Home | History | Annotate | only in /src/common/lib/libprop
History log of /src/common/lib/libprop
RevisionDateAuthorComments
 1.13 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.12 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.11 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.10 28-Jun-2016  pgoyette branches: 1.10.16; 1.10.36;
The local copy of rb_tree code has been unused for quite some time. So
we can just remove it, and adjust callers to use the "real" rbtree
function names.

Addresses PR lib/44090
 1.9 27-Jul-2012  pooka Bit-un-rot the proplib portability layer.
 1.8 30-Jun-2008  matt branches: 1.8.2;
Change tree op members/typedefs to rbto_compare_* from rb_compare_*
 1.7 03-Jun-2008  haad Add prop_array_util functions to proplib. This code is copied/changed
prop_dictionary_util.

From manual page

The prop_array_util family of functions are provided to make getting and
setting values in arrays more convenient in some applications.

OK by mjf@ and freza@.
 1.6 16-Aug-2007  joerg branches: 1.6.8; 1.6.10;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.5 26-Oct-2006  thorpej branches: 1.5.2; 1.5.4; 1.5.12;
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.4 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.3 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.2 05-Jul-2006  thorpej branches: 1.2.2;
Add kernel and user space parts of a protocol for sending property lists
to / from the kernel using ioctls.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.2.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.5.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.5.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.5.2.2 26-Oct-2006  thorpej - Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.5.2.1 26-Oct-2006  thorpej file Makefile.inc was added on branch newlock2 on 2006-10-26 05:02:13 +0000
 1.6.10.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.6.10.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.6.8.1 17-Jun-2008  yamt sync with head.
 1.8.2.1 30-Oct-2012  yamt sync with head
 1.10.36.1 02-Aug-2025  perseant Sync with HEAD
 1.10.16.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.10.16.1 21-Apr-2020  martin Sync with HEAD
 1.16 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.15 06-Jun-2020  thorpej branches: 1.15.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.14 12-Feb-2017  abhinav branches: 1.14.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.13 30-Sep-2011  jym branches: 1.13.26; 1.13.30;
Fix an implementation inconsistency with the prop_*_send_syscall() and
prop_*_recv_syscall() functions from proplib(3). They now share the
same logic as the one from prop_*_send_ioctl() functions:
- returns an int
- 0 indicates "no error", otherwise returns the error number (and
set errno)

Many consumers of the prop_*_{ioctl, syscall} expect errno to be set
on error and use err() to display the error message. As such, ensures that
errno gets set before returning from these functions.

prop_*_send_syscall() functions returned a boolean, and now return an int.
Fix all call sites to use the new paradigm (only quota2 is affected in src).

As the prop_*_{send,recv}_syscall() API appeared in -current and is only
used by the recent quota2 code, I am not bumping the lib. The API change
only affects the prop_*_send_syscall() function (recv_syscall()s were
already used correctly), so ensure you are not mixing "old" -current
quota binaries with a new proplib(3) (or the other way around). This
change will be announced via a HEADS-UP and UPDATING.

Does not affect the kernel part of proplib.

Document the correct API in prop_array(3) and prop_dictionary(3).

Thanks to Francois Tigeot for noticing the API inconsistency and
reporting it on tech-kern@.

ok bouyer@.
 1.12 21-Feb-2011  njoly Fix section for umask xrefs.
 1.11 14-Dec-2009  dholland branches: 1.11.4;
Fix some ordering inconsistencies, noted by Silas Silva in PR 42415.
 1.10 10-Oct-2009  bad Implement prop_array_externalize_to_pref(), prop_array_copyin(),
prop_dictionary_externalize_to_pref() and prop_dictionary_copyin()
as discussed in the thread:
http://mail-index.netbsd.org/tech-kern/2009/07/29/msg005594.html

Bump libprop shlib minor.
 1.9 09-Apr-2009  joerg Improve markup.
 1.8 30-Apr-2008  martin branches: 1.8.8;
Convert TNF licenses to new 2 clause variant
 1.7 21-Jan-2008  christos branches: 1.7.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.6 06-Nov-2007  mjf Fix typo
 1.5 16-Aug-2007  thorpej branches: 1.5.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.4 21-Aug-2006  thorpej branches: 1.4.4; 1.4.16;
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 09-Jul-2006  wiz branches: 1.3.2;
Drop trailing whitespace.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.4.16.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.4.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.2.2 23-Mar-2008  matt sync with HEAD
 1.5.2.1 09-Jan-2008  matt sync with HEAD
 1.7.4.1 18-May-2008  yamt sync with head.
 1.8.8.1 13-May-2009  jym Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.
 1.11.4.1 05-Mar-2011  bouyer Sync with HEAD
 1.13.30.1 21-Apr-2017  bouyer Sync with HEAD
 1.13.26.1 20-Mar-2017  pgoyette Sync with HEAD
 1.14.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.14.12.1 21-Apr-2020  martin Sync with HEAD
 1.15.12.1 02-Aug-2025  perseant Sync with HEAD
 1.27 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.26 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.25 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.24 26-Apr-2025  thorpej Hide the private symbols.
 1.23 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.22 26-Mar-2023  andvar branches: 1.22.6;
fix various typos in documentation, comments and sysctl device description.
mainly aion -> ation and inlude -> include.
 1.21 27-Jul-2012  pooka branches: 1.21.34;
Bit-un-rot the proplib portability layer.
 1.20 11-Aug-2008  christos branches: 1.20.2;
typo in comment and white-space fixes mostly from Stathis Kamperis
 1.19 03-Aug-2008  thorpej Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.18 24-May-2008  yamt fix recursive read-lock bugs found by lockdebug and reported
by Geoff C. Wing and others. ok'ed by Jason Thorpe.
an earlier version was tested by Sverre Froyen.
PR/38732 from oster@.
 1.17 24-May-2008  yamt revert the recent "use trylock to hide locking errors" changes
and their associated changes, in particular, the following versions.
prop_array.c 1.13-1.16
prop_dictionary.c 1.25-1.28
prop_object_impl.h 1.21-1.25
ok'ed by core@.
 1.16 07-May-2008  tron branches: 1.16.2;
Change the argument of _PROP_RWLOCK_TRYRDLOCK() to the lock member and not
its address to be consistent with all the other macros.
 1.15 07-May-2008  tron Replace _prop_rwlock_tryrdlock() by a macro _PROP_RWLOCK_TRYRDLOCK().
This avoids build failures in stand alone binaries (e.g. bootloaders)
where there is no "pa_rwlock" member in the "_prop_array" structure.
 1.14 06-May-2008  xtraeme prop_object_iterator_next() and prop_object_iterator_reset() were
acquiring the rwlock recursively in some paths.

Introduce _prop_rwlock_tryrdlock() and use it in these functions, so
that the rwlock is *always* acquired once, while here add some
_PROP_RWLOCK_OWNED asserts to verify.

This definitely fixes the "locking against myself" panics.
 1.13 06-May-2008  xtraeme Do not acquire the rwlock recursively in prop_{array,dictionary}_iterator_reset()
when prop_{array,dictionary}_copyout_ioctl() is called.

Introduce _PROP_RWLOCK_OWNED() which is a KASSERT(rw_lock_held(lock))
and use it in those two functions, also acquire the rwlock in other
places where it is required now.

This fixes a LOCKDEBUG panic "locking against myself", as reported by
Geoff C. Wing in current-users@.
 1.12 28-Apr-2008  martin Remove clause 3 and 4 from TNF licenses
 1.11 30-Aug-2007  joerg branches: 1.11.6;
Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.10 16-Aug-2007  joerg branches: 1.10.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.9 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.8 16-Jul-2007  joerg prop_array_internalize and prop_dictionary_internalize are basically the
same code. Refactor it into _prop_generic_internalize, which gets passed
the second-level tag.
 1.7 03-Oct-2006  thorpej branches: 1.7.2; 1.7.4; 1.7.12;
- Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.6 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.5 21-Aug-2006  he Add a workaround for a GCC -Wuninitialized mis-warning (seen for mips).
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 28-May-2006  thorpej branches: 1.3.2;
Fix the way that prop_array_ensure_capacity() and _prop_array_expand()
interact.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.3 01-Sep-2006  tron Pull up following revision(s) (requested by riz in ticket #87):
common/lib/libprop/prop_array.c: revision 1.5
Add a workaround for a GCC -Wuninitialized mis-warning (seen for mips).
 1.3.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.7.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.7.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.7.2.2 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.7.2.1 03-Oct-2006  thorpej file prop_array.c was added on branch newlock2 on 2006-10-03 15:45:05 +0000
 1.10.2.1 06-Nov-2007  matt sync with HEAD
 1.11.6.2 04-Jun-2008  yamt sync with head
 1.11.6.1 18-May-2008  yamt sync with head.
 1.16.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.16.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.20.2.1 30-Oct-2012  yamt sync with head
 1.21.34.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.21.34.1 21-Apr-2020  martin Sync with HEAD
 1.22.6.1 02-Aug-2025  perseant Sync with HEAD
 1.13 10-Feb-2024  andvar Fix various typos in comments, log messages and documentation.
 1.12 26-Mar-2023  andvar fix various typos in documentation, comments and sysctl device description.
mainly aion -> ation and inlude -> include.
 1.11 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.10 12-Feb-2017  abhinav branches: 1.10.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.9 31-May-2016  wiz branches: 1.9.2; 1.9.4;
Punctuation nits.
(adding space makes sure they are not marked up)
 1.8 31-May-2016  pgoyette Add prop_array_add_cstring{,_no_copy} utility functions as suggested in
PR lib/46723 using the patch provided. (Header file updates are mine.)
 1.7 17-Oct-2011  wiz Add missing Nd.
 1.6 27-Mar-2011  wiz Fix a typo and a punctuation nit.
 1.5 24-Mar-2011  bouyer Add a new libquota library, which contains some blocks to build and/or
parse quota plists; as well as a getfsquota() function to retrieve quotas
for a single id from a single filesystem (whatever filesystem this is:
a local quota-enabled fs or NFS). This is build on functions getufsquota()
(for local filesystems with UFS-like quotas) and getnfsquota();
which are also available to userland programs.
move functions from quota2_subr.c to libquota or libprop as appropriate,
and ajust in-tree quota tools.
move some declarations from kernel headers to either sys/quota.h or
quota/quota.h as appropriate. ufs/ufs/quota.h still installed because
it's needed by other installed ufs headers.
ufs/ufs/quota1.h still installed as a quick&dirty way to get a code
using the old quotactl() to compile (just include ufs/ufs/quota1.h instead of
ufs/ufs/quota.h - old code won't compile without this change and this is
on purpose).
Discussed on tech-kern@ and tech-net@ (long thread, but not much about
libquota itself ...)
 1.4 20-Jan-2011  wiz Remove trailing whitespace.
 1.3 11-Sep-2008  haad Add prop_array_add_int* and prop_array_add_uint* functions. These functions
can be used to append specified type to the end of prop_array_t.

Ok'ed by @joerg.
 1.2 04-Jun-2008  wiz branches: 1.2.2; 1.2.4;
Sort SEE ALSO.
 1.1 03-Jun-2008  haad Add prop_array_util functions to proplib. This code is copied/changed
prop_dictionary_util.

From manual page

The prop_array_util family of functions are provided to make getting and
setting values in arrays more convenient in some applications.

OK by mjf@ and freza@.
 1.2.4.3 24-Sep-2008  wrstuden Merge in changes between wrstuden-revivesa-base-2 and
wrstuden-revivesa-base-3.
 1.2.4.2 23-Jun-2008  wrstuden Add files to branch that were added on -current.

After this, all that's left of update is to merge some changes
that had conflicts.
 1.2.4.1 04-Jun-2008  wrstuden file prop_array_util.3 was added on branch wrstuden-revivesa on 2008-06-23 05:01:56 +0000
 1.2.2.2 17-Jun-2008  yamt sync with head.
 1.2.2.1 04-Jun-2008  yamt file prop_array_util.3 was added on branch yamt-pf42 on 2008-06-17 09:13:31 +0000
 1.9.4.1 21-Apr-2017  bouyer Sync with HEAD
 1.9.2.1 20-Mar-2017  pgoyette Sync with HEAD
 1.10.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.10.12.1 21-Apr-2020  martin Sync with HEAD
 1.10 26-Apr-2025  thorpej Hide the private symbols.
 1.9 03-Aug-2022  riastradh branches: 1.9.8;
proplib: Nix trailing whitespace.
 1.8 14-Jun-2020  christos add/fix linted comments
 1.7 14-Jun-2020  christos Fix incorrect type (found by lint), and add linted comments for the
long long -> long (uintmax_t on LP64)
 1.6 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.5 31-May-2016  pgoyette branches: 1.5.16;
Add prop_array_add_cstring{,_no_copy} utility functions as suggested in
PR lib/46723 using the patch provided. (Header file updates are mine.)
 1.4 27-Jul-2012  pooka Bit-un-rot the proplib portability layer.
 1.3 24-Mar-2011  bouyer branches: 1.3.4;
Add a new libquota library, which contains some blocks to build and/or
parse quota plists; as well as a getfsquota() function to retrieve quotas
for a single id from a single filesystem (whatever filesystem this is:
a local quota-enabled fs or NFS). This is build on functions getufsquota()
(for local filesystems with UFS-like quotas) and getnfsquota();
which are also available to userland programs.
move functions from quota2_subr.c to libquota or libprop as appropriate,
and ajust in-tree quota tools.
move some declarations from kernel headers to either sys/quota.h or
quota/quota.h as appropriate. ufs/ufs/quota.h still installed because
it's needed by other installed ufs headers.
ufs/ufs/quota1.h still installed as a quick&dirty way to get a code
using the old quotactl() to compile (just include ufs/ufs/quota1.h instead of
ufs/ufs/quota.h - old code won't compile without this change and this is
on purpose).
Discussed on tech-kern@ and tech-net@ (long thread, but not much about
libquota itself ...)
 1.2 11-Sep-2008  haad Add prop_array_add_int* and prop_array_add_uint* functions. These functions
can be used to append specified type to the end of prop_array_t.

