[RFC,2/2] libio: fmemopen rewrite to POSIX compliance

Message ID 5398CC14.7050507@linux.vnet.ibm.com
State Rejected
Headers

Commit Message

Adhemerval Zanella Netto June 11, 2014, 9:37 p.m. UTC
  This patch added a new fmemopen version, for glibc 2.20, that aims to be
POSIX complaint.  It fixes some long-standing glibc fmemopen issues, such
as:

* it changes the way fseek with SEEK_END works on fmemopen to seek
  relative to buffer size instead of first '\0'.  This is default mode and
  'b' opening mode does not change internal behavior (bz#6544).

* fix apending opening mode to use as start position either first null
  byte of len specified in function call (bz#13152 and #13151).

* remove binary option 'b' and internal different handling (bz#12836)

* fix seek/SEE_END with negative values (bz#14292).

Old implementation is moved to libio/oldfmemopen.c and a compatibility
symbol is provided to with old behavior for older symbols version (2.2).

For this implementation I tried to both address and add testcases for
BZ#14292, BZ#13152, BZ#13151, BZ#12836, and BZ#6544.  The tst-fmemopen2
testcase is adjusted to reflect new implementation assumptions and a new
test tst-fmemopen3 is added to check for some operations described in
the bug for read and append mode.

Tested on PPC64 and x86_64. 

PS: I haven't added a CL neither update the ABI files for all archs
since it is RFC message.  I intend to finish the patch will once we 
determine that this new implementation is the way we want for 2.20.

---
  

Comments

Rasmus Villemoes June 20, 2014, 10:02 a.m. UTC | #1
Adhemerval Zanella <azanella@linux.vnet.ibm.com> writes:

> This patch added a new fmemopen version, for glibc 2.20, that aims to be
> POSIX complaint.

[snip]

>  FILE *
> -fmemopen (void *buf, size_t len, const char *mode)
> +__fmemopen (void *buf, size_t len, const char *mode)
>  {
>    cookie_io_functions_t iof;
>    fmemopen_cookie_t *c;
>  
>    if (__glibc_unlikely (len == 0))
>      {
> -    einval:
>        __set_errno (EINVAL);
>        return NULL;
>      }

Regarding this, note that POSIX is changing [1] to allow, and in the future
maybe even require, fmemopen(s, strlen(s), "r") to work, even if s
happens to be an empty string. IMHO, the only sane semantics for
fmemopen with a length of 0 is to behave like /dev/null (when reading)
and /dev/full (when writing).

[1] http://austingroupbugs.net/view.php?id=818

Rasmus
  
Adhemerval Zanella Netto June 21, 2014, 1:56 p.m. UTC | #2
On 20-06-2014 07:02, Rasmus Villemoes wrote:
> Adhemerval Zanella <azanella@linux.vnet.ibm.com> writes:
>
>> This patch added a new fmemopen version, for glibc 2.20, that aims to be
>> POSIX complaint.
> [snip]
>
>>  FILE *
>> -fmemopen (void *buf, size_t len, const char *mode)
>> +__fmemopen (void *buf, size_t len, const char *mode)
>>  {
>>    cookie_io_functions_t iof;
>>    fmemopen_cookie_t *c;
>>  
>>    if (__glibc_unlikely (len == 0))
>>      {
>> -    einval:
>>        __set_errno (EINVAL);
>>        return NULL;
>>      }
> Regarding this, note that POSIX is changing [1] to allow, and in the future
> maybe even require, fmemopen(s, strlen(s), "r") to work, even if s
> happens to be an empty string. IMHO, the only sane semantics for
> fmemopen with a length of 0 is to behave like /dev/null (when reading)
> and /dev/full (when writing).
>
> [1] http://austingroupbugs.net/view.php?id=818
>
> Rasmus
>
Thanks for the input.  My understanding from note [2] from the link you cited:

---
Add a new paragraph after 29200:

    [EINVAL] The size argument specifies a buffer size of zero and the implementation does not support this.
---

Indeed allows zero size buffer to return EINVAL, as noted in comment #11 in
https://sourceware.org/bugzilla/show_bug.cgi?id=11216.

