[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 07/14] realloc-posix: realloc (..., 0) now returns nonnull
|
From: |
Paul Eggert |
|
Subject: |
[PATCH 07/14] realloc-posix: realloc (..., 0) now returns nonnull |
|
Date: |
Mon, 4 Nov 2024 21:43:27 -0800 |
* lib/realloc.c (rpl_realloc): Simplify and tune by using
HAVE_REALLOC_0_NONNULL and HAVE_MALLOC_PTRDIFF, and
by having just one call to realloc instead of two.
* lib/reallocarray.c (reallocarray): Simplify and tune
by delegating the zero case to the revised realloc.
* m4/eealloc.m4 (_AC_FUNC_REALLOC_IF): Since only eealloc uses
this macro now, move its definition here ...
* m4/realloc.m4: ... from here.
(gl_FUNC_REALLOC_0_NONNULL): Also check that realloc (p, 0)
returns nonnull. Require gl_FUNC_REALLOC_POSIX.
Define HAVE_REALLOC_0_NONNULL.
* m4/reallocarray.m4 (gl_FUNC_REALLOCARRAY):
Also replace reallocarray if it returns a null pointer for size zero.
* modules/eealloc (Files): Remove m4/realloc.m4.
* modules/realloc-posix (Depends-on): Add extensions-aix.
* modules/reallocarray (Files): Add m4/realloc.m4.
---
ChangeLog | 18 ++++++
doc/posix-functions/realloc.texi | 15 ++---
doc/posix-functions/reallocarray.texi | 7 ++-
lib/realloc.c | 21 ++++---
lib/reallocarray.c | 6 --
m4/calloc.m4 | 4 +-
m4/eealloc.m4 | 39 ++++++++++++-
m4/realloc.m4 | 79 ++++++++++++---------------
m4/reallocarray.m4 | 11 +++-
modules/eealloc | 1 -
modules/realloc-posix | 1 +
modules/reallocarray | 1 +
12 files changed, 123 insertions(+), 80 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index c4c453a6c0..d00b1029f0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,23 @@
2024-11-04 Paul Eggert <eggert@cs.ucla.edu>
+ realloc-posix: realloc (..., 0) now returns nonnull
+ * lib/realloc.c (rpl_realloc): Simplify and tune by using
+ HAVE_REALLOC_0_NONNULL and HAVE_MALLOC_PTRDIFF, and
+ by having just one call to realloc instead of two.
+ * lib/reallocarray.c (reallocarray): Simplify and tune
+ by delegating the zero case to the revised realloc.
+ * m4/eealloc.m4 (_AC_FUNC_REALLOC_IF): Since only eealloc uses
+ this macro now, move its definition here ...
+ * m4/realloc.m4: ... from here.
+ (gl_FUNC_REALLOC_0_NONNULL): Also check that realloc (p, 0)
+ returns nonnull. Require gl_FUNC_REALLOC_POSIX.
+ Define HAVE_REALLOC_0_NONNULL.
+ * m4/reallocarray.m4 (gl_FUNC_REALLOCARRAY):
+ Also replace reallocarray if it returns a null pointer for size zero.
+ * modules/eealloc (Files): Remove m4/realloc.m4.
+ * modules/realloc-posix (Depends-on): Add extensions-aix.
+ * modules/reallocarray (Files): Add m4/realloc.m4.
+
stdlib: simplify preprocessor conditionals
* lib/stdlib.in.h: Omit some redundant tests in conditionals.
diff --git a/doc/posix-functions/realloc.texi b/doc/posix-functions/realloc.texi
index 3d8cd1705b..bbf4d1736d 100644
--- a/doc/posix-functions/realloc.texi
+++ b/doc/posix-functions/realloc.texi
@@ -20,12 +20,13 @@ On some platforms, @code{realloc (p, n)} can succeed even
if @code{n}
exceeds @code{PTRDIFF_MAX}. Although this behavior is arguably
allowed by POSIX it can lead to behavior not defined by POSIX later,
so @code{realloc-posix} does not allow going over the limit.
-@end itemize
+@item
It is not portable to call @code{realloc} with a size of 0. With a
null pointer argument, this is the same ambiguity as @code{malloc (0)}
as to whether a successful call returns a null pointer or a pointer to a
-new zero-sized memory region.
+new zero-sized memory region. The @code{realloc-posix} module
+implements the latter behavior.
Behavior is a real mess for @code{realloc (p, 0)} with non-null @code{p}.
C23 says behavior is undefined.
@@ -69,6 +70,8 @@ musl libc, macOS, FreeBSD, NetBSD, OpenBSD, Solaris, Cygwin.
