RHBA-2009:1017 - Bug Fix Advisory

Topic

Updated glibc packages that fix several bugs and add an enhancement are now
available for Red Hat Enterprise Linux 4.

Description

The GNU libc packages (known as glibc) contain the standard C libraries
used by applications.

These updated glibc packages provide fixes for the following bugs:

• the strtod() function incorrectly handled the string "-0", which it would

convert to the floating point value "0.0". This was inconsistent with the
documented behavior of strtod(), which was to preserve the minus sign if
one were present in the input. Strtod() now includes code that retains the
minus sign even when the value is zero, so that the function behaves
consistently with its documentation and handles "-0" the same as any other
integer.

• when allocating memory, the valloc() and pvalloc() functions did not try

other arenas when no memory was available in the arena that it first tried.
These functions would therefore fail and return the ENOMEM signal, even
when sufficient memory was available in other arenas. Now, valloc() and
pvalloc() try to allocate memory from other arenas when an arena is full
and will allocate memory when enough free space exists in any arena.

• on IBM System z machines, the _mcount() function and socket system calls

used 32-bit subtraction instead of 64-bit subtraction when creating a stack
frame that spanned a 4 GB address-space boundary. This placed the frame 4
GB away from there it should have been. In rare cases with large
applications involving hundreds of threads, this scenario could corrupt the
stack pointer and potentially cause heap corruption and application
segmentation faults. The _mcount() function and socket system calls now
calculate the stack pointer correctly when, on entry, it is close to the 4
GB-aligned boundary, thus resolving the problem.

• when a Dynamic Thread Vector (DTV) array is not large enough to

accommodate all the shared libraries that use Thread Local Storage (TLS),
glibc creates a larger array and copies the data from the old array to the
new array. Previously, glibc did not copy the data correctly and ignored
array management regions dtv[-1] and dtv[0]. This error left TLS regions 13
and 14 inaccessible. Dynamic TLS would then perform unreliably or crash.
Glibc now copies data correctly from the old array to the new array, so
that dynamic TLS works correctly for large numbers of shared libraries.

• the vfprintf() was susceptible to recursion when the helper_file stream

filled up. On i386 systems, this would lead to a stack overflow, while on
AMD64 and Intel 64 systems it would lead to an infinite loop. Vfprintf()
now moves data to new memory locations to avoid the recursion and the
vprintf() function now operates correctly.

• fixed getgrouplist for NSS modules without initgroups_dyn
• fixed expf
• malloc speedups

Users are advised to upgrade to these updated glibc packages, which resolve
these issues and add this enhancement.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 462081 - [RHEL4] Incorrect behaviour of atof() and strtod()
• BZ - 473068 - [4.7] valloc() fails with ENOMEM without trying to use arenas
• BZ - 475178 - TLS regions 13 and 14 can not be accessed

CVEs

(none)

References

(none)