Correct a signedness bug which allowed members of the operator

group to read kernel memory. [1] Disable handling of GNUTYPE_NAMES tar file entries by default, since they can be used to extract files outside of the cwd. [2] Security: FreeBSD-SA-06:25.kmem [1] Security: FreeBSD-SA-06:26.gtar [2] Approved by: so (cperciva)
Correct multiple vulnerabilities in OpenSSH.
2026-10-30 12:25:10 +01:00 · 2006-12-06 09:18:02 +00:00 · 2006-09-30 19:58:07 +00:00 · 2006-09-29 13:46:41 +00:00 · 2006-09-28 13:06:23 +00:00 · 2006-09-19 14:13:53 +00:00
238 changed files with 29053 additions and 25028 deletions
@@ -4,7 +4,7 @@
 The compilation of software known as FreeBSD is distributed under the
 following terms:

-Copyright (C) 1992-2004 The FreeBSD Project. All rights reserved.
+Copyright (C) 1992-2005 The FreeBSD Project. All rights reserved.

 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
@@ -554,7 +554,7 @@ update:
 	@echo "--------------------------------------------------------------"
 	@echo ">>> Updating ${.CURDIR} from cvs repository" ${CVSROOT}
 	@echo "--------------------------------------------------------------"
-	cd ${.CURDIR}; cvs -R -q update -rRELENG_4 -P -d
+	cd ${.CURDIR}; cvs -R -q update -rRELENG_4_11 -P -d
 .endif

 #
@@ -8,6 +8,127 @@ A reverse chronology since 4.0 was released is included, followed by
 the common items quick how-tos, followed by entries for versions of
 -current prior to 4.0 Release.

