# ChangeLog for sys-kernel/uclinux-sources
# Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.21 2004/11/12 19:57:20 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.22 2004/11/20 11:26:08 plasmaroo Exp $
+
+*uclinux-sources-2.4.26_p0-r9 (20 Nov 2004)
+
+ 20 Nov 2004; <plasmaroo@gentoo.org> -uclinux-sources-2.4.26_p0-r8.ebuild,
+ +uclinux-sources-2.4.26_p0-r9.ebuild, -uclinux-sources-2.6.7_p0-r8.ebuild,
+ +uclinux-sources-2.6.7_p0-r9.ebuild,
+ files/uclinux-sources-2.4.26_p0.binfmt_elf.patch,
+ +files/uclinux-sources-2.4.26_p0.smbfs.patch,
+ files/uclinux-sources-2.6.binfmt_elf.patch,
+ +files/uclinux-sources-2.6.smbfs.patch:
+ Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs
+ security patch (bug #65877).
*uclinux-sources-2.6.7_p0-r8 (12 Nov 2004)
-MD5 4824179876396ff00557ae94071f3b20 ChangeLog 6281
+MD5 ded5ae6571b56f8a44bf64f2cbd76bc3 ChangeLog 6811
MD5 f3fa6c474b8727f8215534b7fc9c93ba metadata.xml 304
-MD5 b48f67e95964c2e92ef015595e538e82 uclinux-sources-2.4.26_p0-r8.ebuild 2487
-MD5 c5fd4eae9b0cde8aa04854eb4fcad7b8 uclinux-sources-2.6.7_p0-r8.ebuild 2445
+MD5 1ff3771f304594e23416d603bec77967 uclinux-sources-2.4.26_p0-r9.ebuild 2566
+MD5 c57f92e3e069a61d4c25b625ca0e17cf uclinux-sources-2.6.7_p0-r9.ebuild 2525
MD5 2b3ddb8b8b15f8da35ade38544b57857 files/uclinux-sources-2.4.26_p0.XDRWrapFix.patch 1499
MD5 dc18e982f8149588a291956481885a8c files/uclinux-sources-2.4.26_p0.CAN-2004-0495.patch 17549
-MD5 040a6d66b9567c30bf1a0cb1ce27c9db files/digest-uclinux-sources-2.6.7_p0-r8 287
MD5 c2510fe1891f5a9effb12c2196922206 files/uclinux-sources-2.6.cmdlineLeak.patch 281
MD5 60d25ff310fc6abfdce39ec9e47345af files/uclinux-sources-2.4.26_p0.CAN-2004-0685.patch 2809
MD5 d4a740ae56c2049247083af387a22a85 files/uclinux-sources-2.4.26_p0.CAN-2004-0394.patch 350
-MD5 d306514f5f3dc06853daf8c3e60d01c9 files/digest-uclinux-sources-2.4.26_p0-r8 301
-MD5 1ee8ba8362089c31fdd7d88b32eaf63e files/uclinux-sources-2.6.binfmt_elf.patch 1938
-MD5 24c53f49954dab29cfc172d4a3ba1a31 files/uclinux-sources-2.4.26_p0.binfmt_elf.patch 1928
+MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/uclinux-sources-2.4.26_p0.smbfs.patch 3434
+MD5 a9991d6324d7404ed99e79be6e44e9de files/uclinux-sources-2.6.binfmt_elf.patch 2348
+MD5 040a6d66b9567c30bf1a0cb1ce27c9db files/digest-uclinux-sources-2.6.7_p0-r9 287
+MD5 915e8d7a0618736caa44d96968015467 files/uclinux-sources-2.4.26_p0.binfmt_elf.patch 2346
MD5 0f66013f643c79c97fda489618a4e2fd files/uclinux-sources-2.4.26_p0.CAN-2004-0535.patch 476
MD5 95708646470a95668e8789cd415844ed files/uclinux-sources.CAN-2004-0497.patch 846
MD5 c9da1bc82b906f6abc648c056e7bf662 files/uclinux-sources-2.4.26_p0.FPULockup-53804.patch 354
MD5 39361f8d16b1fe5891aab62e92f8cd30 files/uclinux-sources-2.6.IPTables-RDoS.patch 390
MD5 aa595005721b58929ee55e2e8f4b6ba0 files/uclinux-sources-2.6.CAN-2004-0816.patch 1693
+MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/uclinux-sources-2.6.smbfs.patch 3309
MD5 452e04a312368605e145428c35bd0e05 files/uclinux-sources-2.6.devPtmx.patch 572
MD5 b738cb0120a32aa92cfcfdbd564dd21f files/uclinux-sources-2.6.ProcPerms.patch 1368
MD5 8204afea1d572b49a4a80d8da4eef0c9 files/uclinux-sources-2.6.CAN-2004-0596.patch 1033
+MD5 d306514f5f3dc06853daf8c3e60d01c9 files/digest-uclinux-sources-2.4.26_p0-r9 301
MD5 d1ccc2047be533c992f67270a150a210 files/uclinux-sources-2.4.26_p0.cmdlineLeak.patch 388
---- linux-2.4.27/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
+--- linux-2.4.27/fs/binfmt_elf.c 2004-04-14 14:05:40.000000000 +0100
++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c 2004-11-19 21:30:26.745410824 +0000
+@@ -299,9 +299,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -475,8 +478,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -513,7 +519,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -523,8 +530,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
+ if (retval != elf_ppnt->p_filesz) {
+ if (retval >= 0)
+ retval = -EIO;
- goto out_free_interp;
++ goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -543,8 +558,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -682,8 +700,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c 2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+ data_len = WVAL(buf, 1);
+
+ /* we can NOT simply trust the data_len given by the server ... */
+- if (data_len > server->packet_size - (buf+3 - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf+3, server->packet);
++ if (data_len > count ||
++ (buf+3 - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf+3, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+@@ -1378,10 +1380,12 @@
+ buf = smb_base(server->packet) + data_off;
+
+ /* we can NOT simply trust the info given by the server ... */
+- if (data_len > server->packet_size - (buf - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf, server->packet);
++ if (data_len > count ||
++ (buf - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c 2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+ parm_disp, parm_offset, parm_count,
+ data_disp, data_offset, data_count);
+ *parm = base + parm_offset;
++ if (*parm - inbuf + parm_tot > server->packet_size)
++ goto out_bad_parm;
+ *data = base + data_offset;
++ if (*data - inbuf + data_tot > server->packet_size)
++ goto out_bad_data;
+ goto success;
+ }
+
+@@ -591,6 +595,8 @@