I checked some other libc implementations and there is no consensus about how to act
on zero length buffer:

* FreeBSD: accepts zero length buffer
  http://svnweb.freebsd.org/base/stable/10/lib/libc/stdio/fmemopen.c?revision=256281&view=markup

* Newlib: returns EINVAL
  https://www.sourceware.org/cgi-bin/cvsweb.cgi/src/newlib/libc/stdio/fmemopen.c?rev=1.5&content-type=text/x-cvsweb-markup&cvsroot=src

* musl: returns EINVAL
  http://git.musl-libc.org/cgit/musl/tree/src/stdio/fmemopen.c

So I am not sure which direction to follow in such case.
  
Rich Felker June 21, 2014, 2:49 p.m. UTC | #3
On Sat, Jun 21, 2014 at 10:56:45AM -0300, Adhemerval Zanella wrote:
> On 20-06-2014 07:02, Rasmus Villemoes wrote:
> > Adhemerval Zanella <azanella@linux.vnet.ibm.com> writes:
> >
> >> This patch added a new fmemopen version, for glibc 2.20, that aims to be
> >> POSIX complaint.
> > [snip]
> >
> >>  FILE *
> >> -fmemopen (void *buf, size_t len, const char *mode)
> >> +__fmemopen (void *buf, size_t len, const char *mode)
> >>  {
> >>    cookie_io_functions_t iof;
> >>    fmemopen_cookie_t *c;
> >>  
> >>    if (__glibc_unlikely (len == 0))
> >>      {
> >> -    einval:
> >>        __set_errno (EINVAL);
> >>        return NULL;
> >>      }
> > Regarding this, note that POSIX is changing [1] to allow, and in the future
> > maybe even require, fmemopen(s, strlen(s), "r") to work, even if s
> > happens to be an empty string. IMHO, the only sane semantics for
> > fmemopen with a length of 0 is to behave like /dev/null (when reading)
> > and /dev/full (when writing).
> >
> > [1] http://austingroupbugs.net/view.php?id=818
> >
> > Rasmus
> >
> Thanks for the input.  My understanding from note [2] from the link you cited:
> 
> ---
> Add a new paragraph after 29200:
> 
>     [EINVAL] The size argument specifies a buffer size of zero and the implementation does not support this.
> ---
> 
> Indeed allows zero size buffer to return EINVAL, as noted in comment #11 in
> https://sourceware.org/bugzilla/show_bug.cgi?id=11216.
> 
> I checked some other libc implementations and there is no consensus about how to act
> on zero length buffer:
> 
> * FreeBSD: accepts zero length buffer
>   http://svnweb.freebsd.org/base/stable/10/lib/libc/stdio/fmemopen.c?revision=256281&view=markup
> 
> * Newlib: returns EINVAL
>   https://www.sourceware.org/cgi-bin/cvsweb.cgi/src/newlib/libc/stdio/fmemopen.c?rev=1.5&content-type=text/x-cvsweb-markup&cvsroot=src
> 
> * musl: returns EINVAL
>   http://git.musl-libc.org/cgit/musl/tree/src/stdio/fmemopen.c
> 
> So I am not sure which direction to follow in such case.

IIRC I only did the EINVAL thing in musl reluctantly because POSIX
required it at the time. I'm happy to change it. As long as the rest
of the specification is sufficient to define how a size-0 buffer would
behave, that's all that should matter. If it's not, we need more
discussion/clarification with/from the Austin Group.

Rich
  

Patch

diff --git a/include/stdio.h b/include/stdio.h
index 9f2ea31..94ba5a5 100644
--- a/include/stdio.h
+++ b/include/stdio.h
@@ -152,7 +152,6 @@  libc_hidden_proto (fread_unlocked)
 libc_hidden_proto (fwrite_unlocked)
 libc_hidden_proto (fgets_unlocked)
 libc_hidden_proto (fputs_unlocked)
-libc_hidden_proto (fmemopen)
 libc_hidden_proto (open_memstream)
 libc_hidden_proto (__libc_fatal)
 libc_hidden_proto (__vsprintf_chk)
@@ -180,6 +179,9 @@  gets (char *__str)
 }
 #  endif
 
