
Patch Name: PHCO_21508

Patch Description: s700_800 10.01 libc cumulative patch

Creation Date: 00/04/06

Post Date:  00/05/23

Hardware Platforms - OS Releases:
	s700: 10.00 10.01
	s800: 10.00 10.01

Products: N/A

Filesets:
	OS-Core.C-MIN OS-Core.CORE-SHLIBS ProgSupport.PROG-AUX
	ProgSupport.PROG-MIN

Automatic Reboot?: No

Status: General Release

Critical:
	No (superseded patches were critical)
	PHCO_8762: CORRUPTION

Path Name: /hp-ux_patches/s700_800/10.X/PHCO_21508

Symptoms:
	PHCO_21508:
	endpwent() dumps core if NIS used.
	JAGab84526; SR 8606112213

	PHCO_20585:
	This is a SP patch version of PHCO_21508.

	PHCO_19370:
	regexec() finds for "." in empty string "" with locales
	other than C.
	JAGaa53114; SR 4701413906

	The asctime() does not work for years >= 2100.
	JAGaa55561

	The check for whether the root directory has been reached
	in getcwd(3C) was not done correctly in the case of a Loop
	Back File System (LOFS).
	JAGaa62640 JAGaa86038 JAGaa86039; SR 4701414862

	For a week which contains days in the previous year and
	the new year, strftime(3C) with %V returns two different
	week numbers for days in the previous year and those in
	the new year. In addition, if there are less than 4 days
	in the new year, it always returns 53 as the week number
	for the days in the new year, regardless of what the last
	week of the previous year is.
	JAGaa93337 JAGaa93338 JAGaa93339; SR 1653245415

	strptime(3C) does not fill in tm_wday, tm_mon and tm_mday
	when supplied both the year and day of the year.
	JAGab65823; SR 8606101862

	PHCO_16721:
	strptime(3C) treats February 29 and March 1 of a leap year
	to be the same day when the %a or %A and %W or %U conversion
	specifications are used at the same time.  The values
	returned for tm_yday and tm_wday for March 1 are incorrect.
	JAGaa41262 SR 1653269738, JAGaa41263 SR 1653269738

	The getdate() function does not parse the template file
	correctly when the %r field descriptor is used in at least
	one of the templates.  This leads to the situation that a
	non-zero value for getdate_err is returned even when the
	template file contains a matching template.

	In addition, getdate() does not correctly handle the case
	where %I is used in a template but %p is not.
	JAGaa00429 JAGaa10165 JAGaa10166 JAGaa10167 JAGaa10168
	JAGaa05222 JAGaa10164 JAGaa10163 JAGaa08067 JAGaa10158
	JAGaa12392

	When the length of the environment variable LANG is longer
	than 1024 (MAXPATHLEN), catopen(3C) in /usr/sbin/lanadmin
	caused coredump.
	JAGaa01290

	PHCO_14253:
	When the customer program containing calls to endpwent() is
	run in NIS environment, a memory leak is observed. After
	several days of running, the program is unable to continue
	due to an out-of-memory condition.  JAGaa01175, SR
	5003395673.

	When more than 435 processes are registered with
	portmap(3c) and a request for PMAPROCDUMP is made via
	UDP, portmapper hangs. SR 1653236562, DTS INDaa29151.

	When a user with an expired password tries to log in on
	the console, the user gets a usage message from the passwd
	command as follows:
	usage: passwd [-F file] [name]
	DTS JAGaa01505, SR 5003380394

	PHCO_13916:
	Calling perror(string) with the length of string plus the
	message larger than 1024 will cause coredump.  DTS #
	JAGaa01178, JAGaa01166.

