Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs security patch...

diff --git a/sys-kernel/win4lin-sources/ChangeLog b/sys-kernel/win4lin-sources/ChangeLog
index 6b91e91d6bf4e32e74a907c78457e1ea40179640..906e660bb0cad7935b5bb21ef18ae6ffee778c38 100644 (file)
--- a/sys-kernel/win4lin-sources/ChangeLog
+++ b/sys-kernel/win4lin-sources/ChangeLog
@@ -1,6 +1,21 @@
 # ChangeLog for sys-kernel/win4lin-sources
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/ChangeLog,v 1.41 2004/11/15 18:07:41 genstef Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/ChangeLog,v 1.42 2004/11/20 11:12:53 plasmaroo Exp $
+
+*win4lin-sources-2.6.9-r1 (20 Nov 2004)
+
+  20 Nov 2004; <plasmaroo@gentoo.org> -win4lin-sources-2.4.26-r8.ebuild,
+  +win4lin-sources-2.4.26-r9.ebuild, -win4lin-sources-2.6.7-r8.ebuild,
+  +win4lin-sources-2.6.7-r9.ebuild, +win4lin-sources-2.6.9-r1.ebuild,
+  -win4lin-sources-2.6.9.ebuild,
+  files/win4lin-sources-2.4.26.binfmt_elf.patch,
+  +files/win4lin-sources-2.4.26.smbfs.patch,
+  +files/win4lin-sources-2.6.7.smbfs.patch,
+  files/win4lin-sources-2.6.9.binfmt_elf.patch,
+  +files/win4lin-sources-2.6.9.smbfs.patch,
+  files/win4lin-sources-2.6.binfmt_elf.patch:
+  Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs
+  security patch (bug #65877).
 
 *win4lin-sources-2.6.9 (15 Nov 2004)
 

