2005-10-17  Thomas Schwinge  <tschwinge@gnu.org>

	* hurd/intr-msg.c (_hurd_intr_rpc_mach_msg): Fix invalid lvalues.
	* sysdeps/mach/hurd/ioctl.c (__ioctl): Likewise.

Index: hurd/intr-msg.c
===================================================================
RCS file: /cvs/glibc/libc/hurd/intr-msg.c,v
retrieving revision 1.16
diff -u -r1.16 intr-msg.c
--- hurd/intr-msg.c	18 Feb 2002 20:56:54 -0000	1.16
+++ hurd/intr-msg.c	13 Sep 2005 19:29:29 -0000
@@ -201,9 +201,10 @@
 		    case MACH_MSG_TYPE_MOVE_SEND:
 		      for (i = 0; i < number; i++)
 			__mach_port_deallocate (__mach_task_self (), *ports++);
-		      (ty->msgtl_header.msgt_longform
-		       ? ty->msgtl_name : ty->msgtl_header.msgt_name)
-			= MACH_MSG_TYPE_COPY_SEND;
+		      if (ty->msgtl_header.msgt_longform)
+			ty->msgtl_name = MACH_MSG_TYPE_COPY_SEND;
+		      else
+			ty->msgtl_header.msgt_name = MACH_MSG_TYPE_COPY_SEND;
 		      break;
 		    case MACH_MSG_TYPE_COPY_SEND:
 		    case MACH_MSG_TYPE_MOVE_RECEIVE:
@@ -223,29 +224,29 @@
 		  name = ty->msgtl_name;
 		  size = ty->msgtl_size;
 		  number = ty->msgtl_number;
-		  (char *) ty += sizeof (mach_msg_type_long_t);
+		  ty = (void *) ty + sizeof (mach_msg_type_long_t);
 		}
 	      else
 		{
 		  name = ty->msgtl_header.msgt_name;
 		  size = ty->msgtl_header.msgt_size;
 		  number = ty->msgtl_header.msgt_number;
-		  (char *) ty += sizeof (mach_msg_type_t);
+		  ty = (void *) ty + sizeof (mach_msg_type_t);
 		}
 
 	      if (ty->msgtl_header.msgt_inline)
 		{
 		  clean_ports ((void *) ty, 0);
 		  /* calculate length of data in bytes, rounding up */
-		  (char *) ty += (((((number * size) + 7) >> 3)
-				   + sizeof (mach_msg_type_t) - 1)
-				  &~ (sizeof (mach_msg_type_t) - 1));
+		  ty = (void *) ty + (((((number * size) + 7) >> 3)
+				       + sizeof (mach_msg_type_t) - 1)
+				      &~ (sizeof (mach_msg_type_t) - 1));
 		}
 	      else
 		{
 		  clean_ports (*(void **) ty,
 			       ty->msgtl_header.msgt_deallocate);
-		  ++(void **) ty;
+		  ty = (void *) ty + sizeof (void *);
 		}
 	    }
 #else  /* Untyped Mach IPC flavor. */
Index: sysdeps/mach/hurd/ioctl.c
===================================================================
RCS file: /cvs/glibc/libc/sysdeps/mach/hurd/ioctl.c,v
retrieving revision 1.50
diff -u -r1.50 ioctl.c
--- sysdeps/mach/hurd/ioctl.c	29 May 2002 08:09:51 -0000	1.50
+++ sysdeps/mach/hurd/ioctl.c	13 Sep 2005 19:29:29 -0000
@@ -136,9 +136,11 @@
 	     Rather than pointing to the value, ARG is the value itself.  */
 #ifdef MACH_MSG_TYPE_BIT
 	  *t++ = io2mach_type (1, _IOTS (integer_t));
-	  *((integer_t *) t)++ = (integer_t) arg;
+	  *(integer_t *) t = (integer_t) arg;
+	  t = (void *) t + sizeof (integer_t);
 #else
-	  *((integer_t *) p)++ = (integer_t) arg;
+	  *(integer_t *) p = (integer_t) arg;
+	  p = (void *) p + sizeof (integer_t);
 #endif
 	}