	Concurrent calls to fread() (or other stdio input
	functions)on unbuffered or line buffered files can lead to a
	deadlock in libc in a multi-threaded application.
	DSDe435666, DSDe435913, JAGaa00772, DSDe439204, SR
	1653211490, SR 1653228528

	PHCO_12009:
	Concurrent calls to fread() (or other stdio input
	functions)on unbuffered or line buffered files can lead
	to a deadlock in libc in a multi-threaded application.
	DSDe435666, DSDe435913, JAGaa00772, DSDe439204, SR
	1653211490, SR 1653228528

	Non-root users of rlogin get the error message:
	"rlogind: /dev/pts/1: Permission denied."
	if configured in /etc/inetd.conf with the -l option.
	DTS INDaa28226, SR 4701364653

	In a customer application, regcomp(3C) followed by
	regexec(3C) returns an unexpected "no match" value when
	the locale is set to non-C locale. DSDe437259, SR
	1653215186.

	Output directed to stderr may be corrupted when an
	application opens files for non-buffered i/o by calling
	setbuf() with the _IONBF flag.  The symptom is likely to
	manifest only in multi-threaded applications. DSDe437356.

	PHCO_10652:
	strcat() may core dump when the last word of the source
	string is at the page boundary. SR 5003302299, DSDe434239,
	DSDe427804.

	For regcomp/regexec, "^ *$" and similar patterns in non-C
	locales will incorrectly match lines with newlines in
	them. DSDe434345, SR 1653204651.

	Regular expression pattern ".*" behaves incorrectly in
	Japanese locale.  Fix for ^$ expression anchoring had
	sideeffects. DSDe433097.

	The memcmp(3c) may core dump at page boundary. DSDe433356,
	SR4701344721.

	February 29, 2000 is rejected as a valid date by the
	getdate(3c) library call.  DSDe434241, DSDe430766;
	SR #s 1653203026, 4701334763.

	The getdate(3c) would set getdate_err to "no matching
	template entry" (7) instead of "invalid input
	specification" (8) for dates outside the range of the
	time_t data type.  This has been fixed. DSDe434270

	Libc patch PHCO_9419 had an unsatisfied symbol
	"__do_replacemeant". DSDe435129, SR 1653208231.

	PHCO_9419:
	Memory leak in globfree().  DSDe431962, SR5003344192.

	If given weekday is the same as today and within the last 7
	days of the month, getdate() returns an Error 8.
	DSDe431143, SR1653185629.

	In non-C locales, non-blank lines would match pattern ^$ for
	regcomp().  DSDe431505 DSDe432126.

	User applications hit a limit of 1023 for number of sets in
	a message catalog.  DSDe431644, SR5003341271.

	Call to tempnam(), mktemp() and mkstemp() sometimes returned
	a dangling symlink as the name for a temporary
	file. SR1653189134.

	The strptime and getdate calls did not handle two digit year
	specifications in the same manner.  This has been addressed
	by providing strptime and getdate with an alternative
	behavior for dealing with two digit year specifications.  In
	order to obtain the alternative behavior, which interprets
	two-digit year values in the range 66-99 to refer to the
	twentieth century and values in the range 00-68 to refer to
	the twenty-first century, the executable must link with the
	supplied object file, /usr/lib/year2000.o.  Existing
	executables will continue to get the compatible behavior.
	DSDe430766, SR4701334763.

	The getdate() routine fails with a signal 11 segmentation
	violation when accessing a datemask file that contains
	a very large number of alternative date formats. DSDe429925,
	SR1653176883.

	PHCO_9220:
	Unaccaptable degradation of collation using swedish
	language. SR1653192161.

	The libc routine ulckpwdf always returns -1. As a result,
	the /etc/.pwd.lock can not be unlocked. SR5003338038,
	DSDe431142.

	PHCO_8762:
	Random truncaton of strings with strcat due to fix
	attempted in PHCO_8368.

	PHCO_8368:
	The readdir() call may inadvertently call a user-defined
	routine.

	getcwd returns EINVAL when a negative buflen is passed
	in.

	memchr tries to read beyond end of valid memory when char
	is not found in thestring and may core dump.