Ok'ed by @joerg.
 1.1 03-Jun-2008  haad branches: 1.1.2; 1.1.4;
Add prop_array_util functions to proplib. This code is copied/changed
prop_dictionary_util.

From manual page

The prop_array_util family of functions are provided to make getting and
setting values in arrays more convenient in some applications.

OK by mjf@ and freza@.
 1.1.4.3 24-Sep-2008  wrstuden Merge in changes between wrstuden-revivesa-base-2 and
wrstuden-revivesa-base-3.
 1.1.4.2 23-Jun-2008  wrstuden Add files to branch that were added on -current.

After this, all that's left of update is to merge some changes
that had conflicts.
 1.1.4.1 03-Jun-2008  wrstuden file prop_array_util.c was added on branch wrstuden-revivesa on 2008-06-23 05:01:56 +0000
 1.1.2.2 17-Jun-2008  yamt sync with head.
 1.1.2.1 03-Jun-2008  yamt file prop_array_util.c was added on branch yamt-pf42 on 2008-06-17 09:13:31 +0000
 1.3.4.1 30-Oct-2012  yamt sync with head
 1.5.16.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.5.16.1 21-Apr-2020  martin Sync with HEAD
 1.9.8.1 02-Aug-2025  perseant Sync with HEAD
 1.8 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.7 12-Feb-2017  abhinav branches: 1.7.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.6 03-Aug-2008  thorpej branches: 1.6.44; 1.6.48;
Fix a typo.
 1.5 30-Apr-2008  martin branches: 1.5.2;
Convert TNF licenses to new 2 clause variant
 1.4 21-Jan-2008  christos branches: 1.4.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.3 16-Aug-2007  thorpej branches: 1.3.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.2 09-Jul-2006  wiz branches: 1.2.6; 1.2.18;
Drop trailing whitespace.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.2.18.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.2.6.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.3.2.1 23-Mar-2008  matt sync with HEAD
 1.4.4.1 18-May-2008  yamt sync with head.
 1.5.2.1 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.6.48.1 21-Apr-2017  bouyer Sync with HEAD
 1.6.44.1 20-Mar-2017  pgoyette Sync with HEAD
 1.7.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.7.12.1 21-Apr-2020  martin Sync with HEAD
 1.24 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.23 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.22 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.21 26-Apr-2025  thorpej Hide the private symbols.
 1.20 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.19 06-Jun-2020  thorpej branches: 1.19.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.18 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.17 03-Jan-2009  pooka branches: 1.17.50;
Get rid of locks with static initializers using once and atomic ops.
This makes proplib simplelock-free.
 1.16 03-Aug-2008  thorpej Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.15 28-Apr-2008  martin branches: 1.15.2;
Remove clause 3 and 4 from TNF licenses
 1.14 05-Jan-2008  ad branches: 1.14.4;
Include sys/simplelock.h in prop_object_impl.h.
 1.13 04-Jan-2008  xtraeme sys/simplelock.h is required now.
 1.12 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.11 16-Aug-2007  joerg branches: 1.11.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.10 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.9 16-Oct-2006  thorpej branches: 1.9.2; 1.9.4; 1.9.12;
Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.8 15-Oct-2006  christos de-lint.
 1.7 12-Oct-2006  thorpej _prop_bool_free(): Consume all of the arguments.
 1.6 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.5 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 05-Jul-2006  thorpej branches: 1.3.2;
Reduce the memory footprint for prop_bool_t objects significantly, taking
adavantage of the immutability of these objects:

Statically allocate a TRUE object and a FALSE object, and simply return
references to those objects for create and copy operations.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.9.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.9.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.9.2.2 16-Oct-2006  thorpej Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.9.2.1 16-Oct-2006  thorpej file prop_bool.c was added on branch newlock2 on 2006-10-16 03:21:08 +0000
 1.11.2.1 06-Nov-2007  matt sync with HEAD
 1.14.4.1 18-May-2008  yamt sync with head.
 1.15.2.1 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.17.50.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.17.50.2 21-Apr-2020  martin Sync with HEAD
 1.17.50.1 10-Jun-2019  christos Sync with HEAD
 1.19.12.1 02-Aug-2025  perseant Sync with HEAD
 1.16 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.15 07-Mar-2017  njoly branches: 1.15.12; 1.15.32;
Fix commas in NAME section.
 1.14 05-Feb-2017  pgoyette Add the *_size() variants to the .Nm list so it will be found by
apropos(1).

While here, reorder the function lists to improve readability.
 1.13 04-Feb-2017  wiz Use just the right amount of commas.
 1.12 29-Jan-2017  pgoyette Update for the new *_size() functions recently added. Mention the
implicit size limit (128KB) for the functions which do not take an
explicit limit argument.
 1.11 15-Jan-2017  wiz Sort errors.
 1.10 15-Jan-2017  pgoyette Document E2BIG error when copying a large object.
 1.9 20-Jan-2011  wiz branches: 1.9.26; 1.9.30; 1.9.34;
Add commas in enumerations.
 1.8 19-Jan-2011  bouyer - Implement prop_{array,dictionary}_copyout(), based on
prop_{array,dictionary}_copyout_ioctl().
- Implement prop_{array,dictionary}_recv_syscall(), which
takes as parameter the pref we got from kernel and internalize it,
and unmaps the buffer prop_{array,dictionary}_copyout() mapped for us.
- add a prop_{array,dictionary}_send_syscall() for symetry, which is
an alias to prop_{array,dictionary}_externalize_to_pref()

Discussed on tech-kern@ and tech-userlevel@
 1.7 14-Dec-2009  dholland Minor wording fix/clarification (sending -> copying) from Silas Silva
in PR 42414.
 1.6 11-Oct-2009  wiz Sort sections. New sentence, new line.
 1.5 10-Oct-2009  bad Implement prop_array_externalize_to_pref(), prop_array_copyin(),
prop_dictionary_externalize_to_pref() and prop_dictionary_copyin()
as discussed in the thread:
http://mail-index.netbsd.org/tech-kern/2009/07/29/msg005594.html

Bump libprop shlib minor.
 1.4 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.3 21-Jan-2008  christos branches: 1.3.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.2 22-Apr-2007  yamt branches: 1.2.4;
correct function names.
 1.1 26-Oct-2006  thorpej branches: 1.1.2;
Add prop_array_t support to prop_kern.
 1.1.2.2 26-Oct-2006  thorpej Add prop_array_t support to prop_kern.
 1.1.2.1 26-Oct-2006  thorpej file prop_copyin_ioctl.9 was added on branch newlock2 on 2006-10-26 18:51:22 +0000
 1.2.4.1 23-Mar-2008  matt sync with HEAD
 1.3.4.1 18-May-2008  yamt sync with head.
 1.9.34.1 21-Apr-2017  bouyer Sync with HEAD
 1.9.30.1 20-Mar-2017  pgoyette Sync with HEAD
 1.9.26.1 30-Oct-2018  martin Pull up following revision(s) (requested by sborrill in ticket #1645):

common/include/prop/prop_dictionary.h: revision 1.16
common/include/prop/prop_array.h: revision 1.15
common/lib/libprop/prop_kern.c: revision 1.21
common/lib/libprop/prop_copyin_ioctl.9: revision 1.12
common/include/prop/prop_array.h: revision 1.16
common/lib/libprop/prop_kern.c: revision 1.22 (patch)
common/lib/libprop/prop_kern.c: revision 1.23 (patch)

add sized versions of the copyin ioctls.

-

add sized versions of the copyin ioctls

-

Update for the new *_size() functions recently added. Mention the
implicit size limit (128KB) for the functions which do not take an
explicit limit argument.

-

fix args

-

missing brace

-

call the proper size functions
 1.15.32.1 02-Aug-2025  perseant Sync with HEAD
 1.15.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.15.12.1 21-Apr-2020  martin Sync with HEAD
 1.10 23-Sep-2025  rillig prop_data.3: fix typo
 1.9 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.8 12-Feb-2017  abhinav branches: 1.8.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.7 14-Dec-2009  dholland branches: 1.7.30; 1.7.34;
Fix some ordering inconsistencies, noted by Silas Silva in PR 42415.
 1.6 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.5 21-Jan-2008  christos branches: 1.5.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.4 16-Aug-2007  thorpej branches: 1.4.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.3 22-Feb-2007  freza Add prop_data_size() to SYNOPSIS.
 1.2 09-Jul-2006  wiz branches: 1.2.6; 1.2.10;
Drop trailing whitespace.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.2.10.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.2.6.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.4.2.1 23-Mar-2008  matt sync with HEAD
 1.5.4.1 18-May-2008  yamt sync with head.
 1.7.34.1 21-Apr-2017  bouyer Sync with HEAD
 1.7.30.1 20-Mar-2017  pgoyette Sync with HEAD
 1.8.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.8.12.1 21-Apr-2020  martin Sync with HEAD
 1.24 23-Sep-2025  rillig libprop: eliminate common subexpression
 1.23 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.22 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.21 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.20 26-Apr-2025  thorpej Hide the private symbols.
 1.19 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.18 03-Aug-2022  riastradh branches: 1.18.8;
proplib: Nix trailing whitespace.
 1.17 08-Jun-2020  thorpej Fix a paste-o that caused prop_data_create_copy() to be intolerant
of creating empty data objects. Fixes t_ifconfig::ifconfig_description
unit test.
 1.16 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.15 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.14 25-Jan-2009  cyber branches: 1.14.50;
Properly handle empty data nodes (such as generated by Apple's
plist editor). They are in the form of <data></data>, whereas the
original code path only checked for empty being <data/>.

This causes an assert to be triggered when trying to access the node's
content.

Patch reviewed by thorpej.
 1.13 03-Aug-2008  thorpej branches: 1.13.4;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.12 15-May-2008  dyoung In prop_data_create_data(blob, len), if len == 0, allocate no memory
for blob, and leave pd_mutable set to NULL. In this way, avoid
tripping over the assertion in prop_data_data_nocopy().
 1.11 28-Apr-2008  martin branches: 1.11.2;
Remove clause 3 and 4 from TNF licenses
 1.10 16-Feb-2008  apb branches: 1.10.4;
For all files under src/common, as well as related man pages under
src/lib/libc, or related headers under src/sys/sys: change u_intNN_t to
uintNN_t.
 1.9 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.8 16-Aug-2007  joerg branches: 1.8.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.7 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.6 04-Mar-2007  dillo Fix white space skipping before closing tag when padding characters
are present.

Okayed by thorpej.
 1.5 18-Oct-2006  martin branches: 1.5.2; 1.5.4; 1.5.6;
Add casts to apease lint.
 1.4 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.3 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.2 18-May-2006  thorpej branches: 1.2.2;
- Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.2.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.2.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.5.6.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.5.4.2 18-Nov-2008  snj Pull up following revision(s) (requested by tsutsui in ticket #1224):
common/lib/libc/gen/bswap64.c: revision 1.2
common/lib/libprop/prop_data.c: revision 1.10
common/lib/libc/inet/inet_addr.c: revision 1.2
common/lib/libc/hash/rmd160/rmd160.c: revision 1.4
common/lib/libc/gen/bswap32.c: revision 1.2
common/lib/libc/gen/bswap16.c: revision 1.2
common/lib/libc/arch/alpha/gen/byte_swap_4.S: revision 1.3
common/lib/libc/arch/sh3/string/memset.S: revision 1.2
common/lib/libc/arch/alpha/gen/byte_swap_2.S: revision 1.3
common/lib/libc/md/md5c.c: revision 1.3
common/lib/libc/hash/sha1/sha1.c: revision 1.3
common/lib/libc/md/md4c.c: revision 1.3
sys/sys/rmd160.h: revision 1.2
sys/sys/sha2.h: revision 1.2
For all files under src/common, as well as related man pages under
src/lib/libc, or related headers under src/sys/sys: change u_intNN_t to
uintNN_t.
 1.5.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.5.2.2 18-Oct-2006  martin Add casts to apease lint.
 1.5.2.1 18-Oct-2006  martin file prop_data.c was added on branch newlock2 on 2006-10-18 14:41:09 +0000
 1.8.2.2 23-Mar-2008  matt sync with HEAD
 1.8.2.1 06-Nov-2007  matt sync with HEAD
 1.10.4.1 18-May-2008  yamt sync with head.
 1.11.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.11.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.13.4.1 26-Jan-2009  snj Pull up following revision(s) (requested by cyber in ticket #316):
common/lib/libprop/prop_data.c: revision 1.14
Properly handle empty data nodes (such as generated by Apple's
plist editor). They are in the form of <data></data>, whereas the
original code path only checked for empty being <data/>.
This causes an assert to be triggered when trying to access the node's
content.
Patch reviewed by thorpej.
 1.14.50.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.14.50.2 21-Apr-2020  martin Sync with HEAD
 1.14.50.1 10-Jun-2019  christos Sync with HEAD
 1.18.8.1 02-Aug-2025  perseant Sync with HEAD
 1.22 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.21 02-Apr-2025  gutteridge prop_dictionary.3 & prop_string.3: minor grammar fixes
 1.20 06-Jun-2020  thorpej branches: 1.20.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.19 12-Feb-2017  abhinav branches: 1.19.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.18 30-Sep-2011  jym branches: 1.18.26; 1.18.30;
Fix an implementation inconsistency with the prop_*_send_syscall() and
prop_*_recv_syscall() functions from proplib(3). They now share the
same logic as the one from prop_*_send_ioctl() functions:
- returns an int
- 0 indicates "no error", otherwise returns the error number (and
set errno)

Many consumers of the prop_*_{ioctl, syscall} expect errno to be set
on error and use err() to display the error message. As such, ensures that
errno gets set before returning from these functions.

prop_*_send_syscall() functions returned a boolean, and now return an int.
Fix all call sites to use the new paradigm (only quota2 is affected in src).

