./PaxHeaders.12213/5.000407550001756001161000000000036116501551420011233xustar0030 atime=1783552627.968690919 5.0004075500017560011610000000000001165015514200102445ustar00ssyncsync5.0/PaxHeaders.12213/alpha00407550001756001161000000000036116501551410012162xustar0030 atime=1783552627.968690919 5.0/alpha004075500017560011610000000000001165015514100113305ustar00ssyncsync5.0/PaxHeaders.12213/amd6400407550001756001161000000000036116501551410012010xustar0030 atime=1783552627.968690919 5.0/amd64004075500017560011610000000000001165015514100111565ustar00ssyncsync5.0/PaxHeaders.12213/armish00407550001756001161000000000036116501551410012360xustar0030 atime=1783552627.968690919 5.0/armish004075500017560011610000000000001165015514100115265ustar00ssyncsync5.0/PaxHeaders.12213/common00407550001756001161000000000036117451620470012375xustar0030 atime=1783552627.968690919 5.0/common004075500017560011610000000000001174516204700115435ustar00ssyncsync5.0/common/PaxHeaders.12213/001_bind.patch01006440001756001161000000000036116657205520014763xustar0030 atime=1783552627.968690919 5.0/common/001_bind.patch010064400017560011610000000070421166572055200141410ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 001_bind.patch And then rebuild and install bind: cd usr.sbin/bind make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: usr.sbin/bind/bin/named/query.c =================================================================== RCS file: /cvs/src/usr.sbin/bind/bin/named/query.c,v retrieving revision 1.8 diff -u -p -r1.8 query.c --- usr.sbin/bind/bin/named/query.c 9 Dec 2007 13:39:42 -0000 1.8 +++ usr.sbin/bind/bin/named/query.c 29 Nov 2011 13:39:58 -0000 @@ -1239,11 +1239,9 @@ query_addadditional(void *arg, dns_name_ goto addname; if (result == DNS_R_NCACHENXRRSET) { dns_rdataset_disassociate(rdataset); - /* - * Negative cache entries don't have sigrdatasets. - */ - INSIST(sigrdataset == NULL || - ! dns_rdataset_isassociated(sigrdataset)); + if (sigrdataset != NULL && + dns_rdataset_isassociated(sigrdataset)) + dns_rdataset_disassociate(sigrdataset); } if (result == ISC_R_SUCCESS) { mname = NULL; @@ -1284,8 +1282,9 @@ query_addadditional(void *arg, dns_name_ goto addname; if (result == DNS_R_NCACHENXRRSET) { dns_rdataset_disassociate(rdataset); - INSIST(sigrdataset == NULL || - ! dns_rdataset_isassociated(sigrdataset)); + if (sigrdataset != NULL && + dns_rdataset_isassociated(sigrdataset)) + dns_rdataset_disassociate(sigrdataset); } if (result == ISC_R_SUCCESS) { mname = NULL; @@ -1733,10 +1732,8 @@ query_addadditional2(void *arg, dns_name goto setcache; if (result == DNS_R_NCACHENXRRSET) { dns_rdataset_disassociate(rdataset); - /* - * Negative cache entries don't have sigrdatasets. - */ - INSIST(! dns_rdataset_isassociated(sigrdataset)); + if (dns_rdataset_isassociated(sigrdataset)) + dns_rdataset_disassociate(sigrdataset); } if (result == ISC_R_SUCCESS) { /* Remember the result as a cache */ Index: usr.sbin/bind/lib/dns/rbtdb.c =================================================================== RCS file: /cvs/src/usr.sbin/bind/lib/dns/rbtdb.c,v retrieving revision 1.6 diff -u -p -r1.6 rbtdb.c --- usr.sbin/bind/lib/dns/rbtdb.c 9 Dec 2007 13:39:43 -0000 1.6 +++ usr.sbin/bind/lib/dns/rbtdb.c 29 Nov 2011 13:39:58 -0000 @@ -244,6 +244,7 @@ typedef struct rdatasetheader { #define RDATASET_ATTR_IGNORE 0x0004 #define RDATASET_ATTR_RETAIN 0x0008 #define RDATASET_ATTR_NXDOMAIN 0x0010 +#define RDATASET_ATTR_NEGATIVE 0x0100 typedef struct acache_cbarg { dns_rdatasetadditional_t type; @@ -278,6 +279,8 @@ struct acachectl { (((header)->attributes & RDATASET_ATTR_RETAIN) != 0) #define NXDOMAIN(header) \ (((header)->attributes & RDATASET_ATTR_NXDOMAIN) != 0) +#define NEGATIVE(header) \ + (((header)->attributes & RDATASET_ATTR_NEGATIVE) != 0) #define DEFAULT_NODE_LOCK_COUNT 7 /*%< Should be prime. */ #define DEFAULT_CACHE_NODE_LOCK_COUNT 1009 /*%< Should be prime. */ @@ -3648,7 +3651,7 @@ cache_find(dns_db_t *db, dns_name_t *nam result == DNS_R_NCACHENXRRSET) { bind_rdataset(search.rbtdb, node, found, search.now, rdataset); - if (foundsig != NULL) + if (!NEGATIVE(found) && foundsig != NULL) bind_rdataset(search.rbtdb, node, foundsig, search.now, sigrdataset); } @@ -4234,7 +4237,7 @@ cache_findrdataset(dns_db_t *db, dns_dbn } if (found != NULL) { bind_rdataset(rbtdb, rbtnode, found, now, rdataset); - if (foundsig != NULL) + if (!NEGATIVE(found) && foundsig != NULL) bind_rdataset(rbtdb, rbtnode, foundsig, now, sigrdataset); } 5.0/common/PaxHeaders.12213/002_libcrypto.patch01006440001756001161000000000036117452730300016050xustar0030 atime=1783552627.968690919 5.0/common/002_libcrypto.patch010064400017560011610000000125511174527303000152270ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 002_libcrypto.patch And then rebuild and install libcrypto: cd lib/libssl/crypto make obj make depend make make install Index: lib/libssl/src/crypto/mem.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/mem.c,v retrieving revision 1.13 retrieving revision 1.13.4.1 diff -u -p -r1.13 -r1.13.4.1 --- lib/libssl/src/crypto/mem.c 1 Oct 2010 22:58:53 -0000 1.13 +++ lib/libssl/src/crypto/mem.c 22 Apr 2012 01:38:23 -0000 1.13.4.1 @@ -362,6 +362,10 @@ void *CRYPTO_realloc_clean(void *str, in if (num <= 0) return NULL; + /* We don't support shrinking the buffer. Note the memcpy that copies + * |old_len| bytes to the new buffer, below. */ + if (num < old_len) return NULL; + if (realloc_debug_func != NULL) realloc_debug_func(str, NULL, num, file, line, 0); ret=malloc_ex_func(num,file,line); Index: lib/libssl/src/crypto/asn1/a_d2i_fp.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/a_d2i_fp.c,v retrieving revision 1.5 retrieving revision 1.5.12.1 diff -u -p -r1.5 -r1.5.12.1 --- lib/libssl/src/crypto/asn1/a_d2i_fp.c 6 Sep 2008 12:17:48 -0000 1.5 +++ lib/libssl/src/crypto/asn1/a_d2i_fp.c 22 Apr 2012 01:38:23 -0000 1.5.12.1 @@ -57,6 +57,7 @@ */ #include +#include #include "cryptlib.h" #include #include @@ -143,17 +144,11 @@ static int asn1_d2i_read_bio(BIO *in, BU BUF_MEM *b; unsigned char *p; int i; - int ret=-1; ASN1_const_CTX c; - int want=HEADER_SIZE; + size_t want=HEADER_SIZE; int eos=0; -#if defined(__GNUC__) && defined(__ia64) - /* pathetic compiler bug in all known versions as of Nov. 2002 */ - long off=0; -#else - int off=0; -#endif - int len=0; + size_t off=0; + size_t len=0; b=BUF_MEM_new(); if (b == NULL) @@ -169,7 +164,7 @@ static int asn1_d2i_read_bio(BIO *in, BU { want-=(len-off); - if (!BUF_MEM_grow_clean(b,len+want)) + if (len + want < len || !BUF_MEM_grow_clean(b,len+want)) { ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; @@ -181,7 +176,14 @@ static int asn1_d2i_read_bio(BIO *in, BU goto err; } if (i > 0) + { + if (len+i < len) + { + ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG); + goto err; + } len+=i; + } } /* else data already loaded */ @@ -206,6 +208,11 @@ static int asn1_d2i_read_bio(BIO *in, BU { /* no data body so go round again */ eos++; + if (eos < 0) + { + ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_HEADER_TOO_LONG); + goto err; + } want=HEADER_SIZE; } else if (eos && (c.slen == 0) && (c.tag == V_ASN1_EOC)) @@ -220,10 +227,16 @@ static int asn1_d2i_read_bio(BIO *in, BU else { /* suck in c.slen bytes of data */ - want=(int)c.slen; + want=c.slen; if (want > (len-off)) { want-=(len-off); + if (want > INT_MAX /* BIO_read takes an int length */ || + len+want < len) + { + ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG); + goto err; + } if (!BUF_MEM_grow_clean(b,len+want)) { ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE); @@ -238,11 +251,18 @@ static int asn1_d2i_read_bio(BIO *in, BU ASN1_R_NOT_ENOUGH_DATA); goto err; } + /* This can't overflow because + * |len+want| didn't overflow. */ len+=i; - want -= i; + want-=i; } } - off+=(int)c.slen; + if (off + c.slen < off) + { + ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG); + goto err; + } + off+=c.slen; if (eos <= 0) { break; @@ -252,9 +272,15 @@ static int asn1_d2i_read_bio(BIO *in, BU } } + if (off > INT_MAX) + { + ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG); + goto err; + } + *pb = b; return off; err: if (b != NULL) BUF_MEM_free(b); - return(ret); + return -1; } Index: lib/libssl/src/crypto/buffer/buffer.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/buffer/buffer.c,v retrieving revision 1.8 retrieving revision 1.8.4.1 diff -u -p -r1.8 -r1.8.4.1 --- lib/libssl/src/crypto/buffer/buffer.c 1 Oct 2010 22:58:54 -0000 1.8 +++ lib/libssl/src/crypto/buffer/buffer.c 22 Apr 2012 01:38:23 -0000 1.8.4.1 @@ -60,6 +60,11 @@ #include "cryptlib.h" #include +/* LIMIT_BEFORE_EXPANSION is the maximum n such that (n+3)/3*4 < 2**31. That + * function is applied in several functions in this file and this limit ensures + * that the result fits in an int. */ +#define LIMIT_BEFORE_EXPANSION 0x5ffffffc + BUF_MEM *BUF_MEM_new(void) { BUF_MEM *ret; @@ -105,6 +110,12 @@ int BUF_MEM_grow(BUF_MEM *str, size_t le str->length=len; return(len); } + /* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */ + if (len > LIMIT_BEFORE_EXPANSION) + { + BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE); + return 0; + } n=(len+3)/3*4; if (str->data == NULL) ret=OPENSSL_malloc(n); @@ -141,6 +152,12 @@ int BUF_MEM_grow_clean(BUF_MEM *str, siz memset(&str->data[str->length],0,len-str->length); str->length=len; return(len); + } + /* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */ + if (len > LIMIT_BEFORE_EXPANSION) + { + BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE); + return 0; } n=(len+3)/3*4; if (str->data == NULL) 5.0/PaxHeaders.12213/hp30000407550001756001161000000000036116501551410011727xustar0030 atime=1783552627.968690919 