	Sometimes strcat would attempt to access an unmapped page
	of memory.

	- The group permissions of the parent directory of the home
	directory does not have to be set for "all" for the
	".rhosts" check to succeed.  The "rhosts" check changes
	the effective group id to the real group id before
	opening ".rhosts" file.
	- ruserok() did not properly parse the username in
	hosts.equiv.

	PHCO_7798:
	regexec does not find pattern "(a*|b)c" in input "c"

	Call to setlocale() caused LC_ALL string to become corrupt.

	"$^" with REG_NEWLINE matches all lines, not just empty.

	PHCO_7177:
	Runtime message catalog functions only support 255 message
	groups.

	PHCO_7175:
	strxfrm(3) can potentially incompletely transform in
	a non-C locale if only one extra byte for NULL is
	allocated and the array is not initialized to zeros.

	PHCO_6778:
	Undocumented behavior for strncpy was missing.

	qsort performs very badly on sorted blocks of data -
	customer found that qsort on a file with 100,000 randomly
	sorted records took seconds, whereasa file of 100,000
	records containing large sorted blocks took over an hour to
	sort.

	Under certain circumstances, a regcomp(3) memory leak
	causes an Uninitialized Memory Read from withing
	regfree(3).

	On 10.10 a call to fileno() with a NULL parameter simply
	returns NULL - that is until you have linked in libdce.sl
	which enables the thread safe version of fileno which core
	dumps when passed a NULL parameter.

	Repeated calls to setlocale(3c) expose a memory leak.

	PHCO_6595:
	Multiple calls to gettxt() would result in a "too many open
	files" error.

	telldir() returns an incorrect offset zero
	for the end of directory record.

	strptime(3c) does not return the correct
	information for 12:xx am.

	Includes change to getpwent.c in function matchname() so
	that it returns 1 instead of 0 if it finds the name under
	the MINUS section.  Also includes change to getgrent.c so
	that interpret will stop processing if it finds a MINUS as
	part of the name.

	PHCO_6427:
	The strncpy() defect documented in PHCO_6342 was not
	completely fixed.

	PHCO_6342:
	Applications calling strncpy() may core dump at
	page boundary between a valid and an invalid page.

	Applications calling gettxt() several times may
	get "too many file descriptors" error

	PHCO_6134:

	Applications using getprotobyname_r(),
	getprotobynumber_r(), getnetbyname_r(), getnetbyaddr_r(),
	getservbyname_r(), or getservbyport_r() in multithreaded
	applications may core dump.

	Applications directly or indirectly calling res_search()
	will experience a memory leak.

	strncpy may behave incorrectly.

	Cu does not work over Datakit.

	Child process file descriptors may be trashed when
	resolving a name with NIS in gethostbyname.

	Fixes stack overrun defect in syslog

	PHCO_6070:
	Applications making a transition from 9.x to 10.x may
	encounter unexpected malloc failures when locale is
	other than C.  eg. german, french locales.

	PHCO_5420:

	Possible unexpected failures from getservbyname_r() when
	querying an NIS server that's without a servi.bynp map.
	The probability of failure is proportional to the number of
	times the getservbyname_r() call is executed.  After an
	initial failure, subsequent calls to getservbyname_r() will
	continue to fail.

	getservbyport() poor performance in an NIS environment if
	the requested service port is not present in the servers
	services.byname map, or if the port is present in the map
	but the user did not specify a protocol in the
	getservbyport() call.  The NIS client would then start a
	sequential search of the map, increasing CPU usage and
	network traffic for the duration of the search.

	The strncpy(3c) function fails with "segmentation
	violation" when (a) the source string ends on a page
	boundary, (b) the page following the source string has not
	been allocated to the process, and (c) the source and
	destination pointers are not aligned the same.

	Calls to malloc for greater than 1Gb of memory fail
	with ENOMEM.

