malloc/calloc/realloc* returns.

99% of the world calls it.
allow just "bcrypt" without params to mean auto-tune ("bcrypt,a").
default remains 8 rounds (for now)
ok deraadt

OpenSSL stopped building it last year and removed it this year.
Based on OpenSSL commit c436e05bdc.
Also cranked major version in libcrypto, libssl and libtls.
"fine with me" bcook@ miod@

platforms) by explicitly making imsg->data = NULL when there is no
data. ok deraadt

OK tedu@

ok deraadt jeremy

ok jsing@

ok gilles claudio doug

henning@ "sure"

bcook@ notes that this check really only impacted 64-bit Windows.  Also,
changed the check to be unsigned for consistency.
ok bcook@

consistent with the behavior of the other libc sort functions.
OK deraadt@

ok miod@ jsing@

ok deraadt@ jsing@ miod@

when we can just make spanp const char * to match it.  OK deraadt@

We do not build, test or ship any dynamic engines, so we can remove the dynamic
engine loader as well. This leaves a stub initialization function in its place.
ok beck@, reyk@, miod@

This only provides the sysctl wrapper in glibc, which we do not use and is not available in other libc implementations for Linux. Thanks to ncopa from github.

Fix one occurence in imsg_flush() and clarify it the man page.
Discussed with at least blambert@ jsg@ yasuoka@.
OK gilles@

is non-portable.  Also add missing asprintf() return value checks.
OK deraadt@ guenther@ doug@

part of the ISO C standard and have also been dropped from POSIX.
OK guenther@ kettenis@

of some undefined value.
OK tedu@

ok millert@ jmc@ schwarze@

separately to avoid false negatives.
ok miod@ millert@

Include it if we have the sysctl syscall.

From Michael Felt.

consistent handling of negative ids on 32bit/64bit systems.
The only negative uid/gid allowed is -1 which is special-cased
so it can be preserved when writing the new master.passwd file
instead of being written as an unsigned number.  OK deraadt@

The issetugid() API is supposed to make a strong promise where "0
means it is safe to look at the environment".  Way back in the past
someone on the OpenSSL team responded to the environment access danger
by creating a wrapper called OPENSSL_issetugid, and went to use it a
number of places.  However, by default on systems lacking true
issetugid(), OPENSSL_issetugid returns 0.  0 indicating safely.  False
safety.  Which means OPENSSL_issetugid() fails to make any sort of
promise about safety, in fact it is just the opposite.
Can you believe the OpenSSL team?
This nastiness was noticed over the years, however noone could gain traction
and get it fixed in OpenSSL.  Also see a paragraph about this in
http://www.tedunangst.com/flak/post/worst-common-denominator-programming
ok jsing

unregistering callbacks if the DSO is unloaded.  Move the callback
handling from libpthread to libc, though libpthread still overrides the
inner call to handle locking and thread-library reinitialization.
Major version bump for both libc and libpthread.
verification that this fixes various ports ajacoutot@
asm assistance miod@; ok millert@ deraadt@

instead of simply zapping it. this can save many syscalls in a program
that repeatedly grows and shrinks a buffer, as observed in the wild.

routines on hppa, the cause for sha512-parisc subtly misbehaving has been
found: despite having fallback pa1.1 code when running on a 32-bit cpu, the
shift constants used in the sigma computations in sha512 are >= 32 and are
silently truncated to 5 bits by the assembler, so there is no chance of
getting this code to work on a non-pa2.0 processor.
However, the pa1.1 fallback code for sha256 is safe, as it never attempts to
shift by more than 31, so reenable it again.

What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time.  This makes the
tree safe for /usr/include/tzfile.h removal.  The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree.  Actual removal of tzfile.h is pending
a ports build.  Based on a diff from deraadt@

for overflow. stop talking about old broken systems, there's little use
for such info.

regress tests but causes tls ciphersuite using sha386 to fail; found the
hard way by henning@.
I can't see anything wrong in the generated assembly code yet, but building
a libcrypto with no assembler code but sha512_block_data_order() is enough
to trigger Henning's issue, so the bug lies there.
No ABI change; ok deraadt@

Printing strerror() in that case will say result too large, even if rounds is
actually too small. invalid is less specific, but less incorrect.
ok millert

Discussed with/requested by deraadt@ at the conclusion of s2k15.

ok dlg

No actual change, but makes it easier to reuse the code elsewhere.
Suggested by Andre Smagin

to avoid swamping it;