* src/printf.c (STRTOX): Add a call to quote when printing the ignored
characters.
* tests/printf/printf.sh: Adjust an existing test case. Add another
quoting test case.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-I9I24ON7.
* src/nl.c (check_section): Add a check for a zero section delimiter
length.
* tests/nl/nl.sh: Add a test case.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-PDYYNTYZ.
* src/cksum (valid_digits): Use '=' to disambiguate hex and base64.
(split_3): Likewise.
(digest_check): Likewise.
* tests/cksum/cksum-base64-untagged.sh: Add a test case.
* NEWS: Mention the fix.
* src/cksum.c (digest_check): Reset the detection flag per file.
* tests/cksum/cksum-c.sh: Add a test case.
* tests/cksum/md5sum-bsd.sh: Likwise.
* NEWS: Mention the fix.
It's not a usual case, but for consistency "-a sha2" should support
e.g. untagged checksums that are a mix of sha256sum and sha512sum.
* src/cksum.c (split_3): Reset the sha2 variant search if
the generic sha2 is specified. It's ok to reset the global
CKSUM_ALGORITHM as its subsequent use is conflicting with
the specific chosen variant.
* tests/cksum/cksum-c.sh: Add test cases.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-83HIODH2.
Discovered by SecBuddyF (with Hy4-preview) of Tencent KeenSecurityLab.
These signals are used by timeout(1) itself, so need special handling.
Since commit v8.13-11-g80a1aca0d we incorrectly ignored them,
which was exacerbated by commit v8.26-39-g2f69dba5d which caused
the -sCHLD case to hang upon child exit.
* src/timeout.c (send_sig): Don't ignore SIGHLD, and discard
the self sent SIGALRM, and rearm the handler.
* tests/timeout/timeout.sh: Add test cases.
* NEWS: Mention the fixes.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-2EQL2L05.
* NEWS: Adjust to mention that -k without -f is resilient to blocking.
* src/timeout.c (cleanup): Unblock SIGALRM when diagnosing, so
an armed --kill-after is honored.
* tests/timeout/timeout.sh: Add a test case.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-GV4Z4T3T.
In the edge case where --verbose diagnostics might block
or induce signals, ensure we always timeout the monitored command
and do not loop diagnosing diagnostic induced signals.
* NEWS: Mention the bug fix.
* src/timeout.c (cleanup): Avoid diagnosing SIGPIPE and SIGXFSZ.
Also send the signal before diagnosing to ensure command is timed out.
* tests/env/env-signal-handler.sh: Run timeout(1) with -f to ensure
the SIGKILL is diagnosed.
* tests/timeout/timeout.sh: Likewise. Also add test cases for
SIGPIPE and SIGXFSZ.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-GV4Z4T3T.
* src/od.c (format_address_std): Add an affirm call to check that the
address is positive or equal to zero, which would have caused a
descriptive assertion in this case instead of a SIGSEGV.
(offset_add): New function.
(dump): Use it to diagnose overflows.
(dump_strings): Likewise.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EZXPB4TK.
* src/cp.c (make_dir_parents_private): Quote the names of the directory
and the source.
* tests/cp/verbose-parents-quote.sh: New file
* tests/local.mk (all_tests): Add the new test.
* NEWS: Mention the bug.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-JJG3V3T9.
* src/chown-core.c (change_file_owner): Set the pointer to NULL if
fstatat fails.
* tests/chgrp/verbose-dangling-symlink.sh: New file.
* tests/chown/verbose-dangling-symlink.sh: New file.
* tests/local.mk (all_tests): Add the new tests.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-YYGC42VE.
* src/selinux.c (restorecon_private): Open the file with O_NOCTTY and
O_NONBLOCK.
* tests/misc/selinux.sh: Add a test case.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-L5GJ7M7X.
splice_cat can leave open file descriptors around. This breaks the
valgrind testsuite with --track-fds=yes. This is fairly innocent, like
still reachable memory, but does need a new suppression when tracking
file descriptor handling. Introduce a new splice_cat_close function
that can be used on error from splice_cat and before exiting main.
