Merge changes between r8303 and r8393 from /fsf/trunk.

git-svn-id: svn://svn.eglibc.org/trunk@8394 7b3dc134-2b1b-0410-93df-9e9f96275f8d

4 files changed, 28 insertions, 23 deletions

diff --git a/libc/stdlib/random_r.c b/libc/stdlib/random_r.c
index 5e564a737..a30055f59 100644
--- a/libc/stdlib/random_r.c
+++ b/libc/stdlib/random_r.c
@@ -1,5 +1,5 @@
 /*
-   Copyright (C) 1995, 2005 Free Software Foundation
+   Copyright (C) 1995, 2005, 2009 Free Software Foundation
 
    The GNU C Library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
@@ -166,7 +166,7 @@ __srandom_r (seed, buf)
   int type;
   int32_t *state;
   long int i;
-  long int word;
+  int32_t word;
   int32_t *dst;
   int kc;
 
diff --git a/libc/stdlib/strfmon_l.c b/libc/stdlib/strfmon_l.c
index c9f3a47b4..eb7a17801 100644
--- a/libc/stdlib/strfmon_l.c
+++ b/libc/stdlib/strfmon_l.c
@@ -1,5 +1,5 @@
 /* Formatting a monetary value according to the given locale.
-   Copyright (C) 1996, 1997, 2002, 2004, 2006 Free Software Foundation, Inc.
+   Copyright (C) 1996,1997,2002,2004,2006,2009 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1996.
 
@@ -90,9 +90,6 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
 {
   struct locale_data *current = loc->__locales[LC_MONETARY];
   _IO_strfile f;
-#ifdef _IO_MTSAFE_IO
-  _IO_lock_t lock;
-#endif
   struct printf_info info;
   char *dest;			/* Pointer so copy the output.  */
   const char *fmt;		/* Pointer that walks through format.  */
@@ -133,7 +130,7 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
       int done;
       const char *currency_symbol;
       size_t currency_symbol_len;
-      int width;
+      long int width;
       char *startp;
       const void *ptr;
       char space_char;
@@ -221,13 +218,21 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
 
 	  while (isdigit (*++fmt))
 	    {
-	      width *= 10;
-	      width += to_digit (*fmt);
+	      int val = to_digit (*fmt);
+
+	      if (width > LONG_MAX / 10
+		  || (width == LONG_MAX && val > LONG_MAX % 10))
+		{
+		  __set_errno (E2BIG);
+		  return -1;
+		}
+
+	      width = width * 10 + val;
 	    }
 
 	  /* If we don't have enough room for the demanded width we
 	     can stop now and return an error.  */
-	  if (dest + width >= s + maxsize)
+	  if (width >= maxsize - (dest - s))
 	    {
 	      __set_errno (E2BIG);
 	      return -1;
@@ -509,11 +514,11 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
 
       /* Print the number.  */
 #ifdef _IO_MTSAFE_IO
-      f._sbf._f._lock = &lock;
+      f._sbf._f._lock = NULL;
 #endif
-      INTUSE(_IO_init) ((_IO_FILE *) &f, 0);
-      _IO_JUMPS ((struct _IO_FILE_plus *) &f) = &_IO_str_jumps;
-      INTUSE(_IO_str_init_static) ((_IO_strfile *) &f, dest,
+      INTUSE(_IO_init) (&f._sbf._f, 0);
+      _IO_JUMPS (&f._sbf) = &_IO_str_jumps;
+      INTUSE(_IO_str_init_static) (&f, dest,
 				   (s + maxsize) - dest, dest);
       /* We clear the last available byte so we can find out whether
 	 the numeric representation is too long.  */
@@ -529,7 +534,7 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
       info.extra = 1;		/* This means use values from LC_MONETARY.  */
 
       ptr = &fpnum;
-      done = __printf_fp ((FILE *) &f, &info, &ptr);
+      done = __printf_fp (&f._sbf._f, &info, &ptr);
       if (done < 0)
 	return -1;
 
@@ -560,7 +565,7 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
 		out_char (space_char);
 	      out_nstring (currency_symbol, currency_symbol_len);
 	    }
-	    
+
 	  if (sign_posn == 4)
 	    {
 	      if (sep_by_space == 2)
@@ -589,9 +594,8 @@ __vstrfmon_l (char *s, size_t maxsize, __locale_t loc, const char *format,
 	    while (dest - startp < width);
 	  else
 	    {
-	      int dist = width - (dest - startp);
-	      char *cp;
-	      for (cp = dest - 1; cp >= startp; --cp)
+	      long int dist = width - (dest - startp);
+	      for (char *cp = dest - 1; cp >= startp; --cp)
 		cp[dist] = cp[0];
 
 	      dest += dist;
diff --git a/libc/stdlib/strtod_l.c b/libc/stdlib/strtod_l.c
index fba7acc36..b48b9c1ca 100644
--- a/libc/stdlib/strtod_l.c
+++ b/libc/stdlib/strtod_l.c
@@ -1,5 +1,5 @@
 /* Convert string representing a number to float value, using given locale.
-   Copyright (C) 1997,1998,2002,2004,2005,2006,2007,2008
+   Copyright (C) 1997,1998,2002,2004,2005,2006,2007,2008,2009
    Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1997.
@@ -233,6 +233,7 @@ round_and_return (mp_limb_t *retval, int exponent, int negative,
 # define DENORM_EXP (MIN_EXP - 2)
 #endif
       exponent = DENORM_EXP;
+      __set_errno (ERANGE);
     }
 
   if ((round_limb & (((mp_limb_t) 1) << round_bit)) != 0
diff --git a/libc/stdlib/tst-strtod.c b/libc/stdlib/tst-strtod.c
index e97a05701..dab13d9e4 100644
--- a/libc/stdlib/tst-strtod.c
+++ b/libc/stdlib/tst-strtod.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991,96,97,98,99,2000,2001,2003 Free Software Foundation, Inc.
+/* Copyright (C) 1991,1996-2001,2003,2009 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -62,10 +62,10 @@ static const struct ltest tests[] =
     { "0x00.0014p19", 160.0, '\0', 0 },
     { "0x1p-1023",
       1.11253692925360069154511635866620203210960799023116591527666e-308,
-      '\0', 0 },
+      '\0', ERANGE },
     { "0x0.8p-1022",
       1.11253692925360069154511635866620203210960799023116591527666e-308,
-      '\0', 0 },
+      '\0', ERANGE },
 #if __GNUC_PREREQ(2,96)
     /* For older GCC release HUGE_VAL is not a constant.  */
     { "Inf", HUGE_VAL, '\0', 0 },