diff --git a/sys-kernel/win4lin-sources/Manifest b/sys-kernel/win4lin-sources/Manifest
index 34640f494797ba1a1b12df03d8d94b9caab6c540..9f331e006e9e95ae57b6011de78cce33bce9aa9a 100644 (file)
--- a/sys-kernel/win4lin-sources/Manifest
+++ b/sys-kernel/win4lin-sources/Manifest
@@ -1,26 +1,29 @@
-MD5 3cce735269e32f6bf2400e99460c63ed win4lin-sources-2.4.26-r8.ebuild 2425
-MD5 a7902a81fa8e139c4678adfd387c36ca win4lin-sources-2.6.9.ebuild 1229
-MD5 029a407b2c1b3519e7fe897cbe0181f2 win4lin-sources-2.6.7-r8.ebuild 1793
-MD5 4a7a94b4da34a504b41d79dafd06f1d2 ChangeLog 9086
+MD5 d3cdbe45004008357f30cf9de907cc54 ChangeLog 9757
+MD5 27cd49bfd7ec2eacd19c15559b90261a win4lin-sources-2.4.26-r9.ebuild 2504
 MD5 608fe99985244b0445f76cee44c9ae14 metadata.xml 290
-MD5 aa595005721b58929ee55e2e8f4b6ba0 files/win4lin-sources-2.6.CAN-2004-0816.patch 1693
+MD5 25b3cbb82e314eebe9c8f9cbc5df124f win4lin-sources-2.6.9-r1.ebuild 1264
+MD5 270c68c2f1305ef5e7c4f831558e0378 win4lin-sources-2.6.7-r9.ebuild 1823
+MD5 2b3ddb8b8b15f8da35ade38544b57857 files/win4lin-sources-2.4.26.XDRWrapFix.patch 1499
 MD5 8204afea1d572b49a4a80d8da4eef0c9 files/win4lin-sources-2.6.CAN-2004-0596.patch 1033
+MD5 c2510fe1891f5a9effb12c2196922206 files/win4lin-sources-2.6.cmdlineLeak.patch 281
+MD5 53fe3d26f6fc45487d69895fc07770cb files/win4lin-sources-2.6.9.binfmt_elf.patch 2350
+MD5 8812f60b8d02b0b3b4c46a3311ddd851 files/win4lin-sources-2.6.9.smbfs.patch 2662
+MD5 a9991d6324d7404ed99e79be6e44e9de files/win4lin-sources-2.6.binfmt_elf.patch 2348
+MD5 452e04a312368605e145428c35bd0e05 files/win4lin-sources-2.6.devPtmx.patch 572
 MD5 c9da1bc82b906f6abc648c056e7bf662 files/win4lin-sources-2.4.26.FPULockup-53804.patch 354
-MD5 d9127fc038c80114d40b69d761803ed2 files/win4lin-sources-2.6.9.binfmt_elf.patch 1929
-MD5 d4a740ae56c2049247083af387a22a85 files/win4lin-sources-2.4.26.CAN-2004-0394.patch 350
-MD5 b738cb0120a32aa92cfcfdbd564dd21f files/win4lin-sources-2.6.ProcPerms.patch 1368
-MD5 1ee8ba8362089c31fdd7d88b32eaf63e files/win4lin-sources-2.6.binfmt_elf.patch 1938
-MD5 24c53f49954dab29cfc172d4a3ba1a31 files/win4lin-sources-2.4.26.binfmt_elf.patch 1928
-MD5 2b3ddb8b8b15f8da35ade38544b57857 files/win4lin-sources-2.4.26.XDRWrapFix.patch 1499
-MD5 9cae5cdb5da7ef0bbe13fbbf6daee5dd files/digest-win4lin-sources-2.6.7-r8 359
-MD5 02c062ec3a11a6a1498cdf0b1716c90a files/win4lin-sources-2.6.6.FPULockup-53804.patch 895
-MD5 95708646470a95668e8789cd415844ed files/win4lin-sources.CAN-2004-0497.patch 846
+MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/win4lin-sources-2.6.7.smbfs.patch 3309
+MD5 d1ccc2047be533c992f67270a150a210 files/win4lin-sources-2.4.26.cmdlineLeak.patch 388
+MD5 aa595005721b58929ee55e2e8f4b6ba0 files/win4lin-sources-2.6.CAN-2004-0816.patch 1693
+MD5 65254b087906bead43e7e7bf9eba7610 files/digest-win4lin-sources-2.4.26-r9 353
+MD5 dc18e982f8149588a291956481885a8c files/win4lin-sources-2.4.26.CAN-2004-0495.patch 17549
 MD5 60d25ff310fc6abfdce39ec9e47345af files/win4lin-sources-2.4.26.CAN-2004-0685.patch 2809
-MD5 65254b087906bead43e7e7bf9eba7610 files/digest-win4lin-sources-2.4.26-r8 353
 MD5 39361f8d16b1fe5891aab62e92f8cd30 files/win4lin-sources-2.6.IPTables-RDoS.patch 390
-MD5 452e04a312368605e145428c35bd0e05 files/win4lin-sources-2.6.devPtmx.patch 572
-MD5 c2510fe1891f5a9effb12c2196922206 files/win4lin-sources-2.6.cmdlineLeak.patch 281
-MD5 d1ccc2047be533c992f67270a150a210 files/win4lin-sources-2.4.26.cmdlineLeak.patch 388
+MD5 9cae5cdb5da7ef0bbe13fbbf6daee5dd files/digest-win4lin-sources-2.6.7-r9 359
+MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/win4lin-sources-2.4.26.smbfs.patch 3434
+MD5 d4a740ae56c2049247083af387a22a85 files/win4lin-sources-2.4.26.CAN-2004-0394.patch 350
+MD5 915e8d7a0618736caa44d96968015467 files/win4lin-sources-2.4.26.binfmt_elf.patch 2346
+MD5 2bd92617d5f73fe2973abc0ceb071fc5 files/digest-win4lin-sources-2.6.9-r1 207
+MD5 02c062ec3a11a6a1498cdf0b1716c90a files/win4lin-sources-2.6.6.FPULockup-53804.patch 895
 MD5 0f66013f643c79c97fda489618a4e2fd files/win4lin-sources-2.4.26.CAN-2004-0535.patch 476
-MD5 dc18e982f8149588a291956481885a8c files/win4lin-sources-2.4.26.CAN-2004-0495.patch 17549
-MD5 2bd92617d5f73fe2973abc0ceb071fc5 files/digest-win4lin-sources-2.6.9 207
+MD5 95708646470a95668e8789cd415844ed files/win4lin-sources.CAN-2004-0497.patch 846
+MD5 b738cb0120a32aa92cfcfdbd564dd21f files/win4lin-sources-2.6.ProcPerms.patch 1368