* src/cat.c (splice_cat): Move static pipefd and pipefd_pipe_size to
file level, guarded by HAVE_SPLICE. Move pipefd close and cleanup from
error handler to...
(splice_cat_close): New function. Empty if we don't HAVE_SPLICE.
(main): Call splice_cat_close before exit.
* src/copy.c (copy_internal): Add a missing quoteaf call.
* tests/cp/link-no-deref.sh: Invoke getlimits_ and uses_strace_. Inject
an error using 'strace' to verify the name of the destination is quoted
in the error message.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-3M3N6L8K.
* src/factor.c (mulredc2): Add the carry to p1, which is the high word
of a two-word integer created by summing two single-word integers and is
therefore unable to overflow, instead of using a low word r0, which may
wrap around by adding the carry.
* tests/factor/mulredc2-infloop.sh: New file.
* tests/local.mk (all_tests): Add the new test.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-CFUR0JKW.
Before:
$ cksum --length -1 -a sha2 /dev/null
cksum: invalid length: ‘-1’: Value too large for defined data type
After:
$ cksum --length -1 -a sha2 /dev/null
cksum: invalid length: ‘-1’
cksum: digest length for ‘SHA2’ must be 224, 256, 384, or 512
* src/cksum.c: Avoid EOVERFLOW for negative numbers
(similarly to commit v9.5-71-gf2c84fe63).
Link: https://github.com/coreutils/coreutils/issues/386
* src/tail.c (tail_forever_inotify): Fallback to polling upon overlow.
* tests/tail/inotify-overflow.sh: Add a new test.
* tests/local.mk: Reference the new test.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-UUNT73BK.
This reverts my commit b64f9bfe4f
dated 2026-04-02. I forgot that posixtime cares whether
-u has been specified, and gets that info via TZ.
It also uses xsetenv rather than the old putenv.
This fixes ANT-2026-LR8TONF4.
* configure.ac (LOCALTIME_CACHE): Bring this back.
* src/date.c (TZSET): Bring this back.
(main): Bring back setting TZ="UTC0" in the environment.
However, use xsetenv rather than putenv, as that’s simpler.
* src/basenc.c (base32hex_decode_ctx_wrapper): Ensure we don't
accept base32 only characters for base32hex.
* tests/basenc/basenc.pl: Ensure negative base32hex tests have the
appropriate number of characters to test character validation
rather than just input size validation.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EP1XO2G4.
* src/factor.c (strtouuint): Return LONGINT_OVERFLOW only if all of the
characters are digits; otherwise, return LONGINT_INVALID.
* tests/factor/factor.pl: Add two test cases.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-IZ8PFQ7Q.
stty currently fails like:
$ stty 9600
$ saved=$(stty -g)
$ stty 19200 "$saved" # Sets 9600 but reports failure
stty: 'standard input': unable to perform all requested operations
Whereas these work fine:
$ stty 19200 9600
$ stty "$saved" 19200
* NEWS: Mention the bug fix.
* src/speedgen (cbaud_to_speed): Determine the speed
from the control flag encoding.
* src/stty.c (recover_mode): If no separate speed specified,
update the speed from the specified control flags.
* tests/stty/stty-save-speed.sh: Add test cases.
Note this changes the output format of -g.
POSIX states that the -g format only needs to be compatible
with the stty implementation that produced it.
However we improve compatibility on Linux by only outputting
the explicit speeds when they're not encoded in the control flags.
* NEWS: Mention the change in behavior.
* src/stty.c (display_recoverable): Output the speeds if needed.
(recover_mode): Read the speeds if present.
* tests/stty/stty-save-speed.sh: Add a new test.
* tests/local.mk: Reference the new test.
Link: https://github.com/coreutils/coreutils/issues/384
* src/stty.c (struct speed_desc): New type, used to differentiate
between errors and (speed_t) -1.