	The routines in the password entry family of routines may
	encounter various problems (core dumps, corrupted
	heap--such as malloc structures, etc.) on systems using
	NIS.

	Calls to opendir with device files and pipes hangs.

	User cannot login via console when password is expired.

	The version of iconv on 10.0 sets errno incorrectly for
	incomplete, double-byte characters when LANG=ja_JP.SJIS or
	LANG=ja_JP.eucJP.  When such an error occurs, errno should
	be set to EINVAL.  Instead, it is set to EILSEQ.

	The update mnttab(3c) function can corrupt can corrupt the
	mnttab file. The values for passno and frequency can be
	invalid in the mnttab file if the root file system is
	incorrect in the existing mnttab, and/or fstab file.

	When using the %V format descriptor with strftime(3c), the
	count for the number of weeks is incorrect when processing
	week 1.  This problem can be demonstrated in applications
	JAGaa01290
	that use strftime(3c) or date(1).

	The FP to ASCII conversion routine "do_fcvt()" rounds
	impercisely for certain numbers.

	HP-UX 9.x applications using regexp(3x) interfaces
	encounters binary compatibility problems with HP-UX
	10.x systems.

	Calling setusershell(3c) may cause data corruption in
	the user's heap area.

	HP-UX 9.x applications using libc_r IPC  interfaces
	may encounter binary compatibility problems with HP-UX
	10.x systems.

Defect Description:
	PHCO_21508:
	endpwent() dumps core if NIS is used.  This is because
	of the segmentation violation occuring in endpwent().

	The cause for the above is, in function
	getnextfromyellow() the return value of yp_next() is
	not checked. The check for return value from yp_next()
	is needed because "outkey"(5th parameter to yp_next())
	contains some orbitary value when end of file is
	reached, and yp_next() returns nonzero value setting
	the errno to YPERR_NOMORE. The outkey value which is
	incorrect is being freed without checking for the return
	value from yp_next.

	Resolution:
	To fix this defect the return value from yp_next() and
	yp_first() is checked and if it returns non zero then
	do not free memory which is not allocated.
	JAGab84526; SR 8606112213

	PHCO_20585:
	This is a SP patch version of PHCO_21508.

	PHCO_19370:
	regexec() matches "." in empty string "" with locales
	other than C.

	Resolution:
	regexec(3C) was matching a "."  in an empty string "".
	The problem was due to an out-of-bound array access
	without checking the end-of-string.  The changes made
	are only to make sure that the accesses are valid.
	JAGaa53114; SR 4701413906

	The asctime() does not work for years >= 2100.

	Resolution:
	The problem was already addressed in 11.0. Backported
	the code from 11.0 to 10.20, 10.10 and 10.01.
	JAGaa55561

	getcwd() was returning prematurely due to an incorrect
	check for whether the root directory has been reached
	in the case of a Loop Back File System (LOFS) and,
	consequently, returns incorrect results.

	Resolution:
	Changed getcwd() to compare the entire mystat structure
	for the current directory and its parent directory when
	determining if the root directory has been reached.  The
	previous code only compares the inode and device numbers.
	This change ensures that cases where the inode and device
	numbers are the same for both the current and parent
	directory will be handled correctly.

	An example of this, prior to applying the fix to getcwd(),
	follows:

	# mount /stand /stand/lofs
	# cd /stand/lofs/build
	# pwd
	/build   /* path obtained from getcwd() */

	This is because the inode and device numbers for lofs and
	stand are the same:

	build:  {ino = 4226; dev = 0x40000001; fstype = lofs;
	       fsid = 0xff000004}
	lofs:   {ino = 5376; dev = 0x40000001; fstype = lofs;
	       fsid = 0xff000004}
	stand:  {ino = 5376; dev = 0x40000001; fstype = ufs;
	       fsid = 0         }
	/:      {ino = 2;    dev = 0x40000001; fstype = ufs;
	       fsid = 0         }
	JAGaa62640 JAGaa86038 JAGaa86039; SR 4701414862


	strftime() returns two different week numbers for %V for
	days in a week which contains days in the previous year and
	the new year.   The week number returned for days in the
	previous year is either 52 or 53.  The week number returned
	for days in the new year is 1 if there are four or more days
	in the new year in that week; otherwise, it is 53,
	regardless of whether the last week of the previous year is
	52 or 53.  The week number should be the same for all days
	in any week.