+This is for the 4.11 release branch.  All entries since 4.11 are an
+itemized list of commits to this branch, numbered from the beginning.
+
+The security advisories related to various patches contain information
+on how to build/install a minimal set of binaries and start/stop a
+minimal number of processes, if possible, for that patch.  For those
+updates that don't have an advisory, or to be safe, you can do a full
+build and install as described in the COMMON ITEMS section.
+
+20061206:	p26	FreeBSD-SA-06:25.kmem, FreeBSD-SA-06.26.gtar
+	Correct a signedness bug which allowed members of the operator
+	group to read kernel memory. [06:25]
+
+	Disable handling of GNUTYPE_NAMES tar file entries by default,
+	since they can be used to extract files outside of the cwd. [06:26]
+
+20060930:	p25	FreeBSD-SA-06:22.openssh
+	Correct multiple vulnerabilities in sshd(8).
+
+20060929:	p24	FreeBSD-SA-06:23.openssl
+	Correct problem in the 2006-09-28 patch concerning the handling of
+	excessively large DH moduli.
+
+20060928:	p23	FreeBSD-SA-06:23.openssl
+	Correct multiple vulnerabilities in crypto(3).
+	Limit the size of public keys used in order to protect applications
+	from a denial of service via insane key sizes.
+
+20060919:	p22	FreeBSD-SA-06:21.gzip
+	Correct multiple vulnerabilities in gzip(1).
+
+20060906:	p21	FreeBSD-SA-06:19.openssl
+	Correct incorrect PKCS#1 v1.5 padding validation in
+	crypto(3).
+
+20060823:	p20	FreeBSD-SA-06:18.ppp
+	Correct buffer overflow in the handling of LCP options in ppp(4).
+
+20060614:	p19	FreeBSD-SA-06:17.sendmail
+	Correct a bug in the handling of multipart messages by sendmail(8)
+	which can allow a malformed message to crash a sendmail queue
+	processing process.
+
+20060531:	p18	FreeBSD-SA-06:16.smbfs
+	Correct a bug in the handling of backslash characters in smbfs
+	which can allow an attacker to escape from a chroot(2).
+
+20060419:	p17	FreeBSD-SA-06:14.fpu
+	Correct a local information leakage bug affecting AMD FPUs.
+
+20060322:	p16	FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie,
+			FreeBSD-SA-06:13.sendmail
+	Add missing code needed for the detection of IPSec packet
+	replays. [06:11]
+
+	Correctly identify the user running opiepasswd(1) when the login
+	name differs from the account name. [06:12]
+
+	Modify timeout handling logic in sendmail(8) to correct a reported
+	signal handling race condition. [06:13]
+
+20060301:	p15	FreeBSD-SA-06:10.nfs
+	Correct a remote kernel panic when processing zero-length RPC
+	records via TCP.
+
+20060111:	p14	FreeBSD-SA-06:01.texindex, FreeBSD-SA-06:02.ee,
+			FreeBSD-SA-06:03.cpio
+	Correct insecure temporary file usage in texindex. [06:01]
+
+	Correct insecure temporary file usage in ee. [06:02]
+
+	Correct a race condition when setting file permissions,
+	sanitize file names by default, and fix a buffer overflow
+	when handling files larger than 4GB in cpio. [06:03]
+
+20051011:	p13	FreeBSD-SA-05:21.openssl
+	Correct a man-in-the-middle SSL version rollback vulnerability.
+
+20050907:	p12	FreeBSD-SA-05:20.cvsbug
+	Correct insecure temporary file usage.
+
+20050629:	p11	FreeBSD-SA-05:14.bzip2, FreeBSD-SA-05:15.tcp
+	Correct bzip2 denial of service and permission race vulnerabilities.
+
+	Correct TCP connection stall denial of service vulnerabilities.
+
+20050608:	p10	FreeBSD-SA-05:11.gzip
+	Correct directory traversal and race condition vulnerabilities in gzip.
+
+20050513:	p9	FreeBSD-SA-05:09.htt
+	Add a knob for disabling/enabling HTT.  Default off due to information
+	disclosure on multi-user systems.
+
+20050508:	p8	FreeBSD-SA-05:08.kmem
+	Correct two issues which were missed from the earlier commit.
+
+20050506:	p7	FreeBSD-SA-05:08.kmem
+	Correct several local kernel memory disclosure bugs.
+
+20050506:	p6	FreeBSD-SA-05:07.ldt
+	Correctly validate inputs to the i386_get_ldt syscall.
+
+20050506:	p5	FreeBSD-SA-05:06.iir
+	Correct overly liberal permissions on /dev/iir.
+
+20050422:	p4	FreeBSD-SA-05:05.cvs
+	Correct several vulnerabilities in CVS.
+
+20050414:	p3	FreeBSD-SA-05:04.ifconf
+	Zero a buffer in ifconf() in order to avoid accidental
+	disclosure of kernel memory to userland.
+
+20050404:	p2	FreeBSD-SA-05:02.sendfile
+	Correct kernel memory disclosure bug in sendfile(2).
+
+20050328:	p1	FreeBSD-SA-05:01.telnet
+	Correct buffer overflows in telnet(1).
+
+20050124:
+	FreeBSD 4.11-RELEASE.
+
 20040527:
 	FreeBSD 4.10-RELEASE.

@@ -312,6 +312,7 @@ static void    compressedStreamEOF   ( void )    NORETURN;

 static void    copyFileName ( Char*, Char* );
 static void*   myMalloc     ( Int32 );
+static int     applySavedFileAttrToOutputFile ( int fd );



@@ -457,6 +458,10 @@ void compressStream ( FILE *stream, FILE *zStream )
   ret = fflush ( zStream );
   if (ret == EOF) goto errhandler_io;
   if (zStream != stdout) {
+      int fd = fileno ( zStream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
      ret = fclose ( zStream );
      outputHandleJustInCase = NULL;
      if (ret == EOF) goto errhandler_io;
@@ -525,6 +530,7 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
   UChar   obuf[5000];
   UChar   unused[BZ_MAX_UNUSED];
   Int32   nUnused;
+   void*   unusedTmpV;
   UChar*  unusedTmp;

   nUnused = 0;
@@ -554,9 +560,10 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
      }
      if (bzerr != BZ_STREAM_END) goto errhandler;