+ rcv_buf = smb_vmalloc(buf_len);
+ if (!rcv_buf)
+ goto out_no_mem;
++ memset(rcv_buf, 0, buf_len);
++
+ *parm = rcv_buf;
+ *data = rcv_buf + total_p;
+ } else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+
+ if (parm_disp + parm_count > total_p)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > server->packet_size)
++ goto out_bad_parm;
+ if (data_disp + data_count > total_d)
+ goto out_bad_data;
++ if (data_offset + data_count > server->packet_size)
++ goto out_bad_data;
+ memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+ memcpy(*data + data_disp, base + data_offset, data_count);
+
+@@ -610,8 +620,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (data_len >= data_tot && parm_len >= parm_tot)
++ if (data_len >= data_tot && parm_len >= parm_tot) {
++ data_len = data_tot;
++ parm_len = parm_tot;
+ break;
++ }
+ }
+
+ /*
+@@ -625,6 +638,9 @@
+ server->packet = rcv_buf;
+ rcv_buf = inbuf;
+ } else {
++ if (parm_len + data_len > buf_len)
++ goto out_data_grew;
++
+ PARANOIA("copying data, old size=%d, new size=%u\n",
+ server->packet_size, buf_len);
+ memcpy(inbuf, rcv_buf, parm_len + data_len);
---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.8.1/fs/binfmt_elf.c 2004-08-14 11:55:23.000000000 +0100
++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c 2004-11-19 23:07:08.375429000 +0000
+@@ -334,9 +334,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -523,8 +526,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -561,7 +567,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -571,8 +578,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -607,8 +622,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -765,8 +783,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c 2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c 2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+ * So we must first calculate the amount of padding used by the server.
+ */
+ data_off -= hdrlen;
+- if (data_off > SMB_READX_MAX_PAD) {
+- PARANOIA("offset is larger than max pad!\n");
+- PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++ if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++ PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++ PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+ req->rq_rlen = req->rq_bufsize + 1;
+ return;
+ }
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c 2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+ data_count = WVAL(inbuf, smb_drcnt);
+
+ /* Modify offset for the split header/buffer we use */
++ if (data_offset < hdrlen)
++ goto out_bad_data;
++ if (parm_offset < hdrlen)
++ goto out_bad_parm;
+ data_offset -= hdrlen;
+ parm_offset -= hdrlen;
+
+@@ -607,6 +611,10 @@
+ req->rq_lparm = parm_count;
+ req->rq_data = req->rq_buffer + data_offset;
+ req->rq_parm = req->rq_buffer + parm_offset;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+ return 0;
+ }
+
+@@ -634,6 +642,7 @@
+ req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
+ if (!req->rq_trans2buffer)
+ goto out_no_mem;
++ memset(req->rq_trans2buffer, 0, buf_len);
+
+ req->rq_parm = req->rq_trans2buffer;
+ req->rq_data = req->rq_trans2buffer + parm_tot;
+@@ -643,8 +652,12 @@
+
+ if (parm_disp + parm_count > req->rq_total_parm)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
+ if (data_disp + data_count > req->rq_total_data)
+ goto out_bad_data;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+
+ inbuf = req->rq_buffer;
+ memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -657,8 +670,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
++ if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
++ req->rq_ldata = data_tot;
++ req->rq_lparm = parm_tot;
+ return 0;
++ }
+ return 1;
+
+ out_too_long:
+@@ -676,13 +692,13 @@
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_parm:
+- printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+- parm_disp, parm_count, parm_tot);
++ printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ parm_disp, parm_count, parm_tot, parm_offset);
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_data:
+- printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+- data_disp, data_count, data_tot);
++ printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ data_disp, data_count, data_tot, data_offset);
+ req->rq_errno = -EIO;
+ out:
+ return req->rq_errno;
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r8.ebuild,v 1.1 2004/11/12 19:57:20 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $
IUSE=""
epatch ${FILESDIR}/${P}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!"
epatch ${FILESDIR}/${P}.binfmt_elf.patch || die "Failed to apply the binfmt_elf patch!"
+ epatch ${FILESDIR}/${P}.smbfs.patch || die "Failed to apply the SMBFS patch!"
kernel_universal_unpack
set ARCH=${MY_ARCH}
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r8.ebuild,v 1.1 2004/11/12 19:57:20 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $
IUSE=""
epatch ${FILESDIR}/${PN}-2.6.CAN-2004-0816.patch || die "Failed to apply the CAN-2004-0816 patch!"
epatch ${FILESDIR}/${PN}-2.6.devPtmx.patch || die "Failed to apply /dev/ptmx patch!"
epatch ${FILESDIR}/${PN}-2.6.binfmt_elf.patch || die "Failed to apply binfmt_elf patch!"
+ epatch ${FILESDIR}/${PN}-2.6.smbfs.patch || die "Failed to apply SMBFS patch!"
set MY_ARCH=${ARCH}
unset ARCH
projects / gentoo.git / commitdiff