	Resolution:
	Changed strftime() to return the same week number for all
	days in a week which contains days in the previous year and
	the new year.   If there are less than 4 days in the new
	year, return the week number of the last week of the
	previous year; otherwise, return 1.
	JAGaa93337 JAGaa93338 JAGaa93339; SR 1653245415

	strptime(3C) does not fill in the tm_wday, tm_mon and
	tm_mday fields in the tm structure when both the year
	and day of year are supplied.

	Resolution:
	The problem was fixed in 10.20 onwards, this fix was
	backported to 10.10 and 10.01
	JAGab65823; SR 8606101862

	PHCO_16721:
	When the format used for March 1 of a leap year contains
	both the %a or %A and %W or %U conversion specifications,
	the values returned by strptime() for tm_yday and tm_wday
	are the same as those for February 29.
	JAGaa41262 SR 1653269738, JAGaa41263 SR 1653269738

	getdate() fails to find a matching template when %r is used
	in a template and there is at least one other template that
	contains %H or %R, even though a matching template exist.
	It also returns an error if a template contains %I but not
	%p and a matching template exists.
	JAGaa00429 JAGaa10165 JAGaa10166 JAGaa10167 JAGaa10168
	JAGaa05222 JAGaa10164 JAGaa10163 JAGaa08067 JAGaa10158
	JAGaa12392

	HP-UX enforces that variable lengthes should not exceed
	1024. In catopen(3C), the string that represents the
	variable LANG was strcpy'ed into a buffer with a fixed size
	MAXPATHLEN (1024). This caused coredump when strlen(LANG)
	is longer than 1024.
	JAGaa01290

	PHCO_14253:
	There is a memory leak in endpwent() and setpwent() libc
	functions when they are run in NIS environments. The
	program size grows in 4k increments, for each endpwent()
	and setpwent() calls in NIS environment.

	When the memory buffer overflows while trying to encode too
	much data, the memory area gets shortened at each request
	eventually ging negatrequest eventually going negative. The
	pointer is not reset on error.

	getlogin(3) API in libc returns NULL when the tty is the
	console. Hence the utilities like passwd print error
	messages when they use getlogin() to access user login name.

	PHCO_13916:
	The size of the string, passed to perror, plus message was
	not checked and could have become larger than the size of
	the allocated output buffer.  In such situations perror
	would have coredumped.

	Incorrect locking order in libc can lead to deadlocks while
	reading unbuffered or line buffered files.

	PHCO_12009:
	Incorrect locking order in libc can lead to deadlocks while
	reading unbuffered or line buffered files.

	The effective user and group id are set incorrectly in
	the call ruserok() when rlogind is invoked with an
	option "-l".

	A local data item was not being initialized properly.

	Incorrect internal buffer allocation can lead to an overlap
	between the stderr buffer and other internal buffers when
	files are opened for non-buffered i/o.

	PHCO_10652:
	strcat() prefetches word before doing shift and
	concatenation. A check for end of string should be performed
	before the prefetch since the prefetched word may be across
	the page boundary. This is now fixed.

	The non-C locale code continued to check beyond the
	terminating null character.

	Regular expression pattern ".*" behaves incorrectly in
	Japanese locale.

	memcmp tried to prefetch words from outside of valid memory
	page and this might cause memory core dumps. The prefetching
	of invalid memory words was caused by incorrect calculation
	of number of words to fetch and compare. This is fixed
	now.

	The leap year algorithm was incorrect for getdate(3c).