As the prop_*_{send,recv}_syscall() API appeared in -current and is only
used by the recent quota2 code, I am not bumping the lib. The API change
only affects the prop_*_send_syscall() function (recv_syscall()s were
already used correctly), so ensure you are not mixing "old" -current
quota binaries with a new proplib(3) (or the other way around). This
change will be announced via a HEADS-UP and UPDATING.

Does not affect the kernel part of proplib.

Document the correct API in prop_array(3) and prop_dictionary(3).

Thanks to Francois Tigeot for noticing the API inconsistency and
reporting it on tech-kern@.

ok bouyer@.
 1.17 21-Feb-2011  njoly Fix section for umask xrefs.
 1.16 02-Feb-2011  plunky prop_dictionary_internalize_from_file_returns_a_dictionary_not_an_array
 1.15 05-Dec-2009  wiz branches: 1.15.4;
Fix prop_dictionary_ensure_capacity signature, bump date.
From Silas Silva in PR 42413.
 1.14 10-Oct-2009  bad Implement prop_array_externalize_to_pref(), prop_array_copyin(),
prop_dictionary_externalize_to_pref() and prop_dictionary_copyin()
as discussed in the thread:
http://mail-index.netbsd.org/tech-kern/2009/07/29/msg005594.html

Bump libprop shlib minor.
 1.13 06-May-2008  xtraeme Xref prop_dictionary_util(3).
 1.12 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.11 21-Jan-2008  christos branches: 1.11.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.10 05-Jan-2008  mjf Nuke prop_dictionary_capacity, there was no implementation for it.

No objections on tech-kern.
 1.9 11-Oct-2007  xtraeme Fix a typo that has been there forever. prop_dictionary_set:
the object will be retained by the dictionary not array.
 1.8 16-Aug-2007  thorpej branches: 1.8.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.7 07-Jul-2007  degroote Fix the prototyp of prop_dictionary_set_keysym in the DESCRIPTION part
 1.6 28-Apr-2007  xtraeme It's "Copy a dictionary" not "Copy an dictionary". preempt wiz and
bump date.
 1.5 26-Oct-2006  thorpej branches: 1.5.2; 1.5.4; 1.5.14;
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 09-Jul-2006  wiz branches: 1.3.2;
Drop trailing whitespace.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.5.14.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.2.2 26-Oct-2006  thorpej - Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.5.2.1 26-Oct-2006  thorpej file prop_dictionary.3 was added on branch newlock2 on 2006-10-26 05:02:13 +0000
 1.8.2.3 23-Mar-2008  matt sync with HEAD
 1.8.2.2 09-Jan-2008  matt sync with HEAD
 1.8.2.1 06-Nov-2007  matt sync with HEAD
 1.11.4.1 18-May-2008  yamt sync with head.
 1.15.4.2 05-Mar-2011  bouyer Sync with HEAD
 1.15.4.1 08-Feb-2011  bouyer Sync with HEAD
 1.18.30.1 21-Apr-2017  bouyer Sync with HEAD
 1.18.26.1 20-Mar-2017  pgoyette Sync with HEAD
 1.19.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.19.12.1 21-Apr-2020  martin Sync with HEAD
 1.20.12.1 02-Aug-2025  perseant Sync with HEAD
 1.51 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.50 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.49 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.48 26-Apr-2025  thorpej Hide the private symbols.
 1.47 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.46 14-Jun-2023  rin branches: 1.46.6;
Sprinkle braces around _PROP_RWLOCK_UNLOCK() in ``if'' block.
It is expanded into /* nothing */ for _STANDALONE.
 1.45 03-Aug-2022  riastradh proplib: Nix trailing whitespace.
 1.44 02-Jul-2022  andvar s/refrences/references/
 1.43 05-Dec-2021  msaitoh s/exisit/exist/ in comment.
 1.42 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.41 28-Jun-2016  pgoyette branches: 1.41.16;
Missed a couple of function-call renames in previous
 1.40 28-Jun-2016  pgoyette The local copy of rb_tree code has been unused for quite some time. So
we can just remove it, and adjust callers to use the "real" rbtree
function names.

Addresses PR lib/44090
 1.39 18-Oct-2013  martin Make this compilable with gcc 4.8.1 without options DIAGNOSTIC.
 1.38 27-Jul-2012  pooka branches: 1.38.2;
Bit-un-rot the proplib portability layer.
 1.37 20-Apr-2011  martin branches: 1.37.4;
Fix "address of a void*" vs. void* confusion.
Part of fixing PR lib/43964.
 1.36 24-Sep-2010  rmind Fixes/improvements to RB-tree implementation:
1. Fix inverted node order, so that negative value from comparison operator
would represent lower (left) node, and positive - higher (right) node.
2. Add an argument (i.e. "context"), passed to comparison operators.
3. Change rb_tree_insert_node() to return a node - either inserted one or
already existing one.
4. Amend the interface to manipulate the actual object, instead of the
rb_node (in a similar way as Patricia-tree interface does).
5. Update all RB-tree users accordingly.

XXX: Perhaps rename rb.h to rbtree.h, since cleaning-up..

1-3 address the PR/43488 by Jeremy Huddleston.

Passes RB-tree regression tests.
Reviewed by: matt@, christos@
 1.35 14-Apr-2009  haad Check if pd is not NULL before we try to lock rw lock associated with it.
This fixes proplib crash when NULL is passed to prop_dictionary_get as a
dictionary.
 1.34 03-Jan-2009  pooka branches: 1.34.2;
Get rid of locks with static initializers using once and atomic ops.
This makes proplib simplelock-free.
 1.33 30-Nov-2008  haad Fix two race conditions in proplib library. In prop_dictionary and prop_number
there was small window in which was entry left in rb tree with reference
count 0 which lead to rb tree coruption when another thread picked this up
before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.

Ok by joerg@, core@, thorpej@
 1.32 03-Aug-2008  thorpej branches: 1.32.4;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.31 17-Jun-2008  thorpej _prop_rb_tree_insert_node() now returns true/false to indicate if the
insertion succeeded. Update existing usage that arranges for insertions
to always succeed to assert that they do.
 1.30 24-May-2008  yamt fix recursive read-lock bugs found by lockdebug and reported
by Geoff C. Wing and others. ok'ed by Jason Thorpe.
an earlier version was tested by Sverre Froyen.
PR/38732 from oster@.
 1.29 24-May-2008  yamt revert the recent "use trylock to hide locking errors" changes
and their associated changes, in particular, the following versions.
prop_array.c 1.13-1.16
prop_dictionary.c 1.25-1.28
prop_object_impl.h 1.21-1.25
ok'ed by core@.
 1.28 07-May-2008  tron branches: 1.28.2;
Change the argument of _PROP_RWLOCK_TRYRDLOCK() to the lock member and not
its address to be consistent with all the other macros.
 1.27 07-May-2008  tron Replace _prop_rwlock_tryrdlock() by a macro _PROP_RWLOCK_TRYRDLOCK().
This avoids build failures in stand alone binaries (e.g. bootloaders)
where there is no "pa_rwlock" member in the "_prop_array" structure.
 1.26 06-May-2008  xtraeme prop_object_iterator_next() and prop_object_iterator_reset() were
acquiring the rwlock recursively in some paths.

Introduce _prop_rwlock_tryrdlock() and use it in these functions, so
that the rwlock is *always* acquired once, while here add some
_PROP_RWLOCK_OWNED asserts to verify.

This definitely fixes the "locking against myself" panics.
 1.25 06-May-2008  xtraeme Do not acquire the rwlock recursively in prop_{array,dictionary}_iterator_reset()
when prop_{array,dictionary}_copyout_ioctl() is called.

Introduce _PROP_RWLOCK_OWNED() which is a KASSERT(rw_lock_held(lock))
and use it in those two functions, also acquire the rwlock in other
places where it is required now.

This fixes a LOCKDEBUG panic "locking against myself", as reported by
Geoff C. Wing in current-users@.
 1.24 28-Apr-2008  martin Remove clause 3 and 4 from TNF licenses
 1.23 05-Mar-2008  cube branches: 1.23.2;
Actually implement prop_dictionary_make_immutable. OK'd by thorpej@.
 1.22 05-Jan-2008  ad branches: 1.22.2;
Include sys/simplelock.h in prop_object_impl.h.
 1.21 04-Jan-2008  xtraeme sys/simplelock.h is required now.
 1.20 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.19 16-Aug-2007  joerg branches: 1.19.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.18 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.17 16-Jul-2007  joerg prop_array_internalize and prop_dictionary_internalize are basically the
same code. Refactor it into _prop_generic_internalize, which gets passed
the second-level tag.
 1.16 26-Oct-2006  thorpej branches: 1.16.2; 1.16.4; 1.16.12;
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.15 18-Oct-2006  martin Backout size_t casts - lint has been fixed.
 1.14 18-Oct-2006  martin Sprinkle a few size_t casts to avoid conversion warnings.
 1.13 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.12 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.11 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.10 21-Aug-2006  he Add a workaround for GCC -Wuninitialized, similar to the prop_array.c
workaround, and properly marked with XXXGCC -Wuninitialized.
 1.9 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.8 07-Jul-2006  thorpej branches: 1.8.2;
Use a red-black tree to unique'ify the dictionary key symbols, rather than
a sorted array. Using a tree puts the linkage into the key symbol itself,
allowing us to avoid having to allocate memory with a mutex held.
 1.7 28-May-2006  jnemeth remove unused variable that broke build
 1.6 28-May-2006  thorpej Keep a table of unique dictionary keysyms. This way, if we have 200 devices
with the "fw-path" property, we only have one copy of the "fw-path" string
as a dictionary key.
 1.5 18-May-2006  thorpej More cleanup.
 1.4 18-May-2006  thorpej Minor cleanup.
 1.3 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.2 07-May-2006  simonb In _prop_dictionary_alloc(), explicitly set pd->pd_flags to zero
instead of leaving random garbage in there.
Should we just use "memset(pd, 0, sizeof(*pd));" instead?

Fixes boot problems on evbppc/WALNUT with new proplib.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.8.2.3 01-Sep-2006  tron Pull up following revision(s) (requested by riz in ticket #87):
common/lib/libprop/prop_dictionary.c: revision 1.10
Add a workaround for GCC -Wuninitialized, similar to the prop_array.c
workaround, and properly marked with XXXGCC -Wuninitialized.
 1.8.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.8.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.16.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.16.4.2 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.16.4.1 27-Sep-2007  xtraeme branches: 1.16.4.1.2;
Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.16.4.1.2.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.16.2.2 26-Oct-2006  thorpej - Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.16.2.1 26-Oct-2006  thorpej file prop_dictionary.c was added on branch newlock2 on 2006-10-26 05:02:13 +0000
 1.19.2.2 23-Mar-2008  matt sync with HEAD
 1.19.2.1 06-Nov-2007  matt sync with HEAD
 1.22.2.1 24-Mar-2008  keiichi sync with head.
 1.23.2.2 04-Jun-2008  yamt sync with head
 1.23.2.1 18-May-2008  yamt sync with head.
 1.28.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.28.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.32.4.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #150):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree with
reference count 0 which lead to rb tree coruption when another thread picked
this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.34.2.1 13-May-2009  jym Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.
 1.37.4.2 22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.37.4.1 30-Oct-2012  yamt sync with head
 1.38.2.1 19-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.41.16.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.41.16.1 21-Apr-2020  martin Sync with HEAD
 1.46.6.1 02-Aug-2025  perseant Sync with HEAD
 1.5 26-Oct-2006  thorpej branches: 1.5.2;
Add prop_array_t support to prop_kern.
 1.4 22-Sep-2006  thorpej Alter the protocol impemented by prop_kern to allow for bi-directional
plist-based messages and to eliminate looping previously required to
receive a plist from the kernel:

- prop_dictionary_copyin_ioctl() and prop_dictionary_copyout_ioctl()
now take the cmd argument rather than the file open flag. The
read-ness or write-ness of an ioctl command is checked by these
routines to ensure that information is being passed to/from the
userland component properly.

- prop_dictionary_copyout_ioctl() now allocates the memory for the
XML plist on behalf of the userland component by way of uvm_mmap().
The XML plist is copied out to the newly-mapped anonymous region,
and the pointer returned via the plistref.

- prop_dictionary_recv_ioctl() is responsible for munmap()'ing the
region after parsing the XML plist into internal represenatation.

- A new prop_dictionary_sendrecv_ioctl() is added, allowing user space
code to send a dictionary to the kernel and receive one back as a
reply.


Update users of prop_kern for the API changes (Bluetooth).

This constitutes an ABI / protocol change -- but this will also be put
into NetBSD 4.0 so that the first proplib release will implement the new
scheme.
 1.3 09-Jul-2006  wiz Make HTML-safe.
 1.2 09-Jul-2006  wiz Drop trailing whitespace.
 1.1 05-Jul-2006  thorpej Add kernel and user space parts of a protocol for sending property lists
to / from the kernel using ioctls.
 1.5.2.2 26-Oct-2006  thorpej Add prop_array_t support to prop_kern.
 1.5.2.1 26-Oct-2006  thorpej file prop_dictionary_copyin_ioctl.9 was added on branch newlock2 on 2006-10-26 18:51:22 +0000
 1.5 26-Oct-2006  thorpej branches: 1.5.2;
Add prop_array_t support to prop_kern.
 1.4 22-Sep-2006  thorpej Alter the protocol impemented by prop_kern to allow for bi-directional
plist-based messages and to eliminate looping previously required to
receive a plist from the kernel:

- prop_dictionary_copyin_ioctl() and prop_dictionary_copyout_ioctl()
now take the cmd argument rather than the file open flag. The
read-ness or write-ness of an ioctl command is checked by these
routines to ensure that information is being passed to/from the
userland component properly.