-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
      if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );

+      unusedTmp = (UChar*)unusedTmpV;
      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];

      BZ2_bzReadClose ( &bzerr, bzf );
@@ -567,6 +574,12 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )

   closeok:
   if (ferror(zStream)) goto errhandler_io;
+   if ( stream != stdout) {
+      int fd = fileno ( stream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
+   }
   ret = fclose ( zStream );
   if (ret == EOF) goto errhandler_io;

@@ -639,6 +652,7 @@ Bool testStream ( FILE *zStream )
   UChar   obuf[5000];
   UChar   unused[BZ_MAX_UNUSED];
   Int32   nUnused;
+   void*   unusedTmpV;
   UChar*  unusedTmp;

   nUnused = 0;
@@ -662,9 +676,10 @@ Bool testStream ( FILE *zStream )
      }
      if (bzerr != BZ_STREAM_END) goto errhandler;

-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
      if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );

+      unusedTmp = (UChar*)unusedTmpV;
      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];

      BZ2_bzReadClose ( &bzerr, bzf );
@@ -1125,7 +1140,7 @@ void saveInputFileMetaInfo ( Char *srcName )


 static 
-void applySavedMetaInfoToOutputFile ( Char *dstName )
+void applySavedTimeInfoToOutputFile ( Char *dstName )
 {
 #  if BZ_UNIX
   IntNative      retVal;
@@ -1134,16 +1149,26 @@ void applySavedMetaInfoToOutputFile ( Char *dstName )
   uTimBuf.actime = fileMetaInfo.st_atime;
   uTimBuf.modtime = fileMetaInfo.st_mtime;

-   retVal = chmod ( dstName, fileMetaInfo.st_mode );
-   ERROR_IF_NOT_ZERO ( retVal );
-
   retVal = utime ( dstName, &uTimBuf );
   ERROR_IF_NOT_ZERO ( retVal );
+#  endif
+}

-   retVal = chown ( dstName, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
+static 
+int applySavedFileAttrToOutputFile ( int fd )
+{
+#  if BZ_UNIX
+   IntNative      retVal;
+
+   retVal = fchmod ( fd, fileMetaInfo.st_mode );
+   if (retVal != 0)
+       return retVal;
+
+   (void) fchown ( fd, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
   /* chown() will in many cases return with EPERM, which can
      be safely ignored.
   */
+   return 0;
 #  endif
 }

@@ -1366,7 +1391,7 @@ void compress ( Char *name )

   /*--- If there was an I/O error, we won't get here. ---*/
   if ( srcMode == SM_F2F ) {
-      applySavedMetaInfoToOutputFile ( outName );
+      applySavedTimeInfoToOutputFile ( outName );
      deleteOutputOnInterrupt = False;
      if ( !keepInputFiles ) {
         IntNative retVal = remove ( inName );
@@ -1544,7 +1569,7 @@ void uncompress ( Char *name )
   /*--- If there was an I/O error, we won't get here. ---*/
   if ( magicNumberOK ) {
      if ( srcMode == SM_F2F ) {
-         applySavedMetaInfoToOutputFile ( outName );
+         applySavedTimeInfoToOutputFile ( outName );
         deleteOutputOnInterrupt = False;
         if ( !keepInputFiles ) {
            IntNative retVal = remove ( inName );
@@ -574,8 +574,11 @@ int BZ_API(BZ2_bzDecompressInit)


 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_FAST ( DState* s )
+Bool unRLE_obuf_to_output_FAST ( DState* s )
 {
   UChar k1;

@@ -584,7 +587,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -594,10 +597,13 @@ void unRLE_obuf_to_output_FAST ( DState* s )
            s->strm->total_out_lo32++;
            if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
         }
-   
+
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
               