	The check for the range of the input date was in the
	wrong place.

	The symbol reference had a typo in one of the modules.

	PHCO_9419:
	Allocated memory was not properly free'd by globfree() after
	use.

	The day of the month was being improperly adjusted for the
	case when the day of the week matched today.

	Pattern map was set such that it would continue matching
	past end of pattern.

	The maximum number of message sets allowed in a message
	catalog was not high enough; it has been increased to 65535.

	The tempnam(), mktemp() and mkstemp() APIs did not check for
	a dangling symlink before returned it and this has been
	fixed now.

	The strptime and getdate calls were not consistent in the
	manner in which they handled two digit year specifications.

	When a very large template file is used, and the
	getdate() routine has to search far into the file to find
	a matching format specifier, getdate() overran the
	allocated array.

	PHCO_9220:
	Unaccaptable degradation of collation using swedish
	language.

	If you lock /etc/.pwd.lock using lckpwdf, there is no way
	to determine that it was unlock, because ulckpwdf always
	returns -1.

	PHCO_8762:
	The fix for strcat's page boundary problem caused truncation
	of some strings.

	PHCO_8368:
	The readdir() call failed to call the primary definition
	of a public routine.

	According to X/Open, getcwd takes a second argument of
	type of size_t and returns EINVAL only when the second
	argument is 0.

	memchr tries to read beyond end of valid memory when char
	is not found in thestring and may core dump.

	The strcat call didn't handle an optimized pre-fetching
	strategy properly, causing the read of bytes belonging to
	unmapped pages.

	1. The "rhosts" check fails if the parent directory of
	the user's home directory does not have the right group
	permissions. Consider the case where the parent directory
	has permissions "710".
	    /home - permissions rwx--x---
	    /home/student - permissions rwx------
	- The directories home and student belong to the same
	group. The "rhosts" check fails when a remote user tries
	to login as "student".
	- This is because, the ruserok() routine does not change
	the effective group id to the real group id before
	opening ".rhosts" file.
	2. Usernames in the host.equiv file are improperly
	parsed.
	- The ruserok() code now exhibits the expected and
	documented behavior.

	PHCO_7798:
	Fix pmap array needed to be set true
	for alternation case when isfirst set to 0, since it
	was getting lost on next expression for case of
	echo c | grep -E '(a*|b)c'

	A previous fix for a setlocale() memory leak releases
	storage for LC_ALL string before it is appropriate.  The
	implementation has been changed to use an internal
	static buffer.

	"$^" with REG_NEWLINE matches all lines, not just empty,
	caused by incorrect fix for DSDe427572.

	PHCO_7177:
	Add runtime support for message sets 256 thru 1023.

	PHCO_7175:
	strxfrm(3) may not completely transform an array in
	non-C locales.

	PHCO_6778:
	Added support back for an undocumented strncpy behavior
	which had been previously removed for performance reasons.

	qsort needed to pick an alternate pivot point when
	detecting sorted or partially sorted data in order to
	improve poor performance.

	When regcomp(3) returns the following error:
	?, *, or + not preceded by valid regular expression
	the regex_t structure argument has already had memory
	allocated to it, resulting in a memory leak.  If regfree(3)
	is called in this case, the result is a Uninitialized
	Memory Read from withing regfree.

	The thread-safe version of fileno() wasn't checking for a
	NULL pointer.

	Repeated calls to setlocale(3c) expose a memory leak.

	PHCO_6595:
	Multiple calls to gettxt() would result in
	a "too many open files" error.

	telldir() returns an incorrect offset zero
	for the end of directory record.

	strptime(3c) does not return the correct information for
	12:xx am.

	Includes change to getpwent.c in function matchname() so
	that it returns 1 instead of 0 if it finds the name under
	the MINUS section.  Also includes change to getgrent.c so
	that interpret will stop processing if it finds a MINUS as
	part of the name.