- prop_dictionary_copyout_ioctl() now allocates the memory for the
XML plist on behalf of the userland component by way of uvm_mmap().
The XML plist is copied out to the newly-mapped anonymous region,
and the pointer returned via the plistref.

- prop_dictionary_recv_ioctl() is responsible for munmap()'ing the
region after parsing the XML plist into internal represenatation.

- A new prop_dictionary_sendrecv_ioctl() is added, allowing user space
code to send a dictionary to the kernel and receive one back as a
reply.


Update users of prop_kern for the API changes (Bluetooth).

This constitutes an ABI / protocol change -- but this will also be put
into NetBSD 4.0 so that the first proplib release will implement the new
scheme.
 1.3 09-Jul-2006  wiz Sort SEE ALSO, make HTML-safe.
 1.2 09-Jul-2006  wiz Drop trailing whitespace.
 1.1 05-Jul-2006  thorpej Add kernel and user space parts of a protocol for sending property lists
to / from the kernel using ioctls.
 1.5.2.2 26-Oct-2006  thorpej Add prop_array_t support to prop_kern.
 1.5.2.1 26-Oct-2006  thorpej file prop_dictionary_send_ioctl.3 was added on branch newlock2 on 2006-10-26 18:51:22 +0000
 1.10 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.9 12-Feb-2017  abhinav branches: 1.9.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.8 17-Oct-2011  wiz branches: 1.8.26; 1.8.30;
Add missing Nd.
 1.7 07-Aug-2011  jmcneill prop_dictionary_get_dict: last argument is prop_dictionary_t *, not bool *
 1.6 27-Mar-2011  wiz Fix a typo and a punctuation nit.
 1.5 24-Mar-2011  bouyer Add a new libquota library, which contains some blocks to build and/or
parse quota plists; as well as a getfsquota() function to retrieve quotas
for a single id from a single filesystem (whatever filesystem this is:
a local quota-enabled fs or NFS). This is build on functions getufsquota()
(for local filesystems with UFS-like quotas) and getnfsquota();
which are also available to userland programs.
move functions from quota2_subr.c to libquota or libprop as appropriate,
and ajust in-tree quota tools.
move some declarations from kernel headers to either sys/quota.h or
quota/quota.h as appropriate. ufs/ufs/quota.h still installed because
it's needed by other installed ufs headers.
ufs/ufs/quota1.h still installed as a quick&dirty way to get a code
using the old quotactl() to compile (just include ufs/ufs/quota1.h instead of
ufs/ufs/quota.h - old code won't compile without this change and this is
on purpose).
Discussed on tech-kern@ and tech-net@ (long thread, but not much about
libquota itself ...)
 1.4 02-Jun-2008  haad Fix typo.

OK by martin@.
 1.3 30-Apr-2008  martin branches: 1.3.2;
Convert TNF licenses to new 2 clause variant
 1.2 16-Aug-2007  thorpej branches: 1.2.8;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.1 26-Oct-2006  thorpej branches: 1.1.2; 1.1.4; 1.1.16;
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.1.16.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.1.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.1.2.2 26-Oct-2006  thorpej - Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.1.2.1 26-Oct-2006  thorpej file prop_dictionary_util.3 was added on branch newlock2 on 2006-10-26 05:02:13 +0000
 1.2.8.2 04-Jun-2008  yamt sync with head
 1.2.8.1 18-May-2008  yamt sync with head.
 1.3.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.8.30.1 21-Apr-2017  bouyer Sync with HEAD
 1.8.26.1 20-Mar-2017  pgoyette Sync with HEAD
 1.9.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.9.12.1 21-Apr-2020  martin Sync with HEAD
 1.10 26-Apr-2025  thorpej Hide the private symbols.
 1.9 03-Aug-2022  riastradh branches: 1.9.8;
proplib: Nix trailing whitespace.
 1.8 15-Jun-2020  christos remove error(1) comments
 1.7 14-Jun-2020  christos add/fix linted comments
 1.6 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.5 27-Jul-2012  pooka branches: 1.5.34;
Bit-un-rot the proplib portability layer.
 1.4 24-Mar-2011  bouyer branches: 1.4.4;
Add a new libquota library, which contains some blocks to build and/or
parse quota plists; as well as a getfsquota() function to retrieve quotas
for a single id from a single filesystem (whatever filesystem this is:
a local quota-enabled fs or NFS). This is build on functions getufsquota()
(for local filesystems with UFS-like quotas) and getnfsquota();
which are also available to userland programs.
move functions from quota2_subr.c to libquota or libprop as appropriate,
and ajust in-tree quota tools.
move some declarations from kernel headers to either sys/quota.h or
quota/quota.h as appropriate. ufs/ufs/quota.h still installed because
it's needed by other installed ufs headers.
ufs/ufs/quota1.h still installed as a quick&dirty way to get a code
using the old quotactl() to compile (just include ufs/ufs/quota1.h instead of
ufs/ufs/quota.h - old code won't compile without this change and this is
on purpose).
Discussed on tech-kern@ and tech-net@ (long thread, but not much about
libquota itself ...)
 1.3 28-Apr-2008  martin Remove clause 3 and 4 from TNF licenses
 1.2 16-Aug-2007  thorpej branches: 1.2.8;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.1 26-Oct-2006  thorpej branches: 1.1.2; 1.1.4; 1.1.12;
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.1.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.1.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.1.2.2 26-Oct-2006  thorpej - Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's
keys and returns them in an array. This effectively allows a caller
to mutate a dictionary while iterating over it (really, you iterate
over the array of keys instead of the dictionary itself).
- Add a slew of utility functions that make it more convenient (in some
circumstances, anyway) to get/set values in a dictionary.
 1.1.2.1 26-Oct-2006  thorpej file prop_dictionary_util.c was added on branch newlock2 on 2006-10-26 05:02:13 +0000
 1.2.8.1 18-May-2008  yamt sync with head.
 1.4.4.1 30-Oct-2012  yamt sync with head
 1.5.34.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.5.34.1 21-Apr-2020  martin Sync with HEAD
 1.9.8.1 02-Aug-2025  perseant Sync with HEAD
 1.2 14-May-2025  thorpej branches: 1.2.4;
Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.1 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.2.4.2 02-Aug-2025  perseant Sync with HEAD
 1.2.4.1 14-May-2025  perseant file prop_extern.c was added on branch perseant-exfatfs on 2025-08-02 05:18:35 +0000
 1.8 12-Feb-2017  abhinav branches: 1.8.12;
Add entry for prop_ingest in the NAME section.
 1.7 12-Feb-2017  abhinav Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.6 18-Feb-2010  wiz branches: 1.6.30; 1.6.34;
Fix typo (specifed -> specified).
 1.5 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.4 21-Jan-2008  christos branches: 1.4.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.3 16-Aug-2007  thorpej branches: 1.3.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.2 23-Aug-2006  wiz branches: 1.2.2; 1.2.6; 1.2.18;
Remove duplicate word. Markup fixes.
 1.1 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.2.18.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.2.6.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.2.2.2 27-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #59):
common/lib/libprop/prop_ingest.3: revision 1.2
Remove duplicate word. Markup fixes.
 1.2.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3.2.1 23-Mar-2008  matt sync with HEAD
 1.4.4.1 18-May-2008  yamt sync with head.
 1.6.34.1 21-Apr-2017  bouyer Sync with HEAD
 1.6.30.1 20-Mar-2017  pgoyette Sync with HEAD
 1.8.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.8.12.1 21-Apr-2020  martin Sync with HEAD
 1.6 26-Apr-2025  thorpej Hide the private symbols.
 1.5 05-Sep-2014  matt branches: 1.5.16; 1.5.36;
Eliminate use of C++ keywords and don't nest struct definitions.
 1.4 27-Jul-2012  pooka Bit-un-rot the proplib portability layer.
 1.3 28-Apr-2008  martin branches: 1.3.4;
Remove clause 3 and 4 from TNF licenses
 1.2 16-Aug-2007  thorpej branches: 1.2.8;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.1 21-Aug-2006  thorpej branches: 1.1.2; 1.1.6; 1.1.14;
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.1.14.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.1.6.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.1.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.2.8.1 18-May-2008  yamt sync with head.
 1.3.4.1 30-Oct-2012  yamt sync with head
 1.5.36.1 02-Aug-2025  perseant Sync with HEAD
 1.5.16.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.5.16.1 21-Apr-2020  martin Sync with HEAD
 1.2 14-May-2025  thorpej branches: 1.2.4;
Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.1 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.2.4.2 02-Aug-2025  perseant Sync with HEAD
 1.2.4.1 14-May-2025  perseant file prop_intern.c was added on branch perseant-exfatfs on 2025-08-02 05:18:35 +0000
 1.30 10-May-2025  thorpej Undo the last change (rev 1.29) and instead elide the entire contents
of this file if HAVE_NBTOOL_CONFIG_H is defined -- what happens in this
file is only the business of the target system and of no interest to
build tools, regardless of which OS those tools run upon.
 1.29 27-Apr-2025  kre Fix builds on NetBSD hosts.

Do not #include prop_object_impl.h in tools or _STANDALONE
builds, it (directly or indirectly) brings in far too much
that is inappropriate in those environments.

If its sole reason for being added was for the fallback
definition of _PROP_EXPORT then in those cases, simply
supply that here.

This is most probably not the most elegant of fixes, and a
better way of supplying that fallback definition than dumping
it in the middle of prop_object_impl.h should be found.

Someone else's problem - but DO test any alternative version
of this with a complete clean build on a NetBSD host before
committing. And note, that since prop_object_impl.h includes
nbtool_config.h, when appropriate, it MUST be included before
any other system include file (but that change alone is not
sufficient to fix things, so do it this way instead).

This should unbreak all (well, all the previously unbroken)
builds on NetBSD hosts.
 1.28 26-Apr-2025  thorpej Hide the private symbols.
 1.27 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.26 08-Sep-2024  rillig fix a/an grammar in obvious cases
 1.25 03-Aug-2022  riastradh branches: 1.25.8;
proplib: Nix trailing whitespace.
 1.24 14-Oct-2018  jdolecek remove M_CANFAIL flag for malloc(9) - it was completely ignored, so had
actually no effect
 1.23 29-Jan-2017  christos branches: 1.23.10; 1.23.12;
call the proper size functions
 1.22 29-Jan-2017  christos missing brace
 1.21 29-Jan-2017  christos add sized versions of the copyin ioctls
 1.20 15-Jan-2017  christos branches: 1.20.2;
bump to 128K (because of npf large rules) and return E2BIG.
 1.19 11-May-2015  christos branches: 1.19.2;
Limit size of xml buffer for userland requests (From Mateusz Kocielski)
XXX: pullup-7
 1.18 14-Dec-2014  chs add a new "fo_mmap" fileops method to allow use of arbitrary uvm_objects for
mappings of file objects. move vnode-specific details of mmap()ing a vnode
from uvm_mmap() to the new vnode-specific vn_mmap(). add new uvm_mmap_dev()
and uvm_mmap_anon() convenience functions for mapping character devices
and anonymous memory, and replace all other calls to uvm_mmap() with those.
use the new fileop in drm2 so that libdrm can use mmap() to map things
like on other platforms (instead of the ioctl that we have used so far).
 1.17 30-Sep-2011  jym branches: 1.17.22;
Fix an implementation inconsistency with the prop_*_send_syscall() and
prop_*_recv_syscall() functions from proplib(3). They now share the
same logic as the one from prop_*_send_ioctl() functions:
- returns an int
- 0 indicates "no error", otherwise returns the error number (and
set errno)

Many consumers of the prop_*_{ioctl, syscall} expect errno to be set
on error and use err() to display the error message. As such, ensures that
errno gets set before returning from these functions.

prop_*_send_syscall() functions returned a boolean, and now return an int.
Fix all call sites to use the new paradigm (only quota2 is affected in src).

As the prop_*_{send,recv}_syscall() API appeared in -current and is only
used by the recent quota2 code, I am not bumping the lib. The API change
only affects the prop_*_send_syscall() function (recv_syscall()s were
already used correctly), so ensure you are not mixing "old" -current
quota binaries with a new proplib(3) (or the other way around). This
change will be announced via a HEADS-UP and UPDATING.

Does not affect the kernel part of proplib.

Document the correct API in prop_array(3) and prop_dictionary(3).