5.0/hp300004075500017560011610000000000001165015514100110755ustar00ssyncsync5.0/PaxHeaders.12213/hppa00407550001756001161000000000036116501551410012025xustar0030 atime=1783552627.968690919 5.0/hppa004075500017560011610000000000001165015514100111735ustar00ssyncsync5.0/PaxHeaders.12213/i38600407550001756001161000000000036116501551410011566xustar0030 atime=1783552627.968690919 5.0/i386004075500017560011610000000000001165015514100107345ustar00ssyncsync5.0/PaxHeaders.12213/landisk00407550001756001161000000000036116501551410012522xustar0030 atime=1783552627.968690919 5.0/landisk004075500017560011610000000000001165015514100116705ustar00ssyncsync5.0/PaxHeaders.12213/luna88k00407550001756001161000000000036116501551410012367xustar0030 atime=1783552627.968690919 5.0/luna88k004075500017560011610000000000001165015514100115355ustar00ssyncsync5.0/PaxHeaders.12213/m68k00407550001756001161000000000036116501551410011662xustar0030 atime=1783552627.968690919 5.0/m68k004075500017560011610000000000001165015514100110305ustar00ssyncsync5.0/PaxHeaders.12213/mac68k00407550001756001161000000000036116501551410012166xustar0030 atime=1783552627.968690919 5.0/mac68k004075500017560011610000000000001165015514100113345ustar00ssyncsync5.0/PaxHeaders.12213/macppc00407550001756001161000000000036116501551410012340xustar0030 atime=1783552627.968690919 5.0/macppc004075500017560011610000000000001165015514100115065ustar00ssyncsync5.0/PaxHeaders.12213/mvme68k00407550001756001161000000000036116501551410012372xustar0030 atime=1783552627.968690919 5.0/mvme68k004075500017560011610000000000001165015514100115405ustar00ssyncsync5.0/PaxHeaders.12213/mvme88k00407550001756001161000000000036116501551410012374xustar0030 atime=1783552627.968690919 5.0/mvme88k004075500017560011610000000000001165015514100115425ustar00ssyncsync5.0/PaxHeaders.12213/ports00407550001756001161000000000036116501551410012244xustar0030 atime=1783552627.968690919 5.0/ports004075500017560011610000000000001165015514100114125ustar00ssyncsync5.0/PaxHeaders.12213/powerpc00407550001756001161000000000036116501551410012554xustar0030 atime=1783552627.968690919 5.0/powerpc004075500017560011610000000000001165015514100117225ustar00ssyncsync5.0/PaxHeaders.12213/sgi00407550001756001161000000000036116501551410011657xustar0030 atime=1783552627.968690919 5.0/sgi004075500017560011610000000000001165015514100110255ustar00ssyncsync5.0/PaxHeaders.12213/socppc00407550001756001161000000000036116501551410012364xustar0030 atime=1783552627.968690919 5.0/socppc004075500017560011610000000000001165015514100115325ustar00ssyncsync5.0/PaxHeaders.12213/sparc00407550001756001161000000000036116501551410012205xustar0030 atime=1783552627.968690919 5.0/sparc004075500017560011610000000000001165015514100113535ustar00ssyncsync5.0/PaxHeaders.12213/sparc6400407550001756001161000000000036116501551410012357xustar0030 atime=1783552627.968690919 5.0/sparc64004075500017560011610000000000001165015514100115255ustar00ssyncsync5.0/PaxHeaders.12213/vax00407550001756001161000000000036116501551410011673xustar0030 atime=1783552627.968690919 5.0/vax004075500017560011610000000000001165015514100110415ustar00ssyncsync5.0/PaxHeaders.12213/zaurus00407550001756001161000000000036116501551410012426xustar0030 atime=1783552627.968690919 5.0/zaurus004075500017560011610000000000001165015514100115745ustar00ssyncsync