@end enumerate
@noindent
+The @code{realloc-posix} module implements behavior (5).
+
A program not suspecting these variations in semantics will either:
@itemize
@@ -82,6 +85,7 @@ Falsely respond to memory exhaustion (if it wisely checks for
@code{realloc} failure), or have double-free bugs (if it does not check),
when it assumes behavior (4) or (5) but the system implements (1), (2) or (3).
@end itemize
+@end itemize
Portability problems not fixed by Gnulib:
@@ -91,11 +95,4 @@ When not growing an already-allocated region, i.e.,
when @code{p} points to a region of size @code{psize} and @code{n <= psize},
@code{realloc (p, n)} can fail and return a null pointer:
glibc 2.40 and probably other platforms.
-
-@item
-If @code{realloc (p, 0)} frees @code{p} and returns a null pointer,
-some platforms do not set @code{errno} to @code{EINVAL},
-even though POSIX.1-2024 requires this:
-glibc 2.1.1--2.40, most likely glibc 2.41+ at least by default,
-Android, mingw, MSVC.
@end itemize
diff --git a/doc/posix-functions/reallocarray.texi
b/doc/posix-functions/reallocarray.texi
index 2cff1fa677..aa43596b60 100644
--- a/doc/posix-functions/reallocarray.texi
+++ b/doc/posix-functions/reallocarray.texi
@@ -31,13 +31,14 @@ On some platforms, @code{reallocarray (p, n, s)} can
succeed even if
multiplying @code{n} by @code{s} would exceed @code{PTRDIFF_MAX},
which can lead to undefined behavior later:
FreeBSD 13, NetBSD 9, OpenBSD 6, musl 1.2.
-@end itemize
-Portability problems not fixed by Gnulib:
-@itemize
@item
It is not portable to call
@code{reallocarray (p, n, s)} when either @code{n} or @code{s} is zero,
as @code{reallocarray} has the same issues with zero sizes
that @code{realloc} does. @xref{realloc}.
@end itemize
+
+Portability problems not fixed by Gnulib:
+@itemize
+@end itemize
diff --git a/lib/realloc.c b/lib/realloc.c
index d0ed2169bc..dbc3d6b165 100644
--- a/lib/realloc.c
+++ b/lib/realloc.c
@@ -51,15 +51,19 @@ rpl_realloc (void *p, size_t n)
abort ();
#endif
- /* When P is null, act like glibc malloc, i.e., like malloc (1)
+ /* realloc (NULL, 0) acts like glibc malloc (0), i.e., like malloc (1)
except the caller cannot dereference any non-null return.
- When P is non-null, POSIX.1-2024 extends C17 to say that
- realloc (P, 0) either fails and returns a null pointer,
+ realloc (P, 0) with non-null P is a messier situation.
+ As mentioned above, C23 says behavior is undefined.
+ POSIX.1-2024 extends C17 to say realloc (P, 0)
+ either fails by setting errno and returning a null pointer,
or succeeds by freeing P and then either:
(a) setting errno=EINVAL and returning a null pointer; or
(b) acting like a successful malloc (0).
- GNU realloc acts like (a) except it does not set errno;
+ glibc 1 through 2.1 realloc acted like (b),
+ which conforms to C17, to C23 and to POSIX.1-2024.
+ glibc 2.1.1+ realloc acts like (a) except it does not set errno;
this conforms to C17 and to C23 but not to POSIX.1-2024.
Quite possibly future versions of POSIX will change,
due either to C23 or to (a)'s semantics being messy.
