CCAN: update to upstream after kimi audit.

ccan/README

@@ -1,3 +1,3 @@
 CCAN imported from https://github.com/rustyrussell/ccan.
 
-CCAN version: fe99a8e0
+CCAN version: 08af1cab

ccan/ccan/asort/asort.c

@@ -34,11 +34,15 @@
 #include <string.h>
 #include <stdbool.h>
 
+/* Vendored glibc code uses GNU void * arithmetic. */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wpointer-arith"
+
 /* glibc-internal type, mapped to ccan's equivalent. */
 typedef _total_order_cb __compar_d_fn_t;
 
 /* glibc-internal helpers, not available outside glibc. */
-static inline void *__mempcpy(void *dst, const void *src, size_t n)
+static inline void *asort_mempcpy(void *dst, const void *src, size_t n)
 {
   return (char *) memcpy (dst, src, n) + n;
 }
@@ -54,8 +58,8 @@ __memswap (void *__restrict p1, void *__restrict p2, size_t n)
   while (n > SWAP_GENERIC_SIZE)
     {
       memcpy (tmp, p1, SWAP_GENERIC_SIZE);
-      p1 = __mempcpy (p1, p2, SWAP_GENERIC_SIZE);
-      p2 = __mempcpy (p2, tmp, SWAP_GENERIC_SIZE);
+      p1 = asort_mempcpy (p1, p2, SWAP_GENERIC_SIZE);
+      p2 = asort_mempcpy (p2, tmp, SWAP_GENERIC_SIZE);
       n -= SWAP_GENERIC_SIZE;
     }
   while (n > 0)
@@ -316,13 +320,13 @@ msort_with_tmp (const struct msort_param *p, void *b, size_t n)
 	{
 	  if (cmp (b1, b2, arg) <= 0)
 	    {
-	      tmp = (char *) __mempcpy (tmp, b1, s);
+	      tmp = (char *) asort_mempcpy (tmp, b1, s);
 	      b1 += s;
 	      --n1;
 	    }
 	  else
 	    {
-	      tmp = (char *) __mempcpy (tmp, b2, s);
+	      tmp = (char *) asort_mempcpy (tmp, b2, s);
 	      b2 += s;
 	      --n2;
 	    }
@@ -452,4 +456,6 @@ _asort (void *const pbase, size_t total_elems, size_t size,
     }
 }
 
+#pragma GCC diagnostic pop
+
 #endif /* !HAVE_QSORT_R_PRIVATE_LAST */

ccan/ccan/asort/asort.h

@@ -23,6 +23,12 @@ _asort((base), (num), sizeof(*(base)),					\
        total_order_cast((cmp), *(base), (ctx)), (ctx))
 
 #if HAVE_QSORT_R_PRIVATE_LAST
+/* qsort_r is only declared under _GNU_SOURCE, which must precede the
+ * first libc include — we can't control our includers, so declare it
+ * ourselves (the configurator only sets this where this GNU signature
+ * was detected). */
+void qsort_r(void *base, size_t nmemb, size_t size,
+	     int (*compar)(const void *, const void *, void *), void *arg);
 #define _asort(b, n, s, cmp, ctx) qsort_r(b, n, s, cmp, ctx)
 #else
 void _asort(void *base, size_t nmemb, size_t size,

ccan/ccan/bitmap/bitmap.h

@@ -13,7 +13,7 @@ typedef unsigned long bitmap_word;
 
 #define BITMAP_WORD_BITS	(sizeof(bitmap_word) * CHAR_BIT)
 #define BITMAP_NWORDS(_n)	\
-	(((_n) + BITMAP_WORD_BITS - 1) / BITMAP_WORD_BITS)
+	(((_n) / BITMAP_WORD_BITS) + (((_n) % BITMAP_WORD_BITS) != 0))
 
 #define BITMAP_WORD_0		(0)
 #define BITMAP_WORD_1		((bitmap_word)-1UL)

ccan/ccan/bitops/bitops.h

@@ -26,7 +26,7 @@ static inline int bitops_ffs32(uint32_t u)
 /**
  * bitops_ffs64: find lowest set bit in a uint64_t
  *
- * Returns 1 for least significant bit, 32 for most significant bit, 0
+ * Returns 1 for least significant bit, 64 for most significant bit, 0
  * for no bits set.
  */
 static inline int bitops_ffs64(uint64_t u)

ccan/ccan/breakpoint/breakpoint.c

@@ -7,26 +7,39 @@
 
 bool breakpoint_initialized;
 bool breakpoint_under_debug;
+pid_t breakpoint_pid;
+
+static volatile sig_atomic_t trapped;
 