Thanks to Francois Tigeot for noticing the API inconsistency and
reporting it on tech-kern@.

ok bouyer@.
 1.16 20-Jan-2011  bouyer prop_*_copyout takes an object as second parameter, not a pointer to object.
 1.15 19-Jan-2011  bouyer - Implement prop_{array,dictionary}_copyout(), based on
prop_{array,dictionary}_copyout_ioctl().
- Implement prop_{array,dictionary}_recv_syscall(), which
takes as parameter the pref we got from kernel and internalize it,
and unmaps the buffer prop_{array,dictionary}_copyout() mapped for us.
- add a prop_{array,dictionary}_send_syscall() for symetry, which is
an alias to prop_{array,dictionary}_externalize_to_pref()

Discussed on tech-kern@ and tech-userlevel@
 1.14 14-Dec-2010  pooka Use a consistent approach for rump kernel calls made by libs.
Should investigate a dynamic approach in the future.
 1.13 11-Oct-2009  bad Back out previous. Builds for me and on autobuild cluster.
 1.12 10-Oct-2009  christos make this compile again.
 1.11 10-Oct-2009  bad Implement prop_array_externalize_to_pref(), prop_array_copyin(),
prop_dictionary_externalize_to_pref() and prop_dictionary_copyin()
as discussed in the thread:
http://mail-index.netbsd.org/tech-kern/2009/07/29/msg005594.html

Bump libprop shlib minor.
 1.10 13-Sep-2009  pooka Wipe out the last vestiges of POOL_INIT with one swift stroke. In
most cases, use a proper constructor. For proplib, give a local
equivalent of POOL_INIT for the kernel object implementation. This
way the code structure can be preserved, and a local link set is
not hazardous anyway (unless proplib is split to several modules,
but that'll be the day).

tested by booting a kernel in qemu and compile-testing i386/ALL
 1.9 28-Apr-2008  martin Remove clause 3 and 4 from TNF licenses
 1.8 16-Aug-2007  joerg branches: 1.8.8;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.7 28-Nov-2006  cube branches: 1.7.2; 1.7.10;
Add a comment to explain how the value for uaddr is chosen. Maybe uvm_mmap
should do that instead of sys_mmap...
 1.6 28-Nov-2006  cube In _prop_object_copyout_ioctl, uaddr was not initialised, although it is
used by uvm_mmap() as a hint for the virtual address to map memory to. As
a consequence, it tended to fail a lot on some architectures.

We cannot use 0, so instead use the value that would have been used if we
were calling mmap(2) with 0 as the first argument.

Fixes PR#34639 by xtraeme@.
 1.5 26-Oct-2006  thorpej branches: 1.5.2;
Add prop_array_t support to prop_kern.
 1.4 22-Sep-2006  dogcow unbreak kernel builds from the last fix
 1.3 22-Sep-2006  dbj protect include of sys/mman.h when building _KERNEL or _STANDALONE
 1.2 22-Sep-2006  thorpej Alter the protocol impemented by prop_kern to allow for bi-directional
plist-based messages and to eliminate looping previously required to
receive a plist from the kernel:

- prop_dictionary_copyin_ioctl() and prop_dictionary_copyout_ioctl()
now take the cmd argument rather than the file open flag. The
read-ness or write-ness of an ioctl command is checked by these
routines to ensure that information is being passed to/from the
userland component properly.

- prop_dictionary_copyout_ioctl() now allocates the memory for the
XML plist on behalf of the userland component by way of uvm_mmap().
The XML plist is copied out to the newly-mapped anonymous region,
and the pointer returned via the plistref.

- prop_dictionary_recv_ioctl() is responsible for munmap()'ing the
region after parsing the XML plist into internal represenatation.

- A new prop_dictionary_sendrecv_ioctl() is added, allowing user space
code to send a dictionary to the kernel and receive one back as a
reply.


Update users of prop_kern for the API changes (Bluetooth).

This constitutes an ABI / protocol change -- but this will also be put
into NetBSD 4.0 so that the first proplib release will implement the new
scheme.
 1.1 05-Jul-2006  thorpej Add kernel and user space parts of a protocol for sending property lists
to / from the kernel using ioctls.
 1.5.2.2 26-Oct-2006  thorpej Add prop_array_t support to prop_kern.
 1.5.2.1 26-Oct-2006  thorpej file prop_kern.c was added on branch newlock2 on 2006-10-26 18:51:22 +0000
 1.7.10.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.7.2.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.8.8.1 18-May-2008  yamt sync with head.
 1.17.22.3 30-Oct-2018  martin Pull up following revision(s) (requested by sborrill in ticket #1645):

common/include/prop/prop_dictionary.h: revision 1.16
common/include/prop/prop_array.h: revision 1.15
common/lib/libprop/prop_kern.c: revision 1.21
common/lib/libprop/prop_copyin_ioctl.9: revision 1.12
common/include/prop/prop_array.h: revision 1.16
common/lib/libprop/prop_kern.c: revision 1.22 (patch)
common/lib/libprop/prop_kern.c: revision 1.23 (patch)

add sized versions of the copyin ioctls.

-

add sized versions of the copyin ioctls

-

Update for the new *_size() functions recently added. Mention the
implicit size limit (128KB) for the functions which do not take an
explicit limit argument.

-

fix args

-

missing brace

-

call the proper size functions
 1.17.22.2 16-May-2015  snj Pull up following revision(s) (requested by christos in ticket #782):
common/lib/libprop/prop_kern.c: revision 1.19
common/lib/libprop/prop_object.c: revision 1.30
common/lib/libprop/prop_object_impl.h: revision 1.32
Limit size of xml buffer for userland requests (From Mateusz Kocielski)
--
Don't treat NUL (EOF) as SPACE. All the code that uses _PROP_ISSPACE() checks
explicitly for _PROP_EOF() anyway, and this can be abused to cause run beyond
the end of buffer DoS (Mateusz Kocielski)
--
Now that _PROP_ISSPACE does not include the EOF check, put the check for
EOF inside the loop. Also fix another unbounded loop that did not check for
EOF. From Mateusz Kocielski
 1.17.22.1 31-Dec-2014  snj Pull up following revision(s) (requested by chs in ticket #363):
common/lib/libprop/prop_kern.c: revision 1.18
sys/arch/mac68k/dev/grf_compat.c: revision 1.27
sys/arch/x68k/dev/grf.c: revision 1.45
sys/external/bsd/drm/dist/bsd-core/drm_bufs.c: revision 1.12
sys/external/bsd/drm2/drm/drm_drv.c: revision 1.12
sys/external/bsd/drm2/drm/drm_vm.c: revision 1.6
sys/external/bsd/drm2/include/linux/mm.h: revision 1.4
sys/kern/vfs_vnops.c: revision 1.192 via patch
sys/rump/librump/rumpkern/vm.c: revision 1.160
sys/sys/file.h: revision 1.78 via patch
sys/uvm/uvm_device.c: revision 1.64
sys/uvm/uvm_device.h: revision 1.13
sys/uvm/uvm_extern.h: revision 1.192
sys/uvm/uvm_mmap.c: revision 1.150 via patch
add a new "fo_mmap" fileops method to allow use of arbitrary uvm_objects for
mappings of file objects. move vnode-specific details of mmap()ing a vnode
from uvm_mmap() to the new vnode-specific vn_mmap(). add new uvm_mmap_dev()
and uvm_mmap_anon() convenience functions for mapping character devices
and anonymous memory, and replace all other calls to uvm_mmap() with those.
use the new fileop in drm2 so that libdrm can use mmap() to map things
like on other platforms (instead of the ioctl that we have used so far).
 1.19.2.1 20-Mar-2017  pgoyette Sync with HEAD
 1.20.2.1 21-Apr-2017  bouyer Sync with HEAD
 1.23.12.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.23.12.2 21-Apr-2020  martin Sync with HEAD
 1.23.12.1 10-Jun-2019  christos Sync with HEAD
 1.23.10.1 20-Oct-2018  pgoyette Sync with head
 1.25.8.1 02-Aug-2025  perseant Sync with HEAD
 1.12 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.11 12-Feb-2017  abhinav branches: 1.11.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.10 20-Jan-2011  wiz branches: 1.10.30; 1.10.34;
New sentence, new line. Use Dq.
 1.9 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.8 21-Jan-2008  christos branches: 1.8.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.7 16-Aug-2007  thorpej branches: 1.7.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.6 02-Feb-2007  mjf Fix typo.
 1.5 14-Oct-2006  wiz branches: 1.5.2; 1.5.4; 1.5.8;
Put macro argument right after macro, not in next line.
 1.4 12-Oct-2006  thorpej Make prop_number_t handle both signed and unsigned numbers. The *integer*
routines now take int64_t arguments, and new *unsigned_integer* routines
take uint64_t arguments. See prop_number(3) for complete details.
 1.3 09-Jul-2006  wiz Drop trailing whitespace.
 1.2 07-Jul-2006  thorpej Change prop_number_t to store a uint64_t, rather than a uintmax_t. No
ABI change, and we ought to explicitly state that this is a fixed-width
type, since that what it needs to be for binary plist support.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.5.8.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.2.2 14-Oct-2006  wiz Put macro argument right after macro, not in next line.
 1.5.2.1 14-Oct-2006  wiz file prop_number.3 was added on branch newlock2 on 2006-10-14 07:30:17 +0000
 1.7.2.1 23-Mar-2008  matt sync with HEAD
 1.8.4.1 18-May-2008  yamt sync with head.
 1.10.34.1 21-Apr-2017  bouyer Sync with HEAD
 1.10.30.1 20-Mar-2017  pgoyette Sync with HEAD
 1.11.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.11.12.1 21-Apr-2020  martin Sync with HEAD
 1.39 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.38 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.37 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.36 26-Apr-2025  thorpej Hide the private symbols.
 1.35 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.34 03-Aug-2022  riastradh branches: 1.34.8;
proplib: Nix trailing whitespace.
 1.33 06-Jun-2020  thorpej Correct a deprecation warning.
 1.32 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.31 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.30 28-Jun-2016  pgoyette branches: 1.30.16;
Fix the previous fix - there's only one _node suffix here!
 1.29 28-Jun-2016  pgoyette Missed a couple of function-call renames in previous
 1.28 28-Jun-2016  pgoyette The local copy of rb_tree code has been unused for quite some time. So
we can just remove it, and adjust callers to use the "real" rbtree
function names.

Addresses PR lib/44090
 1.27 05-Sep-2014  matt Eliminate use of C++ keywords and don't nest struct definitions.
 1.26 26-Mar-2014  christos kill sprintf
 1.25 18-Oct-2013  martin Make this compilable with gcc 4.8.1 without options DIAGNOSTIC.
 1.24 27-Jul-2012  pooka branches: 1.24.2;
Bit-un-rot the proplib portability layer.
 1.23 24-Sep-2010  rmind branches: 1.23.6;
Fixes/improvements to RB-tree implementation:
1. Fix inverted node order, so that negative value from comparison operator
would represent lower (left) node, and positive - higher (right) node.
2. Add an argument (i.e. "context"), passed to comparison operators.
3. Change rb_tree_insert_node() to return a node - either inserted one or
already existing one.
4. Amend the interface to manipulate the actual object, instead of the
rb_node (in a similar way as Patricia-tree interface does).
5. Update all RB-tree users accordingly.

XXX: Perhaps rename rb.h to rbtree.h, since cleaning-up..

1-3 address the PR/43488 by Jeremy Huddleston.

Passes RB-tree regression tests.
Reviewed by: matt@, christos@
 1.22 15-Mar-2009  cegger ansify function definitions
 1.21 03-Jan-2009  pooka branches: 1.21.2;
Get rid of locks with static initializers using once and atomic ops.
This makes proplib simplelock-free.
 1.20 30-Nov-2008  haad Fix two race conditions in proplib library. In prop_dictionary and prop_number
there was small window in which was entry left in rb tree with reference
count 0 which lead to rb tree coruption when another thread picked this up
before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.

Ok by joerg@, core@, thorpej@
 1.19 03-Aug-2008  thorpej branches: 1.19.4;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.18 17-Jun-2008  thorpej _prop_rb_tree_insert_node() now returns true/false to indicate if the
insertion succeeded. Update existing usage that arranges for insertions
to always succeed to assert that they do.
 1.17 28-Apr-2008  martin branches: 1.17.2;
Remove clause 3 and 4 from TNF licenses
 1.16 05-Jan-2008  ad branches: 1.16.4;
Include sys/simplelock.h in prop_object_impl.h.
 1.15 04-Jan-2008  xtraeme sys/simplelock.h is required now.
 1.14 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.13 16-Aug-2007  joerg branches: 1.13.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.12 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.11 15-Oct-2006  christos branches: 1.11.2; 1.11.4; 1.11.12;
delete junk I accidentally committed.
 1.10 15-Oct-2006  christos de-lint.
 1.9 12-Oct-2006  thorpej Appease our stupid lint.
 1.8 12-Oct-2006  thorpej Make prop_number_t handle both signed and unsigned numbers. The *integer*
routines now take int64_t arguments, and new *unsigned_integer* routines
take uint64_t arguments. See prop_number(3) for complete details.
 1.7 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.6 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.5 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 07-Jul-2006  thorpej branches: 1.3.2;
Change prop_number_t to store a uint64_t, rather than a uintmax_t. No
ABI change, and we ought to explicitly state that this is a fixed-width
type, since that what it needs to be for binary plist support.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.11.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.11.4.2 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.11.4.1 27-Sep-2007  xtraeme branches: 1.11.4.1.2;
Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.11.4.1.2.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.11.2.2 15-Oct-2006  christos delete junk I accidentally committed.
 1.11.2.1 15-Oct-2006  christos file prop_number.c was added on branch newlock2 on 2006-10-15 19:11:59 +0000
 1.13.2.1 06-Nov-2007  matt sync with HEAD
 1.16.4.1 18-May-2008  yamt sync with head.
 1.17.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.17.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.19.4.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #150):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree with
reference count 0 which lead to rb tree coruption when another thread picked
this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.21.2.1 13-May-2009  jym Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.
 1.23.6.2 22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.23.6.1 30-Oct-2012  yamt sync with head
 1.24.2.1 19-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.30.16.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.30.16.2 21-Apr-2020  martin Sync with HEAD
 1.30.16.1 10-Jun-2019  christos Sync with HEAD
 1.34.8.1 02-Aug-2025  perseant Sync with HEAD
 1.11 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.10 06-Jun-2020  thorpej branches: 1.10.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.9 12-Feb-2017  abhinav branches: 1.9.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.8 20-Jan-2011  wiz branches: 1.8.30; 1.8.34;
New sentence, new line. Use Dq.
 1.7 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.6 16-Aug-2007  thorpej branches: 1.6.8;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.5 23-Aug-2006  wiz branches: 1.5.4; 1.5.16;
Bump date for previous.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 09-Jul-2006  wiz branches: 1.3.2;
Drop trailing whitespace.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.2 27-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #58):
common/lib/libprop/prop_object.3: revision 1.5
Bump date for previous.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.5.16.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.5.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.6.8.1 18-May-2008  yamt sync with head.
 1.8.34.1 21-Apr-2017  bouyer Sync with HEAD
 1.8.30.1 20-Mar-2017  pgoyette Sync with HEAD
 1.9.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.9.12.1 21-Apr-2020  martin Sync with HEAD
 1.10.12.1 02-Aug-2025  perseant Sync with HEAD
 1.42 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.41 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.40 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.39 26-Apr-2025  thorpej Hide the private symbols.
 1.38 24-Apr-2025  christos pass lint
 1.37 24-Apr-2025  christos typo police.
 1.36 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.35 07-Aug-2022  riastradh branches: 1.35.8;
proplib: Allocate sizeof(*ctx), not sizeof(struct ...).