@@ -67,20 +71,19 @@ rpl_realloc (void *p, size_t n)
matches BSD and V7 realloc, and requires no extra code at
caller sites. */
- void *result = realloc (p, 1);
-#if !HAVE_MALLOC_POSIX
- if (result == NULL)
- errno = ENOMEM;
+#if !HAVE_REALLOC_0_NONNULL
+ n = 1;
#endif
- return result;
}
+#if !HAVE_MALLOC_PTRDIFF
ptrdiff_t signed_n;
if (ckd_add (&signed_n, n, 0))
{
errno = ENOMEM;
return NULL;
}
+#endif
void *result = realloc (p, n);
diff --git a/lib/reallocarray.c b/lib/reallocarray.c
index bae88c937d..b151d46bfb 100644
--- a/lib/reallocarray.c
+++ b/lib/reallocarray.c
@@ -33,12 +33,6 @@ reallocarray (void *ptr, size_t nmemb, size_t size)
return NULL;
}
- /* Work around realloc glitch by treating a 0 size as if it were 1,
- to avoid undefined behavior in strict C23 platforms,
- and so that returning NULL is equivalent to failing. */
- if (nbytes == 0)
- nbytes = 1;
-
/* Call realloc, setting errno to ENOMEM on failure. */
return realloc (ptr, nbytes);
}
diff --git a/m4/calloc.m4 b/m4/calloc.m4
index 7feddbe21c..6514bd1cf9 100644
--- a/m4/calloc.m4
+++ b/m4/calloc.m4
@@ -72,9 +72,7 @@ AC_DEFUN([gl_FUNC_CALLOC_POSIX],
[
AC_REQUIRE([gl_STDLIB_H_DEFAULTS])
AC_REQUIRE([gl_FUNC_MALLOC_POSIX])
- if test $REPLACE_MALLOC_FOR_MALLOC_POSIX = 1; then
- REPLACE_CALLOC_FOR_CALLOC_POSIX=1
- fi
+ REPLACE_CALLOC_FOR_CALLOC_POSIX=$REPLACE_MALLOC_FOR_MALLOC_POSIX
dnl Although in theory we should also test for size_t overflow,
dnl in practice testing for ptrdiff_t overflow suffices
dnl since PTRDIFF_MAX <= SIZE_MAX on all known Gnulib porting targets.
diff --git a/m4/eealloc.m4 b/m4/eealloc.m4
index 0ad90c687b..34032259e2 100644
--- a/m4/eealloc.m4
+++ b/m4/eealloc.m4
@@ -1,5 +1,5 @@
# eealloc.m4
-# serial 5
+# serial 6
dnl Copyright (C) 2003, 2009-2024 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
@@ -33,3 +33,40 @@ AC_DEFUN([gl_EEREALLOC],
[If realloc(NULL,0) is != NULL, define this to 1. Otherwise define this
to 0.])
])
+
+m4_version_prereq([2.73], [], [
+# This is copied from upstream Autoconf here:
+#
https://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/functions.m4?id=f8c82d292699fbce6d60abb46259a3781578f7fc#n1483
+# _AC_FUNC_REALLOC_IF(IF-WORKS, IF-NOT[, UNKNOWN-ASSUME])
+# -------------------------------------------------------
+# If 'realloc (0, 0)' returns nonnull, run IF-WORKS, otherwise, IF-NOT.
+# If it is not known whether it works, assume the shell word UNKNOWN-ASSUME,
+# which should end in "yes" or in something else (the latter is the default).
+AC_DEFUN([_AC_FUNC_REALLOC_IF],
+[
+ AC_REQUIRE([AC_CANONICAL_HOST])dnl for cross-compiles
+ AC_CACHE_CHECK([whether realloc (0, 0) returns nonnull],
+ [ac_cv_func_realloc_0_nonnull],
+ [AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM(
+ [[#include <stdlib.h>
+ /* Use prealloc to test; 'volatile' prevents the compiler
+ from optimizing the realloc call away. */
+ void *(*volatile prealloc) (void *, size_t) = realloc;]],
+ [[void *p = prealloc (0, 0);
+ int result = !p;
+ free (p);
+ return result;]])],
+ [ac_cv_func_realloc_0_nonnull=yes],
+ [ac_cv_func_realloc_0_nonnull=no],
+ [AS_CASE([$host_os],
+ [# Guess yes on platforms where we know the result.
+ *-gnu* | freebsd* | netbsd* | openbsd* | bitrig* \
+ | gnu* | *-musl* | midipix* | midnightbsd* \
+ | hpux* | solaris* | cygwin* | mingw* | windows* | msys*],
+ [ac_cv_func_realloc_0_nonnull="guessing yes"],
+ [# Guess as follows if we don't know.
+ ac_cv_func_realloc_0_nonnull=m4_default([$3], ["guessing no"])])])])
+ AS_CASE([$ac_cv_func_realloc_0_nonnull], [*yes], [$1], [$2])
+])# _AC_FUNC_REALLOC_IF
+])
diff --git a/m4/realloc.m4 b/m4/realloc.m4
index 639d7a9efe..4a3f2ea8ae 100644
--- a/m4/realloc.m4
+++ b/m4/realloc.m4
@@ -1,5 +1,5 @@
# realloc.m4
-# serial 37
+# serial 38
dnl Copyright (C) 2007, 2009-2024 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
@@ -18,43 +18,6 @@ AC_DEFUN([gl_FUNC_REALLOC_SANITIZED],
[test -n "$gl_cv_func_realloc_sanitize" || gl_cv_func_realloc_sanitize=no])
])
-m4_version_prereq([2.73], [], [
-# This is copied from upstream Autoconf here:
-#
https://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/functions.m4?id=f8c82d292699fbce6d60abb46259a3781578f7fc#n1483
-# _AC_FUNC_REALLOC_IF(IF-WORKS, IF-NOT[, UNKNOWN-ASSUME])
-# -------------------------------------------------------
-# If 'realloc (0, 0)' returns nonnull, run IF-WORKS, otherwise, IF-NOT.