(last_ibaud, last_obaud): Define variables as struct speed_desc instead
of speed_t.
(check_speed): Adjust uses of last_ibaud and last_obaud to their new
definitions.
(set_speed): Likewise. Use a struct speed_desc as the argument instead
of speed_t. Check for its validity using the valid member instead of
whether it is equal to (speed_t) -1.
(apply_settings): Use struct speed_desc instead of speed_t to store the
result of string_to_baud. Check for its validity using the valid member
instead of whether it is equal to (speed_t) -1.
(string_to_baud): Adjust the function to return a struct speed_desc
instead of speed_t.
* src/speedgen (value_to_baud): Likewise.
* NEWS: Mention the bug fix.
Link: https://github.com/coreutils/coreutils/issues/383
This preserves any program name transformations, e.g., when
--program-prefix=g is used as a configuration option, unlike commit
ef874ed6c (all: set /proc/self/comm to the program name in the single
binary, 2026-10-17).
* src/coreutils.c (launch_program): Use the last component of argv[0]
when setting the comm value using prctl (PR_SET_NAME, ...).
* tests/misc/proc-self-comm.sh: When using
--enable-single-binary=shebangs, test that the comm value preserves any
program name transformations, e.g., --program-prefix=g.
* NEWS: Adjust the NEWS entry to refer to last component of argv[0]
instead of the program name.
Suggested by Pádraig Brady.
When built with --enable-single-binary=symlinks, the process name
(comm) previously contained the path component. Use prog_name instead of
argv[0] to set the correct process name without the path.
Before:
$ src/sleep 10000 &
[1] 601333
$ cat /proc/601333/comm
src/sleep
After:
$ src/sleep 10000 &
[1] 618100
$ cat /proc/618100/comm
sleep
* src/coreutils.c (launch_program): Use the program name instead of
argv[0] when calling prctl (PR_SET_NAME, ...).
Link: https://github.com/coreutils/coreutils/pull/382
oputs_() scans the option text of translated usage strings and passes
each char directly to isspace(). Translated help text routinely holds
bytes >= 0x80, which are negative where char is signed, so isspace() is
called with a value outside its defined domain (unsigned char or EOF),
which is undefined behavior. Route the arguments through to_uchar() as
done for ctype calls elsewhere in src/.
* src/system.h (oputs_): Pass isspace() arguments through to_uchar().
Copyright-paperwork-exempt: Yes
Link: https://github.com/coreutils/coreutils/pull/381
* src/ptx.c (WORD_TABLE): Change the COUNTED_BY to use the length member
instead of alloc.
(digest_word_file): Increment the length before appending to the table
otherwise -fsanitize=bounds would kill the program.
* src/split.c (open_pipes): Define as a struct containing the previously
global variables. Use COUNTED_BY.
(open_pipes_alloc, n_open_pipes): Remove variables moved into the newly
added struct.
(create): Update uses of the previously existing globals to reference
the open_pipes struct.
(closeout): Likewise. Don't decrement the pipe bounds until after we
make our final access to the last pipe in the array, to satisfy the
requirements of the COUNTED_BY attribute.
* src/sort.c (temp_dirs): Define as a struct containing the previously
global variables. Use COUNTED_BY.
(temp_dir_count, temp_dir_alloc): Remove variables moved into the newly
added struct.
(create_temp_file, open_temp, main): Update uses of the previously
existing globals to reference the temp_dirs struct.
* src/df.c (table): Define as a struct containing the previously global
variables. Use COUNTED_BY.
(columns, ncolumns, ncolumns_alloc, nrows, nrows_alloc): Move into the
table struct.
(alloc_table_row, print_table, alloc_field, get_field_list, get_header)
(get_dev): Update uses of the previously existing globals to reference
the table struct.
* src/join.c (struct line): Change the COUNTED_BY to use the nfields
member instead of nfields_allocated.
(extract_field): Increment the count before writing to the last field,
otherwise -fsanitize=bounds would kill the program.