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -667,6 +673,10 @@ void unRLE_obuf_to_output_FAST ( DState* s )
               cs_avail_out--;
            }
         }   
+         /* Only caused by corrupt data stream? */
+         if (c_nblock_used > s_save_nblockPP)
+            return True;
+
         /* can a new run be started? */
         if (c_nblock_used == s_save_nblockPP) {
            c_state_out_len = 0; goto return_notr;
@@ -712,6 +722,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
      s->strm->avail_out    = cs_avail_out;
      /* end save */
   }
+   return False;
 }


@@ -732,8 +743,11 @@ __inline__ Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab )


 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_SMALL ( DState* s )
+Bool unRLE_obuf_to_output_SMALL ( DState* s )
 {
   UChar k1;

@@ -742,7 +756,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -754,8 +768,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
         }
   
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
-               
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -788,7 +805,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -800,7 +817,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
         }
   
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -830,6 +851,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
 /*---------------------------------------------------*/
 int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
 {
+   Bool    corrupt;
   DState* s;
   if (strm == NULL) return BZ_PARAM_ERROR;
   s = strm->state;
@@ -840,12 +862,13 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
      if (s->state == BZ_X_IDLE) return BZ_SEQUENCE_ERROR;
      if (s->state == BZ_X_OUTPUT) {
         if (s->smallDecompress)
-            unRLE_obuf_to_output_SMALL ( s ); else
-            unRLE_obuf_to_output_FAST  ( s );
+            corrupt = unRLE_obuf_to_output_SMALL ( s ); else
+            corrupt = unRLE_obuf_to_output_FAST  ( s );
+         if (corrupt) return BZ_DATA_ERROR;
         if (s->nblock_used == s->save_nblock+1 && s->state_out_len == 0) {
            BZ_FINALISE_CRC ( s->calculatedBlockCRC );
            if (s->verbosity >= 3) 
-               VPrintf2 ( " {0x%x, 0x%x}", s->storedBlockCRC, 
+               VPrintf2 ( " {0x%08x, 0x%08x}", s->storedBlockCRC, 
                          s->calculatedBlockCRC );
            if (s->verbosity >= 2) VPrintf0 ( "]" );
            if (s->calculatedBlockCRC != s->storedBlockCRC)
@@ -863,7 +886,7 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
         Int32 r = BZ2_decompress ( s );
         if (r == BZ_STREAM_END) {
            if (s->verbosity >= 3)
-               VPrintf2 ( "\n    combined CRCs: stored = 0x%x, computed = 0x%x", 
+               VPrintf2 ( "\n    combined CRCs: stored = 0x%08x, computed = 0x%08x", 
                          s->storedCombinedCRC, s->calculatedCombinedCRC );
            if (s->calculatedCombinedCRC != s->storedCombinedCRC)
               return BZ_DATA_ERROR;
@@ -488,9 +488,11 @@ void sendMTFValues ( EState* s )
      /*--
        Recompute the tables based on the accumulated frequencies.
      --*/
+      /* maxLen was changed from 20 to 17 in bzip2-1.0.3.  See 
+         comment in huffman.c for details. */
      for (t = 0; t < nGroups; t++)
         BZ2_hbMakeCodeLengths ( &(s->len[t][0]), &(s->rfreq[t][0]), 
-                                 alphaSize, 20 );
+                                 alphaSize, 17 /*20*/ );
   }


@@ -527,7 +529,7 @@ void sendMTFValues ( EState* s )
         if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
         if (s->len[t][i] < minLen) minLen = s->len[t][i];
      }
-      AssertH ( !(maxLen > 20), 3004 );
+      AssertH ( !(maxLen > 17 /*20*/ ), 3004 );
      AssertH ( !(minLen < 1),  3005 );
      BZ2_hbAssignCodes ( &(s->code[t][0]), &(s->len[t][0]), 
                          minLen, maxLen, alphaSize );
@@ -651,8 +653,8 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
      if (s->blockNo > 1) s->numZ = 0;

      if (s->verbosity >= 2)
-         VPrintf4( "    block %d: crc = 0x%8x, "
-                   "combined CRC = 0x%8x, size = %d\n",
+         VPrintf4( "    block %d: crc = 0x%08x, "
+                   "combined CRC = 0x%08x, size = %d\n",
                   s->blockNo, s->blockCRC, s->combinedCRC, s->nblock );