+extern FILE * __fmemopen (void *buf, size_t len, const char *mode);
+libc_hidden_proto (__fmemopen)
+
 __END_DECLS
 # endif
 
diff --git a/libio/Makefile b/libio/Makefile
index 56952ce..c76b37e 100644
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -46,7 +46,7 @@  routines	:=							      \
 	__fbufsize __freading __fwriting __freadable __fwritable __flbf	      \
 	__fpurge __fpending __fsetlocking				      \
 									      \
-	libc_fatal fmemopen
+	libc_fatal fmemopen oldfmemopen
 
 tests = tst_swprintf tst_wprintf tst_swscanf tst_wscanf tst_getwc tst_putwc   \
 	tst_wprintf2 tst-widetext test-fmemopen tst-ext tst-ext2 \
diff --git a/libio/Versions b/libio/Versions
index 8df89d2..7ffa64d 100644
--- a/libio/Versions
+++ b/libio/Versions
@@ -148,6 +148,10 @@  libc {
   GLIBC_2.4 {
     open_wmemstream;
   }
+  GLIBC_2.20 {
+    # f*
+    fmemopen;
+  }
   GLIBC_PRIVATE {
     # Used by NPTL and librt
     __libc_fatal;
diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index aee2696..64e2025 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -1,7 +1,6 @@ 
-/* Fmemopen implementation.
-   Copyright (C) 2000-2014 Free Software Foundation, Inc.
+/* fmemopen implementation.
+   Copyright (C) 2014 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
-   Contributed by Hanno Mueller, kontakt@hanno.de, 2000.
 
    The GNU C Library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
@@ -17,54 +16,10 @@ 
    License along with the GNU C Library; if not, see
    <http://www.gnu.org/licenses/>.  */
 
-/*
- * fmemopen() - "my" version of a string stream
- * Hanno Mueller, kontakt@hanno.de
- *
- *
- * I needed fmemopen() for an application that I currently work on,
- * but couldn't find it in libio. The following snippet of code is an
- * attempt to implement what glibc's documentation describes.
- *
- *
- *
- * I already see some potential problems:
- *
- * - I never used the "original" fmemopen(). I am sure that "my"
- *   fmemopen() behaves differently than the original version.
- *
- * - The documentation doesn't say wether a string stream allows
- *   seeks. I checked the old fmemopen implementation in glibc's stdio
- *   directory, wasn't quite able to see what is going on in that
- *   source, but as far as I understand there was no seek there. For
- *   my application, I needed fseek() and ftell(), so it's here.
- *
- * - "append" mode and fseek(p, SEEK_END) have two different ideas
- *   about the "end" of the stream.
- *
- *   As described in the documentation, when opening the file in
- *   "append" mode, the position pointer will be set to the first null
- *   character of the string buffer (yet the buffer may already
- *   contain more data). For fseek(), the last byte of the buffer is
- *   used as the end of the stream.
- *
- * - It is unclear to me what the documentation tries to say when it
- *   explains what happens when you use fmemopen with a NULL
- *   buffer.
- *
- *   Quote: "fmemopen [then] allocates an array SIZE bytes long. This
- *   is really only useful if you are going to write things to the
- *   buffer and then read them back in again."
- *
- *   What does that mean if the original fmemopen() did not allow
- *   seeking? How do you read what you just wrote without seeking back
- *   to the beginning of the stream?
- *
- * - I think there should be a second version of fmemopen() that does
- *   not add null characters for each write. (At least in my
- *   application, I am not actually using strings but binary data and
- *   so I don't need the stream to add null characters on its own.)
- */
+/* fmemopen() from 2.20 and forward works as defined by POSIX.  It also
+   provides an older symbol, version 2.2.5, that behaves different regarding
+   SEEK_END (libio/oldfmemopen.c).  */
+
 
 #include <errno.h>
 #include <libio.h>
@@ -81,7 +36,8 @@  struct fmemopen_cookie_struct
 {
   char *buffer;
   int mybuffer;
-  int binmode;
+  int mode;
+  int append;
   size_t size;
   _IO_off64_t pos;
   size_t maxpos;
@@ -91,13 +47,11 @@  struct fmemopen_cookie_struct
 static ssize_t
 fmemopen_read (void *cookie, char *b, size_t s)
 {
-  fmemopen_cookie_t *c;
+  fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;
 
-  c = (fmemopen_cookie_t *) cookie;
-
-  if (c->pos + s > c->size)
+  if (c->pos + s > c->maxpos)
     {
-      if ((size_t) c->pos == c->size)
+      if ((size_t) c->pos == c->maxpos)
 	return 0;
       s = c->size - c->pos;
     }
@@ -115,29 +69,28 @@  fmemopen_read (void *cookie, char *b, size_t s)
 static ssize_t
 fmemopen_write (void *cookie, const char *b, size_t s)
 {
-  fmemopen_cookie_t *c;
+  fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;;
+  _IO_off64_t pos = c->append ? c->maxpos : c->pos;
   int addnullc;
 