 /* This doesn't get called if we're under GDB. */
 static void trap(int signum)
 {
-	breakpoint_initialized = true;
+	trapped = true;
 }
 
 void breakpoint_init(void)
 {
 	struct sigaction old, new;
+	sigset_t mask, oldmask;
 
 	new.sa_handler = trap;
 	new.sa_flags = 0;
 	sigemptyset(&new.sa_mask);
 	sigaction(SIGTRAP, &new, &old);
+
+	/* If SIGTRAP is blocked, the probe would pend (and kill us when
+	 * the caller restores its mask), not run the handler. */
+	sigemptyset(&mask);
+	sigaddset(&mask, SIGTRAP);
+	sigprocmask(SIG_UNBLOCK, &mask, &oldmask);
+
+	trapped = false;
 	kill(getpid(), SIGTRAP);
+
+	sigprocmask(SIG_SETMASK, &oldmask, NULL);
 	sigaction(SIGTRAP, &old, NULL);
 
-	if (!breakpoint_initialized) {
-		breakpoint_initialized = true;
-		breakpoint_under_debug = true;
-	}
+	breakpoint_pid = getpid();
+	breakpoint_initialized = true;
+	breakpoint_under_debug = !trapped;
 }

ccan/ccan/breakpoint/breakpoint.h

@@ -10,13 +10,20 @@
 void breakpoint_init(void) COLD;
 extern bool breakpoint_initialized;
 extern bool breakpoint_under_debug;
+extern pid_t breakpoint_pid;
 
 /**
  * breakpoint - stop if running under the debugger.
+ *
+ * The first call detects the debugger via a SIGTRAP probe.  This is
+ * not thread-safe: either call breakpoint_init() explicitly at
+ * program start (before creating threads), or don't let first use
+ * race.
  */
 static inline void breakpoint(void)
 {
-	if (!breakpoint_initialized)
+	/* Detection state doesn't carry across fork(). */
+	if (!breakpoint_initialized || breakpoint_pid != getpid())
 		breakpoint_init();
 	if (breakpoint_under_debug)
 		kill(getpid(), SIGTRAP);

ccan/ccan/build_assert/build_assert.h

@@ -1,13 +1,19 @@
 /* CC0 (Public domain) - see LICENSE file for details */
 #ifndef CCAN_BUILD_ASSERT_H
 #define CCAN_BUILD_ASSERT_H
+#include "config.h"
 
 /**
  * BUILD_ASSERT - assert a build-time dependency.
  * @cond: the compile-time condition which must be true.
  *
- * Your compile will fail if the condition isn't true, or can't be evaluated
- * by the compiler.  This can only be used within a function.
+ * Your compile will fail if the condition isn't true.  When the
+ * compiler supports C11 _Static_assert it will also fail if the
+ * condition can't be evaluated by the compiler; otherwise (older
+ * compilers) a non-constant condition is silently accepted (and is
+ * undefined behavior if false at runtime).
+ *
+ * This can only be used within a function.
  *
  * Example:
  *	#include <stddef.h>
@@ -19,22 +25,38 @@
  *		return (char *)foo;
  *	}
  */
+#if HAVE_STATIC_ASSERT
+/* _Static_assert is a declaration, so do-while wrap avoids breaking if (x) BUILD_ASSERT... */
+#define BUILD_ASSERT(cond) \
+	do { _Static_assert(cond, "BUILD_ASSERT"); } while(0)
+#else
 #define BUILD_ASSERT(cond) \
 	do { (void) sizeof(char [1 - 2*!(cond)]); } while(0)
+#endif
 
 /**
  * BUILD_ASSERT_OR_ZERO - assert a build-time dependency, as an expression.
  * @cond: the compile-time condition which must be true.
  *
- * Your compile will fail if the condition isn't true, or can't be evaluated
- * by the compiler.  This can be used in an expression: its value is "0".
+ * Your compile will fail if the condition isn't true.  When the
+ * compiler supports C11 _Static_assert it will also fail if the
+ * condition can't be evaluated by the compiler; otherwise (older
+ * compilers) a non-constant condition is silently accepted (and is
+ * undefined behavior if false at runtime).
+ *
+ * This can be used in an expression: its value is "0".
  *
  * Example:
  *	#define foo_to_char(foo)					\
  *		 ((char *)(foo)						\
  *		  + BUILD_ASSERT_OR_ZERO(offsetof(struct foo, string) == 0))
  */
+#if HAVE_STATIC_ASSERT
+#define BUILD_ASSERT_OR_ZERO(cond) \
+	(sizeof(struct { _Static_assert(cond, "BUILD_ASSERT_OR_ZERO"); char c; }) - 1)
+#else
 #define BUILD_ASSERT_OR_ZERO(cond) \
 	(sizeof(char [1 - 2*!(cond)]) - 1)
+#endif
 