diff --git a/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.4.26-r8 b/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.4.26-r9
similarity index 100%
rename from sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.4.26-r8
rename to sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.4.26-r9

diff --git a/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.7-r8 b/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.7-r9
similarity index 100%
rename from sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.7-r8
rename to sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.7-r9

diff --git a/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.9 b/sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.9-r1
similarity index 100%
rename from sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.9
rename to sys-kernel/win4lin-sources/files/digest-win4lin-sources-2.6.9-r1

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.binfmt_elf.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.binfmt_elf.patch
index 534e4c064a52dda242e746c115a9ebe9b0b57970..9f4f44ee78f54777de2725a5b5c4cb269ed844ec 100644 (file)
--- a/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.binfmt_elf.patch
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.binfmt_elf.patch
@@ -1,6 +1,7 @@
---- linux-2.4.27/fs/binfmt_elf.c       2004-11-10 12:25:16 -08:00
-+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c     2004-11-10 12:25:16 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
+--- linux-2.4.27/fs/binfmt_elf.c       2004-04-14 14:05:40.000000000 +0100
++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c     2004-11-19 21:30:26.745410824 +0000
+@@ -299,9 +299,12 @@
                goto out;
  
        retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
@@ -15,7 +16,7 @@
  
        eppnt = elf_phdata;
        for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -475,8 +478,11 @@
                goto out;
  
        retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
@@ -28,7 +29,17 @@
                
        files = current->files;         /* Refcounted so ok */
        retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -513,7 +519,8 @@
+                        */
+ 
+                       retval = -ENOMEM;
+-                      if (elf_ppnt->p_filesz > PATH_MAX)
++                      if (elf_ppnt->p_filesz > PATH_MAX || 
++                          elf_ppnt->p_filesz == 0)
+                               goto out_free_file;
+                       elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+                                                          GFP_KERNEL);
+@@ -523,8 +530,16 @@
                        retval = kernel_read(bprm->file, elf_ppnt->p_offset,
                                           elf_interpreter,
                                           elf_ppnt->p_filesz);
@@ -36,15 +47,17 @@
 +                      if (retval != elf_ppnt->p_filesz) {
 +                              if (retval >= 0)
 +                                      retval = -EIO;
-                               goto out_free_interp;
++                              goto out_free_interp;
 +                      }
 +                      /* make sure path is NULL terminated */
-+                      elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++                      retval = -EINVAL;
++                      if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+                               goto out_free_interp;
 +
                        /* If the program interpreter is one of these two,
                         * then assume an iBCS2 image. Otherwise assume
                         * a native linux image.
-@@ -616,8 +628,11 @@
+@@ -543,8 +558,11 @@
                        if (IS_ERR(interpreter))
                                goto out_free_interp;
                        retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -56,8 +69,8 @@
 +                      }
  
                        /* Get the exec headers */
-                       loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+                       interp_ex = *((struct exec *) bprm->buf);
+@@ -682,8 +700,10 @@
                }
  
