Ann: SWI-Prolog 7.1.13

Hi,

I've uploaded our lucky number version 7.1.13 after creating a broken
7.1.12 yesterday. Changes mostly involve security, stability and
portability.  Highlights:

# Security

   - Windows binaries ship with OpenSSL, updated to 1.0.1g, fixing
     the heartbleed hole (MacOS and Linux use the OS versions).

   - XML parser allows for SYSTEM entities.  Keri Harris pointed out
     that you can misuse this to get arbitrary information from the
     target system if the server provides POST services that accept
     XML documents.  This feature is now disabled by default.  There
     is also an option max_memory(+Bytes) to limit the buffering
     memory of the XML parser.

   - Several DoS attacks (read: crashes)
     - Converting integer lists to Unicode strings.
     - Crashes in cgi_get_form/1 and library(uri).
     - Crafted XML messages may crash reporting errors.

# Stability

   - Many changes trying to simplify the handling of stack overflows.
     I'm afraid this isn't the last word on this.  The aim is to avoid
     DoS attacks for servers running arbitrary Prolog queries that run
     out of stack.

# Portability

   - Quite a few changes to support MinGW 4.8 (shipping with Ubuntu 14.04).
   - Fixed several issues with locales that do not use . as decimal point
     in xpce and the nlp package.
   - Fixed linking issues with Ubuntu PPAs

	Enjoy --- Jan


=========================================
SWI-Prolog Changelog since version 7.1.11
=========================================

  * ADDED: thread_create/3: option inherit_from(+Thread) to define the
    thread from which all settings are copied.

  * FIXED: url_iri/2 in mode (-,+).  Wouter Beek.

  * FIXED: print_message/2: do not worry if =user_output= does not exist
    (is flushed before writing to =user_error= to ensure proper ordering
    of buffered output).

  * ADDED: create_prolog_flag/3: option keep(true) to keep the flag at
    its current setting if it is already defined.

  * ENHANCED: Do not generate an error if the commandline history cannot
    be written.

  * FIXED: Safe-goal declaration: get_dict_ex --> '$get_dict_ex'

  * MODIFIED: Removed get_dict_ex/3.  This used to implement the functional
    notation for Dict.Field.  The new predicate '$get_dict_ex'/3 has very
    specific behaviour to speed up ./3 for this typical case.

  * DOC: Support [|] in fragile LaTeX environments.

  * DOC: numbervars option of write_term/3.  Ulrich Neumerkel.

  * ENHANCED: Remove order verification from dict contents in is_dict/1
    and is_dict/2.

  * DOC: Clarified numbervars/3.  Guenter Kniesel.

  * FIXED: source location of syntax errors

  * FIXED: previous patch left is_resource_error() undefined

  * FIXED: Implement outOfStack() using more low level primitives, avoiding
    term references.  This saves stack space (which may be scarce) and
    avoids overwriting body terms written by ARGP, which may crash GC.

  * FIXED: library(prolog_colour): Deal with incomplete position
    information

  * SECURITY: Windows: update OpenSSL dependency to 1.0.1g.

  * CLEANUP: Many issues around handling of stack overflows.  This patch
    makes cleans many issues wrt. handling of the `spare' stacks and
    creating space that allows starting the debugger after a stack
    overflow.

  * FIXED: GC: move trimStacks() out of the protected zone of GC such
    that it can indeed shift the stacks.

  * FIXED: Save/restore LD->outofstack over callbacks.

  * CLEANUP: No longer let conditional tracing depend on the outofstack.

  * TEST: Removed obsolete comment

  * TEST: We need to trim the stacks, otherwise the first shift can be
    an overflow, while this test is about shifting.

  * FIXED: open/4: validate argument of option type(+Type).  Ulrich
    Neumerkel.

  * PORT: Avoid looking for clock_gettime() on MinGW because we have our
    replacement and it clock_gettime(CLOCK_REALTIME) returns bogus on
    MinGW4.8 on Win32.

  * MINGW: Fixed detection of pthread_getw32threadhandle_np() vs
    pthread_gethandle()

  * CLEANUP: Avoid some benign type conversion warnings

  * FIXED: Compensate for lazy creating of threads with redirected
    output. This can happen, for example if the pool is created from an
    HTTP server thread.  Dubious.  Most likely we need some option to
    create a thread without inheriting I/O from its parent.