      BZ2_blockSort ( s );
@@ -703,7 +705,7 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
      bsPutUChar ( s, 0x50 ); bsPutUChar ( s, 0x90 );
      bsPutUInt32 ( s, s->combinedCRC );
      if (s->verbosity >= 2)
-         VPrintf1( "    final combined CRC = 0x%x\n   ", s->combinedCRC );
+         VPrintf1( "    final combined CRC = 0x%08x\n   ", s->combinedCRC );
      bsFinishWrite ( s );
   }
 }
@@ -524,17 +524,23 @@ Int32 BZ2_decompress ( DState* s )
      if (s->origPtr < 0 || s->origPtr >= nblock)
         RETURN(BZ_DATA_ERROR);

+      /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      s->cftab[0] = 0;
+      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
+      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+      for (i = 0; i <= 256; i++) {
+         if (s->cftab[i] < 0 || s->cftab[i] > nblock) {
+            /* s->cftab[i] can legitimately be == nblock */
+            RETURN(BZ_DATA_ERROR);
+         }
+      }
+
      s->state_out_len = 0;
      s->state_out_ch  = 0;
      BZ_INITIALISE_CRC ( s->calculatedBlockCRC );
      s->state = BZ_X_OUTPUT;
      if (s->verbosity >= 2) VPrintf0 ( "rt+rld" );

-      /*-- Set up cftab to facilitate generation of T^(-1) --*/
-      s->cftab[0] = 0;
-      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
-      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
-
      if (s->smallDecompress) {

         /*-- Make a copy of cftab, used in generation of T --*/
@@ -162,7 +162,24 @@ void BZ2_hbMakeCodeLengths ( UChar *len,
      
      if (! tooLong) break;

-      for (i = 1; i < alphaSize; i++) {
+      /* 17 Oct 04: keep-going condition for the following loop used
+         to be 'i < alphaSize', which missed the last element,
+         theoretically leading to the possibility of the compressor
+         looping.  However, this count-scaling step is only needed if
+         one of the generated Huffman code words is longer than
+         maxLen, which up to and including version 1.0.2 was 20 bits,
+         which is extremely unlikely.  In version 1.0.3 maxLen was
+         changed to 17 bits, which has minimal effect on compression
+         ratio, but does mean this scaling step is used from time to
+         time, enough to verify that it works.
+
+         This means that bzip2-1.0.3 and later will only produce
+         Huffman codes with a maximum length of 17 bits.  However, in
+         order to preserve backwards compatibility with bitstreams
+         produced by versions pre-1.0.3, the decompressor must still
+         handle lengths of up to 20. */
+
+      for (i = 1; i <= alphaSize; i++) {
         j = weight[i] >> 8;
         j = 1 + (j / 2);
         weight[i] = j << 8;
@@ -46,6 +46,19 @@ $FreeBSD$
 #define lchown chown
 #endif

+# ifndef DIRECTORY_SEPARATOR
+#  define DIRECTORY_SEPARATOR '/'
+# endif
+
+# ifndef ISSLASH
+#  define ISSLASH(C) ((C) == DIRECTORY_SEPARATOR)
+# endif
+
+# ifndef FILE_SYSTEM_PREFIX_LEN
+#  define FILE_SYSTEM_PREFIX_LEN(Filename) 0
+# endif
+
+
 static void read_pattern_file ();
 static void tape_skip_padding ();
 static void defer_copyin ();
@@ -376,6 +389,54 @@ swab_array (ptr, count)
 /* Current time for verbose table.  */
 static time_t current_time;