-  c = (fmemopen_cookie_t *) cookie;
+  addnullc = (s == 0 || b[s - 1] != '\0');
 
-  addnullc = c->binmode == 0 && (s == 0 || b[s - 1] != '\0');
-
-  if (c->pos + s + addnullc > c->size)
+  if (pos + s + addnullc > c->size)
     {
-      if ((size_t) (c->pos + addnullc) == c->size)
+      if ((size_t) (pos + addnullc) >= c->size)
 	{
 	  __set_errno (ENOSPC);
 	  return 0;
 	}
-      s = c->size - c->pos - addnullc;
+      s = c->size - pos - addnullc;
     }
 
-  memcpy (&(c->buffer[c->pos]), b, s);
+  memcpy (&(c->buffer[pos]), b, s);
 
-  c->pos += s;
-  if ((size_t) c->pos > c->maxpos)
+  pos += s;
+  if ((size_t) pos > c->maxpos)
     {
-      c->maxpos = c->pos;
+      c->maxpos = pos;
       if (addnullc)
 	c->buffer[c->maxpos] = '\0';
     }
@@ -150,9 +103,7 @@  static int
 fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
 {
   _IO_off64_t np;
-  fmemopen_cookie_t *c;
-
-  c = (fmemopen_cookie_t *) cookie;
+  fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;
 
   switch (w)
     {
@@ -165,7 +116,7 @@  fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
       break;
 
     case SEEK_END:
-      np = (c->binmode ? c->size : c->maxpos) - *p;
+      np = c->maxpos + *p;
       break;
 
     default:
@@ -184,9 +135,7 @@  fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
 static int
 fmemopen_close (void *cookie)
 {
-  fmemopen_cookie_t *c;
-
-  c = (fmemopen_cookie_t *) cookie;
+  fmemopen_cookie_t *c = (fmemopen_cookie_t *) cookie;
 
   if (c->mybuffer)
     free (c->buffer);
@@ -197,14 +146,13 @@  fmemopen_close (void *cookie)
 
 
 FILE *
-fmemopen (void *buf, size_t len, const char *mode)
+__fmemopen (void *buf, size_t len, const char *mode)
 {
   cookie_io_functions_t iof;
   fmemopen_cookie_t *c;
 
   if (__glibc_unlikely (len == 0))
     {
-    einval:
       __set_errno (EINVAL);
       return NULL;
     }
@@ -231,7 +179,8 @@  fmemopen (void *buf, size_t len, const char *mode)
       if (__glibc_unlikely ((uintptr_t) len > -(uintptr_t) buf))
 	{
 	  free (c);
-	  goto einval;
+	  __set_errno (EINVAL);
+	  return NULL;
 	}
 
       c->buffer = buf;
@@ -244,13 +193,15 @@  fmemopen (void *buf, size_t len, const char *mode)
 
   c->size = len;
 
-  if (mode[0] == 'a')
+  if (mode[0] == 'r')
+    c->maxpos = len;
+
+  c->append = mode[0] == 'a';
+  if (c->append)
     c->pos = c->maxpos;
   else
     c->pos = 0;
 
-  c->binmode = mode[0] != '\0' && mode[1] == 'b';
-
   iof.read = fmemopen_read;
   iof.write = fmemopen_write;
   iof.seek = fmemopen_seek;
@@ -258,4 +209,5 @@  fmemopen (void *buf, size_t len, const char *mode)
 