No functional change intended.
 1.34 04-Aug-2022  riastradh proplib: Fix mistake in previous -- use strncmp for prefix matching.
 1.33 03-Aug-2022  riastradh proplib: Don't run off end of buffer with memcmp.

The input is required to be NUL-terminated anyway, so just use strcmp
here.

Reported-by: syzbot+69838802c8ec55909ba3@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=927d66e8aa079ba2be43497425a6d9878025ad09
 1.32 03-Aug-2022  riastradh proplib: Nix trailing whitespace.
 1.31 08-May-2019  thorpej Use posix_madvise() rather than the legacy madvise() call, and
wrapp the calls in #ifdef for the advice we're giving. Should
address reports of host tool build issues.
 1.30 12-May-2015  christos branches: 1.30.16;
Now that _PROP_ISSPACE does not include the EOF check, put the check for
EOF inside the loop. Also fix another unbounded loop that did not check for
EOF. From Mateusz Kocielski
XXX: pullup-7
 1.29 18-Oct-2013  martin branches: 1.29.4;
Make this compilable with gcc 4.8.1 without options DIAGNOSTIC.
 1.28 27-Jul-2012  pooka branches: 1.28.2;
Bit-un-rot the proplib portability layer.
 1.27 20-Apr-2011  martin branches: 1.27.4;
Update also the non-void pointers to the current test objects.
Finaly fixes PR lib/43964.
 1.26 30-Mar-2009  haad Fix crash where user was able to crash proplib with trying to internalize
bad xml file with non-existing data type e.g. <number>.

Problem is that poi is not NULL even in case that we haven't find any match
in data type name. We need to check if poi->poi_tag is not NULL before
calling poi->poi_intern function which is non existing case NULL and will
cause crash.
 1.25 25-Jan-2009  lukem branches: 1.25.2;
sign-compare fix
 1.24 03-Jan-2009  pooka Get rid of locks with static initializers using once and atomic ops.
This makes proplib simplelock-free.
 1.23 30-Nov-2008  haad Fix two race conditions in proplib library. In prop_dictionary and prop_number
there was small window in which was entry left in rb tree with reference
count 0 which lead to rb tree coruption when another thread picked this up
before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.

Ok by joerg@, core@, thorpej@
 1.22 03-Aug-2008  thorpej branches: 1.22.4;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.21 28-Apr-2008  martin branches: 1.21.2;
Remove clause 3 and 4 from TNF licenses
 1.20 23-Feb-2008  lukem branches: 1.20.2;
Use mkstemp() + fchmod() instead of mktemp(), since the latter
results in linker warnings.
 1.19 05-Jan-2008  ad branches: 1.19.2;
Include sys/simplelock.h in prop_object_impl.h.
 1.18 04-Jan-2008  xtraeme sys/simplelock.h is required now.
 1.17 30-Aug-2007  xtraeme tyop: guaranty -> guarantee.
 1.16 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.15 16-Aug-2007  joerg branches: 1.15.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.14 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.13 16-Jul-2007  joerg prop_array_internalize and prop_dictionary_internalize are basically the
same code. Refactor it into _prop_generic_internalize, which gets passed
the second-level tag.
 1.12 19-Oct-2006  he branches: 1.12.2; 1.12.4; 1.12.12;
sysconf() returns long, which isn't neccessarily assignment-compatible
with size_t, as evidenced by sh5, so add an explicit cast.
 1.11 18-Oct-2006  martin Backout size_t casts - lint has been fixed.
 1.10 18-Oct-2006  martin Sprinkle a few size_t casts to avoid conversion warnings.
 1.9 16-Oct-2006  thorpej Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.8 15-Oct-2006  christos de-lint.
 1.7 12-Oct-2006  thorpej _prop_object_fini(): Consume all of the arguments.
 1.6 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.5 27-Aug-2006  christos complete initialization.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 18-May-2006  thorpej branches: 1.3.2;
Move all of the locking compatibility definitions into prop_object_impl.h.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.12.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.12.4.3 31-Mar-2009  bouyer Apply patch (requested by haad in ticket #1296):
common/lib/libprop/prop_object.c: patch
Fix crash where user was able to crash proplib with trying to
internalize bad xml file with non-existing data type e.g. <number>.
 1.12.4.2 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.12.4.1 27-Sep-2007  xtraeme branches: 1.12.4.1.2;
Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.12.4.1.2.2 31-Mar-2009  bouyer Apply patch (requested by haad in ticket #1296):
common/lib/libprop/prop_object.c: patch
Fix crash where user was able to crash proplib with trying to
internalize bad xml file with non-existing data type e.g. <number>.
 1.12.4.1.2.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.12.2.2 19-Oct-2006  he sysconf() returns long, which isn't neccessarily assignment-compatible
with size_t, as evidenced by sh5, so add an explicit cast.
 1.12.2.1 19-Oct-2006  he file prop_object.c was added on branch newlock2 on 2006-10-19 10:10:36 +0000
 1.15.2.2 23-Mar-2008  matt sync with HEAD
 1.15.2.1 06-Nov-2007  matt sync with HEAD
 1.19.2.1 24-Mar-2008  keiichi sync with head.
 1.20.2.1 18-May-2008  yamt sync with head.
 1.21.2.1 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.22.4.2 30-Mar-2009  snj Pull up following revision(s) (requested by haad in ticket #623):
common/lib/libprop/prop_object.c: revision 1.26
Fix crash where user was able to crash proplib with trying to internalize
bad xml file with non-existing data type e.g. <number>.
Problem is that poi is not NULL even in case that we haven't find any match
in data type name. We need to check if poi->poi_tag is not NULL before
calling poi->poi_intern function which is non existing case NULL and will
cause crash.
 1.22.4.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #150):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree with
reference count 0 which lead to rb tree coruption when another thread picked
this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.25.2.1 13-May-2009  jym Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.
 1.27.4.2 22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.27.4.1 30-Oct-2012  yamt sync with head
 1.28.2.1 19-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.29.4.1 16-May-2015  snj Pull up following revision(s) (requested by christos in ticket #782):
common/lib/libprop/prop_kern.c: revision 1.19
common/lib/libprop/prop_object.c: revision 1.30
common/lib/libprop/prop_object_impl.h: revision 1.32
Limit size of xml buffer for userland requests (From Mateusz Kocielski)
--
Don't treat NUL (EOF) as SPACE. All the code that uses _PROP_ISSPACE() checks
explicitly for _PROP_EOF() anyway, and this can be abused to cause run beyond
the end of buffer DoS (Mateusz Kocielski)
--
Now that _PROP_ISSPACE does not include the EOF check, put the check for
EOF inside the loop. Also fix another unbounded loop that did not check for
EOF. From Mateusz Kocielski
 1.30.16.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.30.16.2 21-Apr-2020  martin Sync with HEAD
 1.30.16.1 10-Jun-2019  christos Sync with HEAD
 1.35.8.1 02-Aug-2025  perseant Sync with HEAD
 1.41 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.40 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.39 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.38 26-Apr-2025  thorpej Hide the private symbols.
 1.37 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.36 12-Jun-2020  thorpej branches: 1.36.12;
Change previous to only apply when building with clang.
 1.35 11-Jun-2020  joerg Unbreak clang builds by removing questionable linker warning sections
trggered all over the place.
 1.34 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.33 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.32 11-May-2015  christos branches: 1.32.16;
Don't treat NUL (EOF) as SPACE. All the code that uses _PROP_ISSPACE() checks
explicitly for _PROP_EOF() anyway, and this can be abused to cause run beyond
the end of buffer DoS (Mateusz Kocielski)
XXX: pullup-7
 1.31 27-Jul-2012  pooka branches: 1.31.12;
Bit-un-rot the proplib portability layer.
 1.30 13-Sep-2009  pooka branches: 1.30.6;
Wipe out the last vestiges of POOL_INIT with one swift stroke. In
most cases, use a proper constructor. For proplib, give a local
equivalent of POOL_INIT for the kernel object implementation. This
way the code structure can be preserved, and a local link set is
not hazardous anyway (unless proplib is split to several modules,
but that'll be the day).

tested by booting a kernel in qemu and compile-testing i386/ALL
 1.29 03-Jan-2009  pooka Get rid of locks with static initializers using once and atomic ops.
This makes proplib simplelock-free.
 1.28 30-Nov-2008  haad Fix two race conditions in proplib library. In prop_dictionary and prop_number
there was small window in which was entry left in rb tree with reference
count 0 which lead to rb tree coruption when another thread picked this up
before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.

Ok by joerg@, core@, thorpej@
 1.27 03-Aug-2008  thorpej branches: 1.27.4;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.26 24-May-2008  yamt revert the recent "use trylock to hide locking errors" changes
and their associated changes, in particular, the following versions.
prop_array.c 1.13-1.16
prop_dictionary.c 1.25-1.28
prop_object_impl.h 1.21-1.25
ok'ed by core@.
 1.25 07-May-2008  tron branches: 1.25.2;
Change the argument of _PROP_RWLOCK_TRYRDLOCK() to the lock member and not
its address to be consistent with all the other macros.
 1.24 07-May-2008  tron Replace _prop_rwlock_tryrdlock() by a macro _PROP_RWLOCK_TRYRDLOCK().
This avoids build failures in stand alone binaries (e.g. bootloaders)
where there is no "pa_rwlock" member in the "_prop_array" structure.
 1.23 07-May-2008  simonb Fix a "#define<tab><tab>" that crept in to previous.
 1.22 06-May-2008  xtraeme prop_object_iterator_next() and prop_object_iterator_reset() were
acquiring the rwlock recursively in some paths.

Introduce _prop_rwlock_tryrdlock() and use it in these functions, so
that the rwlock is *always* acquired once, while here add some
_PROP_RWLOCK_OWNED asserts to verify.

This definitely fixes the "locking against myself" panics.
 1.21 06-May-2008  xtraeme Do not acquire the rwlock recursively in prop_{array,dictionary}_iterator_reset()
when prop_{array,dictionary}_copyout_ioctl() is called.

Introduce _PROP_RWLOCK_OWNED() which is a KASSERT(rw_lock_held(lock))
and use it in those two functions, also acquire the rwlock in other
places where it is required now.

This fixes a LOCKDEBUG panic "locking against myself", as reported by
Geoff C. Wing in current-users@.
 1.20 28-Apr-2008  martin Remove clause 3 and 4 from TNF licenses
 1.19 05-Jan-2008  ad branches: 1.19.4;
Include sys/simplelock.h in prop_object_impl.h.
 1.18 30-Aug-2007  joerg Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.17 16-Aug-2007  joerg branches: 1.17.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.16 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.15 29-Jul-2007  ad branches: 1.15.4;
lockmgr > rwlock
 1.14 17-Jul-2007  joerg Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.
 1.13 16-Jul-2007  joerg prop_array_internalize and prop_dictionary_internalize are basically the
same code. Refactor it into _prop_generic_internalize, which gets passed
the second-level tag.
 1.12 12-Mar-2007  ad Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.
 1.11 18-Oct-2006  martin branches: 1.11.2; 1.11.4; 1.11.8;
Backout size_t casts - lint has been fixed.
 1.10 18-Oct-2006  martin Sprinkle a few size_t casts to avoid conversion warnings.
 1.9 16-Oct-2006  thorpej Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.8 15-Oct-2006  christos de-lint.
 1.7 04-Oct-2006  dbj fix build issue for !_KERNEL
fixes pr lib/34708, credit Henning Petersen via t-online.de
 1.6 03-Oct-2006  thorpej - Add a reader-writer lock to array and dictionary objects that ensures that
the data structure is internally consistent in the face of multiple threads
accessing it concurrently. This is not designed to provide application-
level semantic consistency; applications are responsible for that locking
protocol should it be necessary.
- Rename _PROP_MUTEX_DECL() to _PROP_MUTEX_DECL_STATIC().
 1.5 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.4 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.3 18-May-2006  thorpej branches: 1.3.2;
Move all of the locking compatibility definitions into prop_object_impl.h.
 1.2 18-May-2006  thorpej - Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.11.8.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.11.4.2 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.11.4.1 27-Sep-2007  xtraeme branches: 1.11.4.1.2;
Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.11.4.1.2.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #1243):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23 via patch
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree
with reference count 0 which lead to rb tree coruption when another
thread picked this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.11.2.2 18-Oct-2006  martin Backout size_t casts - lint has been fixed.
 1.11.2.1 18-Oct-2006  martin file prop_object_impl.h was added on branch newlock2 on 2006-10-18 19:15:47 +0000
 1.15.4.2 29-Jul-2007  ad lockmgr > rwlock
 1.15.4.1 29-Jul-2007  ad file prop_object_impl.h was added on branch matt-mips64 on 2007-07-29 11:25:02 +0000
 1.17.2.2 09-Jan-2008  matt sync with HEAD
 1.17.2.1 06-Nov-2007  matt sync with HEAD
 1.19.4.2 04-Jun-2008  yamt sync with head
 1.19.4.1 18-May-2008  yamt sync with head.
 1.25.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.25.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.27.4.1 30-Nov-2008  snj Pull up following revision(s) (requested by haad in ticket #150):
common/lib/libprop/prop_dictionary.c: revision 1.33
common/lib/libprop/prop_number.c: revision 1.20
common/lib/libprop/prop_object.c: revision 1.23
common/lib/libprop/prop_object_impl.h: revision 1.28
Fix two race conditions in proplib library. In prop_dictionary and
prop_number there was small window in which was entry left in rb tree with
reference count 0 which lead to rb tree coruption when another thread picked
this up before it was released.
Add 2 new members to the prop_object_t which are used for locking/unlocking
rb tree guard mutex.
Ok by joerg@, core@, thorpej@
 1.30.6.1 30-Oct-2012  yamt sync with head
 1.31.12.1 16-May-2015  snj Pull up following revision(s) (requested by christos in ticket #782):
common/lib/libprop/prop_kern.c: revision 1.19
common/lib/libprop/prop_object.c: revision 1.30
common/lib/libprop/prop_object_impl.h: revision 1.32
Limit size of xml buffer for userland requests (From Mateusz Kocielski)
--
Don't treat NUL (EOF) as SPACE. All the code that uses _PROP_ISSPACE() checks
explicitly for _PROP_EOF() anyway, and this can be abused to cause run beyond
the end of buffer DoS (Mateusz Kocielski)
--
Now that _PROP_ISSPACE does not include the EOF check, put the check for
EOF inside the loop. Also fix another unbounded loop that did not check for
EOF. From Mateusz Kocielski
 1.32.16.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.32.16.2 21-Apr-2020  martin Sync with HEAD
 1.32.16.1 10-Jun-2019  christos Sync with HEAD
 1.36.12.1 02-Aug-2025  perseant Sync with HEAD
 1.11 28-Jun-2016  pgoyette The local copy of rb_tree code has been unused for quite some time. So
we can just remove it, and adjust callers to use the "real" rbtree
function names.

