./PaxHeaders.49427/6.000407550001756001161000000000074127501442060011260xustar0030 mtime=1470154886.744679313 30 atime=1783552628.008688802 6.0004075500017560011610000000000001275014420600102465ustar00ssyncsync6.0/PaxHeaders.49427/common00407550001756001161000000000074131652142560012417xustar0030 mtime=1507137710.199383005 30 atime=1783552628.008688802 6.0/common004075500017560011610000000000001316521425600115425ustar00ssyncsync6.0/common/PaxHeaders.49427/042_perl.patch.sig01006440001756001161000000000074131613251030015605xustar0030 mtime=1506126403.096330989 30 atime=1783552628.018687845 6.0/common/042_perl.patch.sig010064400017560011610000000076331316132510300147460ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ5cFmAM9fuzSw/Nc6MHqRHojdlOqPwSDmI/ptdtOKT32Q1op9aDaHoPkCaWBRrHnRMwH9jXWvFDgzqNTxjdRqwY= OpenBSD 6.0 errata 042, September 22, 2017: A buffer over-read and heap overflow in perl's regexp may result in a crash or memory leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 042_perl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install perl: cd /usr/src/gnu/usr.bin/perl/ make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: gnu/usr.bin/perl/regcomp.c =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/regcomp.c,v retrieving revision 1.21 diff -u -p -r1.21 regcomp.c --- gnu/usr.bin/perl/regcomp.c 3 Jul 2016 01:07:48 -0000 1.21 +++ gnu/usr.bin/perl/regcomp.c 19 Sep 2017 02:06:07 -0000 @@ -10836,12 +10836,14 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx } sv_catpv(substitute_parse, ")"); - RExC_parse = SvPV(substitute_parse, len); + len = SvCUR(substitute_parse); /* Don't allow empty number */ if (len < 8) { vFAIL("Invalid hexadecimal number in \\N{U+...}"); } + + RExC_parse = SvPV_nolen(substitute_parse); RExC_end = RExC_parse + len; /* The values are Unicode, and therefore not subject to recoding */ @@ -11168,7 +11170,7 @@ S_regatom(pTHX_ RExC_state_t *pRExC_stat dVAR; regnode *ret = NULL; I32 flags = 0; - char *parse_start = RExC_parse; + char *parse_start; U8 op; int invert = 0; @@ -11181,6 +11183,7 @@ S_regatom(pTHX_ RExC_state_t *pRExC_stat PERL_ARGS_ASSERT_REGATOM; tryagain: + parse_start = RExC_parse; switch ((U8)*RExC_parse) { case '^': RExC_seen_zerolen++; @@ -11269,7 +11272,7 @@ tryagain: break; case '{': if (!regcurly(RExC_parse, FALSE)) { - RExC_parse++; + RExC_parse = parse_start; goto defchar; } /* FALL THROUGH */ @@ -11486,7 +11489,7 @@ tryagain: FALSE /* not strict */ )) { if (*flagp & RESTART_UTF8) return NULL; - RExC_parse--; + RExC_parse = parse_start; goto defchar; } break; @@ -11588,6 +11591,7 @@ tryagain: && *RExC_parse != '8' && *RExC_parse != '9')) { /* Probably a character specified in octal, e.g. \35 */ + RExC_parse = parse_start; goto defchar; } } @@ -11638,7 +11642,7 @@ tryagain: default: /* Do not generate "unrecognized" warnings here, we fall back into the quick-grab loop below */ - parse_start--; + RExC_parse = parse_start; goto defchar; } break; @@ -11652,10 +11656,6 @@ tryagain: default: - parse_start = RExC_parse - 1; - - RExC_parse++; - defchar: { STRLEN len = 0; UV ender = 0; @@ -11719,7 +11719,12 @@ tryagain: * could back off to end with only a code point that isn't such a * non-final, but it is possible for there not to be any in the * entire node. */ - for (p = RExC_parse - 1; + + assert( ! UTF /* Is at the beginning of a character */ + || UTF8_IS_INVARIANT(UCHARAT(RExC_parse)) + || UTF8_IS_START(UCHARAT(RExC_parse))); + + for (p = RExC_parse; len < upper_parse && p < RExC_end; len++) { @@ -11792,6 +11797,7 @@ tryagain: goto loopdone; } p = RExC_parse; + RExC_parse = parse_start; if (ender > 0xff) { REQUIRE_UTF8; } 6.0/common/PaxHeaders.49427/022_libssl.patch.sig01006440001756001161000000000074131037040040016126xustar0030 mtime=1494190084.240794883 30 atime=1783552628.018687845 6.0/common/022_libssl.patch.sig010064400017560011610000000026631310370400400152650ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQxiq51WTIK3qrNKc5AWhXdPYQuvyLDUcT1XyY0eMjaeMElPHQNTmLhh71i2s2ioVSx7VX+y78HVn9KT09SJItA4= OpenBSD 6.0 errata 022, May 7, 2017: Incorrect DTLS cookie handling can result in a NULL pointer dereference. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 022_libssl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libssl: cd /usr/src/lib/libssl/ssl make obj make depend make make install Index: lib/libssl/src/ssl/s3_srvr.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/Attic/s3_srvr.c,v retrieving revision 1.126.2.1 retrieving revision 1.126.2.2 diff -u -p -r1.126.2.1 -r1.126.2.2 --- lib/libssl/src/ssl/s3_srvr.c 3 Oct 2016 11:23:13 -0000 1.126.2.1 +++ lib/libssl/src/ssl/s3_srvr.c 30 Apr 2017 00:06:09 -0000 1.126.2.2 @@ -721,7 +721,7 @@ ssl3_send_hello_request(SSL *s) int ssl3_get_client_hello(SSL *s) { - int i, j, ok, al, ret = -1; + int i, j, ok, al, ret = -1, cookie_valid = 0; unsigned int cookie_len; long n; unsigned long id; @@ -887,7 +887,7 @@ ssl3_get_client_hello(SSL *s) goto f_err; } - ret = 2; + cookie_valid = 1; } p += cookie_len; @@ -1070,8 +1070,8 @@ ssl3_get_client_hello(SSL *s) goto err; } - if (ret < 0) - ret = 1; + ret = cookie_valid ? 2 : 1; + if (0) { truncated: al = SSL_AD_DECODE_ERROR; 6.0/common/PaxHeaders.49427/010_smtpd.patch.sig01006440001756001161000000000074127744731620016007xustar0030 mtime=1475507826.687347449 30 atime=1783552628.018687845 6.0/common/010_smtpd.patch.sig010064400017560011610000000025041277447316200151400ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ24PCOyb2HBxKaacU+v/hRSTKWxD36nnioxkUEf8rVVyhIhiqYHZzxv+A+vFP5uZcp2z9fIhREI0uPpgkmODmg4= OpenBSD 6.0 errata 10, Oct 3, 2016: A bug in the smtp session logic can lead to a server crash. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 010_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make obj make depend make make install Index: usr.sbin/smtpd/smtp_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtp_session.c,v retrieving revision 1.284 diff -u -p -r1.284 smtp_session.c --- usr.sbin/smtpd/smtp_session.c 22 Jul 2016 12:12:29 -0000 1.284 +++ usr.sbin/smtpd/smtp_session.c 2 Oct 2016 17:18:06 -0000 @@ -1151,6 +1151,7 @@ smtp_filter_response(uint64_t id, int qu line = line ? line : "Message rejected"; smtp_reply(s, "%d %s", code, line); smtp_enter_state(s, STATE_HELO); + s->phase = PHASE_SETUP; io_reload(&s->io); return; } @@ -1543,6 +1544,7 @@ smtp_data_io_done(struct smtp_session *s smtp_reply(s, "421 Internal server error"); smtp_tx_free(s->tx); smtp_enter_state(s, STATE_HELO); + s->phase = PHASE_SETUP; io_reload(&s->io); } else { 6.0/common/PaxHeaders.49427/011_xorg_libs.patch.sig01006440001756001161000000000074127750562760016655xustar0030 mtime=1475632318.864581839 30 atime=1783552628.018687845 6.0/common/011_xorg_libs.patch.sig010064400017560011610000001303771277505627600160200ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQx0DKD2B091kB8ZXQ35dPjluK10DF3CA0PJYu48Y2yCd+qMAoXNVA6kGVEYH/ZkgNgvwnpmLftHPOPO532mxwAk= OpenBSD 6.0 errata 11, Oct 4, 2016: Protocol handling issues in X Window System client libraries X.Org security advisory: October 4, 2016. Fix a number of issues in the way various X client libraries handle server responses. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 011_xorg_libs.patch.sig \ -m - | (cd /usr/xenocara && patch -p0) And then rebuild and install xenocara libs: cd /usr/xenocara/lib make obj make build Index: lib/libX11/src/FontNames.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libX11/src/FontNames.c,v retrieving revision 1.8 diff -u -p -u -r1.8 FontNames.c --- lib/libX11/src/FontNames.c 6 Apr 2015 20:57:59 -0000 1.8 +++ lib/libX11/src/FontNames.c 4 Oct 2016 16:11:57 -0000 @@ -66,7 +66,7 @@ int *actualCount) /* RETURN */ if (rep.nFonts) { flist = Xmalloc (rep.nFonts * sizeof(char *)); - if (rep.length < (INT_MAX >> 2)) { + if (rep.length > 0 && rep.length < (INT_MAX >> 2)) { rlen = rep.length << 2; ch = Xmalloc(rlen + 1); /* +1 to leave room for last null-terminator */ @@ -93,11 +93,22 @@ int *actualCount) /* RETURN */ if (ch + length < chend) { flist[i] = ch + 1; /* skip over length */ ch += length + 1; /* find next length ... */ - length = *(unsigned char *)ch; - *ch = '\0'; /* and replace with null-termination */ - count++; - } else - flist[i] = NULL; + if (ch <= chend) { + length = *(unsigned char *)ch; + *ch = '\0'; /* and replace with null-termination */ + count++; + } else { + Xfree(flist); + flist = NULL; + count = 0; + break; + } + } else { + Xfree(flist); + flist = NULL; + count = 0; + break; + } } } *actualCount = count; Index: lib/libX11/src/GetImage.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libX11/src/GetImage.c,v retrieving revision 1.5 diff -u -p -u -r1.5 GetImage.c --- lib/libX11/src/GetImage.c 23 May 2013 22:42:07 -0000 1.5 +++ lib/libX11/src/GetImage.c 4 Oct 2016 16:11:57 -0000 @@ -59,6 +59,7 @@ XImage *XGetImage ( char *data; unsigned long nbytes; XImage *image; + int planes; LockDisplay(dpy); GetReq (GetImage, req); /* @@ -91,18 +92,28 @@ XImage *XGetImage ( return (XImage *) NULL; } _XReadPad (dpy, data, nbytes); - if (format == XYPixmap) - image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual), - Ones (plane_mask & - (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))), - format, 0, data, width, height, dpy->bitmap_pad, 0); - else /* format == ZPixmap */ - image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual), - rep.depth, ZPixmap, 0, data, width, height, - _XGetScanlinePad(dpy, (int) rep.depth), 0); + if (format == XYPixmap) { + image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual), + Ones (plane_mask & + (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))), + format, 0, data, width, height, dpy->bitmap_pad, 0); + planes = image->depth; + } else { /* format == ZPixmap */ + image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual), + rep.depth, ZPixmap, 0, data, width, height, + _XGetScanlinePad(dpy, (int) rep.depth), 0); + planes = 1; + } if (!image) Xfree(data); + if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 || + INT_MAX / image->height <= image->bytes_per_line || + INT_MAX / planes <= image->height * image->bytes_per_line || + nbytes < planes * image->height * image->bytes_per_line) { + XDestroyImage(image); + image = NULL; + } UnlockDisplay(dpy); SyncHandle(); return (image); Index: lib/libX11/src/ListExt.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libX11/src/ListExt.c,v retrieving revision 1.7 diff -u -p -u -r1.7 ListExt.c --- lib/libX11/src/ListExt.c 6 Apr 2015 20:57:59 -0000 1.7 +++ lib/libX11/src/ListExt.c 4 Oct 2016 16:11:57 -0000 @@ -55,7 +55,7 @@ char **XListExtensions( if (rep.nExtensions) { list = Xmalloc (rep.nExtensions * sizeof (char *)); - if (rep.length < (INT_MAX >> 2)) { + if (rep.length > 0 && rep.length < (INT_MAX >> 2)) { rlen = rep.length << 2; ch = Xmalloc (rlen + 1); /* +1 to leave room for last null-terminator */ @@ -80,9 +80,13 @@ char **XListExtensions( if (ch + length < chend) { list[i] = ch+1; /* skip over length */ ch += length + 1; /* find next length ... */ - length = *ch; - *ch = '\0'; /* and replace with null-termination */ - count++; + if (ch <= chend) { + length = *ch; + *ch = '\0'; /* and replace with null-termination */ + count++; + } else { + list[i] = NULL; + } } else list[i] = NULL; } Index: lib/libX11/src/ModMap.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libX11/src/ModMap.c,v retrieving revision 1.9 diff -u -p -u -r1.9 ModMap.c --- lib/libX11/src/ModMap.c 6 Apr 2015 20:57:59 -0000 1.9 +++ lib/libX11/src/ModMap.c 4 Oct 2016 16:11:57 -0000 @@ -42,7 +42,8 @@ XGetModifierMapping(register Display *dp GetEmptyReq(GetModifierMapping, req); (void) _XReply (dpy, (xReply *)&rep, 0, xFalse); - if (rep.length < (INT_MAX >> 2)) { + if (rep.length < (INT_MAX >> 2) && + (rep.length >> 1) == rep.numKeyPerModifier) { nbytes = (unsigned long)rep.length << 2; res = Xmalloc(sizeof (XModifierKeymap)); if (res) Index: lib/libXfixes/src/Region.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXfixes/src/Region.c,v retrieving revision 1.4 diff -u -p -u -r1.4 Region.c --- lib/libXfixes/src/Region.c 31 May 2013 14:57:04 -0000 1.4 +++ lib/libXfixes/src/Region.c 4 Oct 2016 16:11:57 -0000 @@ -23,6 +23,7 @@ #ifdef HAVE_CONFIG_H #include #endif +#include #include "Xfixesint.h" XserverRegion @@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display bounds->y = rep.y; bounds->width = rep.width; bounds->height = rep.height; - nbytes = (long) rep.length << 2; - nrects = rep.length >> 1; - rects = Xmalloc (nrects * sizeof (XRectangle)); + + if (rep.length < (INT_MAX >> 2)) { + nbytes = (long) rep.length << 2; + nrects = rep.length >> 1; + rects = Xmalloc (nrects * sizeof (XRectangle)); + } else { + nbytes = 0; + nrects = 0; + rects = NULL; + } + if (!rects) { _XEatDataWords(dpy, rep.length); Index: lib/libXi/src/XGMotion.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGMotion.c,v retrieving revision 1.5 diff -u -p -u -r1.5 XGMotion.c --- lib/libXi/src/XGMotion.c 23 May 2013 22:42:10 -0000 1.5 +++ lib/libXi/src/XGMotion.c 4 Oct 2016 16:11:57 -0000 @@ -114,7 +114,8 @@ XGetDeviceMotionEvents( } /* rep.axes is a CARD8, so assume max number of axes for bounds check */ if (rep.nEvents < - (INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int))))) { + (INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int)))) && + rep.nEvents * (rep.axes + 1) <= rep.length) { size_t bsize = rep.nEvents * (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int))); bufp = Xmalloc(bsize); Index: lib/libXi/src/XGetBMap.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGetBMap.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XGetBMap.c --- lib/libXi/src/XGetBMap.c 23 May 2013 22:42:10 -0000 1.4 +++ lib/libXi/src/XGetBMap.c 4 Oct 2016 16:11:57 -0000 @@ -92,7 +92,8 @@ XGetDeviceButtonMapping( status = _XReply(dpy, (xReply *) & rep, 0, xFalse); if (status == 1) { - if (rep.length <= (sizeof(mapping) >> 2)) { + if (rep.length <= (sizeof(mapping) >> 2) && + rep.nElts <= (rep.length << 2)) { unsigned long nbytes = rep.length << 2; _XRead(dpy, (char *)mapping, nbytes); Index: lib/libXi/src/XGetDCtl.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGetDCtl.c,v retrieving revision 1.7 diff -u -p -u -r1.7 XGetDCtl.c --- lib/libXi/src/XGetDCtl.c 9 May 2014 19:55:33 -0000 1.7 +++ lib/libXi/src/XGetDCtl.c 4 Oct 2016 16:11:57 -0000 @@ -93,7 +93,8 @@ XGetDeviceControl( if (rep.length > 0) { unsigned long nbytes; size_t size = 0; - if (rep.length < (INT_MAX >> 2)) { + if (rep.length < (INT_MAX >> 2) && + (rep.length << 2) >= sizeof(xDeviceState)) { nbytes = (unsigned long) rep.length << 2; d = Xmalloc(nbytes); } @@ -117,7 +118,8 @@ XGetDeviceControl( size_t val_size; r = (xDeviceResolutionState *) d; - if (r->num_valuators >= (INT_MAX / (3 * sizeof(int)))) + if (sizeof(xDeviceResolutionState) > nbytes || + r->num_valuators >= (INT_MAX / (3 * sizeof(int)))) goto out; val_size = 3 * sizeof(int) * r->num_valuators; if ((sizeof(xDeviceResolutionState) + val_size) > nbytes) Index: lib/libXi/src/XGetFCtl.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGetFCtl.c,v retrieving revision 1.6 diff -u -p -u -r1.6 XGetFCtl.c --- lib/libXi/src/XGetFCtl.c 9 May 2014 19:55:33 -0000 1.6 +++ lib/libXi/src/XGetFCtl.c 4 Oct 2016 16:11:57 -0000 @@ -73,6 +73,7 @@ XGetFeedbackControl( XFeedbackState *Sav = NULL; xFeedbackState *f = NULL; xFeedbackState *sav = NULL; + char *end = NULL; xGetFeedbackControlReq *req; xGetFeedbackControlReply rep; XExtDisplayInfo *info = XInput_find_display(dpy); @@ -105,10 +106,12 @@ XGetFeedbackControl( goto out; } sav = f; + end = (char *)f + nbytes; _XRead(dpy, (char *)f, nbytes); for (i = 0; i < *num_feedbacks; i++) { - if (f->length > nbytes) + if ((char *)f + sizeof(*f) > end || + f->length == 0 || f->length > nbytes) goto out; nbytes -= f->length; @@ -125,6 +128,8 @@ XGetFeedbackControl( case StringFeedbackClass: { xStringFeedbackState *strf = (xStringFeedbackState *) f; + if ((char *)f + sizeof(*strf) > end) + goto out; size += sizeof(XStringFeedbackState) + (strf->num_syms_supported * sizeof(KeySym)); } Index: lib/libXi/src/XGetKMap.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGetKMap.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XGetKMap.c --- lib/libXi/src/XGetKMap.c 23 May 2013 22:42:10 -0000 1.4 +++ lib/libXi/src/XGetKMap.c 4 Oct 2016 16:11:57 -0000 @@ -54,6 +54,7 @@ SOFTWARE. #include #endif +#include #include #include #include @@ -93,9 +94,16 @@ XGetDeviceKeyMapping(register Display * return (KeySym *) NULL; } if (rep.length > 0) { - *syms_per_code = rep.keySymsPerKeyCode; - nbytes = (long)rep.length << 2; - mapping = (KeySym *) Xmalloc((unsigned)nbytes); + if (rep.length < INT_MAX >> 2 && + rep.length == rep.keySymsPerKeyCode * keycount) { + *syms_per_code = rep.keySymsPerKeyCode; + nbytes = (long)rep.length << 2; + mapping = (KeySym *) Xmalloc((unsigned)nbytes); + } else { + *syms_per_code = 0; + nbytes = 0; + mapping = NULL; + } if (mapping) _XRead(dpy, (char *)mapping, nbytes); else Index: lib/libXi/src/XGetMMap.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XGetMMap.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XGetMMap.c --- lib/libXi/src/XGetMMap.c 23 May 2013 22:42:10 -0000 1.4 +++ lib/libXi/src/XGetMMap.c 4 Oct 2016 16:11:57 -0000 @@ -53,6 +53,7 @@ SOFTWARE. #include #endif +#include #include #include #include @@ -85,8 +86,14 @@ XGetDeviceModifierMapping( SyncHandle(); return (XModifierKeymap *) NULL; } - nbytes = (unsigned long)rep.length << 2; - res = (XModifierKeymap *) Xmalloc(sizeof(XModifierKeymap)); + if (rep.length < (INT_MAX >> 2) && + rep.numKeyPerModifier == rep.length >> 1) { + nbytes = (unsigned long)rep.length << 2; + res = (XModifierKeymap *) Xmalloc(sizeof(XModifierKeymap)); + } else { + nbytes = 0; + res = NULL; + } if (res) { res->modifiermap = (KeyCode *) Xmalloc(nbytes); if (res->modifiermap) Index: lib/libXi/src/XIQueryDevice.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XIQueryDevice.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XIQueryDevice.c --- lib/libXi/src/XIQueryDevice.c 11 Jun 2012 19:24:49 -0000 1.4 +++ lib/libXi/src/XIQueryDevice.c 4 Oct 2016 16:11:57 -0000 @@ -26,6 +26,7 @@ #include #endif +#include #include #include #include @@ -43,6 +44,7 @@ XIQueryDevice(Display *dpy, int deviceid xXIQueryDeviceReq *req; xXIQueryDeviceReply reply; char *ptr; + char *end; int i; char *buf; @@ -60,14 +62,24 @@ XIQueryDevice(Display *dpy, int deviceid if (!