                error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.smbfs.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.smbfs.patch
new file mode 100644 (file)
index 0000000..63c5ba3
--- /dev/null
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.4.26.smbfs.patch
@@ -0,0 +1,97 @@
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c       2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c       2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+       data_len = WVAL(buf, 1);
+ 
+       /* we can NOT simply trust the data_len given by the server ... */
+-      if (data_len > server->packet_size - (buf+3 - server->packet)) {
+-              printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-                     "%d > %d - (%p - %p)\n",
+-                     data_len, server->packet_size, buf+3, server->packet);
++      if (data_len > count ||
++              (buf+3 - server->packet) + data_len > server->packet_size) {
++              printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++                     "%d > %d || (%p - %p) + %d > %d\n",
++                     data_len, count,
++                     buf+3, server->packet, data_len, server->packet_size);
+               result = -EIO;
+               goto out;
+       }
+@@ -1378,10 +1380,12 @@
+       buf = smb_base(server->packet) + data_off;
+ 
+       /* we can NOT simply trust the info given by the server ... */
+-      if (data_len > server->packet_size - (buf - server->packet)) {
+-              printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-                     "%d > %d - (%p - %p)\n",
+-                     data_len, server->packet_size, buf, server->packet);
++      if (data_len > count ||
++              (buf - server->packet) + data_len > server->packet_size) {
++              printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++                     "%d > %d || (%p - %p) + %d > %d\n",
++                     data_len, count,
++                     buf, server->packet, data_len, server->packet_size);
+               result = -EIO;
+               goto out;
+       }
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c       2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c       2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+                                       parm_disp, parm_offset, parm_count,
+                                       data_disp, data_offset, data_count);
+                               *parm  = base + parm_offset;
++                              if (*parm - inbuf + parm_tot > server->packet_size)
++                                      goto out_bad_parm;
+                               *data  = base + data_offset;
++                              if (*data - inbuf + data_tot > server->packet_size)
++                                      goto out_bad_data;
+                               goto success;
+                       }
+ 
+@@ -591,6 +595,8 @@
+                       rcv_buf = smb_vmalloc(buf_len);
+                       if (!rcv_buf)
+                               goto out_no_mem;
++                      memset(rcv_buf, 0, buf_len);
++                      
+                       *parm = rcv_buf;
+                       *data = rcv_buf + total_p;
+               } else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+ 
+               if (parm_disp + parm_count > total_p)
+                       goto out_bad_parm;
++              if (parm_offset + parm_count > server->packet_size)     
++                      goto out_bad_parm;
+               if (data_disp + data_count > total_d)
+                       goto out_bad_data;
++              if (data_offset + data_count > server->packet_size)     
++                      goto out_bad_data;
+               memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+               memcpy(*data + data_disp, base + data_offset, data_count);
+ 
+@@ -610,8 +620,11 @@
+                * Check whether we've received all of the data. Note that
+                * we use the packet totals -- total lengths might shrink!
+                */
+-              if (data_len >= data_tot && parm_len >= parm_tot)
++              if (data_len >= data_tot && parm_len >= parm_tot) {
++                      data_len = data_tot;
++                      parm_len = parm_tot;
+                       break;
++              }
+       }
+ 
+       /*
+@@ -625,6 +638,9 @@
+               server->packet = rcv_buf;
+               rcv_buf = inbuf;
+       } else {
++              if (parm_len + data_len > buf_len)
++                      goto out_data_grew;
++
+               PARANOIA("copying data, old size=%d, new size=%u\n",
+                        server->packet_size, buf_len);
+               memcpy(inbuf, rcv_buf, parm_len + data_len);