+/* Return a safer suffix of FILE_NAME, or "." if it has no safer
+   suffix.  Check for fully specified file names and other atrocities.  */
+
+static const char *
+safer_name_suffix (char const *file_name)
+{
+  char const *p;
+
+  /* Skip file system prefixes, leading file name components that contain
+     "..", and leading slashes.  */
+
+  size_t prefix_len = FILE_SYSTEM_PREFIX_LEN (file_name);
+
+  for (p = file_name + prefix_len; *p;)
+    {
+      if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
+       prefix_len = p + 2 - file_name;
+
+      do
+       {
+         char c = *p++;
+         if (ISSLASH (c))
+           break;
+       }
+      while (*p);
+    }
+
+  for (p = file_name + prefix_len; ISSLASH (*p); p++)
+    continue;
+  prefix_len = p - file_name;
+
+  if (prefix_len)
+    {
+      char *prefix = alloca (prefix_len + 1);
+      memcpy (prefix, file_name, prefix_len);
+      prefix[prefix_len] = '\0';
+
+
+      error (0, 0, "Removing leading `%s' from member names", prefix);
+    }
+
+  if (!*p)
+    p = ".";
+
+  return p;
+}
+
+
 /* Read the collection from standard input and create files
   in the file system.  */

@@ -396,6 +457,7 @@ process_copy_in ()
  int in_file_des;		/* Input file descriptor.  */
  char skip_file;		/* Flag for use with patterns.  */
  int existing_dir;		/* True if file is a dir & already exists.  */
+  mode_t existing_mode;
  int i;			/* Loop index variable.  */
  char *link_name = NULL;	/* Name of hard and symbolic links.  */
 #ifdef HPUX_CDF
@@ -494,18 +556,11 @@ process_copy_in ()

      /* Do we have to ignore absolute paths, and if so, does the filename
         have an absolute path?  */
-      if (no_abs_paths_flag && file_hdr.c_name && file_hdr.c_name [0] == '/')
+      if (!abs_paths_flag && file_hdr.c_name && file_hdr.c_name[0])
 	{
-	  char *p;
+	  const char *p = safer_name_suffix (file_hdr.c_name);

-	  p = file_hdr.c_name;
-	  while (*p == '/')
-	    ++p;
-	  if (*p == '\0')
-	    {
-	      strcpy (file_hdr.c_name, ".");
-	    }
-	  else
+	  if (p != file_hdr.c_name)
 	    {
 	      char *non_abs_name;

@@ -642,6 +697,7 @@ process_copy_in ()
 		     we are trying to create, don't complain about
 		     it.  */
 		  existing_dir = TRUE;
+		  existing_mode = file_stat.st_mode;
 		}
 	      else if (!unconditional_flag
 		       && file_hdr.c_mtime <= file_stat.st_mtime)
@@ -778,8 +834,6 @@ process_copy_in ()
 		    }
 		  copy_files_tape_to_disk (in_file_des, out_file_des, file_hdr.c_filesize);
 		  disk_empty_output_buffer (out_file_des);
-		  if (close (out_file_des) < 0)
-		    error (0, errno, "%s", file_hdr.c_name);