Replace the O(N) scan of watched names on each directory inotify event
with a Hash_table keyed by (parent_wd, basename), addressing the
long-standing FIXME in tail_forever_inotify.
Keep ownership consistent with wd_to_name: parent_by_name is created
only for Follow_name and returned to the caller, so fallback paths can
return without local hash cleanup.
Hash basenames with hash_string() and mix in parent_wd, matching the
existing gnulib helper rather than a hand-rolled string hash.
Matching cost for N directory events that each compare against N names
(illustrative host timings of the scan vs hash lookup alone):
N=1000: ~0.018s -> ~0.000s
N=5000: ~0.39s -> ~0.000s
N=10000: ~1.5s -> ~0.000s
End-to-end recreate storms remain largely file-system bound on this
host; the hash removes the quadratic name-matching CPU from that path.
* src/tail.c (parent_name_hasher, parent_name_comparator): New.
(tail_forever_inotify): Build and use parent_by_name; return it to the
caller.
(main): Free parent_ht when non-NULL.
* tests/tail/inotify-parent-hash.sh: Require notification mode; cover
multiple names in one directory and the same basename in two
directories.
* tests/local.mk: Reference the new test.
* NEWS: Mention the improvement.
* src/csplit.c (struct buffer_record): Annotate the input data
area with COUNTED_BY (bytes_alloc).
* src/ptx.c (WORD_TABLE): Annotate the word array with
COUNTED_BY (alloc), moving the count field ahead of the pointer
so the attribute can reference an already-declared field.
Link: https://github.com/coreutils/coreutils/pull/377
Strictly we don't need libacl support to detect ACLs
as that's achieved with xattr lookup. But doing this
will optimize ls and simplify its output, when coreutils
is not built with ACL support.
* src/ls.c (file_aclinfo_cache): Also optimize selinux ENOTSUP caching
when we don't care about ACLs.
On systems where the security context reports as unsupported,
and we encountered a file without ACLs, no further lookups
would be performed. Introduced in commit v9.5-156-gb857d66b5.
This fix is along similar lines as commit v9.6-40-gcb2abbac7.
* src/ls.c (file_has_aclinfo_cache): Don't mark file system as
unsupported if there might be ACLs or capabilities present.
* tests/ls/acl-cache.sh: Add a new test.
* tests/local.mk: Reference the new test.
* tests/ls/acl.sh: Add a check.
* NEWS: Mention the bug fix.
* src/ls.c (gobble_file): Directory args don't have their
ACL or security context displayed, so avoid to the lookup.
E.g. this results in the same number of xattr calls with
`ls -l .` and `ls -l`.
Since commit bff0e5412 (build: sort: explicitly tag libcrypto
dependency, 2026-09-06), which added a dependency on Gnulib's sd-dlopen
module, this check has been unnecessary. This can be seen by the
separate variables in Makefile.in, which have the same purpose.
$ grep -E '^LIB_?DL' Makefile.in
LIBDL = @LIBDL@
LIB_DL = @LIB_DL@
* src/local.mk (src_sort_LDADD): Use $(LIBDL) instead of $(LIB_DL).
* configure.ac: Likewise. Don't check for dlopen and libdl, which Gnulib
has already done for us.
`pr -e=-1` gives a confusing error relating to just the "-1" portion,
when in fact "=" might have been inadvertently treated as a param.
Also one gets confusing errors in the case of mishandled
multi-byte characters, if the whole argument is not diagnosed.
* src/pr.c (getoptarg): Output the complete passed argument,
to avoid the confusion with "=" being used with a short option.
* tests/pr/options.sh: Adjust accordingly.
Link: https://github.com/coreutils/coreutils/issues/375
Linux 2.1.57 introduced both prctl(2) and PR_SET_PDEATHSIG(2), so the
condition before this patch is correct there. However, other systems
have a prctl function but not PR_SET_PDEATHSIG, e.g., Irix and
SerenityOS.
* src/timeout.c (main): Check that PR_SET_PDEATHSIG is defined before
using it.
Collin Funk