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.7.smbfs.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.7.smbfs.patch
new file mode 100644 (file)
index 0000000..99401cf
--- /dev/null
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.7.smbfs.patch
@@ -0,0 +1,93 @@
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c      2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c    2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+        * So we must first calculate the amount of padding used by the server.
+        */
+       data_off -= hdrlen;
+-      if (data_off > SMB_READX_MAX_PAD) {
+-              PARANOIA("offset is larger than max pad!\n");
+-              PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++      if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++              PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++              PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+               req->rq_rlen = req->rq_bufsize + 1;
+               return;
+       }
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c   2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+       data_count  = WVAL(inbuf, smb_drcnt);
+ 
+       /* Modify offset for the split header/buffer we use */
++      if (data_offset < hdrlen)
++              goto out_bad_data;
++      if (parm_offset < hdrlen)
++              goto out_bad_parm;
+       data_offset -= hdrlen;
+       parm_offset -= hdrlen;
+ 
+@@ -607,6 +611,10 @@
+               req->rq_lparm = parm_count;
+               req->rq_data = req->rq_buffer + data_offset;
+               req->rq_parm = req->rq_buffer + parm_offset;
++              if (parm_offset + parm_count > req->rq_rlen)
++                      goto out_bad_parm;
++              if (data_offset + data_count > req->rq_rlen)
++                      goto out_bad_data;
+               return 0;
+       }
+ 
+@@ -634,6 +642,7 @@
+               req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
+               if (!req->rq_trans2buffer)
+                       goto out_no_mem;
++              memset(req->rq_trans2buffer, 0, buf_len);
+ 
+               req->rq_parm = req->rq_trans2buffer;
+               req->rq_data = req->rq_trans2buffer + parm_tot;
+@@ -643,8 +652,12 @@
+ 
+       if (parm_disp + parm_count > req->rq_total_parm)
+               goto out_bad_parm;
++      if (parm_offset + parm_count > req->rq_rlen)
++              goto out_bad_parm;
+       if (data_disp + data_count > req->rq_total_data)
+               goto out_bad_data;
++      if (data_offset + data_count > req->rq_rlen)
++              goto out_bad_data;
+ 
+       inbuf = req->rq_buffer;
+       memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -657,8 +670,11 @@
+        * Check whether we've received all of the data. Note that
+        * we use the packet totals -- total lengths might shrink!
+        */
+-      if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
++      if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
++              req->rq_ldata = data_tot;
++              req->rq_lparm = parm_tot;
+               return 0;
++      }
+       return 1;
+ 
+ out_too_long:
+@@ -676,13 +692,13 @@
+       req->rq_errno = -EIO;
+       goto out;
+ out_bad_parm:
+-      printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+-             parm_disp, parm_count, parm_tot);
++      printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++             parm_disp, parm_count, parm_tot, parm_offset);
+       req->rq_errno = -EIO;
+       goto out;
+ out_bad_data:
+-      printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+-             data_disp, data_count, data_tot);
++      printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++             data_disp, data_count, data_tot, data_offset);
+       req->rq_errno = -EIO;
+ out:
+       return req->rq_errno;

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.binfmt_elf.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.binfmt_elf.patch
index c4cc8a82d3fb3202a4224a16304fd4cbd3bd7801..a836201deca1766c2b1c8b902eb2220e3a5c0beb 100644 (file)
--- a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.binfmt_elf.patch
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.binfmt_elf.patch
@@ -1,5 +1,6 @@
---- linux-2.6.9/fs/binfmt_elf.c        2004-11-10 12:25:16 -08:00
-+++ linux-2.6.9-plasmaroo/fs/binfmt_elf.c      2004-11-10 12:25:16 -08:00
+diff -ur linux-2.6.9/fs/binfmt_elf.c linux-2.6.9.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.9/fs/binfmt_elf.c        2004-10-24 14:58:48.000000000 +0100
++++ linux-2.6.9.plasmaroo/fs/binfmt_elf.c      2004-11-19 20:11:36.000000000 +0000
 @@ -335,9 +335,12 @@
                goto out;
  
@@ -28,7 +29,17 @@
  
        files = current->files;         /* Refcounted so ok */
        retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -570,7 +576,8 @@
+                        */
+ 
+                       retval = -ENOMEM;
+-                      if (elf_ppnt->p_filesz > PATH_MAX)
++                      if (elf_ppnt->p_filesz > PATH_MAX || 
++                          elf_ppnt->p_filesz == 0)
+                               goto out_free_file;
+                       elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+                                                          GFP_KERNEL);
+@@ -580,8 +587,16 @@
                        retval = kernel_read(bprm->file, elf_ppnt->p_offset,
                                           elf_interpreter,
                                           elf_ppnt->p_filesz);
@@ -39,12 +50,14 @@
                                goto out_free_interp;
 +                      }
 +                      /* make sure path is NULL terminated */
-+                      elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++                      retval = -EINVAL;
++                      if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++                              goto out_free_interp;
 +
                        /* If the program interpreter is one of these two,
                         * then assume an iBCS2 image. Otherwise assume
                         * a native linux image.
-@@ -616,8 +628,11 @@
+@@ -616,8 +631,11 @@
                        if (IS_ERR(interpreter))
                                goto out_free_interp;
                        retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -57,7 +70,7 @@
  