 #endif /* CCAN_BUILD_ASSERT_H */

ccan/ccan/cdump/cdump.c

@@ -48,9 +48,10 @@ static struct token *tokenize(const void *ctx, const char *code)
 		} else if (code[i] == '/' && code[i+1] == '*') {
 			/* Multi-line comment. */
 			const char *end = strstr(code+i+2, "*/");
-			len = (end + 2) - (code + i);
 			if (!end)
 				len = strlen(code + i);
+			else
+				len = (end + 2) - (code + i);
 			if (tok_start != -1U) {
 				add_token(&toks, code+tok_start, i - tok_start);
 				tok_start = -1U;
@@ -82,6 +83,10 @@ static struct token *tokenize(const void *ctx, const char *code)
 			start_of_line = false;
 	}
 
+	/* A trailing identifier running to EOF is still a token. */
+	if (tok_start != -1U)
+		add_token(&toks, code+tok_start, i - tok_start);
+
 	/* Add terminating NULL. */
 	tal_resizez(&toks, tal_count(toks) + 1);
 	return toks;
@@ -92,6 +97,7 @@ struct parse_state {
 	const struct token *toks;
 	struct cdump_definitions *defs;
 	char *complaints;
+	unsigned int depth;
 };
 
 static const struct token *tok_peek(const struct token **toks)
@@ -277,17 +283,28 @@ static void tok_take_unknown_statement(struct parse_state *ps)
 
 static bool tok_take_expr(struct parse_state *ps, const char *term)
 {
+	/* Recursion is one frame per nested ( or [: bound it. */
+	if (ps->depth++ == 100) {
+		complain(ps, "Expression nested too deeply");
+		goto fail;
+	}
 	while (!tok_is(&ps->toks, term)) {
 		if (tok_take_if(&ps->toks, "(")) {
 			if (!tok_take_expr(ps, ")"))
-				return false;
+				goto fail;
 		} else if (tok_take_if(&ps->toks, "[")) {
 			if (!tok_take_expr(ps, "]"))
-				return false;
+				goto fail;
 		} else if (!tok_take(&ps->toks))
-			return false;
+			goto fail;
 	}
-	return tok_take(&ps->toks);
+	if (!tok_take(&ps->toks))
+		goto fail;
+	ps->depth--;
+	return true;
+fail:
+	ps->depth--;
+	return false;
 }
 
 static char *tok_take_expr_str(const tal_t *ctx,
@@ -347,7 +364,12 @@ static bool tok_take_type(struct parse_state *ps, struct cdump_type **type)
 
 	/* Did we get some? */
 	if (ps->toks != types) {
-		name = string_of_toks(NULL, types, tok_peek(&ps->toks));
+		const struct token *until = tok_peek(&ps->toks);
+		if (!until) {
+			complain(ps, "EOF after type");
+			return false;
+		}
+		name = string_of_toks(NULL, types, until);
 		kind = CDUMP_UNKNOWN;
 	} else {
 		/* Try normal types (or simple typedefs, etc). */
@@ -654,6 +676,7 @@ struct cdump_definitions *cdump_extract(const tal_t *ctx, const char *code,
 	ps.defs = tal(ctx, struct cdump_definitions);
 	ps.complaints = tal_strdup(ctx, "");
 	ps.code = code;
+	ps.depth = 0;
 
 	strmap_init(&ps.defs->enums);
 	strmap_init(&ps.defs->structs);

ccan/ccan/check_type/check_type.h

@@ -45,7 +45,15 @@
  *		 ((encl_type *)						\
  *		  ((char *)(mbr_ptr) - offsetof(encl_type, mbr))))
  */
-#if HAVE_TYPEOF
+#if HAVE_TYPEOF && HAVE_BUILTIN_TYPES_COMPATIBLE_P
+#include <ccan/build_assert/build_assert.h>
+#define check_type(expr, type)			\
+	BUILD_ASSERT_OR_ZERO(__builtin_types_compatible_p(typeof(expr), type))
+
+#define check_types_match(expr1, expr2)				\
+	BUILD_ASSERT_OR_ZERO(__builtin_types_compatible_p(typeof(expr1), \
+							  typeof(expr2)))
+#elif HAVE_TYPEOF
 #define check_type(expr, type)			\
 	((typeof(expr) *)0 != (type *)0)