Addresses PR lib/44090
 1.10 27-Jul-2012  pooka Bit-un-rot the proplib portability layer.
 1.9 17-Jun-2008  thorpej branches: 1.9.2;
_prop_rb_tree_insert_node() now returns true/false to indicate if the
insertion succeeded. Update existing usage that arranges for insertions
to always succeed to assert that they do.
 1.8 28-Apr-2008  martin branches: 1.8.2;
Remove clause 3 and 4 from TNF licenses
 1.7 16-Aug-2007  thorpej branches: 1.7.8;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.6 16-Oct-2006  thorpej branches: 1.6.2; 1.6.4; 1.6.12;
Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.5 15-Oct-2006  christos de-lint.
 1.4 15-Oct-2006  martin Make it compile with -Wextra on big endian machines (at lest the #if in the
definition of struct rb_ndoe on the endianess is the only explanation I have
why nobody complained about this on i386 - I don't understand why it makes a
difference for gcc though)
 1.3 12-Oct-2006  thorpej Make this compile with -Wunused and handle the case where __predict_false()
is not defined (non-NetBSD environments).
 1.2 09-Sep-2006  thorpej Take the node indices out of the same namespace that <sys/tree.h> uses.
 1.1 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.6.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.6.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.6.2.2 16-Oct-2006  thorpej Add a _PROP_ARG_UNUSED that expands to __unused on NetBSD and to nothing
everywhere else. Use it where Christos decided to use __unused in this
code.
 1.6.2.1 16-Oct-2006  thorpej file prop_rb.c was added on branch newlock2 on 2006-10-16 03:21:08 +0000
 1.7.8.1 18-May-2008  yamt sync with head.
 1.8.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.9.2.1 30-Oct-2012  yamt sync with head
 1.10 28-Jun-2016  pgoyette The local copy of rb_tree code has been unused for quite some time. So
we can just remove it, and adjust callers to use the "real" rbtree
function names.

Addresses PR lib/44090
 1.9 27-Jul-2012  pooka Bit-un-rot the proplib portability layer.
 1.8 25-Sep-2010  matt branches: 1.8.6;
Rename rb.h to rbtree.h, as it is more appropriate (c.f. ptree.h). Also
helps find code that hasn't been updated to use the new rbtree API.
 1.7 30-Jun-2008  matt Change tree op members/typedefs to rbto_compare_* from rb_compare_*
 1.6 17-Jun-2008  thorpej _prop_rb_tree_insert_node() now returns true/false to indicate if the
insertion succeeded. Update existing usage that arranges for insertions
to always succeed to assert that they do.
 1.5 28-Apr-2008  martin branches: 1.5.2;
Remove clause 3 and 4 from TNF licenses
 1.4 09-Sep-2006  thorpej branches: 1.4.24;
Take the node indices out of the same namespace that <sys/tree.h> uses.
 1.3 09-Sep-2006  thorpej Revert previous.
 1.2 09-Sep-2006  xtraeme Don't re-define RB_{LEFT,RIGHT,PARENT} before undef'ing them first.
 1.1 09-Sep-2006  thorpej Adapt Matt Thomas's red-black tree implementation for use in proplib. This
has a significant code size savings over <sys/tree.h>.

Also change prop_number_t to store all number objects in an r-b tree,
only ever allocating one object for any given number (we can do this
because numbers are immutable). This results in significant run-time
memory savings.
 1.4.24.1 18-May-2008  yamt sync with head.
 1.5.2.2 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.5.2.1 23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.8.6.1 30-Oct-2012  yamt sync with head
 1.11 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.10 12-Feb-2017  abhinav branches: 1.10.12; 1.10.32;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.9 20-Aug-2015  phx branches: 1.9.2; 1.9.4;
Fixed typo: propertly -> property.
 1.8 27-Sep-2011  jym Indicate type of return variable for prop_dictionary_sendrecv_ioctl.
 1.7 20-Jan-2011  wiz Sort sections.
 1.6 20-Jan-2011  wiz New sentence, new line. Use Dq.
 1.5 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.4 21-Jan-2008  christos branches: 1.4.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.3 10-May-2007  xtraeme branches: 1.3.4;
Typo: prop_dictionary_receive_ioctl -> prop_dictionary_recv_ioctl.

Bump date.
 1.2 22-Apr-2007  yamt correct a section number.
 1.1 26-Oct-2006  thorpej branches: 1.1.2;
Add prop_array_t support to prop_kern.
 1.1.2.2 26-Oct-2006  thorpej Add prop_array_t support to prop_kern.
 1.1.2.1 26-Oct-2006  thorpej file prop_send_ioctl.3 was added on branch newlock2 on 2006-10-26 18:51:22 +0000
 1.3.4.1 23-Mar-2008  matt sync with HEAD
 1.4.4.1 18-May-2008  yamt sync with head.
 1.9.4.1 21-Apr-2017  bouyer Sync with HEAD
 1.9.2.1 20-Mar-2017  pgoyette Sync with HEAD
 1.10.32.1 02-Aug-2025  perseant Sync with HEAD
 1.10.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.10.12.1 21-Apr-2020  martin Sync with HEAD
 1.6 12-Feb-2017  abhinav branches: 1.6.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.5 30-Sep-2011  jym branches: 1.5.26; 1.5.30;
Fix an implementation inconsistency with the prop_*_send_syscall() and
prop_*_recv_syscall() functions from proplib(3). They now share the
same logic as the one from prop_*_send_ioctl() functions:
- returns an int
- 0 indicates "no error", otherwise returns the error number (and
set errno)

Many consumers of the prop_*_{ioctl, syscall} expect errno to be set
on error and use err() to display the error message. As such, ensures that
errno gets set before returning from these functions.

prop_*_send_syscall() functions returned a boolean, and now return an int.
Fix all call sites to use the new paradigm (only quota2 is affected in src).

As the prop_*_{send,recv}_syscall() API appeared in -current and is only
used by the recent quota2 code, I am not bumping the lib. The API change
only affects the prop_*_send_syscall() function (recv_syscall()s were
already used correctly), so ensure you are not mixing "old" -current
quota binaries with a new proplib(3) (or the other way around). This
change will be announced via a HEADS-UP and UPDATING.

Does not affect the kernel part of proplib.

Document the correct API in prop_array(3) and prop_dictionary(3).

Thanks to Francois Tigeot for noticing the API inconsistency and
reporting it on tech-kern@.

ok bouyer@.
 1.4 19-Jun-2011  pgoyette Correct the example.
 1.3 20-Jan-2011  wiz branches: 1.3.4;
Typos, wording.
 1.2 20-Jan-2011  wiz Remove trailing whitespace.
 1.1 19-Jan-2011  bouyer - Implement prop_{array,dictionary}_copyout(), based on
prop_{array,dictionary}_copyout_ioctl().
- Implement prop_{array,dictionary}_recv_syscall(), which
takes as parameter the pref we got from kernel and internalize it,
and unmaps the buffer prop_{array,dictionary}_copyout() mapped for us.
- add a prop_{array,dictionary}_send_syscall() for symetry, which is
an alias to prop_{array,dictionary}_externalize_to_pref()

Discussed on tech-kern@ and tech-userlevel@
 1.3.4.1 23-Jun-2011  cherry Catchup with rmind-uvmplock merge.
 1.5.30.1 21-Apr-2017  bouyer Sync with HEAD
 1.5.26.1 20-Mar-2017  pgoyette Sync with HEAD
 1.6.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.6.12.1 21-Apr-2020  martin Sync with HEAD
 1.3 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.2 30-Aug-2007  joerg branches: 1.2.2; 1.2.4; 1.2.76;
Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.1 16-Aug-2007  joerg branches: 1.1.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.1.2.1 06-Nov-2007  matt sync with HEAD
 1.2.76.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.2.76.2 21-Apr-2020  martin Sync with HEAD
 1.2.76.1 10-Jun-2019  christos Sync with HEAD
 1.2.4.2 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.2.4.1 30-Aug-2007  wrstuden file prop_stack.c was added on branch wrstuden-fixsa on 2007-09-30 03:38:49 +0000
 1.2.2.2 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.2.2.1 30-Aug-2007  xtraeme file prop_stack.c was added on branch netbsd-4 on 2007-09-27 16:16:26 +0000
 1.2 30-Aug-2007  joerg branches: 1.2.2; 1.2.4; 1.2.76;
Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.1 16-Aug-2007  joerg branches: 1.1.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.1.2.1 06-Nov-2007  matt sync with HEAD
 1.2.76.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.2.76.1 21-Apr-2020  martin Sync with HEAD
 1.2.4.2 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.2.4.1 30-Aug-2007  wrstuden file prop_stack.h was added on branch wrstuden-fixsa on 2007-09-30 03:38:50 +0000
 1.2.2.2 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.2.2.1 30-Aug-2007  xtraeme file prop_stack.h was added on branch netbsd-4 on 2007-09-27 16:16:25 +0000
 1.11 02-Apr-2025  gutteridge prop_dictionary.3 & prop_string.3: minor grammar fixes
 1.10 06-Jun-2020  thorpej branches: 1.10.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.9 12-Feb-2017  abhinav branches: 1.9.12;
Use .Fn to refer a function name instead of Nm.
Also, use Xr to refer problib(3) in the HISTORY section instead of Nm.

While parsing the man pages, any .Nm occurrence gets replaced by the
value specified in the NAME section. Referencing individual function
names with .Nm was causing makemandb(8) to replicate the complete
NAME section for every such occurrence. This was leading to an
ugly looking snippet in apropos(1)'s output when searched for
any of these man pages.
 1.8 26-Feb-2011  wiz branches: 1.8.28; 1.8.32;
Remove duplicate "the". From Henning Petersen in PR 44640.
 1.7 14-Dec-2009  dholland branches: 1.7.4;
Add two missing functions to the SYNOPSIS. From Silas Silva in PR 42415.
 1.6 30-Apr-2008  martin Convert TNF licenses to new 2 clause variant
 1.5 21-Jan-2008  christos branches: 1.5.4;
PR/37838: Stathis Kamperis: proplib documentation enhancements
 1.4 16-Aug-2007  thorpej branches: 1.4.2;
boolean_t -> bool
TRUE -> true
FALSE -> false
 1.3 27-Sep-2006  xtraeme branches: 1.3.2; 1.3.4; 1.3.16;
typos: prop_stringy_* -> prop_string_*
 1.2 09-Jul-2006  wiz Drop trailing whitespace.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.3.16.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous processing of 904 was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.3.4.1 24-Sep-2008  bouyer pullup the following revisions, requested by joerg in ticket 904
(the previous 904 processing was incomplete):
common/lib/libprop/prop_array.3 1.5
common/lib/libprop/prop_bool.3 1.3
common/lib/libprop/prop_data.3 1.4
common/lib/libprop/prop_dictionary.3 1.8
common/lib/libprop/prop_dictionary_util.3 1.2
common/lib/libprop/prop_ingest.3 1.3
common/lib/libprop/prop_number.3 1.7
common/lib/libprop/prop_object.3 1.6
common/lib/libprop/prop_string.3 1.4
boolean_t -> bool
TRUE -> true
FALSE -> false
Fixes PR lib/38013.
 1.3.2.2 27-Sep-2006  xtraeme typos: prop_stringy_* -> prop_string_*
 1.3.2.1 27-Sep-2006  xtraeme file prop_string.3 was added on branch newlock2 on 2006-09-27 19:24:29 +0000
 1.4.2.1 23-Mar-2008  matt sync with HEAD
 1.5.4.1 18-May-2008  yamt sync with head.
 1.7.4.1 05-Mar-2011  bouyer Sync with HEAD
 1.8.32.1 21-Apr-2017  bouyer Sync with HEAD
 1.8.28.1 20-Mar-2017  pgoyette Sync with HEAD
 1.9.12.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.9.12.1 21-Apr-2020  martin Sync with HEAD
 1.10.12.1 02-Aug-2025  perseant Sync with HEAD
 1.24 14-May-2025  thorpej Undo previous revert, and fix include ordering in prop_extern.c and
prop_intern.c that broke tools build on some hosts.
 1.23 13-May-2025  thorpej Revert previous while I investigate the build failure.
 1.22 13-May-2025  thorpej Separate the {extern,intern}alize support routines into their own files,
and reduce the verbosity of the names.