   return _IO_fopencookie (c, mode, iof);
 }
-libc_hidden_def (fmemopen)
+libc_hidden_def (__fmemopen)
+versioned_symbol (libc, __fmemopen, fmemopen, GLIBC_2_20);
diff --git a/libio/oldfmemopen.c b/libio/oldfmemopen.c
new file mode 100644
index 0000000..4e85ebe
--- /dev/null
+++ b/libio/oldfmemopen.c
@@ -0,0 +1,265 @@ 
+/* Fmemopen implementation.
+   Copyright (C) 2000-2014 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+   Contributed by Hanno Mueller, kontakt@hanno.de, 2000.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/*
+ * fmemopen() - "my" version of a string stream
+ * Hanno Mueller, kontakt@hanno.de
+ *
+ *
+ * I needed fmemopen() for an application that I currently work on,
+ * but couldn't find it in libio. The following snippet of code is an
+ * attempt to implement what glibc's documentation describes.
+ *
+ *
+ *
+ * I already see some potential problems:
+ *
+ * - I never used the "original" fmemopen(). I am sure that "my"
+ *   fmemopen() behaves differently than the original version.
+ *
+ * - The documentation doesn't say wether a string stream allows
+ *   seeks. I checked the old fmemopen implementation in glibc's stdio
+ *   directory, wasn't quite able to see what is going on in that
+ *   source, but as far as I understand there was no seek there. For
+ *   my application, I needed fseek() and ftell(), so it's here.
+ *
+ * - "append" mode and fseek(p, SEEK_END) have two different ideas
+ *   about the "end" of the stream.
+ *
+ *   As described in the documentation, when opening the file in
+ *   "append" mode, the position pointer will be set to the first null
+ *   character of the string buffer (yet the buffer may already
+ *   contain more data). For fseek(), the last byte of the buffer is
+ *   used as the end of the stream.
+ *
+ * - It is unclear to me what the documentation tries to say when it
+ *   explains what happens when you use fmemopen with a NULL
+ *   buffer.
+ *
+ *   Quote: "fmemopen [then] allocates an array SIZE bytes long. This
+ *   is really only useful if you are going to write things to the
+ *   buffer and then read them back in again."
+ *
+ *   What does that mean if the original fmemopen() did not allow
+ *   seeking? How do you read what you just wrote without seeking back
+ *   to the beginning of the stream?
+ *
+ * - I think there should be a second version of fmemopen() that does
+ *   not add null characters for each write. (At least in my
+ *   application, I am not actually using strings but binary data and
+ *   so I don't need the stream to add null characters on its own.)
+ */
+
+#include "libioP.h"
+
+#if SHLIB_COMPAT (libc, GLIBC_2_2, GLIBC_2_20)
+
+#include <errno.h>
+#include <libio.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/types.h>
+
+
+typedef struct fmemopen_cookie_struct fmemopen_cookie_t;
+struct fmemopen_cookie_struct
+{
+  char *buffer;
+  int mybuffer;
+  int binmode;
+  size_t size;
+  _IO_off64_t pos;
+  size_t maxpos;
+};
+
+
+static ssize_t
+fmemopen_read (void *cookie, char *b, size_t s)
+{
+  fmemopen_cookie_t *c;
+
+  c = (fmemopen_cookie_t *) cookie;
+
+  if (c->pos + s > c->size)
+    {
+      if ((size_t) c->pos == c->size)
+	return 0;
