[libc] Add getpid syscall wrapper for Linux (#220595)
Adds an internal `getpid` Linux system call wrapper
(`LIBC_NAMESPACE::linux_syscalls::getpid`) in
`src/__support/OSUtil/linux/syscall_wrappers/getpid.h` and registers the
corresponding CMake header library target.
This follows the established pattern of existing syscall wrappers in
this directory to allow internal utilities to query the process ID via
`SYS_getpid` in freestanding environments.
Update existing getpid to use it.
Assisted-by: Automated tooling, human reviewed.
[flang-rt] Fix runtime/environment.cpp compilation on FreeBSD (#219705)
`runtime/environment.cpp` doesn't compile on FreeBSD:
```
runtime/environment.cpp:115:47: error: use of undeclared identifier 'RTLD_DEFAULT'
115 | auto envpp{reinterpret_cast<char ***>(dlsym(RTLD_DEFAULT, "environ"))};
| ^~~~~~~~~~~~
```
`<dlfcn.h>` needs to be included.
Tested on `x86_64-pc-freebsd15.1` and `x86_64-pc-linux-gnu`.
fsck_msdosfs: add a test for reconnecting on volumes larger than 4 GiB
Build a 4.5 GiB FAT32 image whose LOST.DIR cluster sits exactly 4 GiB above
the single cluster of a PAYLOAD.BIN, so that truncating the offset of the
former to 32 bits yields the offset of the latter, then inject a lost cluster
chain and let fsck_msdosfs(8) reconnect it.
The test asserts both halves of the bug fixed in the previous commit: that
PAYLOAD.BIN's cluster is unchanged, and that a second pass no longer reports
the chain as lost, which it only stops doing once the directory entry reaches
the real LOST.DIR.
newfs_msdos(8) -C only calls ftruncate(2) and nothing outside the reserved
area, the FATs and a handful of clusters is ever written, so the image stays
sparse and costs about 2 MiB on disk.
The geometry is read back out of the BPB rather than assumed, so
newfs_msdos(8) stays free to lay the file system out differently; the test
fails with a clear message if the volume ever becomes too small to hold a
[3 lines not shown]
fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset
reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit
arithmetic and widened the result only on assignment:
lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
+ boot->FirstCluster * boot->bpbBytesPerSec;
cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo
2**32. Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases
the offset exactly 4 GiB below it, which on such a volume is ordinary
file data.
That offset is used for both the read and the write: reconnect() reads a
cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY
or SLOT_DELETED byte, which arbitrary data readily provides, stores the
new directory entry in that slot, and writes the cluster back to the
same wrong place. Thirty-two bytes of an unrelated file are silently
replaced by a directory entry, and since that entry never reaches the
[14 lines not shown]
[ComplexDeinterleaving] Fix miscompile with fma/fmuladd sign tracking (#220602)
This PR fixes a miscompile where the sign of the product in a `fma` was
also applied to the addend resulting in an incorrect `fcmla` angle.
[libc] Add FieldTokenizer and FlatFileDatabase (#214720)
Refactored the pwd database backend to separate file stream mechanics
from record parsing using generic FlatFileDatabase and FieldTokenizer
template engines.
POSIX user and group database queries must operate without dynamic heap
allocations (ruling out getline/getdelim) and service both static
process state (getpwent) and user-supplied reentrant buffers
(getpwnam_r).
To satisfy these requirements with zero runtime overhead:
* Implemented FieldTokenizer to provide safe, in-place span tokenisation
without pointer arithmetic or index-tracking hazards.
* Implemented FlatFileDatabase<EntryType> to encapsulate file lifecycle
(setdb, enddb, getnext) and predicate-based linear search (lookup)
parameterized directly on record types and free parse_line functions.
* Refactored PasswdParser into free parse_line and updated
[6 lines not shown]
py-fonttools: updated to 4.64.0
4.64.0 (released 2026-08-31)
- [feaLib] Fix name-table parsing for multibyte Mac encodings
- [ttProgram] Also indent TrueType assembly following ``IDEF[ ]``, like function
definitions
- [subset] Keep East Asian spacing ``palt`` by default
- [subset] Bug fix for MATH table in which constructions for glyphs that are only
added during MATH closure were kept
- [ufoLib] Make glyph-to-group construction accessible outside of lookup function
- [glyf] Use reverse glyph map for O(1) ``__setitem__`` membership
- [ttLib] Fix ``fixLookupOverFlows()`` reporting success when it had not promoted
any lookup to Extension, masking unresolvable overflows.