NFCI.
 1.21 26-Apr-2025  thorpej Hide the private symbols.
 1.20 24-Apr-2025  christos pass lint
 1.19 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.18 17-Nov-2023  thorpej branches: 1.18.2;
In _prop_string_instantiate(), when we de-dup a non-MUTABLE string, make
sure we free the provided string buffer if NOCOPY is not set. Fixes
a memory leak reported by M. Boerschig.

While we're at it, also change _prop_string_instantiate() to free the
provided string buffer in the not-NOCOPY case when string object allocation
fails (this was previously handled by _prop_string_instantiate()'s
callers).

PR lib/57699
 1.17 03-Aug-2022  riastradh branches: 1.17.2;
proplib: Nix trailing whitespace.
 1.16 07-Sep-2021  andvar s/aquire/acquire/ in comments, also one typo fix acqure->acquire.
 1.15 20-Jun-2020  christos Fix lint
 1.14 06-Jun-2020  thorpej Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.13 08-May-2019  thorpej Fix building libprop as a host tool library on platforms that don't have
the Matt Thomas rbtree:

- Include rb.c in libnbcompat, and provide a nbcompat sys/rbtree.h
header.
- Make sure libprop's source file include prop_object_impl.h before
anything else, and pull in nbtool_config.h from there.

Tested by simulating such a host system by renaming the host's
<sys/rbtree.h> out of the way (which reproduced the build failure)
and verifying that the host-tool installboot contained the rb_*
functions in its own .text segment.
 1.12 26-Mar-2014  christos branches: 1.12.26;
kill sprintf
 1.11 03-Aug-2008  thorpej branches: 1.11.2; 1.11.24;
Fix an issue introduced with the prop_stack change: It's not a good idea to
return a 3-value enum from a function declared to return bool. This broke
the recurse case for prop_object_equals(). Instead, declare the object type
equals routine to return a _prop_object_equals_rv_t.

Give the same treatment to the object type free routines: declare them to
return a _prop_object_free_rv_t, and consistently check those return values
againt the enum type.

Tidy up some whitespace while we're here.
 1.10 28-Apr-2008  martin branches: 1.10.2;
Remove clause 3 and 4 from TNF licenses
 1.9 30-Aug-2007  joerg branches: 1.9.6;
Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.

Reviewed by mjf@ and adrianp@
 1.8 16-Aug-2007  joerg branches: 1.8.2;
libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
 1.7 16-Aug-2007  thorpej boolean_t -> bool
TRUE -> true
FALSE -> false
 1.6 18-Oct-2006  martin branches: 1.6.2; 1.6.4; 1.6.12;
Backout size_t casts - lint has been fixed.
 1.5 18-Oct-2006  martin Sprinkle a few size_t casts to avoid conversion warnings.
 1.4 22-Aug-2006  thorpej Also guard object accessors against NULL (like we do foreign object types)
so that apps can use this construct safely:

obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}

Suggested by Iain Hibbert.
 1.3 21-Aug-2006  thorpej Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.2 18-May-2006  thorpej branches: 1.2.2;
- Add prop_array_equals(), prop_dictionary_equals(), and
prop_dictionary_keysym_equals(), and prop_object_equals() functions.
- Use realloc() where it makes sense. There will be more changes in this
area.
- Add a _prop_object_type structure that is used internally to keep
information about the object types. Decreases the footprint of the
objects slightly by replacing several pointers with just one.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.2.2.2 27-Aug-2006  riz Pull up following revision(s) (requested by thorpej in ticket #51):
common/lib/libprop/prop_dictionary.c: revision 1.11
common/lib/libprop/prop_number.c: revision 1.5
common/lib/libprop/prop_bool.c: revision 1.5
common/lib/libprop/prop_data.c: revision 1.4
common/lib/libprop/prop_string.c: revision 1.4
common/lib/libprop/prop_array.c: revision 1.6
Also guard object accessors against NULL (like we do foreign object
types)
so that apps can use this construct safely:
obj = prop_dictionary_get(dict, "value");
if (! prop_number_equals_integer(obj, 5)) {
...
}
Suggested by Iain Hibbert.
 1.2.2.1 23-Aug-2006  tron Pull up following revision(s) (requested by thorpej in ticket #43):
common/include/prop/prop_ingest.h: revision 1.1
common/lib/libprop/prop_number.c: revision 1.4
common/include/prop/prop_array.h: revision 1.3
common/lib/libprop/prop_object_impl.h: revision 1.4
common/include/prop/prop_dictionary.h: revision 1.4
distrib/sets/lists/comp/mi: revision 1.911
common/include/prop/Makefile: revision 1.2
common/lib/libprop/prop_bool.c: revision 1.4
distrib/sets/lists/base/shl.mi: revision 1.365
common/lib/libprop/prop_data.c: revision 1.3
lib/libprop/shlib_version: revision 1.4
lib/libprop/Makefile: revision 1.6
common/lib/libprop/prop_object.c: revision 1.4
common/lib/libprop/prop_object.3: revision 1.4
common/include/prop/proplib.h: revision 1.3
common/lib/libprop/Makefile.inc: revision 1.3
common/include/prop/prop_object.h: revision 1.4
common/lib/libprop/prop_array.c: revision 1.4
common/lib/libprop/prop_array.3: revision 1.4
common/lib/libprop/prop_string.c: revision 1.3
common/lib/libprop/prop_dictionary.3: revision 1.4
common/lib/libprop/prop_ingest.c: revision 1.1
common/lib/libprop/prop_ingest.3: revision 1.1
common/lib/libprop/prop_dictionary.c: revision 1.9
Several changes to proplib:
- Arrays can now be externalized and internalized in the same way
dictionaries can.
- Add new "externalize to file" and "internalize from file" functions
to make reading a property list from a file and writing a property
list to a file more convenient.
- Many assertions in the object implementations are gone. Instead,
calling an accessor for one object type with a different object type
as an argument will return a suitable "invalid" value.
- prop_object_type() now returns a new PROP_TYPE_UNKNOWN value if called
with a NULL object.
- Externalized property lists now contain a reference to the Apple XML
plist DTD.
- Add a new prop_ingest(3) facility, which provides a convenient way to
translate a dictionary into an arbitrary binary representation.
 1.6.12.1 30-Sep-2007  wrstuden Catch up on netbsd-4 as of a few days ago.
 1.6.4.1 27-Sep-2007  xtraeme Pull up following revision(s) (requested by joerg in ticket #904):
sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
common/lib/libprop/prop_string.c: revision 1.9 (via patch)
distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
common/include/prop/prop_string.h: revision 1.2 (via patch)
common/include/prop/prop_ingest.h: revision 1.2 (via patch)
usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
common/include/prop/prop_array.h: revision 1.5 (via patch)
common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
common/lib/libprop/prop_number.3: revision 1.7 (via patch)
common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
common/include/prop/prop_bool.h: revision 1.3 (via patch)
common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
common/include/prop/prop_data.h: revision 1.2 (via patch)
sys/sys/dkio.h: revision 1.14 (via patch)
usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
common/include/prop/Makefile: revision 1.3 (via patch)
common/include/prop/prop_number.h: revision 1.5 (via patch)
common/lib/libprop/prop_object.c: revision 1.14 (via patch)
common/lib/libprop/prop_object.c: revision 1.15 (via patch)
common/lib/libprop/prop_object.c: revision 1.16 (via patch)
common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
common/lib/libprop/prop_data.3: revision 1.4 (via patch)
common/lib/libprop/prop_object.3: revision 1.6 (via patch)
common/lib/libprop/prop_data.c: revision 1.7 (via patch)
common/lib/libprop/prop_data.c: revision 1.8 (via patch)
common/lib/libprop/prop_data.c: revision 1.9 (via patch)
common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
common/lib/libprop/prop_number.c: revision 1.12 (via patch)
common/include/prop/proplib.h: revision 1.5 (via patch)
common/lib/libprop/prop_number.c: revision 1.13 (via patch)
common/lib/libprop/prop_number.c: revision 1.14 (via patch)
common/include/prop/prop_object.h: revision 1.5 (via patch)
common/lib/libprop/prop_array.3: revision 1.5 (via patch)
common/include/prop/prop_object.h: revision 1.6 (via patch)
common/lib/libprop/prop_string.3: revision 1.4 (via patch)
common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
common/lib/libprop/prop_array.c: revision 1.10 (via patch)
common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
common/lib/libprop/prop_array.c: revision 1.11 (via patch)
common/lib/libprop/prop_string.c: revision 1.7 (via patch)
common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
common/lib/libprop/prop_array.c: revision 1.9 (via patch)
usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
common/lib/libprop/prop_string.c: revision 1.8 (via patch)
common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@
 1.6.2.2 18-Oct-2006  martin Backout size_t casts - lint has been fixed.
 1.6.2.1 18-Oct-2006  martin file prop_string.c was added on branch newlock2 on 2006-10-18 19:15:47 +0000
 1.8.2.1 06-Nov-2007  matt sync with HEAD
 1.9.6.1 18-May-2008  yamt sync with head.
 1.10.2.1 18-Sep-2008  wrstuden Sync with wrstuden-revivesa-base-2.
 1.11.24.1 19-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.11.2.1 22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.12.26.3 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.12.26.2 21-Apr-2020  martin Sync with HEAD
 1.12.26.1 10-Jun-2019  christos Sync with HEAD
 1.17.2.1 26-Nov-2023  bouyer Pull up following revision(s) (requested by thorpej in ticket #467):
common/lib/libprop/prop_string.c: revision 1.18
In _prop_string_instantiate(), when we de-dup a non-MUTABLE string, make
sure we free the provided string buffer if NOCOPY is not set. Fixes
a memory leak reported by M. Boerschig.
While we're at it, also change _prop_string_instantiate() to free the
provided string buffer in the not-NOCOPY case when string object allocation
fails (this was previously handled by _prop_string_instantiate()'s
callers).
PR lib/57699
 1.18.2.1 02-Aug-2025  perseant Sync with HEAD
 1.10 23-Apr-2025  thorpej Add support for serializing to, and de-serializing from, JSON, as
specified in RFC 8259. Format is automatically detected for input,
and can be specified explicitly for output. The default format remains
XML.

As part of this change, generic prop_object_{internalize,externalize}()
functions are provided, and the "_with_format" flavor allows the output
format to be specified. Previous array- and dictionary-specific routines
remain for backwards compatibility.
 1.9 06-Jun-2020  thorpej branches: 1.9.12;
Improvements to the problib(3) API:

==> Provide a much more complete set of setters and getters for different
value types in the prop_array_util(3) and prop_dictionary_util(3)
functions.

==> Overhaul the prop_data(3), prop_number(3), and prop_string(3) APIs
to be easier to use and less awkwardly named, Deprecate the old
awkward names, and produce link-time warnings when they are referenced.

==> Deprecate mutable prop_data(3) and prop_string(3) objects. The old
APIs that support them still exist, but will now produce link-time
warnings when used.

==> When the new prop_string(3) API is used, strings are internally
de-duplicated as a memory footprint optimization.

==> Provide a rich set of bounds-checked gettter functions in and a
corresponding set of convenience setters in the prop_number(3) API.

==> Add a new prop_bool_value(3) function that is equivalent to
prop_bool_true(3), but aligned with the new "value" routines in
prop_data(3), prop_string(3), and prop_number(3).
 1.8 15-Mar-2012  njoly branches: 1.8.34;
Use Lk macro when dealing with URLs. While here update or remove some
dead URL links. Another part of PR/29238.
 1.7 19-Jan-2011  bouyer branches: 1.7.6;
- Implement prop_{array,dictionary}_copyout(), based on
prop_{array,dictionary}_copyout_ioctl().
- Implement prop_{array,dictionary}_recv_syscall(), which
takes as parameter the pref we got from kernel and internalize it,
and unmaps the buffer prop_{array,dictionary}_copyout() mapped for us.
- add a prop_{array,dictionary}_send_syscall() for symetry, which is
an alias to prop_{array,dictionary}_externalize_to_pref()

Discussed on tech-kern@ and tech-userlevel@
 1.6 13-May-2009  wiz New sentence, new line.
 1.5 30-Apr-2008  martin branches: 1.5.8;
Convert TNF licenses to new 2 clause variant
 1.4 21-Jun-2007  xtraeme branches: 1.4.10;
Xref prop_dictionary_util(3) and prop_send_ioctl(3).
 1.3 09-Jul-2006  wiz Drop trailing whitespace.
 1.2 07-Jul-2006  thorpej Change prop_number_t to store a uint64_t, rather than a uintmax_t. No
ABI change, and we ought to explicitly state that this is a fixed-width
type, since that what it needs to be for binary plist support.
 1.1 27-Apr-2006  thorpej Initial commit of proplib, a library for manipulating property lists and
converting to/from an XML external representation (based on Apple XML
property lists). Works in the kernel and user space.
 1.4.10.1 18-May-2008  yamt sync with head.
 1.5.8.1 23-Jul-2009  jym Sync with HEAD.
 1.7.6.1 17-Apr-2012  yamt sync with head
 1.8.34.2 21-Apr-2020  martin Ooops, restore accidently removed files from merge mishap
 1.8.34.1 21-Apr-2020  martin Sync with HEAD
 1.9.12.1 02-Aug-2025  perseant Sync with HEAD

RSS XML Feed