+      s = c->size - c->pos;
+    }
+
+  memcpy (b, &(c->buffer[c->pos]), s);
+
+  c->pos += s;
+  if ((size_t) c->pos > c->maxpos)
+    c->maxpos = c->pos;
+
+  return s;
+}
+
+
+static ssize_t
+fmemopen_write (void *cookie, const char *b, size_t s)
+{
+  fmemopen_cookie_t *c;
+  int addnullc;
+
+  c = (fmemopen_cookie_t *) cookie;
+
+  addnullc = c->binmode == 0 && (s == 0 || b[s - 1] != '\0');
+
+  if (c->pos + s + addnullc > c->size)
+    {
+      if ((size_t) (c->pos + addnullc) == c->size)
+	{
+	  __set_errno (ENOSPC);
+	  return 0;
+	}
+      s = c->size - c->pos - addnullc;
+    }
+
+  memcpy (&(c->buffer[c->pos]), b, s);
+
+  c->pos += s;
+  if ((size_t) c->pos > c->maxpos)
+    {
+      c->maxpos = c->pos;
+      if (addnullc)
+	c->buffer[c->maxpos] = '\0';
+    }
+
+  return s;
+}
+
+
+static int
+fmemopen_seek (void *cookie, _IO_off64_t *p, int w)
+{
+  _IO_off64_t np;
+  fmemopen_cookie_t *c;
+
+  c = (fmemopen_cookie_t *) cookie;
+
+  switch (w)
+    {
+    case SEEK_SET:
+      np = *p;
+      break;
+
+    case SEEK_CUR:
+      np = c->pos + *p;
+      break;
+
+    case SEEK_END:
+      np = (c->binmode ? c->size : c->maxpos) - *p;
+      break;
+
+    default:
+      return -1;
+    }
+
+  if (np < 0 || (size_t) np > c->size)
+    return -1;
+
+  *p = c->pos = np;
+
+  return 0;
+}
+
+
+static int
+fmemopen_close (void *cookie)
+{
+  fmemopen_cookie_t *c;
+
+  c = (fmemopen_cookie_t *) cookie;
+
+  if (c->mybuffer)
+    free (c->buffer);
+  free (c);
+
+  return 0;
+}
+
+
+FILE *
+__old_fmemopen (void *buf, size_t len, const char *mode)
+{
+  cookie_io_functions_t iof;
+  fmemopen_cookie_t *c;
+
+  if (__glibc_unlikely (len == 0))
+    {
+    einval:
+      __set_errno (EINVAL);
+      return NULL;
+    }
+
+  c = (fmemopen_cookie_t *) malloc (sizeof (fmemopen_cookie_t));
+  if (c == NULL)
+    return NULL;
+
+  c->mybuffer = (buf == NULL);
+
+  if (c->mybuffer)
+    {
+      c->buffer = (char *) malloc (len);
+      if (c->buffer == NULL)
+	{
+	  free (c);
+	  return NULL;
+	}
+      c->buffer[0] = '\0';
+      c->maxpos = 0;
+    }
+  else
+    {
+      if (__glibc_unlikely ((uintptr_t) len > -(uintptr_t) buf))
+	{
+	  free (c);
+	  goto einval;
+	}
+
+      c->buffer = buf;
+
+      if (mode[0] == 'w')
+	c->buffer[0] = '\0';
+
+      c->maxpos = strnlen (c->buffer, len);
+    }
+
+  c->size = len;
+
+  if (mode[0] == 'a')
+    c->pos = c->maxpos;
+  else
+    c->pos = 0;
+
+  c->binmode = mode[0] != '\0' && mode[1] == 'b';
+
+  iof.read = fmemopen_read;
+  iof.write = fmemopen_write;
+  iof.seek = fmemopen_seek;
+  iof.close = fmemopen_close;
+
+  return _IO_fopencookie (c, mode, iof);
+}
+compat_symbol (libc, __old_fmemopen, fmemopen, GLIBC_2_2);
+#endif
diff --git a/stdio-common/Makefile b/stdio-common/Makefile
index 5f8e534..5971e65 100644
--- a/stdio-common/Makefile
+++ b/stdio-common/Makefile
@@ -57,7 +57,7 @@  tests := tstscanf test_rdwr test-popen tstgetln test-fseek \
 	 bug19 bug19a tst-popen2 scanf13 scanf14 scanf15 bug20 bug21 bug22 \
 	 scanf16 scanf17 tst-setvbuf1 tst-grouping bug23 bug24 \
 	 bug-vfprintf-nargs tst-long-dbl-fphex tst-fphex-wide tst-sprintf3 \
-	 bug25 tst-printf-round bug26
+	 bug25 tst-printf-round bug26 tst-fmemopen3
 