	PHCO_6427:
	The strncpy() defect documented in PHCO_6342 was not
	completely fixed.

	PHCO_6342:
	Applications calling strncpy() may core dump at
	page boundary between a valid and an invalid page.
	This has now been corrected.

	The gettxt() function failed to close files before opening
	another file with the same file descriptor.  This caused
	the user to get the error too many file descriptors. This
	code will now close the previously opened files.

	PHCO_6134:
	Possible internal use of an invalid file descriptor
	could cause a core dump.  Applications using
	getprotobyname_r(), getprotobynumber_r(), getnetbyname_r(),
	getnetbyaddr_r(), getservbyname_r(), or getservbyport_r()
	reentrant calls could be affected.

	Memory malloc'd within res_search() would not be free'd.
	This has now been corrected.

	strncpy(3c) occasionally behaves incorrectly on
	different processors.
	This has now been corrected.

	Add support for Cu over DATAKIT

	At hp-ux 10.0, child process file descriptors may be
	trashed when resolving a name with NIS in gethostbyname.
	This has now been corrected.

	Fixes stack overrun defect in syslog.
	This has now been corrected.

	PHCO_6070:

	The root cause of the problem was a memory leak in two
	internal routines called by strxfrm. This memory leak
	evenutally causes the process to run out of space to
	malloc.

	PHCO_5420:
	The getservbyname_r() call would use non-reentrant
	setservent() and endservent() calls rather than their
	reentrant equivalents (setservent_r() and endservent_r()).
	Subsequent calls to getservbyname_r() in an NIS
	environment with no servi.bynp map would not start a
	search of the services.byname map from the first entry
	in the map, but would start from where the last search
	left off.

	In an NIS environment getservbyport() could generate
	higher network traffic and CPU load due to a sequential
	search of the NIS server services.byname map being
	triggered.  This search would be triggered whenever NIS
	was up and the port and protocol pair passed to the
	getservbyport() call were not present in the map, or
	when the user didn't supply a protocol value to the
	getservbyport() call.  A more efficient model has now
	been adopted.

	The calls getservbyport_r(), getprotobyname_r(),
	getprotobynumber_r(), getnetbyname_r(), and
	getnetbyaddr_r() also shared the same issue
	found in getservbyname_r().  No external symptoms have
	been noted, but the changes were introduced as a
	preventative measure.

	The strncpy (3c) function reads an extra word from
	memory which may lead to an application abort if the
	address is out of the current allocated heap space.

	The malloc(3c) function would test for memory > 1Gb
	and flag them as illegal requests.  This is not a
	problem with most applications; however, applications
	built with with the linker option '-N' would be
	limited to memory requests of less than 1Gb per call.

	A call to getpwent(3c) on a system with NIS
	may free a malloc block without recording
	this action.  Future calls to any routines in
	this family may attempt to free the same block
	a second time.

	The opendir(3c) function could hang when passed a device
	file or a named pipe.

	The getlogin() function fails when the program is run on
	the console. It sets errno to EPERM.

	The version of iconv on 10.0 sets errno
	incorrectly for incomplete, double-byte characters when
	LANG=ja_JP.SJIS or LANG=ja_JP.eucJP.  When such an error
	occurs, errno should be set to EINVAL.  Instead, it is
	set to EILSEQ.

	The update mnttab(3c) function can corrupt can corrupt
	the mnttab file. The values for passno and frequency can
	be invalid in the mnttab file if the root file system is
	incorrect in the existing mnttab, and/or fstab file.

	The %V format descriptor in the strftime(3c) function
	returned an incorrect value for the week number for the
	first week of the year.

	Rounding is attempted on the complete number, causing
	errors due to results that may not be accurately
	portrayed in the FP format.

	HP-UX 9.x applications using regexp(3x) interfaces
	encounter binary compatibility problems with HP-UX
	10.x systems.