-# If it is not known whether it works, assume the shell word UNKNOWN-ASSUME,
-# which should end in "yes" or in something else (the latter is the default).
-AC_DEFUN([_AC_FUNC_REALLOC_IF],
-[
- AC_REQUIRE([AC_CANONICAL_HOST])dnl for cross-compiles
- AC_CACHE_CHECK([whether realloc (0, 0) returns nonnull],
- [ac_cv_func_realloc_0_nonnull],
- [AC_RUN_IFELSE(
- [AC_LANG_PROGRAM(
- [[#include <stdlib.h>
- /* Use prealloc to test; 'volatile' prevents the compiler
- from optimizing the realloc call away. */
- void *(*volatile prealloc) (void *, size_t) = realloc;]],
- [[void *p = prealloc (0, 0);
- int result = !p;
- free (p);
- return result;]])],
- [ac_cv_func_realloc_0_nonnull=yes],
- [ac_cv_func_realloc_0_nonnull=no],
- [AS_CASE([$host_os],
- [# Guess yes on platforms where we know the result.
- *-gnu* | freebsd* | netbsd* | openbsd* | bitrig* \
- | gnu* | *-musl* | midipix* | midnightbsd* \
- | hpux* | solaris* | cygwin* | mingw* | windows* | msys*],
- [ac_cv_func_realloc_0_nonnull="guessing yes"],
- [# Guess as follows if we don't know.
- ac_cv_func_realloc_0_nonnull=m4_default([$3], ["guessing no"])])])])
- AS_CASE([$ac_cv_func_realloc_0_nonnull], [*yes], [$1], [$2])
-])# _AC_FUNC_REALLOC_IF
-])
-
# gl_FUNC_REALLOC_POSIX
# ---------------------
# Test whether 'realloc' is POSIX compliant (sets errno to ENOMEM when it
@@ -70,19 +33,45 @@ AC_DEFUN([gl_FUNC_REALLOC_POSIX],
AC_DEFINE([NEED_SANITIZED_REALLOC], [1],
[Define to 1 if realloc should abort upon undefined behaviour.])
else
- if test $REPLACE_MALLOC_FOR_MALLOC_POSIX = 1; then
- REPLACE_REALLOC_FOR_REALLOC_POSIX=1
- fi
+ REPLACE_REALLOC_FOR_REALLOC_POSIX=$REPLACE_MALLOC_FOR_MALLOC_POSIX
fi
])
# gl_FUNC_REALLOC_0_NONNULL
# -------------------------
-# Replace realloc if it is not compatible with GNU libc.
+# Replace realloc if realloc (..., 0) returns null.
AC_DEFUN([gl_FUNC_REALLOC_0_NONNULL],
[
AC_REQUIRE([gl_STDLIB_H_DEFAULTS])
-
- _AC_FUNC_REALLOC_IF([], [REPLACE_REALLOC_FOR_REALLOC_POSIX=1],
- ["$gl_cross_guess_normal"])
+ AC_REQUIRE([AC_CANONICAL_HOST])dnl for cross-compiles
+ AC_REQUIRE([gl_FUNC_REALLOC_POSIX])
+ AC_CACHE_CHECK([whether realloc (..., 0) returns nonnull],
+ [gl_cv_func_realloc_0_nonnull],
+ [AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM(
+ [[#include <stdlib.h>
+ /* Use prealloc to test; "volatile" prevents the compiler
+ from optimizing the realloc call away. */
+ void *(*volatile prealloc) (void *, size_t) = realloc;]],
+ [[void *p = prealloc (0, 0);
+ int result = !p;
+ p = prealloc (p, 0);
+ result |= !p;
+ free (p);
+ return result;]])],
+ [gl_cv_func_realloc_0_nonnull=yes],
+ [gl_cv_func_realloc_0_nonnull=no],
+ [AS_CASE([$host_os],
+ [# Guess yes on platforms where we know the result.
+ freebsd* | netbsd* | openbsd* | darwin* | bitrig* \
+ | *-musl* | midipix* | midnightbsd* \
+ | hpux* | solaris* | cygwin*],
+ [gl_cv_func_realloc_0_nonnull="guessing yes"],
+ [# Guess as follows if we don't know.