_XReply(dpy, (xReply*) &reply, 0, xFalse)) goto error; - *ndevices_return = reply.num_devices; - info = Xmalloc((reply.num_devices + 1) * sizeof(XIDeviceInfo)); + if (reply.length < INT_MAX / 4) + { + *ndevices_return = reply.num_devices; + info = Xmalloc((reply.num_devices + 1) * sizeof(XIDeviceInfo)); + } + else + { + *ndevices_return = 0; + info = NULL; + } + if (!info) goto error; buf = Xmalloc(reply.length * 4); _XRead(dpy, buf, reply.length * 4); ptr = buf; + end = buf + reply.length * 4; /* info is a null-terminated array */ info[reply.num_devices].name = NULL; @@ -79,6 +91,9 @@ XIQueryDevice(Display *dpy, int deviceid XIDeviceInfo *lib = &info[i]; xXIDeviceInfo *wire = (xXIDeviceInfo*)ptr; + if (ptr + sizeof(xXIDeviceInfo) > end) + goto error_loop; + lib->deviceid = wire->deviceid; lib->use = wire->use; lib->attachment = wire->attachment; @@ -87,12 +102,23 @@ XIQueryDevice(Display *dpy, int deviceid ptr += sizeof(xXIDeviceInfo); + if (ptr + wire->name_len > end) + goto error_loop; + lib->name = Xcalloc(wire->name_len + 1, 1); + if (lib->name == NULL) + goto error_loop; strncpy(lib->name, ptr, wire->name_len); + lib->name[wire->name_len] = '\0'; ptr += ((wire->name_len + 3)/4) * 4; sz = size_classes((xXIAnyInfo*)ptr, nclasses); lib->classes = Xmalloc(sz); + if (lib->classes == NULL) + { + Xfree(lib->name); + goto error_loop; + } ptr += copy_classes(lib, (xXIAnyInfo*)ptr, &nclasses); /* We skip over unused classes */ lib->num_classes = nclasses; @@ -103,6 +129,12 @@ XIQueryDevice(Display *dpy, int deviceid SyncHandle(); return info; +error_loop: + while (--i >= 0) + { + Xfree(info[i].name); + Xfree(info[i].classes); + } error: UnlockDisplay(dpy); SyncHandle(); Index: lib/libXi/src/XListDev.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XListDev.c,v retrieving revision 1.7 diff -u -p -u -r1.7 XListDev.c --- lib/libXi/src/XListDev.c 9 May 2014 19:55:33 -0000 1.7 +++ lib/libXi/src/XListDev.c 4 Oct 2016 16:11:57 -0000 @@ -74,7 +74,7 @@ static int pad_to_xid(int base_size) } static size_t -SizeClassInfo(xAnyClassPtr *any, int num_classes) +SizeClassInfo(xAnyClassPtr *any, size_t len, int num_classes) { int size = 0; int j; @@ -90,6 +90,8 @@ SizeClassInfo(xAnyClassPtr *any, int num { xValuatorInfoPtr v; + if (len < sizeof(v)) + return 0; v = (xValuatorInfoPtr) *any; size += pad_to_xid(sizeof(XValuatorInfo) + (v->num_axes * sizeof(XAxisInfo))); @@ -98,6 +100,8 @@ SizeClassInfo(xAnyClassPtr *any, int num default: break; } + if ((*any)->length > len) + return 0; *any = (xAnyClassPtr) ((char *)(*any) + (*any)->length); } @@ -170,7 +174,7 @@ XListInputDevices( register Display *dpy, int *ndevices) { - size_t size; + size_t s, size; xListInputDevicesReq *req; xListInputDevicesReply rep; xDeviceInfo *list, *slist = NULL; @@ -178,6 +182,7 @@ XListInputDevices( XDeviceInfo *clist = NULL; xAnyClassPtr any, sav_any; XAnyClassPtr Any; + char *end = NULL; unsigned char *nptr, *Nptr; int i; unsigned long rlen; @@ -213,16 +218,20 @@ XListInputDevices( any = (xAnyClassPtr) ((char *)list + (*ndevices * sizeof(xDeviceInfo))); sav_any = any; + end = (char *)list + rlen; for (i = 0; i < *ndevices; i++, list++) { - size += SizeClassInfo(&any, (int)list->num_classes); + s = SizeClassInfo(&any, end - (char *)any, (int)list->num_classes); + if (!s) + goto out; + size += s; } - Nptr = ((unsigned char *)list) + rlen + 1; + Nptr = ((unsigned char *)list) + rlen; for (i = 0, nptr = (unsigned char *)any; i < *ndevices; i++) { + if (nptr >= Nptr) + goto out; size += *nptr + 1; nptr += (*nptr + 1); - if (nptr > Nptr) - goto out; } clist = (XDeviceInfoPtr) Xmalloc(size); Index: lib/libXi/src/XOpenDev.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XOpenDev.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XOpenDev.c --- lib/libXi/src/XOpenDev.c 23 May 2013 22:42:10 -0000 1.4 +++ lib/libXi/src/XOpenDev.c 4 Oct 2016 16:11:57 -0000 @@ -53,6 +53,7 @@ SOFTWARE. #include #endif +#include #include #include #include @@ -86,9 +87,15 @@ XOpenDevice( return (XDevice *) NULL; } - rlen = rep.length << 2; - dev = (XDevice *) Xmalloc(sizeof(XDevice) + rep.num_classes * - sizeof(XInputClassInfo)); + if (rep.length < INT_MAX >> 2 && + (rep.length << 2) >= rep.num_classes * sizeof(xInputClassInfo)) { + rlen = rep.length << 2; + dev = (XDevice *) Xmalloc(sizeof(XDevice) + rep.num_classes * + sizeof(XInputClassInfo)); + } else { + rlen = 0; + dev = NULL; + } if (dev) { int dlen; /* data length */ Index: lib/libXi/src/XQueryDv.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXi/src/XQueryDv.c,v retrieving revision 1.5 diff -u -p -u -r1.5 XQueryDv.c --- lib/libXi/src/XQueryDv.c 23 May 2013 22:42:10 -0000 1.5 +++ lib/libXi/src/XQueryDv.c 4 Oct 2016 16:11:57 -0000 @@ -73,7 +73,7 @@ XQueryDeviceState( xQueryDeviceStateReply rep; XDeviceState *state = NULL; XInputClass *any, *Any; - char *data = NULL; + char *data = NULL, *end = NULL; XExtDisplayInfo *info = XInput_find_display(dpy); LockDisplay(dpy); @@ -92,6 +92,7 @@ XQueryDeviceState( if (rep.length < (INT_MAX >> 2)) { rlen = (unsigned long) rep.length << 2; data = Xmalloc(rlen); + end = data + rlen; } if (!data) { _XEatDataWords(dpy, rep.length); @@ -100,7 +101,8 @@ XQueryDeviceState( _XRead(dpy, data, rlen); for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) { - if (any->length > rlen) + if ((char *)any + sizeof(XInputClass) > end || + any->length == 0 || any->length > rlen) goto out; rlen -= any->length; @@ -114,6 +116,8 @@ XQueryDeviceState( case ValuatorClass: { xValuatorState *v = (xValuatorState *) any; + if ((char *)any + sizeof(xValuatorState) > end) + goto out; size += (sizeof(XValuatorState) + (v->num_valuators * sizeof(int))); } Index: lib/libXrandr/src/XrrConfig.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrConfig.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XrrConfig.c --- lib/libXrandr/src/XrrConfig.c 9 Mar 2013 16:34:37 -0000 1.4 +++ lib/libXrandr/src/XrrConfig.c 4 Oct 2016 16:11:58 -0000 @@ -29,6 +29,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -272,23 +273,30 @@ static XRRScreenConfiguration *_XRRGetSc rep.rate = 0; rep.nrateEnts = 0; } + if (rep.length < INT_MAX >> 2) { + nbytes = (long) rep.length << 2; - nbytes = (long) rep.length << 2; + nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) + + ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF(CARD16) */); - nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) + - ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF (CARD16) */); + /* + * first we must compute how much space to allocate for + * randr library's use; we'll allocate the structures in a single + * allocation, on cleanlyness grounds. + */ + + rbytes = sizeof (XRRScreenConfiguration) + + (rep.nSizes * sizeof (XRRScreenSize) + + rep.nrateEnts * sizeof (int)); - /* - * first we must compute how much space to allocate for - * randr library's use; we'll allocate the structures in a single - * allocation, on cleanlyness grounds. - */ - - rbytes = sizeof (XRRScreenConfiguration) + - (rep.nSizes * sizeof (XRRScreenSize) + - rep.nrateEnts * sizeof (int)); + scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes); + } else { + nbytes = 0; + nbytesRead = 0; + rbytes = 0; + scp = NULL; + } - scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes); if (scp == NULL) { _XEatData (dpy, (unsigned long) nbytes); return NULL; Index: lib/libXrandr/src/XrrCrtc.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrCrtc.c,v retrieving revision 1.7 diff -u -p -u -r1.7 XrrCrtc.c --- lib/libXrandr/src/XrrCrtc.c 6 Mar 2016 13:37:21 -0000 1.7 +++ lib/libXrandr/src/XrrCrtc.c 4 Oct 2016 16:11:58 -0000 @@ -24,6 +24,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -57,22 +58,33 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenR return NULL; } - nbytes = (long) rep.length << 2; + if (rep.length < INT_MAX >> 2) + { + nbytes = (long) rep.length << 2; - nbytesRead = (long) (rep.nOutput * 4 + - rep.nPossibleOutput * 4); + nbytesRead = (long) (rep.nOutput * 4 + + rep.nPossibleOutput * 4); - /* - * first we must compute how much space to allocate for - * randr library's use; we'll allocate the structures in a single - * allocation, on cleanlyness grounds. - */ + /* + * first we must compute how much space to allocate for + * randr library's use; we'll allocate the structures in a single + * allocation, on cleanlyness grounds. + */ + + rbytes = (sizeof (XRRCrtcInfo) + + rep.nOutput * sizeof (RROutput) + + rep.nPossibleOutput * sizeof (RROutput)); - rbytes = (sizeof (XRRCrtcInfo) + - rep.nOutput * sizeof (RROutput) + - rep.nPossibleOutput * sizeof (RROutput)); + xci = (XRRCrtcInfo *) Xmalloc(rbytes); + } + else + { + nbytes = 0; + nbytesRead = 0; + rbytes = 0; + xci = NULL; + } - xci = (XRRCrtcInfo *) Xmalloc(rbytes); if (xci == NULL) { _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); @@ -194,12 +206,21 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc cr if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) goto out; - nbytes = (long) rep.length << 2; + if (rep.length < INT_MAX >> 2) + { + nbytes = (long) rep.length << 2; - /* three channels of CARD16 data */ - nbytesRead = (rep.size * 2 * 3); + /* three channels of CARD16 data */ + nbytesRead = (rep.size * 2 * 3); - crtc_gamma = XRRAllocGamma (rep.size); + crtc_gamma = XRRAllocGamma (rep.size); + } + else + { + nbytes = 0; + nbytesRead = 0; + crtc_gamma = NULL; + } if (!crtc_gamma) { @@ -357,7 +378,7 @@ XRRGetCrtcTransform (Display *dpy, xRRGetCrtcTransformReq *req; int major_version, minor_version; XRRCrtcTransformAttributes *attr; - char *extra = NULL, *e; + char *extra = NULL, *end = NULL, *e; int p; *attributes = NULL; @@ -395,9 +416,17 @@ XRRGetCrtcTransform (Display *dpy, else { int extraBytes = rep.length * 4 - CrtcTransformExtra; - extra = Xmalloc (extraBytes); + if (rep.length < INT_MAX / 4 && + rep.length * 4 >= CrtcTransformExtra) { + extra = Xmalloc (extraBytes); + end = extra + extraBytes; + } else + extra = NULL; if (!extra) { - _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2)); + if (rep.length > (CrtcTransformExtra >> 2)) + _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2)); + else + _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return False; @@ -429,22 +458,38 @@ XRRGetCrtcTransform (Display *dpy, e = extra; + if (e + rep.pendingNbytesFilter > end) { + XFree (extra); + return False; + } memcpy (attr->pendingFilter, e, rep.pendingNbytesFilter); attr->pendingFilter[rep.pendingNbytesFilter] = '\0'; e += (rep.pendingNbytesFilter + 3) & ~3; for (p = 0; p < rep.pendingNparamsFilter; p++) { INT32 f; + if (e + 4 > end) { + XFree (extra); + return False; + } memcpy (&f, e, 4); e += 4; attr->pendingParams[p] = (XFixed) f; } attr->pendingNparams = rep.pendingNparamsFilter; + if (e + rep.currentNbytesFilter > end) { + XFree (extra); + return False; + } memcpy (attr->currentFilter, e, rep.currentNbytesFilter); attr->currentFilter[rep.currentNbytesFilter] = '\0'; e += (rep.currentNbytesFilter + 3) & ~3; for (p = 0; p < rep.currentNparamsFilter; p++) { INT32 f; + if (e + 4 > end) { + XFree (extra); + return False; + } memcpy (&f, e, 4); e += 4; attr->currentParams[p] = (XFixed) f; Index: lib/libXrandr/src/XrrMonitor.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrMonitor.c,v retrieving revision 1.1 diff -u -p -u -r1.1 XrrMonitor.c --- lib/libXrandr/src/XrrMonitor.c 6 Mar 2016 13:37:21 -0000 1.1 +++ lib/libXrandr/src/XrrMonitor.c 4 Oct 2016 16:11:58 -0000 @@ -24,6 +24,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -65,6 +66,15 @@ XRRGetMonitors(Display *dpy, Window wind return NULL; } + if (rep.length > INT_MAX >> 2 || + rep.nmonitors > INT_MAX / SIZEOF(xRRMonitorInfo) || + rep.noutputs > INT_MAX / 4 || + rep.nmonitors * SIZEOF(xRRMonitorInfo) > INT_MAX - rep.noutputs * 4) { + _XEatData (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } nbytes = (long) rep.length << 2; nmon = rep.nmonitors; noutput = rep.noutputs; @@ -111,6 +121,14 @@ XRRGetMonitors(Display *dpy, Window wind mon[m].outputs = output; buf += SIZEOF (xRRMonitorInfo); xoutput = (CARD32 *) buf; + if (xmon->noutput > rep.noutputs) { + Xfree(buf); + Xfree(mon); + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } + rep.noutputs -= xmon->noutput; for (o = 0; o < xmon->noutput; o++) output[o] = xoutput[o]; output += xmon->noutput; Index: lib/libXrandr/src/XrrOutput.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrOutput.c,v retrieving revision 1.5 diff -u -p -u -r1.5 XrrOutput.c --- lib/libXrandr/src/XrrOutput.c 6 Mar 2016 13:37:21 -0000 1.5 +++ lib/libXrandr/src/XrrOutput.c 4 Oct 2016 16:11:58 -0000 @@ -25,6 +25,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -60,6 +61,16 @@ XRRGetOutputInfo (Display *dpy, XRRScree return NULL; } + if (rep.length > INT_MAX >> 2 || rep.length < (OutputInfoExtra >> 2)) + { + if (rep.length > (OutputInfoExtra >> 2)) + _XEatDataWords (dpy, rep.length - (OutputInfoExtra >> 2)); + else + _XEatDataWords (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } nbytes = ((long) (rep.length) << 2) - OutputInfoExtra; nbytesRead = (long) (rep.nCrtcs * 4 + Index: lib/libXrandr/src/XrrProvider.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrProvider.c,v retrieving revision 1.4 diff -u -p -u -r1.4 XrrProvider.c --- lib/libXrandr/src/XrrProvider.c 6 Mar 2016 13:37:21 -0000 1.4 +++ lib/libXrandr/src/XrrProvider.c 4 Oct 2016 16:11:58 -0000 @@ -25,6 +25,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -59,12 +60,20 @@ XRRGetProviderResources(Display *dpy, Wi return NULL; } - nbytes = (long) rep.length << 2; + if (rep.length < INT_MAX >> 2) { + nbytes = (long) rep.length << 2; - nbytesRead = (long) (rep.nProviders * 4); + nbytesRead = (long) (rep.nProviders * 4); - rbytes = (sizeof(XRRProviderResources) + rep.nProviders * sizeof(RRProvider)); - xrpr = (XRRProviderResources *) Xmalloc(rbytes); + rbytes = (sizeof(XRRProviderResources) + rep.nProviders * + sizeof(RRProvider)); + xrpr = (XRRProviderResources *) Xmalloc(rbytes); + } else { + nbytes = 0; + nbytesRead = 0; + rbytes = 0; + xrpr = NULL; + } if (xrpr == NULL) { _XEatDataWords (dpy, rep.length); @@ -116,6 +125,17 @@ XRRGetProviderInfo(Display *dpy, XRRScre if (!_XReply (dpy, (xReply *) &rep, ProviderInfoExtra >> 2, xFalse)) { + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } + + if (rep.length > INT_MAX >> 2 || rep.length < ProviderInfoExtra >> 2) + { + if (rep.length < ProviderInfoExtra >> 2) + _XEatDataWords (dpy, rep.length); + else + _XEatDataWords (dpy, rep.length - (ProviderInfoExtra >> 2)); UnlockDisplay (dpy); SyncHandle (); return NULL; Index: lib/libXrandr/src/XrrScreen.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrandr/src/XrrScreen.c,v retrieving revision 1.5 diff -u -p -u -r1.5 XrrScreen.c --- lib/libXrandr/src/XrrScreen.c 6 Mar 2016 13:37:21 -0000 1.5 +++ lib/libXrandr/src/XrrScreen.c 4 Oct 2016 16:11:58 -0000 @@ -24,6 +24,7 @@ #include #endif +#include #include #include /* we need to be able to manipulate the Display structure on events */ @@ -105,27 +106,36 @@ doGetScreenResources (Display *dpy, Wind xrri->has_rates = _XRRHasRates (xrri->minor_version, xrri->major_version); } - nbytes = (long) rep.length << 2; + if (rep.length < INT_MAX >> 2) { + nbytes = (long) rep.length << 2; - nbytesRead = (long) (rep.nCrtcs * 4 + - rep.nOutputs * 4 + - rep.nModes * SIZEOF (xRRModeInfo) + - ((rep.nbytesNames + 3) & ~3)); - - /* - * first we must compute how much space to allocate for - * randr library's use; we'll allocate the structures in a single - * allocation, on cleanlyness grounds. - */ - - rbytes = (sizeof (XRRScreenResources) + - rep.nCrtcs * sizeof (RRCrtc) + - rep.nOutputs * sizeof (RROutput) + - rep.nModes * sizeof (XRRModeInfo) + - rep.nbytesNames + rep.nModes); /* '\0' terminate names */ + nbytesRead = (long) (rep.nCrtcs * 4 + + rep.nOutputs * 4 + + rep.nModes * SIZEOF (xRRModeInfo) + + ((rep.nbytesNames + 3) & ~3)); + + /* + * first we must compute how much space to allocate for + * randr library's use; we'll allocate the structures in a single + * allocation, on cleanlyness grounds. + */ + + rbytes = (sizeof (XRRScreenResources) + + rep.nCrtcs * sizeof (RRCrtc) + + rep.nOutputs * sizeof (RROutput) + + rep.nModes * sizeof (XRRModeInfo) + + rep.nbytesNames + rep.nModes); /* '\0' terminate names */ + + xrsr = (XRRScreenResources *) Xmalloc(rbytes); + wire_names = (char *) Xmalloc (rep.nbytesNames); + } else { + nbytes = 0; + nbytesRead = 0; + rbytes = 0; + xrsr = NULL; + wire_names = NULL; + } - xrsr = (XRRScreenResources *) Xmalloc(rbytes); - wire_names = (char *) Xmalloc (rep.nbytesNames); if (xrsr == NULL || wire_names == NULL) { if (xrsr) Xfree (xrsr); if (wire_names) Xfree (wire_names); @@ -174,6 +184,14 @@ doGetScreenResources (Display *dpy, Wind wire_name = wire_names; for (i = 0; i < rep.nModes; i++) { xrsr->modes[i].name = names; + if (xrsr->modes[i].nameLength > rep.nbytesNames) { + Xfree (xrsr); + Xfree (wire_names); + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } + rep.nbytesNames -= xrsr->modes[i].nameLength; memcpy (names, wire_name, xrsr->modes[i].nameLength); names[xrsr->modes[i].nameLength] = '\0'; names += xrsr->modes[i].nameLength + 1; Index: lib/libXrender/src/Filter.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrender/src/Filter.c,v retrieving revision 1.5 diff -u -p -u -r1.5 Filter.c --- lib/libXrender/src/Filter.c 23 May 2013 22:42:11 -0000 1.5 +++ lib/libXrender/src/Filter.c 4 Oct 2016 16:11:58 -0000 @@ -38,7 +38,7 @@ XRenderQueryFilters (Display *dpy, Drawa char *name; char len; int i; - unsigned long nbytes, nbytesAlias, nbytesName; + unsigned long nbytes, nbytesAlias, nbytesName, reply_left; if (!RenderHasExtension (info)) return NULL; @@ -114,6 +114,7 @@ XRenderQueryFilters (Display *dpy, Drawa * Read the filter aliases */ _XRead16Pad (dpy, filters->alias, 2 * rep.numAliases); + reply_left = 8 + rep.length - 2 * rep.numAliases;; /* * Read the filter names @@ -122,9 +123,19 @@ XRenderQueryFilters (Display *dpy, Drawa { int l; _XRead (dpy, &len, 1); + reply_left--; l = len & 0xff; + if ((unsigned long)l + 1 > nbytesName) { + _XEatDataWords(dpy, reply_left); + Xfree(filters); + UnlockDisplay (dpy); + SyncHandle (); + return NULL; + } + nbytesName -= l + 1; filters->filter[i] = name; _XRead (dpy, name, l); + reply_left -= l; name[l] = '\0'; name += l + 1; } Index: lib/libXrender/src/Xrender.