- [ttLib] Add support for TrueType Collection version 2
- [ttLib] Pin a single head.modified timestamp across ``TTCollection.save``
- [ttLib] Give an actionable error when LookupList overflow is unrecoverable
- [ttLib] Add support for the AAT bitmap tables ``bhed``, ``bdat``, ``bloc``,
variants of ``head``, ``EBDT``, ``EBLC`` used in legacy Apple bitmap-only fonts
[57 lines not shown]
[AArch64][SVE] Promote unpacked 16-bit floats to legal VECTOR_COMPRESS ops (#220268)
This patch promotes f16 and bf16 VECTOR_COMPRESS ops for nxv2/nxv4 to
64-bit or 32-bit operations respectively. This allows lowering them via
`compact` in SVE1.
Assisted-by: Codex (tests)
system: run file and configuration selfchecks
Execute these just before rc.bootup would start bringing
up the system. This would still have to audit-log, but
syslog-ng has not started yet.
fsck_msdosfs: add tests for the 32-bit boot block field decoding
Exercise each of the 32-bit BIOS Parameter Block and FSInfo fields that
readboot() decodes, using values whose most significant byte has its high
bit set. Each case checks two things: that fsck_msdosfs(8) reports the
full unsigned 32-bit value back on stdout, and that nothing writes a
sanitizer runtime error to stderr.
The second check is what catches a byte-at-a-time decode. Shifting such
a byte left by 24 is undefined, but every compiler we use wraps it into
the same bit pattern, so the decoded value alone cannot tell a correct
decode from an overflowing one. In a WITH_UBSAN build bsd.sanitizer.mk
compiles with -fsanitize=undefined and -fsanitize-recover=undefined, so
the shift is reported on stderr and execution continues, which the test
can then assert on. Against the byte-at-a-time decode these cases fail
in a WITH_UBSAN build and pass without it.
Note that the stderr check also fails on unrelated undefined behavior
that these images reach anywhere in fsck_msdosfs(8), which is intended.
[2 lines not shown]
py-weasyprint: updated to 69.0
69.0
**This is a security update (CVE-2026-49452).**
We strongly recommend to upgrade WeasyPrint to the latest version if you use the
``--presentational-hints`` option and render untrusted HTML with restricted CSS
properties.
Security:
* Avoid CSS injection with HTML presentational hints.
Command-line API:
* The ``--srgb`` option has been replaced by ``--output-intent=srgb``. Other values are
possible: ``device-cmyk`` for CMYK documents with no ICC profile, or the CSS
identifier of a ``@color-profile`` rule.
[13 lines not shown]
fsck_msdosfs: avoid signed integer overflow in readboot()
readboot() decoded the 32-bit little-endian BIOS Parameter Block and
FSInfo fields by shifting the individual bytes of a u_char array into
place. The u_char operands are promoted to signed int, so shifting a
most significant byte of 0x80 or greater left by 24 overflows int, which
is undefined behavior. Use le32dec() from <sys/endian.h> instead, which
is both well defined and easier to read.
No functional change intended.
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2350
clang/ARM: Derive -pg mcount name from the triple environment
For a glibc/gnueabi ARM and AArch64 targets, GCC's -pg instrumentation
always calls __gnu_mcount_nc (with the caller pushing LR, per the "nc"
no-LR-clobber ABI). clang only produced this when -meabi=gnu was passed
explicitly; a separate gnueabi triple wrongly called plain "mcount".
On ARM, glibc's EABI profiling entry point is __gnu_mcount_nc
(sysdeps/arm/arm-mcount.S, exported since GLIBC_2.8). It does provide plain
mcount/_mcount, but only as a legacy APCS compat alias (__mcount_arm_compat,
gated on GCC_COMPAT(4,3)/SHLIB_COMPAT) that reads an APCS frame-pointer
record rather than following the EABI push-LR convention. Calling it from
EABI -pg code is thus an ABI mismatch, not the intended entry point.
Derive the GNU-vs-plain mcount name from the triple environment in addition
to the explicit -meabi=gnu, so a gnueabi target gets the correct __gnu_mcount_nc
call by default, matching GCC:
push {lr}
[5 lines not shown]