+ gl_cv_func_realloc_0_nonnull=$gl_cross_guess_normal])])])
+ AS_CASE([$gl_cv_func_realloc_0_nonnull],
+ [*yes],
+ [AC_DEFINE([HAVE_REALLOC_0_NONNULL], [1],
+ [Define to 1 if realloc (..., 0) returns nonnull.])],
+ [REPLACE_REALLOC_FOR_REALLOC_POSIX=1])
])
diff --git a/m4/reallocarray.m4 b/m4/reallocarray.m4
index 9407a7fe63..cc2ef2ccaa 100644
--- a/m4/reallocarray.m4
+++ b/m4/reallocarray.m4
@@ -1,5 +1,5 @@
# reallocarray.m4
-# serial 5
+# serial 6
dnl Copyright (C) 2017-2024 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
@@ -13,14 +13,19 @@ AC_DEFUN([gl_FUNC_REALLOCARRAY],
AC_REQUIRE([gl_STDLIB_H_DEFAULTS])
AC_REQUIRE([gl_CHECK_MALLOC_PTRDIFF])
+ AC_REQUIRE([gl_FUNC_REALLOC_0_NONNULL])
+ REPLACE_REALLOCARRAY=$REPLACE_REALLOC_FOR_REALLOC_POSIX
gl_CHECK_FUNCS_ANDROID([reallocarray], [[#include <stdlib.h>]])
if test "$ac_cv_func_reallocarray" = no; then
HAVE_REALLOCARRAY=0
case "$gl_cv_onwards_func_reallocarray" in
future*) REPLACE_REALLOCARRAY=1 ;;
esac
- elif test "$gl_cv_malloc_ptrdiff" = no; then
- REPLACE_REALLOCARRAY=1
+ else
+ case $gl_cv_func_realloc_0_nonnull in
+ *yes) ;;
+ *) REPLACE_REALLOCARRAY=1 ;;
+ esac
fi
])
diff --git a/modules/eealloc b/modules/eealloc
index d63e994737..fee6d7b013 100644
--- a/modules/eealloc
+++ b/modules/eealloc
@@ -6,7 +6,6 @@ lib/eealloc.h
lib/eealloc.c
m4/eealloc.m4
m4/malloc.m4
-m4/realloc.m4
Depends-on:
extern-inline
diff --git a/modules/realloc-posix b/modules/realloc-posix
index e7188b5f04..b19c82f792 100644
--- a/modules/realloc-posix
+++ b/modules/realloc-posix
@@ -7,6 +7,7 @@ m4/realloc.m4
m4/malloc.m4
Depends-on:
+extensions-aix
stdckdint [test $REPLACE_REALLOC_FOR_REALLOC_POSIX = 1]
stdlib
diff --git a/modules/reallocarray b/modules/reallocarray
index 41c80e454b..28de7a0a3d 100644
--- a/modules/reallocarray
+++ b/modules/reallocarray
@@ -4,6 +4,7 @@ reallocarray function that is glibc compatible.
Files:
lib/reallocarray.c
m4/malloc.m4
+m4/realloc.m4
m4/reallocarray.m4
Depends-on:
--
2.43.0
- [PATCH 01/14] calloc: depend on stdckdint not xalloc-oversized, Paul Eggert, 2024/11/05
- [PATCH 02/14] malloc-gnu: depend on stdckdint not xalloc-oversized, Paul Eggert, 2024/11/05
- [PATCH 03/14] calloc: configure more like malloc, Paul Eggert, 2024/11/05
- [PATCH 04/14] calloc, malloc: tune a bit, Paul Eggert, 2024/11/05
- [PATCH 05/14] realloc: don’t require success for nongrowth, Paul Eggert, 2024/11/05
- [PATCH 06/14] stdlib: simplify preprocessor conditionals, Paul Eggert, 2024/11/05
- [PATCH 07/14] realloc-posix: realloc (..., 0) now returns nonnull,
Paul Eggert <=
- [PATCH 08/14] realloc-posix: set CHERI bounds, Paul Eggert, 2024/11/05
- [PATCH 09/14] stdlib: make MB_CUR_MAX usable from extern inline, Paul Eggert, 2024/11/05
- [PATCH 10/14] realloc-posix: use _GL_USE_STDLIB_ALLOC, Paul Eggert, 2024/11/05
- [PATCH 11/14] realloc-posix: tune for glibc-like, Paul Eggert, 2024/11/05