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXrender/src/Xrender.c,v retrieving revision 1.4 diff -u -p -u -r1.4 Xrender.c --- lib/libXrender/src/Xrender.c 23 May 2013 22:42:11 -0000 1.4 +++ lib/libXrender/src/Xrender.c 4 Oct 2016 16:11:58 -0000 @@ -533,12 +533,30 @@ XRenderQueryFormats (Display *dpy) screen->fallback = _XRenderFindFormat (xri, xScreen->fallback); screen->subpixel = SubPixelUnknown; xDepth = (xPictDepth *) (xScreen + 1); + if (screen->ndepths > rep.numDepths) { + Xfree (xri); + Xfree (xData); + _XEatDataWords (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return 0; + } + rep.numDepths -= screen->ndepths; for (nd = 0; nd < screen->ndepths; nd++) { depth->depth = xDepth->depth; depth->nvisuals = xDepth->nPictVisuals; depth->visuals = visual; xVisual = (xPictVisual *) (xDepth + 1); + if (depth->nvisuals > rep.numVisuals) { + Xfree (xri); + Xfree (xData); + _XEatDataWords (dpy, rep.length); + UnlockDisplay (dpy); + SyncHandle (); + return 0; + } + rep.numVisuals -= depth->nvisuals; for (nv = 0; nv < depth->nvisuals; nv++) { visual->visual = _XRenderFindVisual (dpy, xVisual->visual); Index: lib/libXtst/src/XRecord.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXtst/src/XRecord.c,v retrieving revision 1.5 diff -u -p -u -r1.5 XRecord.c --- lib/libXtst/src/XRecord.c 23 May 2013 22:42:15 -0000 1.5 +++ lib/libXtst/src/XRecord.c 4 Oct 2016 16:11:58 -0000 @@ -760,15 +760,23 @@ parse_reply_call_callback( switch (rep->category) { case XRecordFromServer: if (rep->elementHeader&XRecordFromServerTime) { + if (current_index + 4 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index, data->server_time); current_index += 4; } + if (current_index + 1 > rep->length << 2) + return Error; switch (reply->buf[current_index]) { case X_Reply: /* reply */ + if (current_index + 8 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index+4, datum_bytes); + if (datum_bytes < 0 || datum_bytes > ((INT_MAX >> 2) - 8)) + return Error; datum_bytes = (datum_bytes+8) << 2; break; default: /* error or event */ @@ -777,52 +785,73 @@ parse_reply_call_callback( break; case XRecordFromClient: if (rep->elementHeader&XRecordFromClientTime) { + if (current_index + 4 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index, data->server_time); current_index += 4; } if (rep->elementHeader&XRecordFromClientSequence) { + if (current_index + 4 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index, data->client_seq); current_index += 4; } + if (current_index + 4 > rep->length<<2) + return Error; if (reply->buf[current_index+2] == 0 && reply->buf[current_index+3] == 0) /* needn't swap 0 */ { /* BIG-REQUESTS */ + if (current_index + 8 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index+4, datum_bytes); } else { EXTRACT_CARD16(rep->clientSwapped, reply->buf+current_index+2, datum_bytes); } + if (datum_bytes < 0 || datum_bytes > INT_MAX >> 2) + return Error; datum_bytes <<= 2; break; case XRecordClientStarted: + if (current_index + 8 > rep->length << 2) + return Error; EXTRACT_CARD16(rep->clientSwapped, reply->buf+current_index+6, datum_bytes); datum_bytes = (datum_bytes+2) << 2; break; case XRecordClientDied: if (rep->elementHeader&XRecordFromClientSequence) { + if (current_index + 4 > rep->length << 2) + return Error; EXTRACT_CARD32(rep->clientSwapped, reply->buf+current_index, data->client_seq); current_index += 4; - } - /* fall through */ + } else if (current_index < rep->length << 2) + return Error; + datum_bytes = 0; + break; case XRecordStartOfData: case XRecordEndOfData: + if (current_index < rep->length << 2) + return Error; datum_bytes = 0; + break; } if (datum_bytes > 0) { - if (current_index + datum_bytes > rep->length << 2) + if (INT_MAX - datum_bytes < (rep->length << 2) - current_index) { fprintf(stderr, "XRecord: %lu-byte reply claims %d-byte element (seq %lu)\n", - (long)rep->length << 2, current_index + datum_bytes, + (unsigned long)rep->length << 2, current_index + datum_bytes, dpy->last_request_read); + return Error; + } /* * This assignment (and indeed the whole buffer sharing * scheme) assumes arbitrary 4-byte boundaries are @@ -869,6 +898,12 @@ XRecordEnableContext(Display *dpy, XReco /* This code should match that in XRecordEnableContextAsync */ if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) { + UnlockDisplay(dpy); + SyncHandle(); + return 0; + } + + if (rep.length > INT_MAX >> 2) { UnlockDisplay(dpy); SyncHandle(); return 0; Index: lib/libXv/src/Xv.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXv/src/Xv.c,v retrieving revision 1.6 diff -u -p -u -r1.6 Xv.c --- lib/libXv/src/Xv.c 28 Sep 2013 17:51:21 -0000 1.6 +++ lib/libXv/src/Xv.c 4 Oct 2016 16:11:58 -0000 @@ -158,6 +158,7 @@ XvQueryAdaptors( size_t size; unsigned int ii, jj; char *name; + char *end; XvAdaptorInfo *pas = NULL, *pa; XvFormat *pfs, *pf; char *buffer = NULL; @@ -197,17 +198,13 @@ XvQueryAdaptors( /* GET INPUT ADAPTORS */ if (rep.num_adaptors == 0) { - /* If there's no adaptors, there's nothing more to do. */ + /* If there are no adaptors, there's nothing more to do. */ status = Success; goto out; } - if (size < (rep.num_adaptors * sz_xvAdaptorInfo)) { - /* If there's not enough data for the number of adaptors, - then we have a problem. */ - status = XvBadReply; - goto out; - } + u.buffer = buffer; + end = buffer + size; size = rep.num_adaptors * sizeof(XvAdaptorInfo); if ((pas = Xmalloc(size)) == NULL) { @@ -225,9 +222,12 @@ XvQueryAdaptors( pa++; } - u.buffer = buffer; pa = pas; for (ii = 0; ii < rep.num_adaptors; ii++) { + if (u.buffer + sz_xvAdaptorInfo > end) { + status = XvBadReply; + goto out; + } pa->type = u.pa->type; pa->base_id = u.pa->base_id; pa->num_ports = u.pa->num_ports; @@ -239,6 +239,10 @@ XvQueryAdaptors( size = u.pa->name_size; u.buffer += pad_to_int32(sz_xvAdaptorInfo); + if (u.buffer + size > end) { + status = XvBadReply; + goto out; + } if ((name = Xmalloc(size + 1)) == NULL) { status = XvBadAlloc; goto out; @@ -259,6 +263,11 @@ XvQueryAdaptors( pf = pfs; for (jj = 0; jj < pa->num_formats; jj++) { + if (u.buffer + sz_xvFormat > end) { + Xfree(pfs); + status = XvBadReply; + goto out; + } pf->depth = u.pf->depth; pf->visual_id = u.pf->visual; pf++; @@ -327,6 +336,7 @@ XvQueryEncodings( size_t size; unsigned int jj; char *name; + char *end; XvEncodingInfo *pes = NULL, *pe; char *buffer = NULL; union { @@ -364,17 +374,13 @@ XvQueryEncodings( /* GET ENCODINGS */ if (rep.num_encodings == 0) { - /* If there's no encodings, there's nothing more to do. */ + /* If there are no encodings, there's nothing more to do. */ status = Success; goto out; } - if (size < (rep.num_encodings * sz_xvEncodingInfo)) { - /* If there's not enough data for the number of adaptors, - then we have a problem. */ - status = XvBadReply; - goto out; - } + u.buffer = buffer; + end = buffer + size; size = rep.num_encodings * sizeof(XvEncodingInfo); if ((pes = Xmalloc(size)) == NULL) { @@ -391,10 +397,12 @@ XvQueryEncodings( pe++; } - u.buffer = buffer; - pe = pes; for (jj = 0; jj < rep.num_encodings; jj++) { + if (u.buffer + sz_xvEncodingInfo > end) { + status = XvBadReply; + goto out; + } pe->encoding_id = u.pe->encoding; pe->width = u.pe->width; pe->height = u.pe->height; @@ -405,6 +413,10 @@ XvQueryEncodings( size = u.pe->name_size; u.buffer += pad_to_int32(sz_xvEncodingInfo); + if (u.buffer + size > end) { + status = XvBadReply; + goto out; + } if ((name = Xmalloc(size + 1)) == NULL) { status = XvBadAlloc; goto out; Index: lib/libXvMC/src/XvMC.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXvMC/src/XvMC.c,v retrieving revision 1.6 diff -u -p -u -r1.6 XvMC.c --- lib/libXvMC/src/XvMC.c 6 Apr 2015 13:33:24 -0000 1.6 +++ lib/libXvMC/src/XvMC.c 4 Oct 2016 16:11:58 -0000 @@ -576,9 +576,9 @@ Status XvMCGetDRInfo(Display *dpy, XvPor if (*name && *busID && tmpBuf) { _XRead(dpy, tmpBuf, realSize); strncpy(*name,tmpBuf,rep.nameLen); - (*name)[rep.nameLen - 1] = '\0'; + (*name)[rep.nameLen == 0 ? 0 : rep.nameLen - 1] = '\0'; strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); - (*busID)[rep.busIDLen - 1] = '\0'; + (*busID)[rep.busIDLen == 0 ? 0 : rep.busIDLen - 1] = '\0'; XFree(tmpBuf); } else { XFree(*name); 6.0/common/PaxHeaders.49427/043_tcb.patch.sig01006440001756001161000000000073131631116240015416xustar0029 mtime=1506579348.54474243 30 atime=1783552628.018687845 6.0/common/043_tcb.patch.sig010064400017560011610000000054041316311162400145520ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ/9ZByBSf/YnpAx05RoMZegxjmiw3ozzj91vJbpq/ngp+Dftj/BQiVpa46OAhM+NeFyR1qop2/5ykksQq4shNQ0= OpenBSD 6.0 errata 043, September 27, 2017: Out of bounds TCB settings may result in a kernel panic. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 043_tcb.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/arch/amd64/amd64/sys_machdep.c =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/sys_machdep.c,v --- sys/arch/amd64/amd64/sys_machdep.c 18 May 2015 19:59:27 -0000 1.16 +++ sys/arch/amd64/amd64/sys_machdep.c 27 Sep 2017 06:32:39 -0000 @@ -111,6 +111,8 @@ amd64_set_fsbase(struct proc *p, void *a if ((error = copyin(args, &base, sizeof(base))) != 0) return (error); + if (TCB_INVALID(base)) + return EINVAL; tcb_set(p, base); return 0; } Index: sys/arch/amd64/include/tcb.h =================================================================== RCS file: /cvs/src/sys/arch/amd64/include/tcb.h,v --- sys/arch/amd64/include/tcb.h 18 May 2015 19:59:27 -0000 1.3 +++ sys/arch/amd64/include/tcb.h 27 Sep 2017 06:33:15 -0000 @@ -27,6 +27,9 @@ void tcb_set(struct proc *_p, void *_new #define TCB_GET(p) tcb_get(p) #define TCB_SET(p, addr) tcb_set(p, addr) +/* address must be in canonical form; requiring lower-half is okay */ +#define TCB_INVALID(addr) ((u_long)(addr) > 0x0000ffffffffffff) + #else /* _KERNEL */ #include /* for offsetof */ Index: sys/kern/kern_fork.c =================================================================== RCS file: /cvs/src/sys/kern/kern_fork.c,v --- sys/kern/kern_fork.c 25 Apr 2016 20:18:31 -0000 1.187 +++ sys/kern/kern_fork.c 27 Sep 2017 06:32:07 -0000 @@ -129,6 +129,10 @@ sys___tfork(struct proc *p, void *v, reg if (KTRPOINT(p, KTR_STRUCT)) ktrstruct(p, "tfork", ¶m, sizeof(param)); #endif +#ifdef TCB_INVALID + if (TCB_INVALID(param.tf_tcb)) + return EINVAL; +#endif /* TCB_INVALID */ flags = FORK_TFORK | FORK_THREAD | FORK_SIGHAND | FORK_SHAREVM | FORK_SHAREFILES; Index: sys/kern/kern_prot.c =================================================================== RCS file: /cvs/src/sys/kern/kern_prot.c,v --- sys/kern/kern_prot.c 30 Mar 2016 07:49:11 -0000 1.65 +++ sys/kern/kern_prot.c 27 Sep 2017 06:32:01 -0000 @@ -1094,6 +1094,10 @@ sys___set_tcb(struct proc *p, void *v, r syscallarg(void *) tcb; } */ *uap = v; +#ifdef TCB_INVALID + if (TCB_INVALID(SCARG(uap, tcb))) + return EINVAL; +#endif /* TCB_INVALID */ TCB_SET(p, SCARG(uap, tcb)); return (0); } 6.0/common/PaxHeaders.49427/019_pf.patch.sig01006440001756001161000000000074130603117200015252xustar0030 mtime=1489081296.832106034 30 atime=1783552628.018687845 6.0/common/019_pf.patch.sig010064400017560011610000000027111306031172000144030ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ4OxjFuyRvq5X47YqvxsDviyNWsmDqtG+bOxWYJsV6CDVnisQIPcMl/nQkIUX93yT5e1kKdOkDVIRBfgO++CcQM= OpenBSD 6.0 errata 19, Mar 9, 2017: Prevent integer overflow in PF when calculating the adaptive timeout, causing spuriously expired states under pressure. Alternatively, disable adaptive timeouts with set timeout { adaptive.start 0, adaptive.end 0 } Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 019_pf.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/net/pf.c =================================================================== RCS file: /cvs/src/sys/net/pf.c,v retrieving revision 1.979 diff -u -p -r1.979 pf.c --- sys/net/pf.c 18 Jul 2016 13:17:44 -0000 1.979 +++ sys/net/pf.c 9 Mar 2017 14:58:15 -0000 @@ -1194,7 +1194,7 @@ pf_purge_thread(void *v) int32_t pf_state_expires(const struct pf_state *state) { - int32_t timeout; + u_int32_t timeout; u_int32_t start; u_int32_t end; u_int32_t states; @@ -1223,7 +1223,7 @@ pf_state_expires(const struct pf_state * if (states >= end) return (0); - timeout = timeout * (end - states) / (end - start); + timeout = (u_int64_t)timeout * (end - states) / (end - start); } return (state->expire + timeout); 6.0/common/PaxHeaders.49427/023_freetype.patch.sig01006440001756001161000000000074131056366560016505xustar0030 mtime=1494695342.972982313 30 atime=1783552628.018687845 6.0/common/023_freetype.patch.sig010064400017560011610000000050711310563665600156400ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ6SONgNO5/HTxPldrHGAx1wiwG2bB9zaLNPAQsiS/gHkDll5PBCqGBMz+noxOlt3dXs19jGB4sl/DoOkkT1ingA= OpenBSD 6.0 errata 023, May 11, 2017: Heap-based buffer overflows in freetype can result in out-of-bounds writes. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 023_freetype.patch.sig \ -m - | (cd /usr/xenocara && patch -p0) And then rebuild and install freetype: cd /usr/xenocara/lib/freetype make obj make build Index: lib/freetype/src/psaux/psobjs.c =================================================================== RCS file: /cvs/xenocara/lib/freetype/src/psaux/psobjs.c,v retrieving revision 1.16 diff -u -p -r1.16 psobjs.c --- lib/freetype/src/psaux/psobjs.c 29 May 2016 11:57:13 -0000 1.16 +++ lib/freetype/src/psaux/psobjs.c 11 May 2017 00:42:36 -0000 @@ -1718,6 +1718,14 @@ first = outline->n_contours <= 1 ? 0 : outline->contours[outline->n_contours - 2] + 1; + /* in malformed fonts it can happen that a contour was started */ + /* but no points were added */ + if ( outline->n_contours && first == outline->n_points ) + { + outline->n_contours--; + return; + } + /* We must not include the last point in the path if it */ /* is located on the first point. */ if ( outline->n_points > 1 ) Index: lib/freetype/src/psaux/t1decode.c =================================================================== RCS file: /cvs/xenocara/lib/freetype/src/psaux/t1decode.c,v retrieving revision 1.17 diff -u -p -r1.17 t1decode.c --- lib/freetype/src/psaux/t1decode.c 29 May 2016 11:57:13 -0000 1.17 +++ lib/freetype/src/psaux/t1decode.c 11 May 2017 00:42:36 -0000 @@ -783,10 +783,19 @@ /* point without adding any point to the outline */ idx = decoder->num_flex_vectors++; if ( idx > 0 && idx < 7 ) + { + /* in malformed fonts it is possible to have other */ + /* opcodes in the middle of a flex (which don't */ + /* increase `num_flex_vectors'); we thus have to */ + /* check whether we can add a point */ + if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) ) + goto Syntax_Error; + t1_builder_add_point( builder, x, y, (FT_Byte)( idx == 3 || idx == 6 ) ); + } } break; 6.0/common/PaxHeaders.49427/012_amap.patch.sig01006440001756001161000000000074127765375210015602xustar0030 mtime=1476050769.664085828 30 atime=1783552628.018687845 6.0/common/012_amap.patch.sig010064400017560011610000000032271277653752100147360ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ9TdYJa2HDKdITybCISVckLUDZO2kvMBEbWZk8CMFaXMaiAJVyplHeQt612H+qpfyzqeDTLoBKp7gY1G/DimOwE= OpenBSD 6.0 errata 12, Oct 08, 2016: Allocation of an amap with at least 131072 slots causes an integer overflow that leads to an infinite loop. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 012_amap.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/uvm/uvm_amap.c =================================================================== RCS file: /cvs/src/sys/uvm/uvm_amap.c,v retrieving revision 1.75 diff -u -p -r1.75 uvm_amap.c --- sys/uvm/uvm_amap.c 14 Jul 2016 16:23:49 -0000 1.75 +++ sys/uvm/uvm_amap.c 8 Oct 2016 15:12:14 -0000 @@ -268,7 +268,7 @@ amap_alloc1(int slots, int waitf, int la { struct vm_amap *amap; struct vm_amap_chunk *chunk, *tmp; - int chunks, chunkperbucket = 1, hashshift = 0; + int chunks, log_chunks, chunkperbucket = 1, hashshift = 0; int buckets, i, n; int pwaitf = (waitf == M_WAITOK) ? PR_WAITOK : PR_NOWAIT; @@ -305,8 +305,11 @@ amap_alloc1(int slots, int waitf, int la * for the hash buckets of all amaps to exceed the maximal * amount of KVA memory reserved for amaps. */ + for (log_chunks = 1; (chunks >> log_chunks) > 0; log_chunks++) + continue; + chunkperbucket = 1 << hashshift; - while ((1 << chunkperbucket) * 2 <= chunks) { + while (chunkperbucket + 1 < log_chunks) { hashshift++; chunkperbucket = 1 << hashshift; } 6.0/common/PaxHeaders.49427/029_sigio.patch.sig01006440001756001161000000000074131406066630015774xustar0030 mtime=1501760947.232960143 30 atime=1783552628.018687845 6.0/common/029_sigio.patch.sig010064400017560011610000000066651314060666300151410ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ0Y5LwhaZH3c8OR9Xuv0EA/fqm0Oq+DX/EqooxCbX6MKedhyLERxSoN25oRiSTN2g/UXlcpZxjfYYkHvSlWxOAQ= OpenBSD 6.0 errata 029, August 3, 2017: Use-after-free can occur related to SIGIO in two drivers. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 029_sigio.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/midi.c =================================================================== RCS file: /cvs/src/sys/dev/midi.c,v --- sys/dev/midi.c 22 May 2015 12:52:00 -0000 1.40 +++ sys/dev/midi.c 2 Aug 2017 16:24:57 -0000 @@ -98,8 +98,6 @@ midi_iintr(void *addr, int data) wakeup(&sc->rchan); } selwakeup(&sc->rsel); - if (sc->async) - psignal(sc->async, SIGIO); } } @@ -208,8 +206,6 @@ midi_out_stop(struct midi_softc *sc) wakeup(&sc->wchan); } selwakeup(&sc->wsel); - if (sc->async) - psignal(sc->async, SIGIO); } void @@ -431,20 +427,9 @@ midiioctl(dev_t dev, u_long cmd, caddr_t case FIONBIO: /* All handled in the upper FS layer */ break; - case FIOASYNC: - if (*(int *)addr) { - if (sc->async) { - error = EBUSY; - goto done; - } - sc->async = p; - } else - sc->async = 0; - break; default: error = ENOTTY; } -done: device_unref(&sc->dev); return error; } @@ -467,7 +452,6 @@ midiopen(dev_t dev, int flags, int mode, MIDIBUF_INIT(&sc->outbuf); sc->isbusy = 0; sc->rchan = sc->wchan = 0; - sc->async = 0; sc->flags = flags; error = sc->hw_if->open(sc->hw_hdl, flags, midi_iintr, midi_ointr, sc); if (error) Index: sys/dev/usb/uhid.c =================================================================== RCS file: /cvs/src/sys/dev/usb/uhid.c,v --- sys/dev/usb/uhid.c 24 May 2016 05:35:01 -0000 1.66 +++ sys/dev/usb/uhid.c 1 Aug 2017 21:55:02 -0000 1.66.6.1 @@ -75,7 +75,6 @@ struct uhid_softc { struct clist sc_q; struct selinfo sc_rsel; - struct process *sc_async; /* process that wants SIGIO */ u_char sc_state; /* driver state */ #define UHID_ASLP 0x01 /* waiting for device data */ @@ -198,10 +197,6 @@ uhid_intr(struct uhidev *addr, void *dat wakeup(&sc->sc_q); } selwakeup(&sc->sc_rsel); - if (sc->sc_async != NULL) { - DPRINTFN(3, ("uhid_intr: sending SIGIO %p\n", sc->sc_async)); - prsignal(sc->sc_async, SIGIO); - } } int @@ -228,7 +223,6 @@ uhidopen(dev_t dev, int flag, int mode, clalloc(&sc->sc_q, UHID_BSIZE, 0); sc->sc_obuf = malloc(sc->sc_hdev.sc_osize, M_USBDEV, M_WAITOK); - sc->sc_async = NULL; return (0); } @@ -244,7 +238,6 @@ uhidclose(dev_t dev, int flag, int mode, clfree(&sc->sc_q); free(sc->sc_obuf, M_USBDEV, 0); - sc->sc_async = NULL; uhidev_close(&sc->sc_hdev); return (0); @@ -367,24 +360,6 @@ uhid_do_ioctl(struct uhid_softc *sc, u_l switch (cmd) { case FIONBIO: /* All handled in the upper FS layer. */ - break; - - case FIOASYNC: - if (*(int *)addr) { - if (sc->sc_async != NULL) - return (EBUSY); - sc->sc_async = p->p_p; - DPRINTF(("uhid_do_ioctl: FIOASYNC %p\n", p)); - } else - sc->sc_async = NULL; - break; - - /* XXX this is not the most general solution. */ - case TIOCSPGRP: - if (sc->sc_async == NULL) - return (EINVAL); - if (*(int *)addr != sc->sc_async->ps_pgid) - return (EPERM); break; case USB_GET_DEVICEINFO: 6.0/common/PaxHeaders.49427/021_softraid_concat.patch.sig01006440001756001161000000000074131021470330020001xustar0030 mtime=1493749275.961722206 30 atime=1783552628.018687845 6.0/common/021_softraid_concat.patch.sig010064400017560011610000000025641310214703300171400ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ/PABGAAj4tgJm8RG0U2uH4SUOLh2b3YBXPRVkCb9GC+SW3GVZWBWjtPU3Eus+/+baddglO+AwJuMPPuIyG9oAE= OpenBSD 6.0 errata 21, May 1, 2017: softraid(4) was unable to create usable concat volumes because it always set the size of the volume to zero sectors. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 021_softraid_concat.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/softraid_concat.c =================================================================== RCS file: /cvs/src/sys/dev/softraid_concat.c,v --- sys/dev/softraid_concat.c 12 Apr 2016 16:26:54 -0000 1.25 +++ sys/dev/softraid_concat.c 28 Apr 2017 23:33:07 -0000 1.26 @@ -60,11 +60,19 @@ int sr_concat_create(struct sr_discipline *sd, struct bioc_createraid *bc, int no_chunk, int64_t coerced_size) { + int i; + if (no_chunk < 2) { sr_error(sd->sd_sc, "%s requires two or more chunks", sd->sd_name); return EINVAL; } + + sd->sd_meta->ssdi.ssd_size = 0; + for (i = 0; i < no_chunk; i++) { + sd->sd_meta->ssdi.ssd_size += + sd->sd_vol.sv_chunks[i]->src_size; + } return sr_concat_init(sd); } 6.0/common/PaxHeaders.49427/013_ssh_kexinit.patch.sig01006440001756001161000000000074127767711320017213xustar0030 mtime=1476129370.420256676 30 atime=1783552628.018687845 6.0/common/013_ssh_kexinit.patch.sig010064400017560011610000000022021277677113200163370ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ+nvjojNv0BETtBpdOsfAjnPnz8Ko3XL5UcaGDRRrkHt9GulGnU/URXBZxe3q32aOgGIe01P3mF9iSo0umkskAQ= OpenBSD 6.0 errata 13, Oct 10, 2016: A protocol parsing bug in sshd can lead to unauthenticated memory and CPU consumption. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 013_ssh_kexinit.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install sshd: cd /usr/src/usr.bin/ssh make obj make depend make make install Index: usr.bin/ssh/kex.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/kex.c,v retrieving revision 1.118 retrieving revision 1.118.4.1 diff -p -u -IOpenBSD -r1.118 -r1.118.4.1 --- usr.bin/ssh/kex.c 2 May 2016 10:26:04 -0000 1.118 +++ usr.bin/ssh/kex.c 10 Oct 2016 19:35:47 -0000 1.118.4.1 @@ -452,6 +452,7 @@ kex_input_kexinit(int type, u_int32_t se if (kex == NULL) return SSH_ERR_INVALID_ARGUMENT; + ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); ptr = sshpkt_ptr(ssh, &dlen); if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) return r; 6.0/common/PaxHeaders.49427/020_exec_elf.patch.sig01006440001756001161000000000074130637726640016434xustar0030 mtime=1490023860.106296931 30 atime=1783552628.018687845 6.0/common/020_exec_elf.patch.sig010064400017560011610000000021071306377266400155640ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ8YVCKjPokLrn99Y/6LRUX0kW5slAa2hDjh9otci/Z3FRDdpTKReGSU/HuUXS7ARXvA7juDoIEAKQe5fNmYk+Ao= OpenBSD 6.0 errata 20, Mar 20, 2017 ELF auxiliary vector storage leaks piece of kernel stack. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 020_exec_elf.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/exec_elf.c =================================================================== RCS file: /cvs/src/sys/kern/exec_elf.c,v retrieving revision 1.139 retrieving revision 1.140 diff -u -p -r1.139 -r1.140 --- sys/kern/exec_elf.c 5 Mar 2017 00:45:30 -0000 1.139 +++ sys/kern/exec_elf.c 20 Mar 2017 00:05:21 -0000 1.140 @@ -802,6 +802,7 @@ exec_elf_fixup(struct proc *p, struct ex * linked binaries */ if (error == 0) { + memset(&ai, 0, sizeof ai); a = ai; a->au_id = AUX_phdr; 6.0/common/PaxHeaders.49427/014_smtpd.patch.sig01006440001756001161000000000074127777227040016015xustar0030 mtime=1476371908.926495191 30 atime=1783552628.018687845 6.0/common/014_smtpd.patch.sig010064400017560011610000000035301277772270400151460ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ7Fd3pidPCqHCaDW23pbANPcfI/fSOmPFnO2pqrTE7FFdudkyvBYqxf23hroaopNJ07mizlp+xb7sXakqPkeyg0= OpenBSD 6.0 errata 14, Oct 13, 2016: A logic issue in smtpd's header parsing can cause SMTP sessions to hang. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 014_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make obj make depend make make install Index: usr.sbin/smtpd/rfc2822.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/rfc2822.c,v retrieving revision 1.7.6.1 diff -u -p -r1.7.6.1 rfc2822.c --- usr.sbin/smtpd/rfc2822.c 23 Aug 2016 11:15:17 -0000 1.7.6.1 +++ usr.sbin/smtpd/rfc2822.c 12 Oct 2016 16:18:07 -0000 @@ -50,6 +50,9 @@ header_callback(struct rfc2822_parser *r struct rfc2822_hdr_cb *hdr_cb; struct rfc2822_hdr_miss_cb *hdr_miss_cb; + if (!rp->in_hdr) + goto end; + TAILQ_FOREACH(hdr_cb, &rp->hdr_cb, next) if (strcasecmp(hdr_cb->name, rp->header.name) == 0) { hdr_cb->func(&rp->header, hdr_cb->arg); @@ -148,6 +151,8 @@ rfc2822_parser_flush(struct rfc2822_pars return; header_callback(rp); + + missing_headers_callback(rp); } void Index: usr.sbin/smtpd/smtp_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtp_session.c,v retrieving revision 1.284.4.1 diff -u -p -r1.284.4.1 smtp_session.c --- usr.sbin/smtpd/smtp_session.c 4 Oct 2016 00:12:27 -0000 1.284.4.1 +++ usr.sbin/smtpd/smtp_session.c 12 Oct 2016 16:18:07 -0000 @@ -1343,6 +1343,8 @@ smtp_io(struct io *io, int evt) s->tx->dataeom = 1; if (iobuf_queued(&s->tx->obuf) == 0) smtp_data_io_done(s); + else + io_reload(&s->tx->oev); return; } 6.0/common/PaxHeaders.49427/040_smap.patch.sig01006440001756001161000000000074131503276750015617xustar0030 mtime=1503768509.254190601 30 atime=1783552628.018687845 6.0/common/040_smap.patch.sig010064400017560011610000000170221315032767500147510ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ7x/7TX0z5lu84+V137LjuAO6zKsia0XHdKKJlVxUhMizWg5cdhl+en8p7HdBUa+6JRAr2wy2Ji7HopVtUIsAAw= OpenBSD 6.0 errata 040, August 26, 2017: SMAP enforcement could be bypassed by userland code. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 040_smap.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/arch/amd64/amd64/copy.S =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/copy.S,v retrieving revision 1.7 diff -u -p -r1.7 copy.S --- sys/arch/amd64/amd64/copy.S 25 Apr 2015 21:31:24 -0000 1.7 +++ sys/arch/amd64/amd64/copy.S 26 Aug 2017 00:05:09 -0000 @@ -45,23 +45,6 @@ #include /* - * As stac/clac SMAP instructions are 3 bytes, we want the fastest - * 3 byte nop sequence possible here. This will be replaced by - * stac/clac instructions if SMAP is detected after booting. - * - * This would be 'nop (%rax)' if binutils could cope. - * Intel documents multi-byte NOP sequences as being available - * on all family 0x6 and 0xf processors (ie 686+) - */ -#define SMAP_NOP .byte 0x0f, 0x1f, 0x00 -#define SMAP_STAC CODEPATCH_START ;\ - SMAP_NOP ;\ - CODEPATCH_END(CPTAG_STAC) -#define SMAP_CLAC CODEPATCH_START ;\ - SMAP_NOP ;\ - CODEPATCH_END(CPTAG_CLAC) - -/* * Copy routines from and to userland, plus a few more. See the * section 9 manpages for info. Some cases can be optimized more. * Index: sys/arch/amd64/amd64/cpu.c =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/cpu.c,v retrieving revision 1.101 diff -u -p -r1.101 cpu.c --- sys/arch/amd64/amd64/cpu.c 28 Jun 2016 05:37:50 -0000 1.101 +++ sys/arch/amd64/amd64/cpu.c 26 Aug 2017 00:05:09 -0000 @@ -838,7 +838,7 @@ cpu_init_msrs(struct cpu_info *ci) ((uint64_t)GSEL(GUCODE32_SEL, SEL_UPL) << 48)); wrmsr(MSR_LSTAR, (uint64_t)Xsyscall); wrmsr(MSR_CSTAR, (uint64_t)Xsyscall32); - wrmsr(MSR_SFMASK, PSL_NT|PSL_T|PSL_I|PSL_C|PSL_D); + wrmsr(MSR_SFMASK, PSL_NT|PSL_T|PSL_I|PSL_C|PSL_D|PSL_AC); wrmsr(MSR_FSBASE, 0); wrmsr(MSR_GSBASE, (u_int64_t)ci); Index: sys/arch/amd64/amd64/trap.c =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/trap.c,v retrieving revision 1.49 diff -u -p -r1.49 trap.c --- sys/arch/amd64/amd64/trap.c 27 Feb 2016 13:08:06 -0000 1.49 +++ sys/arch/amd64/amd64/trap.c 26 Aug 2017 00:05:09 -0000 @@ -169,6 +169,15 @@ trap(struct trapframe *frame) printf("pid %d\n", p->p_pid); } #endif +#ifdef DIAGNOSTIC + if (curcpu()->ci_feature_sefflags_ebx & SEFF0EBX_SMAP) { + u_long rf = read_rflags(); + if (rf & PSL_AC) { + write_rflags(rf & ~PSL_AC); + panic("%s: AC set on entry", "trap"); + } + } +#endif if (!KERNELMODE(frame->tf_cs, frame->tf_rflags)) { type |= T_USER; @@ -506,6 +515,16 @@ syscall(struct trapframe *frame) int nsys; size_t argsize, argoff; register_t code, args[9], rval[2], *argp; + +#ifdef DIAGNOSTIC + if (curcpu()->ci_feature_sefflags_ebx & SEFF0EBX_SMAP) { + u_long rf = read_rflags(); + if (rf & PSL_AC) { + write_rflags(rf & ~PSL_AC); + panic("%s: AC set on entry", "syscall"); + } + } +#endif uvmexp.syscalls++; p = curproc; Index: sys/arch/amd64/amd64/vector.S =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/vector.S,v retrieving revision 1.46 diff -u -p -r1.46 vector.S --- sys/arch/amd64/amd64/vector.S 22 Jun 2016 01:12:38 -0000 1.46 +++ sys/arch/amd64/amd64/vector.S 26 Aug 2017 00:05:09 -0000 @@ -125,6 +125,7 @@ IDTVEC(trap07) INTRENTRY sti cld + SMAP_CLAC movq CPUVAR(SELF),%rdi call _C_LABEL(fpudna) INTRFASTEXIT @@ -246,6 +247,7 @@ NENTRY(alltraps) sti calltrap: cld + SMAP_CLAC #ifdef DIAGNOSTIC movl CPUVAR(ILEVEL),%ebx #endif /* DIAGNOSTIC */ @@ -343,6 +345,7 @@ IDTVEC(resume_lapic_ipi) movl $IPL_IPI,CPUVAR(ILEVEL) sti cld + SMAP_CLAC pushq %rbx call _C_LABEL(x86_ipi_handler) jmp _C_LABEL(Xdoreti) @@ -426,6 +429,7 @@ IDTVEC(resume_lapic_ltimer) movl $IPL_CLOCK,CPUVAR(ILEVEL) sti cld + SMAP_CLAC pushq %rbx xorq %rdi,%rdi call _C_LABEL(lapic_clockintr) @@ -460,6 +464,7 @@ IDTVEC(resume_xen_upcall) movl $IPL_NET,CPUVAR(ILEVEL) sti cld + SMAP_CLAC pushq %rbx call _C_LABEL(xen_intr) jmp _C_LABEL(Xdoreti) @@ -494,6 +499,7 @@ IDTVEC(resume_hyperv_upcall) movl $IPL_NET,CPUVAR(ILEVEL) sti cld + SMAP_CLAC pushq %rbx call _C_LABEL(hv_intr) jmp _C_LABEL(Xdoreti) @@ -543,6 +549,7 @@ IDTVEC(intr_##name##num) ;\ movl %ebx,CPUVAR(ILEVEL) ;\ sti ;\ cld ;\ + SMAP_CLAC ;\ incl CPUVAR(IDEPTH) ;\ movq IS_HANDLERS(%r14),%rbx ;\ 6: \ Index: sys/arch/amd64/include/codepatch.h =================================================================== RCS file: /cvs/src/sys/arch/amd64/include/codepatch.h,v retrieving revision 1.2 diff -u -p -r1.2 codepatch.h --- sys/arch/amd64/include/codepatch.h 19 Apr 2015 19:45:21 -0000 1.2 +++ sys/arch/amd64/include/codepatch.h 26 Aug 2017 00:05:09 -0000 @@ -50,4 +50,21 @@ void codepatch_call(uint16_t tag, void * #define CPTAG_CLAC 2 #define CPTAG_EOI 3 +/* + * As stac/clac SMAP instructions are 3 bytes, we want the fastest + * 3 byte nop sequence possible here. This will be replaced by + * stac/clac instructions if SMAP is detected after booting. + * + * This would be 'nop (%rax)' if binutils could cope. + * Intel documents multi-byte NOP sequences as being available + * on all family 0x6 and 0xf processors (ie 686+) + */ +#define SMAP_NOP .byte 0x0f, 0x1f, 0x00 +#define SMAP_STAC CODEPATCH_START ;\ + SMAP_NOP ;\ + CODEPATCH_END(CPTAG_STAC) +#define SMAP_CLAC CODEPATCH_START ;\ + SMAP_NOP ;\ + CODEPATCH_END(CPTAG_CLAC) + #endif /* _MACHINE_CODEPATCH_H_ */ Index: sys/arch/i386/i386/locore.s =================================================================== RCS file: /cvs/src/sys/arch/i386/i386/locore.s,v retrieving revision 1.170 diff -u -p -r1.170 locore.s --- sys/arch/i386/i386/locore.s 16 Jul 2016 06:04:29 -0000 1.170 +++ sys/arch/i386/i386/locore.s 26 Aug 2017 00:05:09 -0000 @@ -115,6 +115,7 @@ */ #define INTRENTRY \ cld ; \ + SMAP_CLAC ; \ pushl %eax ; \ pushl %ecx ; \ pushl %edx ; \ Index: sys/arch/i386/i386/trap.c =================================================================== RCS file: /cvs/src/sys/arch/i386/i386/trap.c,v retrieving revision 1.125 diff -u -p -r1.125 trap.c --- sys/arch/i386/i386/trap.c 28 Feb 2016 15:46:18 -0000 1.125 +++ sys/arch/i386/i386/trap.c 26 Aug 2017 00:05:09 -0000 @@ -148,6 +148,15 @@ trap(struct trapframe *frame) printf("curproc %p\n", curproc); } #endif +#ifdef DIAGNOSTIC + if (curcpu()->ci_feature_sefflags_ebx & SEFF0EBX_SMAP) { + u_int ef = read_eflags(); + if (ef & PSL_AC) { + write_eflags(ef & ~PSL_AC); + panic("%s: AC set on entry", "trap"); + } + } +#endif if (!KERNELMODE(frame->tf_cs, frame->tf_eflags)) { type |= T_USER; @@ -556,6 +565,16 @@ syscall(struct trapframe *frame) if (!USERMODE(frame->tf_cs, frame->tf_eflags)) panic("syscall"); #endif +#ifdef DIAGNOSTIC + if (curcpu()->ci_feature_sefflags_ebx & SEFF0EBX_SMAP) { + u_int ef = read_eflags(); + if (ef & PSL_AC) { + write_eflags(ef & ~PSL_AC); + panic("%s: AC set on entry", "syscall"); + } + } +#endif + p = curproc; p->p_md.md_regs = frame; code = frame->tf_eax; 6.0/common/PaxHeaders.49427/024_exec_subr.patch.sig01006440001756001161000000000074131075745650016644xustar0030 mtime=1495202165.732786907 30 atime=1783552628.018687845 6.0/common/024_exec_subr.patch.sig010064400017560011610000000026611310757456500160010ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ5wrofYkEvhPM/gqaOggMqABF/CR2ddMpsEDhWDRXvADwvEyWN+8aE99LBy4EjXIBN9tRIVxXdFFpxAbAO2xSw4= OpenBSD 6.0 errata 024, May 18, 2017: Add a gap of 1MB between the stack and mmap spaces. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 024_exec_subr.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: KK=`sysctl -n kern.osversion | cut -d# -f1` cd /usr/src/sys/arch/`machine`/compile/$KK make obj make config make make install Index: sys/kern/exec_subr.c =================================================================== RCS file: /cvs/src/sys/kern/exec_subr.c,v retrieving revision 1.51 diff -u -p -r1.51 exec_subr.c --- sys/kern/exec_subr.c 29 Aug 2015 05:40:01 -0000 1.51 +++ sys/kern/exec_subr.c 18 May 2017 18:56:53 -0000 @@ -315,6 +315,10 @@ vmcmd_randomize(struct proc *p, struct e return (error); } +#ifndef MAXSSIZ_GUARD +#define MAXSSIZ_GUARD (1024 * 1024) +#endif + /* * exec_setup_stack(): Set up the stack segment for an executable. * @@ -336,7 +340,7 @@ exec_setup_stack(struct proc *p, struct epp->ep_maxsaddr = USRSTACK; epp->ep_minsaddr = USRSTACK + MAXSSIZ; #else - epp->ep_maxsaddr = USRSTACK - MAXSSIZ; + epp->ep_maxsaddr = USRSTACK - MAXSSIZ - MAXSSIZ_GUARD; epp->ep_minsaddr = USRSTACK; #endif epp->ep_ssize = round_page(p->p_rlimit[RLIMIT_STACK].rlim_cur); 6.0/common/PaxHeaders.49427/031_fuse.patch.sig01006440001756001161000000000074131406066630015615xustar0030 mtime=1501760947.282960999 30 atime=1783552628.018687845 6.0/common/031_fuse.patch.sig010064400017560011610000000036761314060666300147610ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQwi8ADWKm5MD49usniTW+3acahh4QRbBhir2p4OjstAS3G83AzLDhR9Oe//OJzpFMU7vNC81lVROFYgQGUWSFwQ= OpenBSD 6.0 errata 031, August 3, 2017: An out-of-bound read in vfs_getcwd_scandir() (mainly used for FUSE) may result in a kernel panic or info leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 031_fuse.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/vfs_getcwd.c =================================================================== RCS file: /cvs/src/sys/kern/vfs_getcwd.c,v --- sys/kern/vfs_getcwd.c 19 Mar 2016 12:04:15 -0000 1.26 +++ sys/kern/vfs_getcwd.c 2 Aug 2017 16:27:05 -0000 @@ -102,18 +102,20 @@ vfs_getcwd_scandir(struct vnode **lvpp, /* If we don't care about the pathname, we're done */ if (bufp == NULL) { - vrele(lvp); - *lvpp = NULL; - return (0); + error = 0; + goto out; } fileno = va.va_fileid; dirbuflen = DIRBLKSIZ; - if (dirbuflen < va.va_blocksize) dirbuflen = va.va_blocksize; - + /* XXX we need some limit for fuse, 1 MB should be enough */ + if (dirbuflen > 0xfffff) { + error = EINVAL; + goto out; + } dirbuf = malloc(dirbuflen, M_TEMP, M_WAITOK); off = 0; @@ -159,15 +161,20 @@ vfs_getcwd_scandir(struct vnode **lvpp, reclen = dp->d_reclen; /* Check for malformed directory */ - if (reclen < DIRENT_RECSIZE(1)) { + if (reclen < DIRENT_RECSIZE(1) || reclen > len) { error = EINVAL; goto out; } if (dp->d_fileno == fileno) { char *bp = *bpp; - bp -= dp->d_namlen; + if (offsetof(struct dirent, d_name) + + dp->d_namlen > reclen) { + error = EINVAL; + goto out; + } + bp -= dp->d_namlen; if (bp <= bufp) { error = ERANGE; goto out; 6.0/common/PaxHeaders.49427/030_sendsyslog.patch.sig01006440001756001161000000000074131406066630017044xustar0030 mtime=1501760947.262960698 30 atime=1783552628.018687845 6.0/common/030_sendsyslog.patch.sig010064400017560011610000000020311314060666300161700ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ/nzEC2650yurwBzbbnaYx3TOsReydSfZLWll41aSNWKgXtjU6Fs4eUxRFKB53AlSMNUMCrYZqGwTxYm3Qf2Mgo= OpenBSD 6.0 errata 030, August 3, 2017: A missing length check in sys_sendsyslog() may result in a kernel panic. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 030_sendsyslog.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/subr_log.c =================================================================== RCS file: /cvs/src/sys/kern/subr_log.c,v --- sys/kern/subr_log.c 23 Jun 2016 15:41:42 -0000 1.48 +++ sys/kern/subr_log.c 2 Aug 2017 16:26:20 -0000 @@ -415,6 +415,9 @@ dosendsyslog(struct proc *p, const char size_t i, len; int error; + if (nbyte > 8192) + nbyte = 8192; + if (syslogf) FREF(syslogf); else if (!ISSET(flags, LOG_CONS)) 6.0/common/PaxHeaders.49427/008_libssl.patch.sig01006440001756001161000000000074127710241250016143xustar0030 mtime=1474570325.758779914 30 atime=1783552628.018687845 6.0/common/008_libssl.patch.sig010064400017560011610000000040471277102412500153000ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ9h1PPDo5hFSxeqy0mO4oEQq78+JeE/qS3I3BEztDzZYrZX4LruPq8ymAVL9EfidIM7V1pPRXCUC/gnM3KlRaAI= OpenBSD 6.0 errata 8, Sep 22, 2016: Avoid unbounded memory growth in libssl, which can be triggered by a TLS client repeatedly renegotiating and sending OCSP Status Request TLS extensions. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 008_libssl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libssl: cd /usr/src/lib/libssl make obj make depend make make install Index: lib/libssl/src/ssl/t1_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/Attic/t1_lib.c,v retrieving revision 1.87 diff -u -p -r1.87 t1_lib.c --- lib/libssl/src/ssl/t1_lib.c 30 May 2016 13:42:54 -0000 1.87 +++ lib/libssl/src/ssl/t1_lib.c 22 Sep 2016 17:43:51 -0000 @@ -1438,10 +1438,28 @@ ssl_parse_clienthello_tlsext(SSL *s, uns /* Read in responder_id_list */ n2s(data, dsize); size -= 2; - if (dsize > size ) { + if (dsize > size) { *al = SSL_AD_DECODE_ERROR; return 0; } + + /* + * We remove any OCSP_RESPIDs from a + * previous handshake to prevent + * unbounded memory growth. + */ + sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, + OCSP_RESPID_free); + s->tlsext_ocsp_ids = NULL; + if (dsize > 0) { + s->tlsext_ocsp_ids = + sk_OCSP_RESPID_new_null(); + if (s->tlsext_ocsp_ids == NULL) { + *al = SSL_AD_INTERNAL_ERROR; + return 0; + } + } + while (dsize > 0) { OCSP_RESPID *id; int idsize; @@ -1467,13 +1485,6 @@ ssl_parse_clienthello_tlsext(SSL *s, uns if (data != sdata) { OCSP_RESPID_free(id); *al = SSL_AD_DECODE_ERROR; - return 0; - } - if (!s->tlsext_ocsp_ids && - !(s->tlsext_ocsp_ids = - sk_OCSP_RESPID_new_null())) { - OCSP_RESPID_free(id); - *al = SSL_AD_INTERNAL_ERROR; return 0; } if (!sk_OCSP_RESPID_push( 6.0/common/PaxHeaders.49427/025_icmp_opts.patch.sig01006440001756001161000000000074131106450070016643xustar0030 mtime=1495484935.089575912 30 atime=1783552628.018687845 6.0/common/025_icmp_opts.patch.sig010064400017560011610000000023171311064500700157760ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ+rRwru8/NPqjRlv6J9DvMMN7QJETg4Utc4F0Aft8w29WDyz0vxM1iIcb8g4x3L6dKahAPQEJe8EoWb/u9lUEgU= OpenBSD 6.0 errata 025, May 22, 2017: The kernel could leak memory when processing ICMP packets with IP options. Note that pf(4) blocks such packets by default. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 025_icmp_opts.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/netinet/ip_icmp.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_icmp.c,v retrieving revision 1.151 diff -u -p -r1.151 ip_icmp.c --- sys/netinet/ip_icmp.c 9 Dec 2015 09:27:40 -0000 1.151 +++ sys/netinet/ip_icmp.c 22 May 2017 15:48:23 -0000 @@ -592,8 +592,10 @@ reflect: icmpstat.icps_reflect++; icmpstat.icps_outhist[icp->icmp_type]++; - if (!icmp_reflect(m, &opts, NULL)) + if (!icmp_reflect(m, &opts, NULL)) { icmp_send(m, opts); + m_free(opts); + } return; case ICMP_REDIRECT: 6.0/common/PaxHeaders.49427/026_perl.patch.sig01006440001756001161000000000074131150604400015606xustar0030 mtime=1496604960.212399482 30 atime=1783552628.018687845 6.0/common/026_perl.patch.sig010064400017560011610000000056721311506044000147500ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ6oQmYmWT/1JPk2B3KI/ekIcVcfsQKLPYTKPICxaMJvCf64l3fjAja5RQiISj+76ziwnnTPp17PW7knhT2dyIAg= OpenBSD 6.0 errata 26, June 04, 2017: Use fchmod to avoid a race condition in File::Path. Fixes CVE-2017-6512. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 026_perl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then install the new file: install -o root -g wheel -m 0444 \ /usr/src/gnu/usr.bin/perl/cpan/File-Path/lib/File/Path.pm \ /usr/libdata/perl5/File/ Index: gnu/usr.bin/perl/cpan/File-Path/lib/File/Path.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/cpan/File-Path/lib/File/Path.pm,v retrieving revision 1.1.1.2 diff -u -p -u -p -r1.1.1.2 Path.pm --- gnu/usr.bin/perl/cpan/File-Path/lib/File/Path.pm 24 Mar 2014 14:58:52 -0000 1.1.1.2 +++ gnu/usr.bin/perl/cpan/File-Path/lib/File/Path.pm 1 Jun 2017 22:00:11 -0000 @@ -17,7 +17,7 @@ BEGIN { use Exporter (); use vars qw($VERSION @ISA @EXPORT @EXPORT_OK); -$VERSION = '2.09'; +$VERSION = '2.09_01'; @ISA = qw(Exporter); @EXPORT = qw(mkpath rmtree); @EXPORT_OK = qw(make_path remove_tree); @@ -284,13 +284,32 @@ sub _rmtree { if (!chdir($root)) { # see if we can escalate privileges to get in # (e.g. funny protection mask such as -w- instead of rwx) - $perm &= 07777; - my $nperm = $perm | 0700; - if (!($arg->{safe} or $nperm == $perm or chmod($nperm, $root))) { - _error($arg, "cannot make child directory read-write-exec", $canon); - next ROOT_DIR; + # This uses fchmod to avoid traversing outside of the proper + # location (CVE-2017-6512) + my $root_fh; + if (open($root_fh, '<', $root)) { + my ($fh_dev, $fh_inode) = (stat $root_fh )[0,1]; + $perm &= oct '7777'; + my $nperm = $perm | oct '700'; + local $@; + if ( + !( + $arg->{safe} + or $nperm == $perm + or !-d _ + or $fh_dev ne $ldev + or $fh_inode ne $lino + or eval { chmod( $nperm, $root_fh ) } + ) + ) + { + _error( $arg, + "cannot make child directory read-write-exec", $canon ); + next ROOT_DIR; + } + close $root_fh; } - elsif (!chdir($root)) { + if (!chdir($root)) { _error($arg, "cannot chdir to child", $canon); next ROOT_DIR; } 6.0/common/PaxHeaders.49427/027_sti.patch.sig01006440001756001161000000000074131175661650015465xustar0030 mtime=1497295989.262883522 30 atime=1783552628.018687845 6.0/common/027_sti.patch.sig010064400017560011610000000031341311756616500146160ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ4cryj2ELe5IomTbKgPI18JZme4WueuBAnf/RdLPRg5Vj+pm63Jws8zy4u+6NuDYKZwoNVMYrQBTzpkqsiebGAo= OpenBSD 6.0 errata 027, June 12, 2017: Fix an integer overflow in two range checks of the sti(4) display driver. This issue only affects the hppa architecture. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 027_sti.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/ic/sti.c =================================================================== RCS file: /cvs/src/sys/dev/ic/sti.c,v retrieving revision 1.77 diff -u -p -r1.77 sti.c --- sys/dev/ic/sti.c 9 Sep 2015 18:23:39 -0000 1.77 +++ sys/dev/ic/sti.c 11 Jun 2017 02:32:04 -0000 @@ -1130,7 +1130,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t d cmapp = (struct wsdisplay_cmap *)data; idx = cmapp->index; count = cmapp->count; - if (idx >= STI_NCMAP || idx + count > STI_NCMAP) + if (idx >= STI_NCMAP || count > STI_NCMAP - idx) return EINVAL; if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count))) break; @@ -1146,7 +1146,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t d cmapp = (struct wsdisplay_cmap *)data; idx = cmapp->index; count = cmapp->count; - if (idx >= STI_NCMAP || idx + count > STI_NCMAP) + if (idx >= STI_NCMAP || count > STI_NCMAP - idx) return EINVAL; if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count))) break; 6.0/common/PaxHeaders.49427/028_wsmux.patch.sig01006440001756001161000000000074131175661650016052xustar0030 mtime=1497295989.282883756 30 atime=1783552628.018687845 6.0/common/028_wsmux.patch.sig010064400017560011610000000023001311756616500151750ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ6AGZHP5WaZ87TSASuD0+j8d7zcLc6DFiZ9qdp9hdsWvm7ZqTzwtoTZqGoAvLQ1CLnfS33VxY5/oTukJO/kLwgU= OpenBSD 6.0 errata 028, June 12, 2017: An unprivileged console user can cause a kernel crash. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 028_wsmux.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/wscons/wsmux.c =================================================================== RCS file: /cvs/src/sys/dev/wscons/wsmux.c,v retrieving revision 1.31 diff -u -p -r1.31 wsmux.c --- sys/dev/wscons/wsmux.c 10 Sep 2015 18:14:52 -0000 1.31 +++ sys/dev/wscons/wsmux.c 12 Jun 2017 16:33:17 -0000 @@ -142,10 +142,10 @@ wsmux_getmux(int n) bcopy(old, new, nwsmux * sizeof(*wsmuxdevs)); for (i = nwsmux; i < (n + 1); i++) new[i] = NULL; - wsmuxdevs = new; - nwsmux = n + 1; if (old != NULL) free(old, M_DEVBUF, nwsmux * sizeof(*wsmuxdevs)); + wsmuxdevs = new; + nwsmux = n + 1; } sc = wsmuxdevs[n]; 6.0/common/PaxHeaders.49427/032_recv.patch.sig01006440001756001161000000000074131406066630015613xustar0030 mtime=1501760947.292961254 30 atime=1783552628.018687845 6.0/common/032_recv.patch.sig010064400017560011610000000026161314060666300147500ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ+RuVaD9ouo/4Ah7rg8rxFBCX41Jn48wqhdO1CUs19ufYZOSpoPGcS9JZgkIf6RtVDA3LYo3LhJvYsxv/PkTAwk= OpenBSD 6.0 errata 032, August 3, 2017: An alignment issue in recv() may result in an info leak via ktrace(). Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 032_recv.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/uipc_syscalls.c =================================================================== RCS file: /cvs/src/sys/kern/uipc_syscalls.c,v --- sys/kern/uipc_syscalls.c 27 Mar 2017 11:45:49 -0000 1.151 +++ sys/kern/uipc_syscalls.c 1 Aug 2017 22:10:56 -0000 1.151.4.1 @@ -872,16 +872,16 @@ recvit(struct proc *p, int s, struct msg i = len; } error = copyout(mtod(m, caddr_t), cp, i); +#ifdef KTRACE + if (KTRPOINT(p, KTR_STRUCT) && error == 0 && i) + ktrcmsghdr(p, mtod(m, char *), i); +#endif if (m->m_next) i = ALIGN(i); cp += i; len -= i; if (error != 0 || len <= 0) break; -#ifdef KTRACE - if (KTRPOINT(p, KTR_STRUCT) && i) - ktrcmsghdr(p, mtod(m, char *), i); -#endif } while ((m = m->m_next) != NULL); len = cp - (caddr_t)mp->msg_control; } 6.0/common/PaxHeaders.49427/033_tcp_usrreq.patch.sig01006440001756001161000000000074131406066630017044xustar0030 mtime=1501760947.302961299 30 atime=1783552628.018687845 6.0/common/033_tcp_usrreq.patch.sig010064400017560011610000000025771314060666300162070ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQxbWNVpFYTNrLrAxKx17f7US9vawpLjjUiY/E++5Z13yS6jCAZAKPsFjKXn1g5Hdfu/D347DoZDC/bU076KczAc= OpenBSD 6.0 errata 033, August 3, 2017: With an invalid address family, tcp_usrreq() may take an unintended code path. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 033_tcp_usrreq.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/netinet/tcp_usrreq.c =================================================================== RCS file: /cvs/src/sys/netinet/tcp_usrreq.c,v --- sys/netinet/tcp_usrreq.c 20 Jul 2016 19:57:53 -0000 1.134 +++ sys/netinet/tcp_usrreq.c 2 Aug 2017 16:37:39 -0000 @@ -258,9 +258,9 @@ tcp_usrreq(so, req, m, nam, control, p) } error = in6_pcbconnect(inp, nam); - } else if (sin->sin_family == AF_INET) + } else #endif /* INET6 */ - { + if (sin->sin_family == AF_INET) { if ((sin->sin_addr.s_addr == INADDR_ANY) || (sin->sin_addr.s_addr == INADDR_BROADCAST) || IN_MULTICAST(sin->sin_addr.s_addr) || @@ -270,6 +270,8 @@ tcp_usrreq(so, req, m, nam, control, p) } error = in_pcbconnect(inp, nam); + } else { + error = EAFNOSUPPORT; } if (error) 6.0/common/PaxHeaders.49427/034_sockaddr.patch.sig01006440001756001161000000000074131406066630016450xustar0030 mtime=1501760947.322961739 30 atime=1783552628.018687845 6.0/common/034_sockaddr.patch.sig010064400017560011610000000026311314060666300156020ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ06Q5htJ+dET+Fnmw0G1tDcGgonr9FlE6V7I0/F8NT3dlySQFpZUitqWrRF7SjT8Oqc0OcGajxN7QkKhQgINRAo= OpenBSD 6.0 errata 034, August 3, 2017: Missing socket address validation from userland may result in an info leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 034_sockaddr.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/uipc_syscalls.c =================================================================== RCS file: /cvs/src/sys/kern/uipc_syscalls.c,v --- sys/kern/uipc_syscalls.c 1 Aug 2017 22:10:56 -0000 1.151.4.1 +++ sys/kern/uipc_syscalls.c 1 Aug 2017 22:21:24 -0000 1.151.4.2 @@ -1104,8 +1104,10 @@ sockargs(struct mbuf **mp, const void *b * We can't allow socket names > UCHAR_MAX in length, since that * will overflow sa_len. Also, control data more than MCLBYTES in * length is just too much. + * Memory for sa_len and sa_family must exist. */ - if (buflen > (type == MT_SONAME ? UCHAR_MAX : MCLBYTES)) + if ((buflen > (type == MT_SONAME ? UCHAR_MAX : MCLBYTES)) || + (type == MT_SONAME && buflen < offsetof(struct sockaddr, sa_data))) return (EINVAL); /* Allocate an mbuf to hold the arguments. */ 6.0/common/PaxHeaders.49427/035_ptrace.patch.sig01006440001756001161000000000074131406066630016135xustar0030 mtime=1501760947.332961924 30 atime=1783552628.018687845 6.0/common/035_ptrace.patch.sig010064400017560011610000000020101314060666300152560ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQzuRtZpQhYe60JFjH8HrqNHWcMIM0XsmL1wPGYxPPhyhW7giKRQBnu59zuk/ypIc1CsOhs59FRslAG/Y6KBRbAw= OpenBSD 6.0 errata 035, August 3, 2017: An uninitialized variable in sys_ptrace() may result in an info leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 035_ptrace.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/sys_process.c =================================================================== RCS file: /cvs/src/sys/kern/sys_process.c,v --- sys/kern/sys_process.c 31 May 2016 22:34:53 -0000 1.69 +++ sys/kern/sys_process.c 2 Aug 2017 16:27:51 -0000 @@ -101,7 +101,7 @@ sys_ptrace(struct proc *p, void *v, regi register_t wcookie; #endif int error, write; - int temp; + int temp = 0; int req = SCARG(uap, req); int s; 6.0/common/PaxHeaders.49427/045_xrstor_resume.patch.sig01006440001756001161000000000074131652142560017601xustar0030 mtime=1507137710.219383238 30 atime=1783552628.018687845 6.0/common/045_xrstor_resume.patch.sig010064400017560011610000000104121316521425600167270ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ7PpOq+FMOp0pZF44oaBgHmZvHBBxODPWMy+5imAZ4x3Lh2IzicWYL+82ttXR7DfRqyV8xe7/mH0Emy34PviNw8= OpenBSD 6.0 errata 045, October 4th, 2017: Do not leak kernel address when restoring an invalid FPU context. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 045_xrstor_resume.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/arch/amd64/amd64/fpu.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/fpu.c,v retrieving revision 1.33.2.1 diff -u -p -r1.33.2.1 fpu.c --- sys/arch/amd64/amd64/fpu.c 3 Oct 2017 22:08:05 -0000 1.33.2.1 +++ sys/arch/amd64/amd64/fpu.c 4 Oct 2017 13:21:53 -0000 @@ -56,7 +56,8 @@ #include -void xrstor_user(struct savefpu *_addr, uint64_t _mask); +int xrstor_user(struct savefpu *_addr, uint64_t _mask); +void trap(struct trapframe *); /* * We do lazy initialization and switching using the TS bit in cr0 and the @@ -112,7 +113,7 @@ xrstor(struct savefpu *addr, uint64_t ma __asm volatile("xrstor %0" : : "m" (*addr), "a" (lo), "d" (hi)); } -void fpudna(struct cpu_info *); +void fpudna(struct cpu_info *, struct trapframe *); static int x86fpflags_to_siginfo(u_int32_t); /* @@ -226,7 +227,7 @@ x86fpflags_to_siginfo(u_int32_t flags) * saved state. */ void -fpudna(struct cpu_info *ci) +fpudna(struct cpu_info *ci, struct trapframe *frame) { struct savefpu *sfp; struct proc *p; @@ -287,7 +288,12 @@ fpudna(struct cpu_info *ci) p->p_md.md_flags |= MDP_USEDFPU; } else { if (xsave_mask) { - xrstor_user(sfp, xsave_mask); + if (xrstor_user(sfp, xsave_mask)) { + fpusave_proc(p, 0); /* faulted */ + frame->tf_trapno = T_PROTFLT; + trap(frame); + return; + } } else { static double zero = 0.0; Index: sys/arch/amd64/amd64/locore.S =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/locore.S,v retrieving revision 1.82.2.1 diff -u -p -r1.82.2.1 locore.S --- sys/arch/amd64/amd64/locore.S 3 Oct 2017 22:08:05 -0000 1.82.2.1 +++ sys/arch/amd64/amd64/locore.S 4 Oct 2017 13:21:53 -0000 @@ -1167,6 +1167,10 @@ ENTRY(xrstor_user) .globl xrstor_fault xrstor_fault: xrstor (%rdi) + xorl %eax, %eax + ret +ENTRY(xrstor_resume) + movl $1, %eax ret ENTRY(pagezero) Index: sys/arch/amd64/amd64/trap.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/trap.c,v retrieving revision 1.49.2.2 diff -u -p -r1.49.2.2 trap.c --- sys/arch/amd64/amd64/trap.c 3 Oct 2017 22:08:05 -0000 1.49.2.2 +++ sys/arch/amd64/amd64/trap.c 4 Oct 2017 13:22:16 -0000 @@ -148,7 +148,8 @@ trap(struct trapframe *frame) struct proc *p = curproc; int type = (int)frame->tf_trapno; struct pcb *pcb; - extern char doreti_iret[], resume_iret[], xrstor_fault[]; + extern char doreti_iret[], resume_iret[]; + extern char xrstor_fault[], xrstor_resume[]; caddr_t onfault; int error; uint64_t cr2; @@ -228,8 +229,8 @@ trap(struct trapframe *frame) * instruction that faulted. */ if (frame->tf_rip == (u_int64_t)xrstor_fault && p != NULL) { - fpusave_proc(p, 0); - goto user_trap; + frame->tf_rip = (u_int64_t)xrstor_resume; + return; } case T_SEGNPFLT: case T_ALIGNFLT: @@ -261,7 +262,6 @@ copyfault: case T_SEGNPFLT|T_USER: case T_STKFLT|T_USER: case T_NMI|T_USER: -user_trap: #ifdef TRAP_SIGDEBUG printf("pid %d (%s): BUS at rip %lx addr %lx\n", p->p_pid, p->p_comm, frame->tf_rip, rcr2()); Index: sys/arch/amd64/amd64/vector.S =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/vector.S,v retrieving revision 1.46.2.1 diff -u -p -r1.46.2.1 vector.S --- sys/arch/amd64/amd64/vector.S 26 Aug 2017 00:15:05 -0000 1.46.2.1 +++ sys/arch/amd64/amd64/vector.S 4 Oct 2017 13:21:53 -0000 @@ -127,6 +127,7 @@ IDTVEC(trap07) cld SMAP_CLAC movq CPUVAR(SELF),%rdi + movq %rsp, %rsi call _C_LABEL(fpudna) INTRFASTEXIT IDTVEC(trap08) 6.0/common/PaxHeaders.49427/015_libssl.patch.sig01006440001756001161000000000074130073740610016141xustar0030 mtime=1478359089.068524755 30 atime=1783552628.018687845 6.0/common/015_libssl.patch.sig010064400017560011610000000045611300737406100152770ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ111xX2lFlJ3LCcKBI85hpABi/RjQa8d6h4VhhaqLR+RX5noSq5d7ruQbfgXkxJ5E20drXrdr5BzvuS+XWePSAk= OpenBSD 6.0 errata 15, Nov 5, 2016: Avoid continual processing of an unlimited number of TLS records. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 015_libssl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libssl: cd /usr/src/lib/libssl make obj make depend make make install Index: lib/libssl/src/ssl/s3_pkt.c =================================================================== retrieving revision 1.58 retrieving revision 1.58.2.1 diff -u -p -r1.58 -r1.58.2.1 --- lib/libssl/src/ssl/s3_pkt.c 10 Jul 2016 23:07:34 -0000 1.58 +++ lib/libssl/src/ssl/s3_pkt.c 3 Nov 2016 16:28:36 -0000 1.58.2.1 @@ -839,10 +839,11 @@ ssl3_write_pending(SSL *s, int type, con int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek) { - int al, i, j, ret; + void (*cb)(const SSL *ssl, int type2, int val) = NULL; + int al, i, j, ret, rrcount = 0; unsigned int n; SSL3_RECORD *rr; - void (*cb)(const SSL *ssl, int type2, int val) = NULL; + BIO *bio; if (s->s3->rbuf.buf == NULL) /* Not initialized yet */ if (!ssl3_setup_read_buffer(s)) @@ -896,7 +897,27 @@ ssl3_read_bytes(SSL *s, int type, unsign return (-1); } } + start: + /* + * Do not process more than three consecutive records, otherwise the + * peer can cause us to loop indefinitely. Instead, return with an + * SSL_ERROR_WANT_READ so the caller can choose when to handle further + * processing. In the future, the total number of non-handshake and + * non-application data records per connection should probably also be + * limited... + */ + if (rrcount++ >= 3) { + if ((bio = SSL_get_rbio(s)) == NULL) { + SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR); + return -1; + } + BIO_clear_retry_flags(bio); + BIO_set_retry_read(bio); + s->rwstate = SSL_READING; + return -1; + } + s->rwstate = SSL_NOTHING; /* @@ -1050,7 +1071,6 @@ start: if (!