Add mkdtemps(3), like mkdtemp(3) but with a suffix.
OK deraadt@ tb@

Inroduce malloc_conceal() and calloc_conceal(). Similar to their
counterparts but return memory in pages marked MAP_CONCEAL and on
free() freezero() is actually called.

Introducing malloc_usable_size() was a mistake. While some other
libs have it, it is a function that is considered harmful, so:

Delete malloc_usable_size(). It is a function that blurs the line
betw

Introducing malloc_usable_size() was a mistake. While some other
libs have it, it is a function that is considered harmful, so:

Delete malloc_usable_size(). It is a function that blurs the line
between malloc managed memory and application managed memory and
exposes some of the internal workings of malloc. If an application
relies on that, it is likely to break using another implementation
of malloc. If you want usable size x, just allocate x bytes. ok
deraadt@ and other devs

show more ...

Implement malloc_usable_size(); ok millert@ deraadt@ and jmc@ for the man page

Implement C11's aligned_alloc(3). ok guenther@

New POSIX xlocale implementation written from scratch.
Complete in the sense that all POSIX *locale(3) and *_l(3) functions
are included, but in OpenBSD, we of course only really care about
LC_CTYPE

New POSIX xlocale implementation written from scratch.
Complete in the sense that all POSIX *locale(3) and *_l(3) functions
are included, but in OpenBSD, we of course only really care about
LC_CTYPE and we only support ASCII and UTF-8.

With important help from kettenis@, guenther@, and jca@.
Repeated testing in ports bulk builds by naddy@.
Additional testing by jca@, sebastia@, dcoppa@, and others.
OK kettenis@ dcoppa@, and guenther@ on an earlier version.
Riding guenther@'s libc/librthread major bump.

show more ...

arc4random_buf should be bounded buffer, not bounded string

ok millert@

Add bounded attribute to freezero(). OK tom@

Introducing freezero(3) a version of free that guarantees the process
no longer has access to the content of a memmory object. It does
this by either clearing (if the object memory remains cached) or

Introducing freezero(3) a version of free that guarantees the process
no longer has access to the content of a memmory object. It does
this by either clearing (if the object memory remains cached) or
by calling munmap(2). ok millert@, deraadt@, guenther@

show more ...

Introducing recallocarray(3), a blend of calloc(3) and reallocarray(3)
with the added feature that released memory is cleared. Much input from various
developers. ok deraadt@ tom@

Remove duplicated includes in stdlib.h and termios.h

OK guenther@

Move the 10 (!) defintions of NULL to their own mini header file and
update the NULL definition for C++11. OK deraadt@ guenther@ kettenis@

The first argument to devname(3) should be dev_t, not int.
The man page was already correct.

add restrict to strtol like functions. ok guenther

we don't have an alloca() symbol anywhere in libc, don't prototype it.
instead, #define to __builtin_alloca. if that doesn't work, you're hosed.
from an old discussion about the perils of alloca. (do

we don't have an alloca() symbol anywhere in libc, don't prototype it.
instead, #define to __builtin_alloca. if that doesn't work, you're hosed.
from an old discussion about the perils of alloca. (don't use alloca!)

show more ...

Change rand(), random(), drand48(), lrand48(), mrand48(), and srand48()
to returning strong random by default, source from arc4random(3).
Parameters to the seeding functions are ignored, and the subs

Change rand(), random(), drand48(), lrand48(), mrand48(), and srand48()
to returning strong random by default, source from arc4random(3).
Parameters to the seeding functions are ignored, and the subsystems remain
in strong random mode. If you wish the standardized deterministic mode,
call srand_deterministic(), srandom_determistic(), srand48_deterministic(),
seed48_deterministic() or lcong48_deterministic() instead.
The re-entrant functions rand_r(), erand48(), nrand48(), jrand48() are
unaffected by this change and remain in deterministic mode (for now).

Verified as a good roadmap forward by auditing 8800 pieces of software.
Roughly 60 pieces of software will need adaptation to request the
deterministic mode.

Violates POSIX and C89, which violate best practice in this century.
ok guenther tedu millert

show more ...

header changes for recent libc changes:
add siphash
delete setkey, encrypt, cfree

Add additional userland interfaces for setting close-on-exec on fds
when creating them: mkostemp(), mkostemps(), the 'e' mode letter for
fopen(), freopen(), fdopen(), and popen(). The close-on-exec

Add additional userland interfaces for setting close-on-exec on fds
when creating them: mkostemp(), mkostemps(), the 'e' mode letter for
fopen(), freopen(), fdopen(), and popen(). The close-on-exec flag will
be cleared by the action created by posix_spawn_file_actions_adddup2().

Also, add support for the C11 'x' mode letter for fopen() and freopen(),
setting O_EXCL when possibly creating files.

Note: this requires kernel support for pipe2() and dup3()!

ok millert@

show more ...

Clean up after arc4random u_int32_t uint32_t change
ok jsing@

change mallocarray to reallocarray. useful in a few more situations.
malloc can, as always, be emulated via realloc(NULL).
ok deraadt

Introducing: void *mallocarray(size_t nmemb, size_t size);
Like calloc(), except without the cleared-memory gaurantee
ok beck guenther, discussed for more than a year...

Annotate a few more bounded functions: realpath(3) needs a buffer
of size at least PATH_MAX. pread(2), pwrite(2) and readlinkat(2)
also take the buffer and the bound. OK theo.

Fix typo; 200809 not 20080 for __POSIX_VISIBLE. Noticed by jca@

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be in
stdlib.h. The non-standard suboptarg extern remains in the BSD-only
section of stdlib.h. Neither getsubopt() nor suboptarg belong in
unistd.h or getopt.h. They were only there to allow us to protect
all the getopt() bits from being multiply defined. OK guenther@

show more ...

Remove arc4random_stir() and arc4random_addrandom(), which none should
be using directly. Well, a few rare people cloned it upstream and it
will take a bit of time for them to learn.
ok various