 		  if (archive_format == arf_crcascii)
 		    {
@@ -789,13 +843,15 @@ process_copy_in ()
 		    }
 		  /* File is now copied; set attributes.  */
 		  if (!no_chown_flag)
-		    if ((chown (file_hdr.c_name,
+		    if ((fchown (out_file_des,
 				set_owner_flag ? set_owner : file_hdr.c_uid,
 			   set_group_flag ? set_group : file_hdr.c_gid) < 0)
 			&& errno != EPERM)
 		      error (0, errno, "%s", file_hdr.c_name);
 		  /* chown may have turned off some permissions we wanted. */
-		  if (chmod (file_hdr.c_name, (int) file_hdr.c_mode) < 0)
+		  if (fchmod (out_file_des, (int) file_hdr.c_mode) < 0)
+		    error (0, errno, "%s", file_hdr.c_name);
+		  if (close (out_file_des) < 0)
 		    error (0, errno, "%s", file_hdr.c_name);
 		  if (retain_time_flag)
 		    {
@@ -847,14 +903,23 @@ process_copy_in ()
 		      cdf_flag = 1;
 		    }
 #endif
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      else
-		res = 0;
+		{
+		  if (!no_chown_flag && (existing_mode & 077) != 0
+		     && chmod (file_hdr.c_name, existing_mode & 07700) < 0)
+		   {
+		     error (0, errno, "%s: chmod", file_hdr.c_name);
+		     return;
+		   }
+		   res = 0;
+		}
+
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      if (res < 0)
 		{
@@ -936,20 +1001,20 @@ process_copy_in ()
 	      
 #ifdef CP_IFIFO
 	      if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 	      else
 #endif
-		res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 		      makedev (file_hdr.c_rdev_maj, file_hdr.c_rdev_min));
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
 #ifdef CP_IFIFO
 		  if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 		  else
 #endif
-		    res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		    res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 				 makedev (file_hdr.c_rdev_maj,
 					  file_hdr.c_rdev_min));
 		}
@@ -1376,18 +1441,18 @@ create_final_defers ()
 	  continue;
 	}

-      if (close (out_file_des) < 0)
-	error (0, errno, "%s", d->header.c_name);
-
+  
      /* File is now copied; set attributes.  */
      if (!no_chown_flag)
-	if ((chown (d->header.c_name,
+	if ((fchown (out_file_des,
 		    set_owner_flag ? set_owner : d->header.c_uid,
 	       set_group_flag ? set_group : d->header.c_gid) < 0)
 	    && errno != EPERM)
 	  error (0, errno, "%s", d->header.c_name);
      /* chown may have turned off some permissions we wanted. */
-      if (chmod (d->header.c_name, (int) d->header.c_mode) < 0)
+      if (fchmod (out_file_des, (int) d->header.c_mode) < 0)
+	error (0, errno, "%s", d->header.c_name);
+      if (close (out_file_des) < 0)
 	error (0, errno, "%s", d->header.c_name);
      if (retain_time_flag)
 	{
@@ -49,12 +49,13 @@ write_out_header (file_hdr, out_des)
    {
      char ascii_header[112];
      char *magic_string;
+      int ret;

      if (archive_format == arf_crcascii)
 	magic_string = "070702";
      else
 	magic_string = "070701";
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%6s%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx",
 	       magic_string,
 	       file_hdr->c_ino, file_hdr->c_mode, file_hdr->c_uid,
@@ -62,6 +63,10 @@ write_out_header (file_hdr, out_des)
 	     file_hdr->c_filesize, file_hdr->c_dev_maj, file_hdr->c_dev_min,
 	   file_hdr->c_rdev_maj, file_hdr->c_rdev_min, file_hdr->c_namesize,
 	       file_hdr->c_chksum);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
      tape_buffered_write (ascii_header, out_des, 110L);

      /* Write file name to output.  */
@@ -71,6 +76,7 @@ write_out_header (file_hdr, out_des)
  else if (archive_format == arf_oldascii || archive_format == arf_hpoldascii)
    {
      char ascii_header[78];
+      int ret;
 #ifndef __MSDOS__
      dev_t dev;
      dev_t rdev;
@@ -112,7 +118,7 @@ write_out_header (file_hdr, out_des)
      if ((file_hdr->c_ino >> 16) != 0)
 	error (0, 0, "%s: truncating inode number", file_hdr->c_name);