  * PORT: Updated README.mingw to document compilation on Ubuntu
    14.04/MinGW 4.8

  * PORT: PL_atom_generator(): fixed thread-specific data handling (0 is
    a valid key).

  * MINGW: Make NSIS script deal with different thread models.

  * MINGW: Pass detected pthread library to Makefile and NSIS

  * MINGW: Deal with versions that needed pthread-win32 and recent versions
    that have that bundled.

  * MINGW: Do not install SSL documentation as the .pod file do not
    process in Ubuntu 14.04 and we do not need these for building.

  * PORT: Install proper support libraries

  * PORT: Allow using MinGW 4.8 default pthread emulation

  * PORT: Avoid undefined timespec_to_double()

  * PORT: Be prepared that dtoa and strtod are macros

  * PORT: Avoid dependency on ms_snprintf() in pl-stream.c

  * FIXED: library(prolog_stack): avoid error if source location is
    incomplete.

  * FIXED: library(prolog_colour) to color quasi quotations that produce
    a goal term.

  * FIXED: possible crash when reading very large multibyte characters

  * FIXED: possible crash when using excessively large character codes
    with atoms

  * ENHANCED: Make PL_chars_to_term() process a plain number by bypassing
    the while Prolog machinery.  This allows for (relatively) fast parsing
    of e.g. large integers.



==============
Package debian
==============

  * FIXED: Debian/Ubuntu packages: install static library also in
    /usr/lib. With help from jon judge and Eugeniy Meshcheryakov.

============
Package clib
============

  * FIXED: Bug#174: uri_encoded/3 should encode IRIs and %.  Raivo
    Laanemets.

  * FIXED: cgi_get_form/1 to use Prolog's parser for numbers.  This avoids
    locale issues and supports unbounded integers.

  * FIXED: possible off-by-one error when processing URIs

  * FIXED: possible hang when processing invalid query string

==========
Package db
==========

  * ENHANCED: Do not register at-halt if library could not be loaded.

============
Package http
============

  * ENHANCED: library(http/http_unix_daemon) to disable the IDE for
    messages.

  * MODIFIED: library(http/http_unix_daemon): By default, suppress all
    debug messages

  * FIXED: library(http/http_daemon): try to avoid starting the xpce
    event handling thread before forking.

  * ADDED: library(http/http_unix_daemon): options --help and --interactive

  * FIXED: library(http/http_header): bug where a second round of
    authentication fails.

===========
Package nlp
===========

  * FIXED: tokenize_atom/2 now uses PL_chars_to_term() to translate
      recognised numbers into Prolog integers.  This implies: - Numeric
      tokens are not locale sensitive - Integer tokens profit from
      unbounded arithmetic

================
Package pengines
================

  * FIXED: Prevent pengine thread-pool hook to create threads for other
    libraries.

  * REVERTED: The pengine default application is named =pengine_sandbox=

  * ADDED: Inherit settings over pengine:<Setting>.  This is both more
    practical and avoids incompatibility.

  * UPDATED: plans.txt

  * FIXED: Ignore errors resetting streams (dubious).

  * ADDED: pengine_event_loop/2: options created(+ListOfPengines) to stop
    the loop terminating before all pengines have become visible.

  * DOC: Pengine IDs are UUIDs

  * ADDED: pengine_application/1 to declare a new pengine application

  * ADDED: pengine_property/2: new application(Application) property

  * CLEANUP: Throw standard exception if the pengine limit is reached

  * CLEANUP: Import library(aggregates)

==============
Package semweb
==============

  * FIXED: Attach to a read-only database is supposed to raise only
    a warning

  * FIXED: Include <stdio.h> to get swprintf().

============
Package sgml
============

  * ADDED: Warning when trying to use SYSTEM entities if this is not
    allowed.

  * FIXED: possible crash while reporting markup syntax errors

  * SECURITY: provide a max_memory/1 option to load_structure/3 to stop
    entity-expansion blowup

  * SECURITY: disable SYSTEM entity expansion by default

  * ADDED: Dialect support for xhtml and xhtml5.

============
Package xpce
============

  * ENHANCED: Only set the message_ide flag if it was not set before.

  * ENHANCED: Be silent about errors saving PceEmacs bookmarks

  * FIXED: Handling of type 1.2..2.4 in locales that do not use . for
    decimal point.

  * FIXED: Use new answer_write_options flag instead of
    toplevel_print_options.