 test-srcs = tst-unbputc tst-printf
 
diff --git a/stdio-common/psiginfo.c b/stdio-common/psiginfo.c
index 564d237..62a9671 100644
--- a/stdio-common/psiginfo.c
+++ b/stdio-common/psiginfo.c
@@ -60,7 +60,7 @@  void
 psiginfo (const siginfo_t *pinfo, const char *s)
 {
   char buf[512];
-  FILE *fp = fmemopen (buf, sizeof (buf), "w");
+  FILE *fp = __fmemopen (buf, sizeof (buf), "w");
   if (fp == NULL)
     {
       const char *colon;
diff --git a/stdio-common/tst-fmemopen.c b/stdio-common/tst-fmemopen.c
index 756d6fe..2f2a598 100644
--- a/stdio-common/tst-fmemopen.c
+++ b/stdio-common/tst-fmemopen.c
@@ -39,7 +39,7 @@  do_test (void)
   if (fwrite (blah, 1, strlen (blah), fp) != strlen (blah))
     {
       fclose (fp);
-      return 1;
+      return 2;
     }
 
   rewind (fp);
diff --git a/stdio-common/tst-fmemopen2.c b/stdio-common/tst-fmemopen2.c
index c2a4baa..65180f4 100644
--- a/stdio-common/tst-fmemopen2.c
+++ b/stdio-common/tst-fmemopen2.c
@@ -9,7 +9,8 @@  do_test (void)
 {
   int result = 0;
   char buf[100];
-  FILE *fp = fmemopen (buf, sizeof (buf), "w");
+#define nbuf (sizeof (buf))
+  FILE *fp = fmemopen (buf, nbuf, "w");
   if (fp == NULL)
     {
       puts ("fmemopen failed");
@@ -39,7 +40,7 @@  do_test (void)
   o = ftello (fp);
   if (o != nstr)
     {
-      printf ("third ftello returned %ld, expected %zu\n", o, nstr);
+      printf ("third ftello returned %ld, expected %zu\n", o, nbuf);
       result = 1;
     }
   rewind (fp);
diff --git a/stdio-common/tst-fmemopen3.c b/stdio-common/tst-fmemopen3.c
new file mode 100644
index 0000000..1ff0920
--- /dev/null
+++ b/stdio-common/tst-fmemopen3.c
@@ -0,0 +1,206 @@ 
+/* fmemopen tests for append and read mode.
+   Copyright (C) 2014 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+
+static void
+print_buffer (const char *s, size_t n)
+{
+  size_t i;
+  for (i=0; i<n; ++i)
+    printf ("0x%02X (%c), ", s[i], s[i]);
+}
+
+/* This test check append mode initial position (a/a+) based on POSIX defition
+   (BZ#6544 and BZ#13151).  */
+static int
+do_test_write_append (const char *mode)
+{
+  char buf[32] = "testing buffer";
+  char exp[32] = "testing bufferXX";
+
+  FILE *fp = fmemopen (buf, sizeof (buf), mode);
+
+  fflush (fp);
+  fprintf (fp, "X");
+  fseek (fp, 0, SEEK_SET);
+  fprintf (fp, "X");
+  fclose (fp);
+
+  if (strcmp (buf, exp) != 0)
+    {
+      printf ("%s: check failed: %s != %s\n", __FUNCTION__, buf, exp);
+      return 1;
+    }
+
+  return 0;
+}
+
+/* This test check append mode initial position (a/a+) based on POSIX defition
+   (BZ#6544 and BZ#13151) for buffer without null byte end.  */
+static int
+do_test_write_append_without_null (const char *mode)
+{
+  char buf[] = { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55 };
+  char exp[] = { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55 };
+
+  /* If '\0' is not found in buffer, POSIX states that SEEK_SET should be
+     the size argument.  */
+  FILE *fp = fmemopen (buf, sizeof (buf) - 2, "a");
+
+  fflush (fp);
+  fputc (0x70, fp);
+  fseek (fp, 0, SEEK_SET);
+  fputc (0x70, fp);
+  fputc (0x70, fp);
+  fclose (fp);
+
+  /* POSIX also states that a write operation on the stream shall not advance
+     the current buffer size beyond the size given in fmemopen, so the string
+     should be same.  */
+  if (memcmp (buf, exp, sizeof (buf)) != 0)
+    {
+      printf ("%s: check failed: ", __FUNCTION__);
+      print_buffer (buf, sizeof (buf));
+      printf ("!= ");
+      print_buffer (exp, sizeof (exp));
+      printf ("\n");
+      return 1;
+    }
+
+  return 0;
+}
+
+/* This test check for initial position and feek value for fmemopen objects
+   opened with append mode.  */
+static int
+do_test_read_append (void)