(s->mode & SSL_MODE_AUTO_RETRY)) { if (s->s3->rbuf.left == 0) { /* no read-ahead left? */ - BIO *bio; /* In the case where we try to read application data, * but we trigger an SSL handshake, we return -1 with * the retry option set. Otherwise renegotiation may 6.0/common/PaxHeaders.49427/018_net80211.patch.sig01006440001756001161000000000073130560372520016037xustar0029 mtime=1488469674.10637642 30 atime=1783552628.018687845 6.0/common/018_net80211.patch.sig010064400017560011610000000200441305603725200151700ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ23A0xOCp400PktTZDUBix4+WeFGbvgFpT0syqTQuVCngviXTDrfBjkHEtJf4NmhIhDL44A9T2UnLSaoMOVPyAc= OpenBSD 6.0 errata 18, Mar 1, 2017: WiFi clients using WPA1 or WPA2 are vulnerable to a man-in-the-middle attack by rouge access points. This is version 2 of the patch file. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 018_net80211.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/net80211/ieee80211_input.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_input.c,v retrieving revision 1.178 diff -u -p -r1.178 ieee80211_input.c --- sys/net80211/ieee80211_input.c 18 May 2016 08:15:28 -0000 1.178 +++ sys/net80211/ieee80211_input.c 1 Mar 2017 18:24:55 -0000 @@ -2299,6 +2299,7 @@ ieee80211_recv_assoc_resp(struct ieee802 */ if (ic->ic_flags & IEEE80211_F_RSNON) { /* XXX ic->ic_mgt_timer = 5; */ + ni->ni_rsn_supp_state = RSNA_SUPP_PTKSTART; } else if (ic->ic_flags & IEEE80211_F_WEPON) ni->ni_flags |= IEEE80211_NODE_TXRXPROT; Index: sys/net80211/ieee80211_node.h =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_node.h,v retrieving revision 1.60 diff -u -p -r1.60 ieee80211_node.h --- sys/net80211/ieee80211_node.h 28 Apr 2016 08:18:10 -0000 1.60 +++ sys/net80211/ieee80211_node.h 1 Mar 2017 18:24:55 -0000 @@ -99,6 +99,14 @@ enum { RSNA_KEYERROR }; +/* Supplicant state machine: 4-Way Handshake (not documented in standard) */ +enum { + RSNA_SUPP_INITIALIZE, /* not expecting any messages */ + RSNA_SUPP_PTKSTART, /* awaiting handshake message 1 */ + RSNA_SUPP_PTKNEGOTIATING, /* got message 1 and derived PTK */ + RNSA_SUPP_PTKDONE /* got message 3 and authenticated AP */ +}; + struct ieee80211_rxinfo { u_int32_t rxi_flags; u_int32_t rxi_tstamp; @@ -205,6 +213,7 @@ struct ieee80211_node { /* RSN */ struct timeout ni_eapol_to; u_int ni_rsn_state; + u_int ni_rsn_supp_state; u_int ni_rsn_gstate; u_int ni_rsn_retries; u_int ni_rsnprotos; Index: sys/net80211/ieee80211_pae_input.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_pae_input.c,v retrieving revision 1.25 diff -u -p -r1.25 ieee80211_pae_input.c --- sys/net80211/ieee80211_pae_input.c 15 Jul 2015 22:16:42 -0000 1.25 +++ sys/net80211/ieee80211_pae_input.c 2 Mar 2017 09:00:08 -0000 @@ -193,6 +193,15 @@ ieee80211_recv_4way_msg1(struct ieee8021 ic->ic_opmode != IEEE80211_M_IBSS) return; #endif + /* + * Message 1 is always expected while RSN is active since some + * APs will rekey the PTK by sending Msg1/4 after some time. + */ + if (ni->ni_rsn_supp_state == RSNA_SUPP_INITIALIZE) { + DPRINTF(("unexpected in state: %d\n", ni->ni_rsn_supp_state)); + return; + } + /* enforce monotonicity of key request replay counter */ if (ni->ni_replaycnt_ok && BE_READ_8(key->replaycnt) <= ni->ni_replaycnt) { ic->ic_stats.is_rx_eapol_replay++; @@ -343,6 +352,13 @@ ieee80211_recv_4way_msg3(struct ieee8021 ic->ic_opmode != IEEE80211_M_IBSS) return; #endif + /* discard if we're not expecting this message */ + if (ni->ni_rsn_supp_state != RSNA_SUPP_PTKNEGOTIATING && + ni->ni_rsn_supp_state != RNSA_SUPP_PTKDONE) { + DPRINTF(("unexpected in state: %d\n", ni->ni_rsn_supp_state)); + return; + } + /* enforce monotonicity of key request replay counter */ if (ni->ni_replaycnt_ok && BE_READ_8(key->replaycnt) <= ni->ni_replaycnt) { ic->ic_stats.is_rx_eapol_replay++; @@ -737,6 +753,12 @@ ieee80211_recv_rsn_group_msg1(struct iee ic->ic_opmode != IEEE80211_M_IBSS) return; #endif + /* discard if we're not expecting this message */ + if (ni->ni_rsn_supp_state != RNSA_SUPP_PTKDONE) { + DPRINTF(("unexpected in state: %d\n", ni->ni_rsn_supp_state)); + return; + } + /* enforce monotonicity of key request replay counter */ if (BE_READ_8(key->replaycnt) <= ni->ni_replaycnt) { ic->ic_stats.is_rx_eapol_replay++; return; @@ -883,6 +905,12 @@ ieee80211_recv_wpa_group_msg1(struct iee ic->ic_opmode != IEEE80211_M_IBSS) return; #endif + /* discard if we're not expecting this message */ + if (ni->ni_rsn_supp_state != RNSA_SUPP_PTKDONE) { + DPRINTF(("unexpected in state: %d\n", ni->ni_rsn_supp_state)); + return; + } + /* enforce monotonicity of key request replay counter */ if (BE_READ_8(key->replaycnt) <= ni->ni_replaycnt) { ic->ic_stats.is_rx_eapol_replay++; return; @@ -975,6 +1003,7 @@ ieee80211_recv_group_msg2(struct ieee802 ni->ni_rsn_gstate)); return; } + /* enforce monotonicity of key request replay counter */ if (BE_READ_8(key->replaycnt) != ni->ni_replaycnt) { ic->ic_stats.is_rx_eapol_replay++; return; @@ -1019,6 +1048,11 @@ ieee80211_recv_eapol_key_req(struct ieee ic->ic_opmode != IEEE80211_M_IBSS) return; + /* discard if we're not expecting this message */ + if (ni->ni_rsn_state != RSNA_PTKINITDONE) { + DPRINTF(("unexpected in state: %d\n", ni->ni_rsn_state)); + return; + } /* enforce monotonicity of key request replay counter */ if (ni->ni_reqreplaycnt_ok && BE_READ_8(key->replaycnt) <= ni->ni_reqreplaycnt) { Index: sys/net80211/ieee80211_pae_output.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_pae_output.c,v retrieving revision 1.27 diff -u -p -r1.27 ieee80211_pae_output.c --- sys/net80211/ieee80211_pae_output.c 12 Apr 2016 14:33:27 -0000 1.27 +++ sys/net80211/ieee80211_pae_output.c 1 Mar 2017 18:24:55 -0000 @@ -310,6 +310,7 @@ ieee80211_send_4way_msg2(struct ieee8021 u_int16_t info; u_int8_t *frm; + ni->ni_rsn_supp_state = RSNA_SUPP_PTKNEGOTIATING; m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, (ni->ni_rsnprotos == IEEE80211_PROTO_WPA) ? 2 + IEEE80211_WPAIE_MAXLEN : @@ -438,6 +439,7 @@ ieee80211_send_4way_msg4(struct ieee8021 struct mbuf *m; u_int16_t info; + ni->ni_rsn_supp_state = RNSA_SUPP_PTKDONE; m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, 0); if (m == NULL) return ENOMEM; Index: sys/net80211/ieee80211_proto.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_proto.c,v retrieving revision 1.68 diff -u -p -r1.68 ieee80211_proto.c --- sys/net80211/ieee80211_proto.c 20 Jul 2016 15:40:27 -0000 1.68 +++ sys/net80211/ieee80211_proto.c 2 Mar 2017 08:57:50 -0000 @@ -358,8 +358,8 @@ ieee80211_set_shortslottime(struct ieee8 int ieee80211_keyrun(struct ieee80211com *ic, u_int8_t *macaddr) { + struct ieee80211_node *ni = ic->ic_bss; #ifndef IEEE80211_STA_ONLY - struct ieee80211_node *ni; struct ieee80211_pmk *pmk; #endif @@ -368,6 +368,7 @@ ieee80211_keyrun(struct ieee80211com *ic !(ic->ic_flags & IEEE80211_F_RSNON)) return ENETDOWN; + ni->ni_rsn_supp_state = RSNA_SUPP_PTKSTART; #ifndef IEEE80211_STA_ONLY if (ic->ic_opmode == IEEE80211_M_STA) #endif @@ -732,6 +733,10 @@ ieee80211_auth_open(struct ieee80211com } ieee80211_new_state(ic, IEEE80211_S_AUTH, wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); + + /* In IBSS mode no (re)association frames are sent. */ + if (ic->ic_flags & IEEE80211_F_RSNON) + ni->ni_rsn_supp_state = RSNA_SUPP_PTKSTART; break; case IEEE80211_M_AHDEMO: @@ -898,6 +903,7 @@ justcleanup: ieee80211_free_allnodes(ic); break; } + ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; break; case IEEE80211_S_SCAN: ic->ic_flags &= ~IEEE80211_F_SIBSS; @@ -908,6 +914,7 @@ justcleanup: ieee80211_chan2mode(ic, ni->ni_chan)]; ni->ni_associd = 0; ni->ni_rstamp = 0; + ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; switch (ostate) { case IEEE80211_S_INIT: #ifndef IEEE80211_STA_ONLY @@ -950,6 +957,7 @@ justcleanup: } break; case IEEE80211_S_AUTH: + ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; switch (ostate) { case IEEE80211_S_INIT: DPRINTF(("invalid transition\n")); 6.0/common/PaxHeaders.49427/002_perl.patch.sig01006440001756001161000000000073127514622740015617xustar0029 mtime=1470522556.83010508 30 atime=1783552628.008688802 6.0/common/002_perl.patch.sig010064400017560011610000000144711275146227400147570ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQxSIKFwCcVt1dWtbe3Ts73xo+2tGXwL6FdawY7bBCOeVHa2ZGzYcUj4rapIbNDsN/gYjJS88FHDnaRI2tLA+/QA= OpenBSD 6.0 errata 02, Aug 06, 2016: Revert incorrect version bumps in perl modules. Fixes IO::Socket::IP complaining about non-numeric version numbers. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 002_perl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then install the new files: cd /usr/src/gnu/usr.bin/perl/dist/IO/lib/IO install -o root -g wheel -m 0444 \ Dir.pm File.pm Handle.pm Pipe.pm Poll.pm \ Seekable.pm Select.pm Socket.pm \ /usr/libdata/perl5/`machine`-openbsd/5.20.3/IO install -o root -g wheel -m 0444 \ Socket/INET.pm Socket/UNIX.pm \ /usr/libdata/perl5/`machine`-openbsd/5.20.3/IO/Socket Index: gnu/usr.bin/perl/dist/IO/lib/IO/Dir.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Dir.pm,v retrieving revision 1.2 diff -u -p -r1.2 Dir.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Dir.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Dir.pm 5 Aug 2016 16:35:27 -0000 @@ -19,7 +19,7 @@ use File::stat; use File::Spec; @ISA = qw(Tie::Hash Exporter); -$VERSION = "1.10_01"; +$VERSION = "1.10"; $VERSION = eval $VERSION; @EXPORT_OK = qw(DIR_UNLINK); Index: gnu/usr.bin/perl/dist/IO/lib/IO/File.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/File.pm,v retrieving revision 1.2 diff -u -p -r1.2 File.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/File.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/File.pm 5 Aug 2016 16:35:27 -0000 @@ -136,7 +136,7 @@ require Exporter; @ISA = qw(IO::Handle IO::Seekable Exporter); -$VERSION = "1.16_01"; +$VERSION = "1.16"; @EXPORT = @IO::Seekable::EXPORT; Index: gnu/usr.bin/perl/dist/IO/lib/IO/Handle.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Handle.pm,v retrieving revision 1.2 diff -u -p -r1.2 Handle.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Handle.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Handle.pm 5 Aug 2016 16:35:27 -0000 @@ -271,7 +271,7 @@ use IO (); # Load the XS module require Exporter; @ISA = qw(Exporter); -$VERSION = "1.35_01"; +$VERSION = "1.35"; $VERSION = eval $VERSION; @EXPORT_OK = qw( Index: gnu/usr.bin/perl/dist/IO/lib/IO/Pipe.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Pipe.pm,v retrieving revision 1.2 diff -u -p -r1.2 Pipe.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Pipe.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Pipe.pm 5 Aug 2016 16:35:27 -0000 @@ -14,7 +14,7 @@ our($VERSION); use Carp; use Symbol; -$VERSION = "1.15_01"; +$VERSION = "1.15"; sub new { my $type = shift; Index: gnu/usr.bin/perl/dist/IO/lib/IO/Poll.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Poll.pm,v retrieving revision 1.2 diff -u -p -r1.2 Poll.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Poll.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Poll.pm 5 Aug 2016 16:35:27 -0000 @@ -13,7 +13,7 @@ use Exporter (); our(@ISA, @EXPORT_OK, @EXPORT, $VERSION); @ISA = qw(Exporter); -$VERSION = "0.09_01"; +$VERSION = "0.09"; @EXPORT = qw( POLLIN POLLOUT Index: gnu/usr.bin/perl/dist/IO/lib/IO/Seekable.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Seekable.pm,v retrieving revision 1.2 diff -u -p -r1.2 Seekable.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Seekable.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Seekable.pm 5 Aug 2016 16:35:27 -0000 @@ -107,7 +107,7 @@ require Exporter; @EXPORT = qw(SEEK_SET SEEK_CUR SEEK_END); @ISA = qw(Exporter); -$VERSION = "1.10_01"; +$VERSION = "1.10"; $VERSION = eval $VERSION; sub seek { Index: gnu/usr.bin/perl/dist/IO/lib/IO/Select.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Select.pm,v retrieving revision 1.2 diff -u -p -r1.2 Select.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Select.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Select.pm 5 Aug 2016 16:35:28 -0000 @@ -11,7 +11,7 @@ use warnings::register; use vars qw($VERSION @ISA); require Exporter; -$VERSION = "1.22_01"; +$VERSION = "1.22"; @ISA = qw(Exporter); # This is only so we can do version checking Index: gnu/usr.bin/perl/dist/IO/lib/IO/Socket.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Socket.pm,v retrieving revision 1.2 diff -u -p -r1.2 Socket.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Socket.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Socket.pm 5 Aug 2016 16:35:28 -0000 @@ -24,7 +24,7 @@ require IO::Socket::UNIX if ($^O ne 'epo @ISA = qw(IO::Handle); -$VERSION = "1.38_01"; +$VERSION = "1.38"; @EXPORT_OK = qw(sockatmark); Index: gnu/usr.bin/perl/dist/IO/lib/IO/Socket/INET.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Socket/INET.pm,v retrieving revision 1.2 diff -u -p -r1.2 INET.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Socket/INET.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Socket/INET.pm 5 Aug 2016 16:35:28 -0000 @@ -15,7 +15,7 @@ use Exporter; use Errno; @ISA = qw(IO::Socket); -$VERSION = "1.35_01"; +$VERSION = "1.35"; my $EINVAL = exists(&Errno::EINVAL) ? Errno::EINVAL() : 1; Index: gnu/usr.bin/perl/dist/IO/lib/IO/Socket/UNIX.pm =================================================================== RCS file: /cvs/src/gnu/usr.bin/perl/dist/IO/lib/IO/Socket/UNIX.pm,v retrieving revision 1.2 diff -u -p -r1.2 UNIX.pm --- gnu/usr.bin/perl/dist/IO/lib/IO/Socket/UNIX.pm 25 Jul 2016 10:53:03 -0000 1.2 +++ gnu/usr.bin/perl/dist/IO/lib/IO/Socket/UNIX.pm 5 Aug 2016 16:35:28 -0000 @@ -12,7 +12,7 @@ use IO::Socket; use Carp; @ISA = qw(IO::Socket); -$VERSION = "1.26_01"; +$VERSION = "1.26"; $VERSION = eval $VERSION; IO::Socket::UNIX->register_domain( AF_UNIX ); 6.0/common/PaxHeaders.49427/036_fcntl.patch.sig01006440001756001161000000000074131406066630015766xustar0030 mtime=1501760947.342962109 30 atime=1783552628.018687845 6.0/common/036_fcntl.patch.sig010064400017560011610000000020431314060666300151150ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ4XKs9hiELd5Eg2hRuepMQFJrxI+lLvu6pDD5yYq3YIvfJ0bAjrCIK5ZBC8e++zT874bqW+nYfUP7DmLlFWbDgQ= OpenBSD 6.0 errata 036, August 3, 2017: An uninitialized variable in sys_fcntl() may result in an info leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 036_fcntl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/kern_descrip.c =================================================================== RCS file: /cvs/src/sys/kern/kern_descrip.c,v --- sys/kern/kern_descrip.c 29 May 2016 13:51:53 -0000 1.132 +++ sys/kern/kern_descrip.c 2 Aug 2017 16:28:32 -0000 @@ -435,6 +435,7 @@ restart: *retval = ((struct pipe *)fp->f_data)->pipe_pgid; break; } + tmp = 0; error = (*fp->f_ops->fo_ioctl) (fp, TIOCGPGRP, (caddr_t)&tmp, p); *retval = -tmp; 6.0/common/PaxHeaders.49427/037_wsdisplay.patch.sig01006440001756001161000000000074131406066630016700xustar0030 mtime=1501760947.362962619 30 atime=1783552628.018687845 6.0/common/037_wsdisplay.patch.sig010064400017560011610000000024411314060666300160310ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ7o+A63mXBBV1+V3puGKZ3Z68XY9NHGgRnxKcN7ghQcxfRRpvyqg1SapN+0vWxkNJ1D+qGivFx3yp54JJpdRKwg= OpenBSD 6.0 errata 037, August 3, 2017: An integer overflow in wsdisplay_cfg_ioctl() may result in an out-of-bounds read. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 037_wsdisplay.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/wscons/wsdisplay.c =================================================================== RCS file: /cvs/src/sys/dev/wscons/wsdisplay.c,v --- sys/dev/wscons/wsdisplay.c 8 Sep 2015 11:13:20 -0000 1.124 +++ sys/dev/wscons/wsdisplay.c 2 Aug 2017 16:44:07 -0000 @@ -1305,6 +1305,10 @@ wsdisplay_cfg_ioctl(struct wsdisplay_sof #define d ((struct wsdisplay_font *)data) if (!sc->sc_accessops->load_font) return (EINVAL); + if (d->fontheight > 64 || d->stride > 8) /* 64x64 pixels */ + return (EINVAL); + if (d->numchars > 65536) /* unicode plane */ + return (EINVAL); fontsz = d->fontheight * d->stride * d->numchars; if (fontsz > WSDISPLAY_MAXFONTSZ) return (EINVAL); 6.0/common/PaxHeaders.49427/038_sosplice.patch.sig01006440001756001161000000000074131406066630016503xustar0030 mtime=1501760947.372962804 30 atime=1783552628.018687845 6.0/common/038_sosplice.patch.sig010064400017560011610000000040661314060666300156410ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ5/xQlA/78kaKvliGgaP/wZNKjrLmS7oCyFrOzTM/o4I1P3WUiuOIfSy3jkK7u10csVSb2D0njWgr/s3fWM2tQU= OpenBSD 6.0 errata 038, August 3, 2017: A race condition in sosplice() may result in a kernel memory leak. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 038_sosplice.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/uipc_socket.c =================================================================== RCS file: /cvs/src/sys/kern/uipc_socket.c,v --- sys/kern/uipc_socket.c 13 Jun 2016 21:24:43 -0000 1.152 +++ sys/kern/uipc_socket.c 2 Aug 2017 16:29:08 -0000 @@ -1047,6 +1047,7 @@ sosplice(struct socket *so, int fd, off_ { struct file *fp; struct socket *sosp; + struct sosplice *sp; int s, error = 0; if ((so->so_proto->pr_flags & PR_SPLICE) == 0) @@ -1056,8 +1057,13 @@ sosplice(struct socket *so, int fd, off_ if ((so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0 && (so->so_proto->pr_flags & PR_CONNREQUIRED)) return (ENOTCONN); - if (so->so_sp == NULL) - so->so_sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO); + if (so->so_sp == NULL) { + sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO); + if (so->so_sp == NULL) + so->so_sp = sp; + else + pool_put(&sosplice_pool, sp); + } /* If no fd is given, unsplice by removing existing link. */ if (fd < 0) { @@ -1083,8 +1089,13 @@ sosplice(struct socket *so, int fd, off_ if ((error = getsock(curproc, fd, &fp)) != 0) return (error); sosp = fp->f_data; - if (sosp->so_sp == NULL) - sosp->so_sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO); + if (sosp->so_sp == NULL) { + sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO); + if (sosp->so_sp == NULL) + sosp->so_sp = sp; + else + pool_put(&sosplice_pool, sp); + } /* Lock both receive and send buffer. */ if ((error = sblock(&so->so_rcv, 6.0/common/PaxHeaders.49427/044_xrstor.patch.sig01006440001756001161000000000074131652064040016214xustar0030 mtime=1507134724.227581729 30 atime=1783552628.018687845 6.0/common/044_xrstor.patch.sig010064400017560011610000000064051316520640400153510ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ8qux8rz3eB2vYfGGBp/WEBKuVcfHufa00nR7p6V4CY/PXEgdDI9ppw8n4LLVaLAQGdoP1yAZ8bxfyVE9kIzLgI= OpenBSD 6.0 errata 044, October 4th, 2017: Correctly handle exceptions when restoring an invalid FPU context. This is the second revision of the patch. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 044_xrstor.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/arch/amd64/amd64/fpu.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/fpu.c,v retrieving revision 1.33 diff -u -p -r1.33 fpu.c --- sys/arch/amd64/amd64/fpu.c 21 Apr 2016 22:08:27 -0000 1.33 +++ sys/arch/amd64/amd64/fpu.c 3 Oct 2017 21:31:18 -0000 @@ -56,6 +56,8 @@ #include +void xrstor_user(struct savefpu *_addr, uint64_t _mask); + /* * We do lazy initialization and switching using the TS bit in cr0 and the * MDP_USEDFPU bit in mdproc. @@ -285,7 +287,7 @@ fpudna(struct cpu_info *ci) p->p_md.md_flags |= MDP_USEDFPU; } else { if (xsave_mask) { - xrstor(sfp, xsave_mask); + xrstor_user(sfp, xsave_mask); } else { static double zero = 0.0; Index: sys/arch/amd64/amd64/locore.S =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/locore.S,v retrieving revision 1.82 diff -u -p -r1.82 locore.S --- sys/arch/amd64/amd64/locore.S 16 Jul 2016 06:04:29 -0000 1.82 +++ sys/arch/amd64/amd64/locore.S 3 Oct 2017 21:31:18 -0000 @@ -1160,6 +1160,15 @@ _C_LABEL(doreti_iret): iretq +ENTRY(xrstor_user) + movq %rsi, %rdx + movl %esi, %eax + shrq $32, %rdx + .globl xrstor_fault +xrstor_fault: + xrstor (%rdi) + ret + ENTRY(pagezero) movq $-PAGE_SIZE,%rdx subq %rdx,%rdi Index: sys/arch/amd64/amd64/trap.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/arch/amd64/amd64/trap.c,v retrieving revision 1.49.2.1 diff -u -p -r1.49.2.1 trap.c --- sys/arch/amd64/amd64/trap.c 26 Aug 2017 00:15:05 -0000 1.49.2.1 +++ sys/arch/amd64/amd64/trap.c 3 Oct 2017 21:40:14 -0000 @@ -148,7 +148,7 @@ trap(struct trapframe *frame) struct proc *p = curproc; int type = (int)frame->tf_trapno; struct pcb *pcb; - extern char doreti_iret[], resume_iret[]; + extern char doreti_iret[], resume_iret[], xrstor_fault[]; caddr_t onfault; int error; uint64_t cr2; @@ -222,6 +222,15 @@ trap(struct trapframe *frame) /*NOTREACHED*/ case T_PROTFLT: + /* + * Check for xrstor faulting because of invalid xstate + * We do this by looking at the address of the + * instruction that faulted. + */ + if (frame->tf_rip == (u_int64_t)xrstor_fault && p != NULL) { + fpusave_proc(p, 0); + goto user_trap; + } case T_SEGNPFLT: case T_ALIGNFLT: case T_TSSFLT: @@ -252,6 +261,7 @@ copyfault: case T_SEGNPFLT|T_USER: case T_STKFLT|T_USER: case T_NMI|T_USER: +user_trap: #ifdef TRAP_SIGDEBUG printf("pid %d (%s): BUS at rip %lx addr %lx\n", p->p_pid, p->p_comm, frame->tf_rip, rcr2()); 6.0/common/PaxHeaders.49427/039_ieee80211.patch.sig01006440001756001161000000000074131406066630016166xustar0030 mtime=1501760947.382963059 30 atime=1783552628.018687845 6.0/common/039_ieee80211.patch.sig010064400017560011610000000047221314060666300153230ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ49mnoTnUSoWs+JmfWHKitfNSmv+uEexV+JSQJ/WXjy4S7rchLQvjSdyeFk2AL7OMPfpHdbCC7n9p3AVH/o5yQE= OpenBSD 6.0 errata 039, August 3, 2017: An out of bounds read could occur during processing of EAPOL frames in the wireless stack. Information from kernel memory could be leaked to root in userland via an ieee80211(9) ioctl. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 039_ieee80211.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/net80211/ieee80211_ioctl.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_ioctl.c,v --- sys/net80211/ieee80211_ioctl.c 23 Mar 2017 04:10:10 -0000 1.52 +++ sys/net80211/ieee80211_ioctl.c 1 Aug 2017 23:07:01 -0000 1.52.4.1 @@ -60,6 +60,10 @@ ieee80211_node2req(struct ieee80211com * ieee80211_node2req(struct ieee80211com *ic, const struct ieee80211_node *ni, struct ieee80211_nodereq *nr) { + memset(nr, 0, sizeof(*nr)); + + strlcpy(nr->nr_ifname, ic->ic_if.if_xname, sizeof(nr->nr_ifname)); + /* Node address and name information */ IEEE80211_ADDR_COPY(nr->nr_macaddr, ni->ni_macaddr); IEEE80211_ADDR_COPY(nr->nr_bssid, ni->ni_bssid); Index: sys/net80211/ieee80211_pae_input.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_pae_input.c,v --- sys/net80211/ieee80211_pae_input.c 1 Mar 2017 20:57:51 -0000 1.25.6.1 +++ sys/net80211/ieee80211_pae_input.c 2 Aug 2017 16:42:31 -0000 @@ -78,7 +78,7 @@ ieee80211_eapol_key_input(struct ieee802 struct ether_header *eh; struct ieee80211_eapol_key *key; u_int16_t info, desc; - int totlen; + int totlen, bodylen, paylen; ifp->if_ibytes += m->m_pkthdr.len; @@ -109,12 +109,14 @@ ieee80211_eapol_key_input(struct ieee802 goto done; /* check packet body length */ - if (m->m_pkthdr.len < 4 + BE_READ_2(key->len)) + bodylen = BE_READ_2(key->len); + totlen = 4 + bodylen; + if (m->m_pkthdr.len < totlen || totlen > MCLBYTES) goto done; /* check key data length */ - totlen = sizeof(*key) + BE_READ_2(key->paylen); - if (m->m_pkthdr.len < totlen || totlen > MCLBYTES) + paylen = BE_READ_2(key->paylen); + if (paylen > totlen - sizeof(*key)) goto done; info = BE_READ_2(key->info); 6.0/common/PaxHeaders.49427/003_relayd.patch.sig01006440001756001161000000000074127514622740016137xustar0030 mtime=1470522556.840104425 30 atime=1783552628.018687845 6.0/common/003_relayd.patch.sig010064400017560011610000000142661275146227400153000ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQz5yMCgijPP8NK5lgFOuTCaBS/1ls877CCT5dqYFarm6EcmFP8PBQLYFN6D0BjlMrwArvGZOokKnQ9M4fMrYcQA= OpenBSD 6.0 errata 3, Aug 06, 2016: Improve parsing of the Host-header by following RFC 7230 Section 5.4 more strictly. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 003_relayd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install relayd: cd /usr/src/usr.sbin/relayd make obj make depend make make install Index: usr.sbin/relayd/relay_http.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relay_http.c,v retrieving revision 1.56 diff -u -p -r1.56 relay_http.c --- usr.sbin/relayd/relay_http.c 22 Jul 2016 09:30:36 -0000 1.56 +++ usr.sbin/relayd/relay_http.c 2 Aug 2016 19:46:28 -0000 @@ -150,7 +150,8 @@ relay_read_http(struct bufferevent *bev, struct protocol *proto = rlay->rl_proto; struct evbuffer *src = EVBUFFER_INPUT(bev); char *line = NULL, *key, *value; - int action; + char *urlproto, *host, *path; + int action, unique, ret; const char *errstr; size_t size, linelen; struct kv *hdr = NULL; @@ -331,11 +332,35 @@ relay_read_http(struct bufferevent *bev, strcasecmp("chunked", value) == 0) desc->http_chunked = 1; + /* The following header should only occur once */ + if (strcasecmp("Host", key) == 0) { + unique = 1; + + /* + * The path may contain a URL. The host in the + * URL has to match the Host: value. + */ + if (parse_url(desc->http_path, + &urlproto, &host, &path) == 0) { + ret = strcasecmp(host, value); + free(urlproto); + free(host); + free(path); + if (ret != 0) { + relay_abort_http(con, 400, + "malformed host", 0); + goto abort; + } + } + } else + unique = 0; + if (cre->line != 1) { if ((hdr = kv_add(&desc->http_headers, key, - value)) == NULL) { - free(line); - goto fail; + value, unique)) == NULL) { + relay_abort_http(con, 400, + "malformed header", 0); + goto abort; } desc->http_lastheader = hdr; } @@ -1537,7 +1562,7 @@ relay_apply_actions(struct ctl_relay_eve if (addkv && kv->kv_matchtree != NULL) { /* Add new entry to the list (eg. new HTTP header) */ if ((match = kv_add(kv->kv_matchtree, kp->kv_key, - kp->kv_value)) == NULL) + kp->kv_value, 0)) == NULL) goto fail; match->kv_option = kp->kv_option; match->kv_type = kp->kv_type; Index: usr.sbin/relayd/relayd.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relayd.c,v retrieving revision 1.153 diff -u -p -r1.153 relayd.c --- usr.sbin/relayd/relayd.c 2 Feb 2016 17:51:11 -0000 1.153 +++ usr.sbin/relayd/relayd.c 2 Aug 2016 19:46:28 -0000 @@ -645,9 +645,8 @@ purge_relay(struct relayd *env, struct r free(rlay); } - struct kv * -kv_add(struct kvtree *keys, char *key, char *value) +kv_add(struct kvtree *keys, char *key, char *value, int unique) { struct kv *kv, *oldkv; @@ -655,24 +654,30 @@ kv_add(struct kvtree *keys, char *key, c return (NULL); if ((kv = calloc(1, sizeof(*kv))) == NULL) return (NULL); - if ((kv->kv_key = strdup(key)) == NULL) { - free(kv); - return (NULL); - } + if ((kv->kv_key = strdup(key)) == NULL) + goto fail; if (value != NULL && - (kv->kv_value = strdup(value)) == NULL) { - free(kv->kv_key); - free(kv); - return (NULL); - } + (kv->kv_value = strdup(value)) == NULL) + goto fail; TAILQ_INIT(&kv->kv_children); if ((oldkv = RB_INSERT(kvtree, keys, kv)) != NULL) { + /* + * return error if the key should occur only once, + * or add it to a list attached to the key's node. + */ + if (unique) + goto fail; TAILQ_INSERT_TAIL(&oldkv->kv_children, kv, kv_entry); kv->kv_parent = oldkv; } return (kv); + fail: + free(kv->kv_key); + free(kv->kv_value); + free(kv); + return (NULL); } int @@ -1379,6 +1384,52 @@ canonicalize_host(const char *host, char fail: errno = EINVAL; return (NULL); +} + +int +parse_url(const char *url, char **protoptr, char **hostptr, char **pathptr) +{ + char *p, *proto = NULL, *host = NULL, *path = NULL; + + /* return error if it is not a URL */ + if ((p = strstr(url, ":/")) == NULL || + (strcspn(url, ":/") != (size_t)(p - url))) + return (-1); + + /* get protocol */ + if ((proto = strdup(url)) == NULL) + goto fail; + p = proto + (p - url); + + /* get host */ + p += strspn(p, ":/"); + if (*p == '\0' || (host = strdup(p)) == NULL) + goto fail; + *p = '\0'; + + /* find and copy path or default to "/" */ + if ((p = strchr(host, '/')) == NULL) + p = "/"; + if ((path = strdup(p)) == NULL) + goto fail; + + /* strip path after host */ + host[strcspn(host, "/")] = '\0'; + + DPRINTF("%s: %s proto %s, host %s, path %s", __func__, + url, proto, host, path); + + *protoptr = proto; + *hostptr = host; + *pathptr = path; + + return (0); + + fail: + free(proto); + free(host); + free(path); + return (-1); } int Index: usr.sbin/relayd/relayd.h =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relayd.h,v retrieving revision 1.223 diff -u -p -r1.223 relayd.h --- usr.sbin/relayd/relayd.h 22 Jul 2016 09:30:36 -0000 1.223 +++ usr.sbin/relayd/relayd.h 2 Aug 2016 19:46:28 -0000 @@ -1268,6 +1268,7 @@ void purge_table(struct relayd *, stru void purge_relay(struct relayd *, struct relay *); char *digeststr(enum digest_type, const u_int8_t *, size_t, char *); const char *canonicalize_host(const char *, char *, size_t); +int parse_url(const char *, char **, char **, char **); int map6to4(struct sockaddr_storage *); int map4to6(struct sockaddr_storage *, struct sockaddr_storage *); void imsg_event_add(struct imsgev *); @@ -1281,7 +1282,7 @@ struct in6_addr *prefixlen2mask6(u_int8_ u_int32_t prefixlen2mask(u_int8_t); int accept_reserve(int, struct sockaddr *, socklen_t *, int, volatile int *); -struct kv *kv_add(struct kvtree *, char *, char *); +struct kv *kv_add(struct kvtree *, char *, char *, int); int kv_set(struct kv *, char *, ...); int kv_setkey(struct kv *, char *, ...); void kv_delete(struct kvtree *, struct kv *); 6.0/common/PaxHeaders.49427/041_net80211_replay.patch.sig01006440001756001161000000000074131515420160017403xustar0030 mtime=1504101390.163093083 30 atime=1783552628.018687845 6.0/common/041_net80211_replay.patch.sig010064400017560011610000000336601315154201600165430ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQzcYx1qpk3xo94+fk008L6WnGNF5Rq+pk+B8EeR8RUe9I0jZN9REXpEKpAKpqGE4v/2/P86nedk8e2Ywvdl79Qs= OpenBSD 6.0 errata 041, August 30, 2017 State transition errors could cause reinstallation of old WPA keys. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 041_net80211_replay.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/net80211/ieee80211_crypto.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_crypto.c,v retrieving revision 1.66 diff -u -p -r1.66 ieee80211_crypto.c --- sys/net80211/ieee80211_crypto.c 24 Nov 2015 13:45:06 -0000 1.66 +++ sys/net80211/ieee80211_crypto.c 29 Aug 2017 21:20:52 -0000 @@ -76,7 +76,6 @@ ieee80211_crypto_detach(struct ifnet *if { struct ieee80211com *ic = (void *)ifp; struct ieee80211_pmk *pmk; - int i; /* purge the PMKSA cache */ while ((pmk = TAILQ_FIRST(&ic->ic_pmksa)) != NULL) { @@ -86,15 +85,23 @@ ieee80211_crypto_detach(struct ifnet *if } /* clear all group keys from memory */ + ieee80211_crypto_clear_groupkeys(ic); + + /* clear pre-shared key from memory */ + explicit_bzero(ic->ic_psk, IEEE80211_PMK_LEN); +} + +void +ieee80211_crypto_clear_groupkeys(struct ieee80211com *ic) +{ + int i; + for (i = 0; i < IEEE80211_GROUP_NKID; i++) { struct ieee80211_key *k = &ic->ic_nw_keys[i]; if (k->k_cipher != IEEE80211_CIPHER_NONE) (*ic->ic_delete_key)(ic, NULL, k); explicit_bzero(k, sizeof(*k)); } - - /* clear pre-shared key from memory */ - explicit_bzero(ic->ic_psk, IEEE80211_PMK_LEN); } /* Index: sys/net80211/ieee80211_crypto.h =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_crypto.h,v retrieving revision 1.23 diff -u -p -r1.23 ieee80211_crypto.h --- sys/net80211/ieee80211_crypto.h 5 Dec 2015 16:26:53 -0000 1.23 +++ sys/net80211/ieee80211_crypto.h 29 Aug 2017 21:20:52 -0000 @@ -111,6 +111,7 @@ struct ieee80211_node; void ieee80211_crypto_attach(struct ifnet *); void ieee80211_crypto_detach(struct ifnet *); +void ieee80211_crypto_clear_groupkeys(struct ieee80211com *); struct ieee80211_key *ieee80211_get_txkey(struct ieee80211com *, const struct ieee80211_frame *, struct ieee80211_node *); struct ieee80211_key *ieee80211_get_rxkey(struct ieee80211com *, Index: sys/net80211/ieee80211_node.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_node.c,v retrieving revision 1.103 diff -u -p -r1.103 ieee80211_node.c --- sys/net80211/ieee80211_node.c 21 May 2016 09:07:11 -0000 1.103 +++ sys/net80211/ieee80211_node.c 29 Aug 2017 21:20:52 -0000 @@ -1430,6 +1430,7 @@ ieee80211_node_join_rsn(struct ieee80211 ni->ni_key_count = 0; ni->ni_port_valid = 0; ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT; + ni->ni_flags &= ~IEEE80211_NODE_RSN_NEW_PTK; ni->ni_replaycnt = -1; /* XXX */ ni->ni_rsn_retries = 0; ni->ni_rsncipher = ni->ni_rsnciphers; Index: sys/net80211/ieee80211_node.h =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_node.h,v retrieving revision 1.60.2.1 diff -u -p -r1.60.2.1 ieee80211_node.h --- sys/net80211/ieee80211_node.h 1 Mar 2017 20:57:51 -0000 1.60.2.1 +++ sys/net80211/ieee80211_node.h 29 Aug 2017 21:20:52 -0000 @@ -291,6 +291,7 @@ struct ieee80211_node { #define IEEE80211_NODE_HT 0x0400 /* HT negotiated */ #define IEEE80211_NODE_SA_QUERY 0x0800 /* SA Query in progress */ #define IEEE80211_NODE_SA_QUERY_FAILED 0x1000 /* last SA Query failed */ +#define IEEE80211_NODE_RSN_NEW_PTK 0x2000 /* expecting a new PTK */ }; RB_HEAD(ieee80211_tree, ieee80211_node); Index: sys/net80211/ieee80211_pae_input.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_pae_input.c,v retrieving revision 1.25.6.2 diff -u -p -r1.25.6.2 ieee80211_pae_input.c --- sys/net80211/ieee80211_pae_input.c 2 Aug 2017 16:51:38 -0000 1.25.6.2 +++ sys/net80211/ieee80211_pae_input.c 29 Aug 2017 21:20:52 -0000 @@ -47,6 +47,8 @@ void ieee80211_recv_4way_msg2(struct iee struct ieee80211_eapol_key *, struct ieee80211_node *, const u_int8_t *); #endif +int ieee80211_must_update_group_key(struct ieee80211_key *, const uint8_t *, + int); void ieee80211_recv_4way_msg3(struct ieee80211com *, struct ieee80211_eapol_key *, struct ieee80211_node *); #ifndef IEEE80211_STA_ONLY @@ -261,6 +263,9 @@ ieee80211_recv_4way_msg1(struct ieee8021 ieee80211_derive_ptk(ni->ni_rsnakms, ni->ni_pmk, ni->ni_macaddr, ic->ic_myaddr, ni->ni_nonce, ic->ic_nonce, &tptk); + /* We are now expecting a new pairwise key. */ + ni->ni_flags |= IEEE80211_NODE_RSN_NEW_PTK; + if (ic->ic_if.if_flags & IFF_DEBUG) printf("%s: received msg %d/%d of the %s handshake from %s\n", ic->ic_if.if_xname, 1, 4, "4-way", @@ -335,6 +340,14 @@ ieee80211_recv_4way_msg2(struct ieee8021 } #endif /* IEEE80211_STA_ONLY */ +int +ieee80211_must_update_group_key(struct ieee80211_key *k, const uint8_t *gtk, + int len) +{ + return (k->k_cipher == IEEE80211_CIPHER_NONE || k->k_len != len || + memcmp(k->k_key, gtk, len) != 0); +} + /* * Process Message 3 of the 4-Way Handshake (sent by Authenticator). */ @@ -515,7 +528,8 @@ ieee80211_recv_4way_msg3(struct ieee8021 if (ieee80211_send_4way_msg4(ic, ni) != 0) return; /* ..authenticator will retry */ - if (ni->ni_rsncipher != IEEE80211_CIPHER_USEGROUP) { + if (ni->ni_rsncipher != IEEE80211_CIPHER_USEGROUP && + (ni->ni_flags & IEEE80211_NODE_RSN_NEW_PTK)) { u_int64_t prsc; /* check that key length matches that of pairwise cipher */ @@ -538,9 +552,13 @@ ieee80211_recv_4way_msg3(struct ieee8021 reason = IEEE80211_REASON_AUTH_LEAVE; goto deauth; } + ni->ni_flags &= ~IEEE80211_NODE_RSN_NEW_PTK; ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT; ni->ni_flags |= IEEE80211_NODE_RXPROT; - } + } else if (ni->ni_rsncipher != IEEE80211_CIPHER_USEGROUP) + printf("%s: unexpected pairwise key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); + if (gtk != NULL) { u_int8_t kid; @@ -553,20 +571,24 @@ ieee80211_recv_4way_msg3(struct ieee8021 /* map GTK to 802.11 key */ kid = gtk[6] & 3; k = &ic->ic_nw_keys[kid]; - memset(k, 0, sizeof(*k)); - k->k_id = kid; /* 0-3 */ - k->k_cipher = ni->ni_rsngroupcipher; - k->k_flags = IEEE80211_KEY_GROUP; - if (gtk[6] & (1 << 2)) - k->k_flags |= IEEE80211_KEY_TX; - k->k_rsc[0] = LE_READ_6(key->rsc); - k->k_len = keylen; - memcpy(k->k_key, >k[8], k->k_len); - /* install the GTK */ - if ((*ic->ic_set_key)(ic, ni, k) != 0) { - reason = IEEE80211_REASON_AUTH_LEAVE; - goto deauth; - } + if (ieee80211_must_update_group_key(k, >k[8], keylen)) { + memset(k, 0, sizeof(*k)); + k->k_id = kid; /* 0-3 */ + k->k_cipher = ni->ni_rsngroupcipher; + k->k_flags = IEEE80211_KEY_GROUP; + if (gtk[6] & (1 << 2)) + k->k_flags |= IEEE80211_KEY_TX; + k->k_rsc[0] = LE_READ_6(key->rsc); + k->k_len = keylen; + memcpy(k->k_key, >k[8], k->k_len); + /* install the GTK */ + if ((*ic->ic_set_key)(ic, ni, k) != 0) { + reason = IEEE80211_REASON_AUTH_LEAVE; + goto deauth; + } + } else + printf("%s: reused group key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); } if (igtk != NULL) { /* implies MFP && gtk != NULL */ u_int16_t kid; @@ -584,18 +606,22 @@ ieee80211_recv_4way_msg3(struct ieee8021 } /* map IGTK to 802.11 key */ k = &ic->ic_nw_keys[kid]; - memset(k, 0, sizeof(*k)); - k->k_id = kid; /* either 4 or 5 */ - k->k_cipher = ni->ni_rsngroupmgmtcipher; - k->k_flags = IEEE80211_KEY_IGTK; - k->k_mgmt_rsc = LE_READ_6(&igtk[8]); /* IPN */ - k->k_len = 16; - memcpy(k->k_key, &igtk[14], k->k_len); - /* install the IGTK */ - if ((*ic->ic_set_key)(ic, ni, k) != 0) { - reason = IEEE80211_REASON_AUTH_LEAVE; - goto deauth; - } + if (ieee80211_must_update_group_key(k, &igtk[14], 16)) { + memset(k, 0, sizeof(*k)); + k->k_id = kid; /* either 4 or 5 */ + k->k_cipher = ni->ni_rsngroupmgmtcipher; + k->k_flags = IEEE80211_KEY_IGTK; + k->k_mgmt_rsc = LE_READ_6(&igtk[8]); /* IPN */ + k->k_len = 16; + memcpy(k->k_key, &igtk[14], k->k_len); + /* install the IGTK */ + if ((*ic->ic_set_key)(ic, ni, k) != 0) { + reason = IEEE80211_REASON_AUTH_LEAVE; + goto deauth; + } + } else + printf("%s: reused group key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); } if (info & EAPOL_KEY_INSTALL) ni->ni_flags |= IEEE80211_NODE_TXRXPROT; @@ -821,20 +847,24 @@ ieee80211_recv_rsn_group_msg1(struct iee /* map GTK to 802.11 key */ kid = gtk[6] & 3; k = &ic->ic_nw_keys[kid]; - memset(k, 0, sizeof(*k)); - k->k_id = kid; /* 0-3 */ - k->k_cipher = ni->ni_rsngroupcipher; - k->k_flags = IEEE80211_KEY_GROUP; - if (gtk[6] & (1 << 2)) - k->k_flags |= IEEE80211_KEY_TX; - k->k_rsc[0] = LE_READ_6(key->rsc); - k->k_len = keylen; - memcpy(k->k_key, >k[8], k->k_len); - /* install the GTK */ - if ((*ic->ic_set_key)(ic, ni, k) != 0) { - reason = IEEE80211_REASON_AUTH_LEAVE; - goto deauth; - } + if (ieee80211_must_update_group_key(k, >k[8], keylen)) { + memset(k, 0, sizeof(*k)); + k->k_id = kid; /* 0-3 */ + k->k_cipher = ni->ni_rsngroupcipher; + k->k_flags = IEEE80211_KEY_GROUP; + if (gtk[6] & (1 << 2)) + k->k_flags |= IEEE80211_KEY_TX; + k->k_rsc[0] = LE_READ_6(key->rsc); + k->k_len = keylen; + memcpy(k->k_key, >k[8], k->k_len); + /* install the GTK */ + if ((*ic->ic_set_key)(ic, ni, k) != 0) { + reason = IEEE80211_REASON_AUTH_LEAVE; + goto deauth; + } + } else + printf("%s: reused group key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); if (igtk != NULL) { /* implies MFP */ /* check that the IGTK KDE is valid */ if (igtk[1] != 4 + 24) { @@ -849,18 +879,22 @@ ieee80211_recv_rsn_group_msg1(struct iee } /* map IGTK to 802.11 key */ k = &ic->ic_nw_keys[kid]; - memset(k, 0, sizeof(*k)); - k->k_id = kid; /* either 4 or 5 */ - k->k_cipher = ni->ni_rsngroupmgmtcipher; - k->k_flags = IEEE80211_KEY_IGTK; - k->k_mgmt_rsc = LE_READ_6(&igtk[8]); /* IPN */ - k->k_len = 16; - memcpy(k->k_key, &igtk[14], k->k_len); - /* install the IGTK */ - if ((*ic->ic_set_key)(ic, ni, k) != 0) { - reason = IEEE80211_REASON_AUTH_LEAVE; - goto deauth; - } + if (ieee80211_must_update_group_key(k, &igtk[14], 16)) { + memset(k, 0, sizeof(*k)); + k->k_id = kid; /* either 4 or 5 */ + k->k_cipher = ni->ni_rsngroupmgmtcipher; + k->k_flags = IEEE80211_KEY_IGTK; + k->k_mgmt_rsc = LE_READ_6(&igtk[8]); /* IPN */ + k->k_len = 16; + memcpy(k->k_key, &igtk[14], k->k_len); + /* install the IGTK */ + if ((*ic->ic_set_key)(ic, ni, k) != 0) { + reason = IEEE80211_REASON_AUTH_LEAVE; + goto deauth; + } + } else + printf("%s: reused group key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); } if (info & EAPOL_KEY_SECURE) { #ifndef IEEE80211_STA_ONLY @@ -901,6 +935,7 @@ ieee80211_recv_wpa_group_msg1(struct iee u_int16_t info; u_int8_t kid; int keylen; + const uint8_t *gtk; #ifndef IEEE80211_STA_ONLY if (ic->ic_opmode != IEEE80211_M_STA && @@ -946,23 +981,27 @@ ieee80211_recv_wpa_group_msg1(struct iee /* map GTK to 802.11 key */ kid = (info >> EAPOL_KEY_WPA_KID_SHIFT) & 3; k = &ic->ic_nw_keys[kid]; - memset(k, 0, sizeof(*k)); - k->k_id = kid; /* 0-3 */ - k->k_cipher = ni->ni_rsngroupcipher; - k->k_flags = IEEE80211_KEY_GROUP; - if (info & EAPOL_KEY_WPA_TX) - k->k_flags |= IEEE80211_KEY_TX; - k->k_rsc[0] = LE_READ_6(key->rsc); - k->k_len = keylen; - /* key data field contains the GTK */ - memcpy(k->k_key, &key[1], k->k_len); - /* install the GTK */ - if ((*ic->ic_set_key)(ic, ni, k) != 0) { - IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, - IEEE80211_REASON_AUTH_LEAVE); - ieee80211_new_state(ic, IEEE80211_S_SCAN, -1); - return; - } + gtk = (const uint8_t *)&key[1]; /* key data field contains the GTK */ + if (ieee80211_must_update_group_key(k, gtk, keylen)) { + memset(k, 0, sizeof(*k)); + k->k_id = kid; /* 0-3 */ + k->k_cipher = ni->ni_rsngroupcipher; + k->k_flags = IEEE80211_KEY_GROUP; + if (info & EAPOL_KEY_WPA_TX) + k->k_flags |= IEEE80211_KEY_TX; + k->k_rsc[0] = LE_READ_6(key->rsc); + k->k_len = keylen; + memcpy(k->k_key, gtk, k->k_len); + /* install the GTK */ + if ((*ic->ic_set_key)(ic, ni, k) != 0) { + IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, + IEEE80211_REASON_AUTH_LEAVE); + ieee80211_new_state(ic, IEEE80211_S_SCAN, -1); + return; + } + } else + printf("%s: reused group key update received from %s\n", + ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr)); if (info & EAPOL_KEY_SECURE) { #ifndef IEEE80211_STA_ONLY if (ic->ic_opmode != IEEE80211_M_IBSS || Index: sys/net80211/ieee80211_proto.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_proto.c,v retrieving revision 1.68.2.2 diff -u -p -r1.68.2.2 ieee80211_proto.c --- sys/net80211/ieee80211_proto.c 2 Mar 2017 09:47:32 -0000 1.68.2.2 +++ sys/net80211/ieee80211_proto.c 29 Aug 2017 21:20:52 -0000 @@ -904,6 +904,7 @@ justcleanup: break; } ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; + ieee80211_crypto_clear_groupkeys(ic); break; case IEEE80211_S_SCAN: ic->ic_flags &= ~IEEE80211_F_SIBSS; @@ -915,6 +916,7 @@ justcleanup: ni->ni_associd = 0; ni->ni_rstamp = 0; ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; + ieee80211_crypto_clear_groupkeys(ic); switch (ostate) { case IEEE80211_S_INIT: #ifndef IEEE80211_STA_ONLY @@ -958,6 +960,7 @@ justcleanup: break; case IEEE80211_S_AUTH: ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; + ieee80211_crypto_clear_groupkeys(ic); switch (ostate) { case IEEE80211_S_INIT: DPRINTF(("invalid transition\n")); 6.0/common/PaxHeaders.49427/016_libcrypto.patch.sig01006440001756001161000000000074130335006160016655xustar0030 mtime=1483637134.753235269 30 atime=1783552628.018687845 6.0/common/016_libcrypto.patch.sig010064400017560011610000000023701303350061600160070ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ55BCxFoKK3pckJBYNZ3l6vujvan4SYLtXvRIsH6PNnmu7Xu18ILyYPxIQnYmCf1ux+IeoD8vzKfEeoCb+UVdQg= OpenBSD 6.0 errata 16, Jan 5, 2017: Avoid possible side-channel leak of ECDSA private keys when signing. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 016_libcrypto.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libcrypto: cd /usr/src/lib/libcrypto make obj make depend make make install Index: lib/libssl/src/crypto/ecdsa/ecs_ossl.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/ecdsa/Attic/ecs_ossl.c,v retrieving revision 1.6 retrieving revision 1.6.8.1 diff -u -p -r1.6 -r1.6.8.1 --- lib/libssl/src/crypto/ecdsa/ecs_ossl.c 8 Feb 2015 13:35:07 -0000 1.6 +++ lib/libssl/src/crypto/ecdsa/ecs_ossl.c 5 Jan 2017 13:28:48 -0000 1.6.8.1 @@ -141,6 +141,8 @@ ecdsa_sign_setup(EC_KEY *eckey, BN_CTX * if (BN_num_bits(k) <= BN_num_bits(order)) if (!BN_add(k, k, order)) goto err; + + BN_set_flags(k, BN_FLG_CONSTTIME); /* compute r the x-coordinate of generator * k */ if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { 6.0/common/PaxHeaders.49427/005_wsfont.patch.sig01006440001756001161000000000074127671373570016211xustar0030 mtime=1474084591.587454751 30 atime=1783552628.018687845 6.0/common/005_wsfont.patch.sig010064400017560011610000000036761276713735700153550ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ/PhYXHNfj2UaVm8wrh7ryXGjD/GjFYJtJDPPJuUywpddLSSZAjKUY1Hasp10eBD4wjNtePER2jTjvile65NvQg= OpenBSD 6.0 errata 05, Sep 17, 2016: Limit the number of wscons fonts that can be loaded into the kernel. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 005_wsfont.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/wscons/wsconsio.h =================================================================== RCS file: /cvs/src/sys/dev/wscons/wsconsio.h,v retrieving revision 1.74 retrieving revision 1.74.2.1 diff -u -p -r1.74 -r1.74.2.1 --- sys/dev/wscons/wsconsio.h 30 Mar 2016 23:34:12 -0000 1.74 +++ sys/dev/wscons/wsconsio.h 16 Sep 2016 14:54:37 -0000 1.74.2.1 @@ -418,6 +418,7 @@ struct wsdisplay_cursor { struct wsdisplay_font { char name[WSFONT_NAME_SIZE]; int index; +#define WSDISPLAY_MAXFONTCOUNT 8 int firstchar, numchars; int encoding; #define WSDISPLAY_FONTENC_ISO 0 Index: sys/dev/wsfont/wsfont.c =================================================================== RCS file: /cvs/src/sys/dev/wsfont/wsfont.c,v retrieving revision 1.42 retrieving revision 1.42.4.1 diff -u -p -r1.42 -r1.42.4.1 --- sys/dev/wsfont/wsfont.c 13 Sep 2015 16:44:30 -0000 1.42 +++ sys/dev/wsfont/wsfont.c 16 Sep 2016 14:54:37 -0000 1.42.4.1 @@ -450,13 +450,21 @@ wsfont_add(struct wsdisplay_font *font, { static int cookiegen = 666; struct font *ent; - int s; + int s, fontc = 0; s = splhigh(); /* Don't allow exact duplicates */ if (wsfont_find(font->name, font->fontwidth, font->fontheight, font->stride) >= 0) { + splx(s); + return (-1); + } + + TAILQ_FOREACH(ent, &fontlist, chain) + fontc++; + + if (fontc >= WSDISPLAY_MAXFONTCOUNT) { splx(s); return (-1); } 6.0/common/PaxHeaders.49427/009_libssl.patch.sig01006440001756001161000000000074127710241250016144xustar0030 mtime=1474570325.758779914 30 atime=1783552628.018687845 6.0/common/009_libssl.patch.sig010064400017560011610000000027731277102412500153050ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ9ZFM3xIkMBu8BeBCYbv6eon/Tt9qohFeLd4eHuYMfou24e0ejr9aUDbsUt2/YzcAFxFtj4G2xexfc81z6RqpAg= OpenBSD 6.0 errata 9, Sep 22, 2016: Avoid falling back to a weak digest for (EC)DH when using SNI with libssl. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 009_libssl.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libssl: cd /usr/src/lib/libssl make obj make depend make make install Index: lib/libssl/src/ssl/ssl_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/Attic/ssl_lib.c,v retrieving revision 1.116 diff -u -p -r1.116 ssl_lib.c --- lib/libssl/src/ssl/ssl_lib.c 25 Oct 2015 15:52:49 -0000 1.116 +++ lib/libssl/src/ssl/ssl_lib.c 22 Sep 2016 17:44:12 -0000 @@ -2847,13 +2847,20 @@ SSL_get_SSL_CTX(const SSL *ssl) SSL_CTX * SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) { + CERT *ocert = ssl->cert; + if (ssl->ctx == ctx) return (ssl->ctx); if (ctx == NULL) ctx = ssl->initial_ctx; - if (ssl->cert != NULL) - ssl_cert_free(ssl->cert); ssl->cert = ssl_cert_dup(ctx->cert); + if (ocert != NULL) { + int i; + /* Copy negotiated digests from original certificate. */ + for (i = 0; i < SSL_PKEY_NUM; i++) + ssl->cert->pkeys[i].digest = ocert->pkeys[i].digest; + ssl_cert_free(ocert); + } CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX); SSL_CTX_free(ssl->ctx); /* decrement reference count */ ssl->ctx = ctx; 6.0/common/PaxHeaders.49427/017_httpd.patch.sig01006440001756001161000000000074130445431620015777xustar0030 mtime=1486014066.410589808 30 atime=1783552628.018687845 6.0/common/017_httpd.patch.sig010064400017560011610000000030361304454316200151310ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ3eNwKs/S5yXsFP65nKdFo1W++cCqhctN4sF1gSAws62g1SLUOm1KcCYlKzasUPxcrI4Xk4uAekDH+e/jQGpHws= OpenBSD 6.0 errata 17, Jan 31, 2017 A bug in the processing of range headers in httpd can lead to memory exhaustion. This patch disables range header processing. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 017_httpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install httpd: cd /usr/src/usr.sbin/httpd make obj make depend make make install Index: usr.sbin/httpd/server_file.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/server_file.c,v retrieving revision 1.62 diff -u -p -r1.62 server_file.c --- usr.sbin/httpd/server_file.c 17 May 2016 03:12:39 -0000 1.62 +++ usr.sbin/httpd/server_file.c 31 Jan 2017 15:04:37 -0000 @@ -65,7 +65,6 @@ server_file_access(struct httpd *env, st struct http_descriptor *desc = clt->clt_descreq; struct server_config *srv_conf = clt->clt_srv_conf; struct stat st; - struct kv *r, key; char *newpath, *encodedpath; int ret; @@ -145,13 +144,7 @@ server_file_access(struct httpd *env, st goto fail; } - key.kv_key = "Range"; - r = kv_find(&desc->http_headers, &key); - if (r != NULL) - return (server_partial_file_request(env, clt, path, &st, - r->kv_value)); - else - return (server_file_request(env, clt, path, &st)); + return (server_file_request(env, clt, path, &st)); fail: switch (errno) { 6.0/common/PaxHeaders.49427/006_iked.patch.sig01006440001756001161000000000074127674026170015600xustar0030 mtime=1474168207.147118094 30 atime=1783552628.018687845 6.0/common/006_iked.patch.sig010064400017560011610000000020671276740261700147350ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ/cNueHXB60QopDDgrfL27XGOqkV4wf7x5Nchi8V7ib8bbDxQuk71xVUcPPNkZoGUXvJlxYh/mlfBm//OVs9ggA= OpenBSD 6.0 errata 6, Sept 17, 2016: During parsing of the iked(8) configuration, a variable is set to 0 by mistake, disabling Pre-Shared key authentication. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 006_iked.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install iked: cd /usr/src/sbin/iked make obj make depend make make install Index: sbin/iked/parse.y =================================================================== RCS file: /cvs/src/sbin/iked/parse.y,v retrieving revision 1.56 diff -u -p -r1.56 parse.y --- sbin/iked/parse.y 20 Jul 2016 12:31:00 -0000 1.56 +++ sbin/iked/parse.y 14 Sep 2016 22:31:03 -0000 @@ -823,7 +823,6 @@ ikeauth : /* empty */ { memcpy(&$$, &$2, sizeof($$)); $$.auth_method = IKEV2_AUTH_SHARED_KEY_MIC; $$.auth_eap = 0; - $$.auth_length = 0; } | EAP STRING { unsigned int i; 6.0/common/PaxHeaders.49427/004_smtpd.patch.sig01006440001756001161000000000074127566705540016016xustar0030 mtime=1471902060.973172203 30 atime=1783552628.018687845 6.0/common/004_smtpd.patch.sig010064400017560011610000000021721275667055400151500ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ9/BL5Z2N1Vqrq9/VPCrm8vQH/xbQmz0cHARb1rzkdBhQTO8UyTz9kI1WL4il5POleO3os0fnr/Rpp+gClLdJwk= OpenBSD 6.0 errata 4, Aug 23, 2016: A missing initialization can prevent mail headers from being altered as intended, resulting in mail being sent to incorrect addresses. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 004_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make obj make depend make make install Index: usr.sbin/smtpd/rfc2822.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/rfc2822.c,v retrieving revision 1.7 diff -u -p -r1.7 rfc2822.c --- usr.sbin/smtpd/rfc2822.c 4 Feb 2016 22:35:17 -0000 1.7 +++ usr.sbin/smtpd/rfc2822.c 22 Aug 2016 15:23:41 -0000 @@ -138,6 +138,7 @@ rfc2822_parser_init(struct rfc2822_parse TAILQ_INIT(&rp->header.lines); rfc2822_header_default_callback(rp, hdr_dflt_cb, NULL); rfc2822_body_callback(rp, body_dflt_cb, NULL); + rfc2822_parser_reset(rp); } void 6.0/common/PaxHeaders.49427/001_uvmisavail.patch.sig01006440001756001161000000000074127502674170017036xustar0030 mtime=1470197519.627660767 30 atime=1783552628.008688802 6.0/common/001_uvmisavail.patch.sig010064400017560011610000000032641275026741700161730ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ8uLlE/2x21afWh28cxDmpSO7LhyEJdxRTUJBscHYM5sMJ3952+Gs9Mr6g3EE0CkKe0aFd91GExK6k8IzbUljww= OpenBSD 6.0 errata 01, Aug 02, 2016: Missing overflow checks in uvm may result in panics. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 001_uvmisavail.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/uvm/uvm_map.c =================================================================== RCS file: /cvs/src/sys/uvm/uvm_map.c,v retrieving revision 1.217 diff -u -p -r1.217 uvm_map.c --- sys/uvm/uvm_map.c 17 Jun 2016 10:48:25 -0000 1.217 +++ sys/uvm/uvm_map.c 1 Aug 2016 19:22:10 -0000 @@ -771,6 +771,9 @@ uvm_map_isavail(struct vm_map *map, stru struct uvm_map_addr *atree; struct vm_map_entry *i, *i_end; + if (addr + sz < addr) + return 0; + /* * Kernel memory above uvm_maxkaddr is considered unavailable. */ @@ -1033,6 +1036,12 @@ uvm_mapanon(struct vm_map *map, vaddr_t goto unlock; } + /* Check if selected address doesn't cause overflow. */ + if (*addr + sz < *addr) { + error = ENOMEM; + goto unlock; + } + /* If we only want a query, return now. */ if (flags & UVM_FLAG_QUERY) { error = 0; @@ -1274,6 +1283,12 @@ uvm_map(struct vm_map *map, vaddr_t *add if (error != 0) goto unlock; + } + + /* Check if selected address doesn't cause overflow. */ + if (*addr + sz < *addr) { + error = ENOMEM; + goto unlock; } KASSERT((map->flags & VM_MAP_ISVMSPACE) == VM_MAP_ISVMSPACE || 6.0/common/PaxHeaders.49427/007_libcrypto.patch.sig01006440001756001161000000000074127710241250016661xustar0030 mtime=1474570325.748772328 30 atime=1783552628.018687845 6.0/common/007_libcrypto.patch.sig010064400017560011610000000025121277102412500160110ustar00ssyncsyncuntrusted comment: signature from openbsd 6.0 base secret key RWSho3oKSqgLQ6yNUUNBraPrO/BUmtdK55+gqzrBaDp8fcGFTmDoV2EG/HMPRaE1ofDfTB0twnpHQWobBz9dxtYK1yiEfkVbEQs= OpenBSD 6.0 errata 7, Sep 22, 2016: Revert change that cleans up the EVP cipher context in EVP_EncryptFinal() and EVP_DecryptFinal(). Some software relies on the previous behaviour. Apply by doing: signify -Vep /etc/signify/openbsd-60-base.pub -x 007_libcrypto.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libcrypto: cd /usr/src/lib/libcrypto make obj make depend make make install Index: lib/libssl/src/crypto/evp/evp_enc.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/evp/Attic/evp_enc.c,v retrieving revision 1.31 retrieving revision 1.31.2.1 diff -u -p -r1.31 -r1.31.2.1 --- lib/libssl/src/crypto/evp/evp_enc.c 30 May 2016 13:42:54 -0000 1.31 +++ lib/libssl/src/crypto/evp/evp_enc.c 22 Sep 2016 04:50:19 -0000 1.31.2.1 @@ -371,7 +371,6 @@ EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, un int ret; ret = EVP_EncryptFinal_ex(ctx, out, outl); - (void) EVP_CIPHER_CTX_cleanup(ctx); return ret; } @@ -485,7 +484,6 @@ EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, un int ret; ret = EVP_DecryptFinal_ex(ctx, out, outl); - (void) EVP_CIPHER_CTX_cleanup(ctx); return ret; }