readdir_r} and mandate the level of thread safety for
++@code{readdir} which is provided by @theglibc{} and other
++implementations today.
++@end itemize
+ 
+ Normally @code{readdir_r} returns zero and sets @code{*@var{result}}
+ to @var{entry}.  If there are no more entries in the directory or an
+@@ -481,15 +523,6 @@ error is detected, @code{readdir_r} sets @code{*@var{result}} to a
+ null pointer and returns a nonzero error code, also stored in
+ @code{errno}, as described for @code{readdir}.
+ 
+-@strong{Portability Note:} On some systems @code{readdir_r} may not
+-return a NUL terminated string for the file name, even when there is no
+-@code{d_reclen} field in @code{struct dirent} and the file
+-name is the maximum allowed size.  Modern systems all have the
+-@code{d_reclen} field, and on old systems multi-threading is not
+-critical.  In any case there is no such problem with the @code{readdir}
+-function, so that even on systems without the @code{d_reclen} member one
+-could use multiple threads by using external locking.
+-
+ It is also important to look at the definition of the @code{struct
+ dirent} type.  Simply passing a pointer to an object of this type for
+ the second parameter of @code{readdir_r} might not be enough.  Some
+diff --git a/sysdeps/posix/dirstream.h b/sysdeps/posix/dirstream.h
+index a7a074d..8e8570d 100644
+--- a/sysdeps/posix/dirstream.h
++++ b/sysdeps/posix/dirstream.h
+@@ -39,6 +39,8 @@ struct __dirstream
+ 
+     off_t filepos;		/* Position of next entry to read.  */
+ 
++    int errcode;		/* Delayed error code.  */
++
+     /* Directory block.  */
+     char data[0] __attribute__ ((aligned (__alignof__ (void*))));
+   };
+diff --git a/sysdeps/posix/opendir.c b/sysdeps/posix/opendir.c
+index ddfc3a7..fc05b0f 100644
+--- a/sysdeps/posix/opendir.c
++++ b/sysdeps/posix/opendir.c
+@@ -231,6 +231,7 @@ __alloc_dir (int fd, bool close_fd, int flags, const struct stat64 *statp)
+   dirp->size = 0;
+   dirp->offset = 0;
+   dirp->filepos = 0;
++  dirp->errcode = 0;
+ 
+   return dirp;
+ }
+diff --git a/sysdeps/posix/readdir_r.c b/sysdeps/posix/readdir_r.c
+index b5a8e2e..8ed5c3f 100644
+--- a/sysdeps/posix/readdir_r.c
++++ b/sysdeps/posix/readdir_r.c
+@@ -40,6 +40,7 @@ __READDIR_R (DIR *dirp, DIRENT_TYPE *entry, DIRENT_TYPE **result)
+   DIRENT_TYPE *dp;
+   size_t reclen;
+   const int saved_errno = errno;
++  int ret;
+ 
+   __libc_lock_lock (dirp->lock);
+ 
+@@ -70,10 +71,10 @@ __READDIR_R (DIR *dirp, DIRENT_TYPE *entry, DIRENT_TYPE **result)
+ 		  bytes = 0;
+ 		  __set_errno (saved_errno);
+ 		}
++	      if (bytes < 0)
++		dirp->errcode = errno;
+ 
+ 	      dp = NULL;
+-	      /* Reclen != 0 signals that an error occurred.  */
+-	      reclen = bytes != 0;
+ 	      break;
+ 	    }
+ 	  dirp->size = (size_t) bytes;
+@@ -106,29 +107,46 @@ __READDIR_R (DIR *dirp, DIRENT_TYPE *entry, DIRENT_TYPE **result)
+       dirp->filepos += reclen;
+ #endif
+ 
+-      /* Skip deleted files.  */
++#ifdef NAME_MAX
++      if (reclen > offsetof (DIRENT_TYPE, d_name) + NAME_MAX + 1)
++	{
++	  /* The record is very long.  It could still fit into the
++	     caller-supplied buffer if we can skip padding at the
++	     end.  */
++	  size_t namelen = _D_EXACT_NAMLEN (dp);
++	  if (namelen <= NAME_MAX)
++	    reclen = offsetof (DIRENT_TYPE, d_name) + namelen + 1;
++	  else
++	    {
++	      /* The name is too long.  Ignore this file.  */
++	      dirp->errcode = ENAMETOOLONG;
++	      dp->d_ino = 0;
++	      continue;
++	    }
++	}
++#endif
++
++      /* Skip deleted and ignored files.  */
+     }
+   while (dp->d_ino == 0);
+ 
+   if (dp != NULL)
+     {
+-#ifdef GETDENTS_64BIT_ALIGNED
+-      /* The d_reclen value might include padding which is not part of
+-	 the DIRENT_TYPE data structure.  */
+-      reclen = MIN (reclen,
+-		    offsetof (DIRENT_TYPE, d_name) + sizeof (dp->d_name));
+-#endif
+       *result = memcpy (entry, dp, reclen);
+-#ifdef GETDENTS_64BIT_ALIGNED
++#ifdef _DIRENT_HAVE_D_RECLEN
+       entry->d_reclen = reclen;
+ #endif
++      ret = 0;
+     }
+   else
+-    *result = NULL;
++    {
++      *result = NULL;
++      ret = dirp->errcode;
++    }
+ 
+   __libc_lock_unlock (dirp->lock);
+ 
+-  return dp != NULL ? 0 : reclen ? errno : 0;
++  return ret;
+ }
+ 
+ #ifdef __READDIR_R_ALIAS
+diff --git a/sysdeps/posix/rewinddir.c b/sysdeps/posix/rewinddir.c
+index 2935a8e..d4991ad 100644
+--- a/sysdeps/posix/rewinddir.c
++++ b/sysdeps/posix/rewinddir.c
+@@ -33,6 +33,7 @@ rewinddir (dirp)
+   dirp->filepos = 0;
+   dirp->offset = 0;
+   dirp->size = 0;
++  dirp->errcode = 0;
+ #ifndef NOT_IN_libc
+   __libc_lock_unlock (dirp->lock);
+ #endif
+diff --git a/sysdeps/unix/sysv/linux/i386/readdir64_r.c b/sysdeps/unix/sysv/linux/i386/readdir64_r.c
+index 8ebbcfd..a7d114e 100644
+--- a/sysdeps/unix/sysv/linux/i386/readdir64_r.c
++++ b/sysdeps/unix/sysv/linux/i386/readdir64_r.c
+@@ -18,7 +18,6 @@
+ #define __READDIR_R __readdir64_r
+ #define __GETDENTS __getdents64
+ #define DIRENT_TYPE struct dirent64
+-#define GETDENTS_64BIT_ALIGNED 1
+ 
+ #include <sysdeps/posix/readdir_r.c>
+ 
+diff --git a/sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c b/sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c
+index 5ed8e95..290f2c8 100644
+--- a/sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c
++++ b/sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c
+@@ -1,5 +1,4 @@
+ #define readdir64_r __no_readdir64_r_decl
+-#define GETDENTS_64BIT_ALIGNED 1
+ #include <sysdeps/posix/readdir_r.c>
+ #undef readdir64_r
+ weak_alias (__readdir_r, readdir64_r)