After six months of development, the release of the GNU C Library 2.43 (glibc) has been published, fully complying with the ISO C23 and POSIX.1-2024 standards. A total of 69 developers contributed to the creation of this new release.
Notable improvements implemented in Glibc 2.43 include:
- An experimental feature has been added for building with the Clang compiler, currently available only for aarch64-linux-gnu and x86_64-linux-gnu platforms when using a runtime compatible with libgcc. Clang version 18 or higher is required to build Glibc.
- The mseal() function has been added for Linux systems, allowing processes to set locks on changing certain areas of their address space.
- The openat2() function has been added for Linux systems, supporting a set of additional flags to restrict file path resolution (preventing crossing mount points, symbolic links, magic links (/proc/PID/fd), and components ".."), unlike the openat() function.
- Functions such as free_sized, free_aligned_sized, memset_explicit, and memalignment have been introduced, as outlined in the C23 standard.
- According to the C23 standard, the assert call is defined as a macro with a variable number of arguments, supporting comma-separated expressions within the initializer.
- In accordance with the C23 standard, the functions bsearch, memchr, strchr, strpbrk, strrchr, strstr, wcschr, wcspbrk, wcsrchr, wcsstr, and wmemchr, which return pointers to input arrays, have been redefined as macros that return a pointer to a type with the 'const' qualifier if the input argument is a pointer to a type with the 'const' qualifier.
- The math.h header file has been updated to include definitions for the types long_double_t, _Float32_t, _Float64_t, and _Float128_t, which have appeared in the C23 standard.
- Optional time measurement modes have been added: TIME_MONOTONIC (continuously increasing time, unaffected by changes to the system clock), TIME_ACTIVE, and TIME_THREAD_ACTIVE (time of active process or thread execution) for use in the timespec_get function.
- Optimized versions of mathematical functions such as acosh, asinh, atanh, erf, erfc, lgamma, and tgamma have been imported from the CORE-MATH project.
- Optimized implementations of the functions fma, fmaf, remainder, remaindef, frexpf, frexp, frexpl (binary128), and frexpl (intel96) have been added.
- The performance of mathematical functions acosf, acoshf, asinhf, atan2f, atanhf, coshf, fmodf, lgammaf/lgammaf_r, log10f, remainderf, sinhf, sqrtf, tgammaf, y0/j0, y1/j1, and yn/jn has been improved by removing the SVID error handling code (the user function matherr call upon error) for new builds (to maintain compatibility with already compiled programs, they remain in compat mode).
- Support for Intel Nova Lake and Wildcat Lake processors has been added on x86 systems.
- On AArch64 systems, support for large memory pages (transparent huge pages) of 2MB size is now enabled by default in the malloc function (the parameter ibc.malloc.hugetlb is now set to 1). The clone() function has implemented the disabling of the ZA (Z-Array) state on CPUs that support the SME (Scalable Matrix Extension).
- For AArch64 systems that support the BTI (Branch Target Identification) extension, the glibc.cpu.aarch64_bti setting has been added to forcibly enable BTI for all executables and libraries. BTI provides blocking of jumps to arbitrary code sections to counter the creation of gadgets in exploits that use return-oriented programming techniques.
- On AArch64 systems that support one of the branch protection extensions (Branch Target Identification or Guarded Control Stack), it is now allowed to use the environment variable 'LD_DEBUG=security' to output warnings by the linker when loading executables and libraries that do not support these extensions.
- Vectorized versions of the functions exp2m1, exp10m1, log10p1, log2p1, and rsqrt have been added for AArch64 systems.
- An optimized implementation of the memset function using the RVV (RISC-V Vector) extension has been added for the RISC-V architecture.
- The test suite has significantly expanded the checks for multithreading and the functions scanf, strerror, and strsignal.
- Encoding data, information on character types, and transliteration tables have been updated to support Unicode specification 17.0.0.
- In the implementation of the LD_PROFILE functionality, the default directory (/var/tmp) for writing profiling data has been discontinued. Now, a directory must be explicitly defined for this data through the environment variable LD_PROFILE_OUTPUT.
- Fixed vulnerabilities:
- CVE-2026-0861 — integer overflow in the memalign function leading to heap corruption.
- CVE-2026-0915 — leakage of stack contents in the functions getnetbyaddr and getnetbyaddr_r.
- CVE-2025-15281 — the return of uninitialized memory that may contain residual data when using the wordexp function with the WRDE_REUSE and WRDE_APPEND parameters.
Additionally, after a year of development, the Cygwin project has released version 4.6.0 of the standard C library newlib, developed by engineers from Red Hat. This library aims to provide a compact implementation of the standard C library (libc) suitable for use in embedded systems with limited flash storage and RAM. The project's code is written in C and is distributed under the LGPLv2 license.
In the new version of newlib:
- Support for the POSIX.1-2024 specification has been expanded.
- Performance of the memcpy, mempcpy, and memmove functions has been improved.
- An option ‘—enable-newlib-hw-misaligned-access’ has been added.
- RISC-V architecture functions in the mem* and str* series have been optimized.
- The locale processing code has been redesigned, eliminating the global variable global_locale_string in favor of separate locale_string variables for each locale object with the type locale_t.
- Support for the new platform m68k-atari-elf has been added.
- Code strtorQ.c from the FreeBSD gdtoa library has been migrated, which is used to implement support for the 128-bit type ‘long double’ in the strtold function.
- Encoding data has been updated to Unicode 17.0.
Source: opennet.ru