+{
+  char buf[32] = "testing buffer";
+  size_t buflen = strlen (buf);
+  long fpos;
+
+  /* POSIX defines for 'a+' the initial position is the first null byte.  */
+  FILE *fp = fmemopen (buf, sizeof (buf), "a+");
+
+  fpos = ftell (fp);
+  if (fpos != buflen)
+    {
+      printf ("%s: ftell|SEEK_SET (fp) %li != strlen (%s) %li\n",
+	      __FUNCTION__, fpos, buf, buflen);
+      fclose (fp);
+      return 1;
+    }
+
+  fseek (fp, 0, SEEK_END);
+
+  if (fpos != buflen)
+    {
+      printf ("%s: ftell|SEEK_END (fp) %li != strlen (%s) %li\n",
+	      __FUNCTION__, fpos, buf, buflen);
+      fclose (fp);
+      return 1;
+    }
+  fclose (fp);
+
+  /* Check if attempting to read past the current size, defined as strlen (buf)
+     yield an EOF.  */
+  fp = fmemopen (buf, sizeof (buf), "a+");
+  if (getc(fp) != EOF)
+    {
+      printf ("%s: getc(fp) != EOF\n", __FUNCTION__);
+      fclose (fp);
+      return -1;
+    }
+
+  fclose (fp);
+
+  return 0;
+}
+
+/* This test check for fseek (SEEK_END) using negative offsets (BZ#14292).  The
+   starting position of descriptor is different base on the opening mode.  */
+static int
+do_test_read_seek_neg (const char *mode, const char *expected)
+{
+  char buf[] = "abcdefghijklmnopqrstuvxz0123456789";
+  char tmp[10];
+  size_t tmps = sizeof (tmps);
+  long offset = -11;
+
+  FILE *fp = fmemopen (buf, sizeof (buf), mode);
+  fseek (fp, offset, SEEK_END);
+  fread (tmp, tmps, 1, fp);
+  
+  if (memcmp (tmp, expected, tmps) != 0)
+    {
+      printf ("%s: fmemopen(%s) - fseek (fp, %li, SEEK_END):\n",
+	      __FUNCTION__, mode, offset);
+      printf ("  returned: ");
+      print_buffer (tmp, tmps);
+      printf ("\n");
+      printf ("  expected: ");
+      print_buffer (expected, tmps);
+      printf ("\n");
+      return 1;
+    }
+  
+  fclose (fp);
+
+  return 0;
+}
+
+static int
+do_test_read_seek_negative (void)
+{
+  int ret = 0;
+
+  /* 'r' and 'w' modes defines the initial position at the buffer start and
+     seek with SEEK_END shall seek relative to its size give in fmemopen
+     call.  The expected tmp result is 0 to 9 *without* the ending null  */
+  ret += do_test_read_seek_neg ("r", "0123456789");
+  /* 'a+' mode sets the initial position at the first null byte in buffer and
+    SEEK_END shall seek relative to its size as well.  The expected result is
+    z012345678, since SEEK_END plus a+ start at '\0', not size.  */
+  ret += do_test_read_seek_neg ("a+", "z012345678");
+
+  return ret;
+}
+
+static int
+do_test (void)
+{
+  int ret = 0;
+
+  ret += do_test_write_append ("a");
+  ret += do_test_write_append_without_null ("a");
+  ret += do_test_write_append ("a+");
+  ret += do_test_write_append_without_null ("a+");
+
+  ret += do_test_read_append ();
+
+  ret += do_test_read_seek_negative ();
+
+  return ret;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/sysdeps/unix/sysv/linux/powerpc/powerpc64/nptl/libc.abilist b/sysdeps/unix/sysv/linux/powerpc/powerpc64/nptl/libc.abilist
index 195b587..7a1deff 100644
--- a/sysdeps/unix/sysv/linux/powerpc/powerpc64/nptl/libc.abilist
+++ b/sysdeps/unix/sysv/linux/powerpc/powerpc64/nptl/libc.abilist
@@ -90,6 +90,9 @@  GLIBC_2.17
 GLIBC_2.18
  GLIBC_2.18 A
  __cxa_thread_atexit_impl F
+GLIBC_2.20
+ GLIBC_2.20 A
+ fmemopen F
 GLIBC_2.3
  GLIBC_2.3 A
  _Exit F
diff --git a/sysdeps/unix/sysv/linux/x86_64/64/libc.abilist b/sysdeps/unix/sysv/linux/x86_64/64/libc.abilist
index 914b590..b77feba 100644
--- a/sysdeps/unix/sysv/linux/x86_64/64/libc.abilist
+++ b/sysdeps/unix/sysv/linux/x86_64/64/libc.abilist
@@ -1854,6 +1854,9 @@  GLIBC_2.2.5
 GLIBC_2.2.6
  GLIBC_2.2.6 A
  __nanosleep F
+GLIBC_2.20
+ GLIBC_2.20 A
+ fmemopen F
 GLIBC_2.3
  GLIBC_2.3 A
  __ctype_b_loc F