                        /* Get the exec headers */
                        loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+@@ -776,8 +794,10 @@
                }
  
                error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.smbfs.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.smbfs.patch
new file mode 100644 (file)
index 0000000..f10cfed
--- /dev/null
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.9.smbfs.patch
@@ -0,0 +1,72 @@
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c      2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c    2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+        * So we must first calculate the amount of padding used by the server.
+        */
+       data_off -= hdrlen;
+-      if (data_off > SMB_READX_MAX_PAD) {
+-              PARANOIA("offset is larger than max pad!\n");
+-              PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++      if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++              PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++              PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+               req->rq_rlen = req->rq_bufsize + 1;
+               return;
+       }
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c   2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+       data_count  = WVAL(inbuf, smb_drcnt);
+ 
+       /* Modify offset for the split header/buffer we use */
++      if (data_offset < hdrlen)
++              goto out_bad_data;
++      if (parm_offset < hdrlen)
++              goto out_bad_parm;
+       data_offset -= hdrlen;
+       parm_offset -= hdrlen;
+ 
+@@ -607,6 +611,10 @@
+               req->rq_lparm = parm_count;
+               req->rq_data = req->rq_buffer + data_offset;
+               req->rq_parm = req->rq_buffer + parm_offset;
++              if (parm_offset + parm_count > req->rq_rlen)
++                      goto out_bad_parm;
++              if (data_offset + data_count > req->rq_rlen)
++                      goto out_bad_data;
+               return 0;
+       }
+
+@@ -643,8 +652,12 @@
+ 
+       if (parm_disp + parm_count > req->rq_total_parm)
+               goto out_bad_parm;
++      if (parm_offset + parm_count > req->rq_rlen)
++              goto out_bad_parm;
+       if (data_disp + data_count > req->rq_total_data)
+               goto out_bad_data;
++      if (data_offset + data_count > req->rq_rlen)
++              goto out_bad_data;
+ 
+       inbuf = req->rq_buffer;
+       memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -676,13 +692,13 @@
+       req->rq_errno = -EIO;
+       goto out;
+ out_bad_parm:
+-      printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+-             parm_disp, parm_count, parm_tot);
++      printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++             parm_disp, parm_count, parm_tot, parm_offset);
+       req->rq_errno = -EIO;
+       goto out;
+ out_bad_data:
+-      printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+-             data_disp, data_count, data_tot);
++      printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++             data_disp, data_count, data_tot, data_offset);
+       req->rq_errno = -EIO;
+ out:
+       return req->rq_errno;

diff --git a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.binfmt_elf.patch b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.binfmt_elf.patch
index 9ca23675f25d9134b3b5e45c5d0ae61f74c8f681..87d05e7b5fa42df5cec409a1e7e7e63177701123 100644 (file)
--- a/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.binfmt_elf.patch
+++ b/sys-kernel/win4lin-sources/files/win4lin-sources-2.6.binfmt_elf.patch
@@ -1,6 +1,7 @@
---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c       2004-11-12 11:50:08 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.8.1/fs/binfmt_elf.c      2004-08-14 11:55:23.000000000 +0100
++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c    2004-11-19 23:07:08.375429000 +0000
+@@ -334,9 +334,12 @@
                goto out;
  
        retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
@@ -15,7 +16,7 @@
  
        eppnt = elf_phdata;
        for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -523,8 +526,11 @@
                goto out;
  
        retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
@@ -28,7 +29,17 @@
  
        files = current->files;         /* Refcounted so ok */
        retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -561,7 +567,8 @@
+                        */
+ 
+                       retval = -ENOMEM;
+-                      if (elf_ppnt->p_filesz > PATH_MAX)
++                      if (elf_ppnt->p_filesz > PATH_MAX || 
++                          elf_ppnt->p_filesz == 0)
+                               goto out_free_file;
+                       elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+                                                          GFP_KERNEL);
+@@ -571,8 +578,16 @@
                        retval = kernel_read(bprm->file, elf_ppnt->p_offset,
                                           elf_interpreter,
                                           elf_ppnt->p_filesz);
@@ -39,12 +50,14 @@
                                goto out_free_interp;
 +                      }
 +                      /* make sure path is NULL terminated */
-+                      elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++                      retval = -EINVAL;
++                      if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++                              goto out_free_interp;
 +
                        /* If the program interpreter is one of these two,
                         * then assume an iBCS2 image. Otherwise assume
                         * a native linux image.
-@@ -616,8 +628,11 @@
+@@ -607,8 +622,11 @@
                        if (IS_ERR(interpreter))
                                goto out_free_interp;
                        retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -56,8 +69,8 @@
 +                      }
  