	A routine called by setusershell() writes one
	additional byte to memory blocked than was
	orignally allocated.

	HP-UX 9.x applications using libc_r IPC  interfaces
	may encounter binary compatibility problems with HP-UX
	10.x systems.

SR:
	8606112213 4701413906 4701414862 1653245415 8606101862
	1653269738 1653269738 5003306746 4701319327 1653159293
	5003249490 5003233056 5003251611 5003235648 1653119107
	5003247882 5003272542 5003262022 1653141440 5003260257
	1653140376 5003291716 5003291716 5003290056 1653174425
	5003338038 1653192161 5003344192 1653185629 5003341271
	1653189134 4701334763 1653176883 5003302299 1653204651
	4701344721 1653203026 1653208231 1653215186 4701364653
	1653211490 1653228528 1653211490 1653228528 5003395673
	1653236562 5003380394

Patch Files:
	/usr/lib/libc.a
	/usr/lib/libp/libc.a
	/usr/lib/libpicc.a
	/usr/lib/year2000.o
	/usr/lib/libc.1

what(1) Output:
	/usr/lib/libc.a:
		PATCH/10_01 PHCO_21508 $Revision: 74.9.1.16.1.134 $
	/usr/lib/libp/libc.a:
		PATCH/10_01 PHCO_21508 $Revision: 74.9.1.16.1.134 $
	/usr/lib/libpicc.a:
		PATCH/10_01 PHCO_21508 $Revision: 74.9.1.16.1.134 $
	/usr/lib/year2000.o:
		None
	/usr/lib/libc.1:
		PATCH/10_01 PHCO_21508 $Revision: 74.9.1.16.1.134 $

cksum(1) Output:
	342298214 2158942 /usr/lib/libc.a
	3133269043 2369286 /usr/lib/libp/libc.a
	2349541047 2266868 /usr/lib/libpicc.a
	1134807830 700 /usr/lib/year2000.o
	3898833167 1623608 /usr/lib/libc.1

Patch Conflicts: None

Patch Dependencies: None

Hardware Dependencies: None

Other Dependencies: None

Supersedes:
	PHCO_5420 PHCO_6070 PHCO_6134 PHCO_6342 PHCO_6427 PHCO_6595
	PHCO_6778 PHCO_7175 PHCO_7177 PHCO_7798 PHCO_8368 PHCO_8762
	PHCO_9220 PHCO_9419 PHCO_10652 PHCO_12009 PHCO_13916 PHCO_14253
	PHCO_16721 PHCO_19370 PHCO_20585

Equivalent Patches: None

Patch Package Size: 8290 KBytes

Installation Instructions:
	Please review all instructions and the Hewlett-Packard
	SupportLine User Guide or your Hewlett-Packard support terms
	and conditions for precautions, scope of license,
	restrictions, and, limitation of liability and warranties,
	before installing this patch.
	------------------------------------------------------------
	1. Back up your system before installing a patch.

	2. Login as root.

	3. Copy the patch to the /tmp directory.

	4. Move to the /tmp directory and unshar the patch:

		cd /tmp
		sh PHCO_21508

	5a. For a standalone system, run swinstall to install the
	    patch:

		swinstall -x autoreboot=true -x match_target=true \
			-s /tmp/PHCO_21508.depot

	By default swinstall will archive the original software in
	/var/adm/sw/patch/PHCO_21508.  If you do not wish to retain a
	copy of the original software, you can create an empty file
	named /var/adm/sw/patch/PATCH_NOSAVE.

	WARNING: If this file exists when a patch is installed, the
	         patch cannot be deinstalled.  Please be careful
		 when using this feature.

	It is recommended that you move the PHCO_21508.text file to
	/var/adm/sw/patch for future reference.

	To put this patch on a magnetic tape and install from the
	tape drive, use the command:

		dd if=/tmp/PHCO_21508.depot of=/dev/rmt/0m bs=2k

Special Installation Instructions: None