                        /* Get the exec headers */
-                       loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+                       interp_ex = *((struct exec *) bprm->buf);
+@@ -765,8 +783,10 @@
                }
  
                error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);

diff --git a/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r8.ebuild b/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r9.ebuild
similarity index 94%
rename from sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r8.ebuild
rename to sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r9.ebuild
index 0c8843472b02f2b7c9d568b80cf3670fccc51592..3f0735b0f652c2c688ecbf7850d0564cb3abbbb8 100644 (file)
--- a/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r8.ebuild
+++ b/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r9.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r8.ebuild,v 1.1 2004/11/12 20:30:32 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.4.26-r9.ebuild,v 1.1 2004/11/20 11:12:53 plasmaroo Exp $
 
 # OKV=original kernel version, KV=patched kernel version.  They can be the same.
 
@@ -43,6 +43,7 @@ src_unpack() {
        epatch ${FILESDIR}/${P}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
        epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!"
        epatch ${FILESDIR}/${P}.binfmt_elf.patch || die "Failed to apply the binfmt_elf patch!"
+       epatch ${FILESDIR}/${P}.smbfs.patch || die "Failed to apply the SMBFS patch!"
 
        kernel_universal_unpack
 }

diff --git a/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r8.ebuild b/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r9.ebuild
similarity index 92%
rename from sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r8.ebuild
rename to sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r9.ebuild
index dd07e00a400c09724a0e5f3c186a7de8d13c598c..5ae437c455b978b3859aa4dd803b9ca73d5a2e8b 100644 (file)
--- a/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r8.ebuild
+++ b/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r9.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r8.ebuild,v 1.1 2004/11/12 20:30:32 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.6.7-r9.ebuild,v 1.1 2004/11/20 11:12:53 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
@@ -19,7 +19,8 @@ UNIPATCH_LIST="
        ${FILESDIR}/${PN}-2.6.cmdlineLeak.patch
        ${FILESDIR}/${PN}-2.6.CAN-2004-0816.patch
        ${FILESDIR}/${PN}-2.6.devPtmx.patch
-       ${FILESDIR}/${PN}-2.6.binfmt_elf.patch"
+       ${FILESDIR}/${PN}-2.6.binfmt_elf.patch
+       ${FILESDIR}/${P}.smbfs.patch"
 
 S=${WORKDIR}/linux-${KV}
 

diff --git a/sys-kernel/win4lin-sources/win4lin-sources-2.6.9.ebuild b/sys-kernel/win4lin-sources/win4lin-sources-2.6.9-r1.ebuild
similarity index 88%
rename from sys-kernel/win4lin-sources/win4lin-sources-2.6.9.ebuild
rename to sys-kernel/win4lin-sources/win4lin-sources-2.6.9-r1.ebuild
index 447d2b5187fb864c26a1b76a176aac9a1685ed6a..12342f7d38d24a8d6d454536337514ae7984853c 100644 (file)
--- a/sys-kernel/win4lin-sources/win4lin-sources-2.6.9.ebuild
+++ b/sys-kernel/win4lin-sources/win4lin-sources-2.6.9-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.6.9.ebuild,v 1.1 2004/11/15 18:07:41 genstef Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/win4lin-sources/win4lin-sources-2.6.9-r1.ebuild,v 1.1 2004/11/20 11:12:53 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
@@ -10,7 +10,8 @@ MKI_VERSION='1_3_8'
 UNIPATCH_LIST="
        ${DISTDIR}/Kernel-Win4Lin3-${OKV}.patch
        ${DISTDIR}/mki-adapter26_${MKI_VERSION}.patch:1
-       ${FILESDIR}/${PN}-2.6.9.binfmt_elf.patch"
+       ${FILESDIR}/${PN}-2.6.9.binfmt_elf.patch
+       ${FILESDIR}/${P}.smbfs.patch"
 
 S=${WORKDIR}/linux-${KV}