-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%06o%06o%06lo%06lo%06lo%06lo%06lo%06o%011lo%06lo%011lo",
 	       file_hdr->c_magic & 0xFFFF, dev & 0xFFFF,
 	       file_hdr->c_ino & 0xFFFF, file_hdr->c_mode & 0xFFFF,
@@ -120,6 +126,10 @@ write_out_header (file_hdr, out_des)
 	       file_hdr->c_nlink & 0xFFFF, rdev & 0xFFFF,
 	       file_hdr->c_mtime, file_hdr->c_namesize & 0xFFFF,
 	       file_hdr->c_filesize);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
      tape_buffered_write (ascii_header, out_des, 76L);

      /* Write file name to output.  */
@@ -258,6 +268,14 @@ process_copy_out ()
 	  file_hdr.c_dev_maj = major (file_stat.st_dev);
 	  file_hdr.c_dev_min = minor (file_stat.st_dev);
 	  file_hdr.c_ino = file_stat.st_ino;
+
+	  /* Skip files larger than 4GB which will cause problems on
+	     64bit platforms (and just not work on 32bit). */
+	  if (file_stat.st_size > 0xffffffff) {
+	    error (0, 0, "%s: skipping >4GB file", input_name.ds_string);
+	    continue;
+	  }
+
 	  /* For POSIX systems that don't define the S_IF macros,
 	     we can't assume that S_ISfoo means the standard Unix
 	     S_IFfoo bit(s) are set.  So do it manually, with a
@@ -173,18 +173,18 @@ process_copy_pass ()
 	      disk_empty_output_buffer (out_file_des);
 	      if (close (in_file_des) < 0)
 		error (0, errno, "%s", input_name.ds_string);
-	      if (close (out_file_des) < 0)
-		error (0, errno, "%s", output_name.ds_string);

 	      /* Set the attributes of the new file.  */
 	      if (!no_chown_flag)
-		if ((chown (output_name.ds_string,
+		if ((fchown (out_file_des,
 			    set_owner_flag ? set_owner : in_file_stat.st_uid,
 		      set_group_flag ? set_group : in_file_stat.st_gid) < 0)
 		    && errno != EPERM)
 		  error (0, errno, "%s", output_name.ds_string);
 	      /* chown may have turned off some permissions we wanted. */
-	      if (chmod (output_name.ds_string, in_file_stat.st_mode) < 0)
+	      if (fchmod (out_file_des, in_file_stat.st_mode) < 0)
+		error (0, errno, "%s", output_name.ds_string);
+	      if (close (out_file_des) < 0)
 		error (0, errno, "%s", output_name.ds_string);
 	      if (reset_time_flag)
 		{
@@ -223,15 +223,24 @@ process_copy_pass ()
 		  cdf_flag = 1;
 		}
 #endif
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);

 	    }
 	  else
-	    res = 0;
+            {
+              if (!no_chown_flag && (out_file_stat.st_mode & 077) != 0
+                  && chmod (output_name.ds_string, out_file_stat.st_mode & 07700) < 0)
+                {
+                  error (0, errno, "%s: chmod", output_name.ds_string);
+                  continue;
+                }
+              res = 0;
+            }
+
 	  if (res < 0 && create_dir_flag)
 	    {
 	      create_all_directories (output_name.ds_string);
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 	    }
 	  if (res < 0)
 	    {
@@ -297,20 +306,20 @@ process_copy_pass ()
 	    {
 #ifdef S_ISFIFO
 	      if (S_ISFIFO (in_file_stat.st_mode))
-		res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 	      else
 #endif
-		res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 			     in_file_stat.st_rdev);
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (output_name.ds_string);
 #ifdef S_ISFIFO
 		  if (S_ISFIFO (in_file_stat.st_mode))
-		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 		  else
 #endif
-		    res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		    res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 				 in_file_stat.st_rdev);
 		}
 	      if (res < 0)
@@ -19,7 +19,7 @@ cpio \- copy files to and from archives
 [\-\-unconditional] [\-\-verbose] [\-\-block-size=blocks] [\-\-swap-halfwords]
 [\-\-io-size=bytes] [\-\-pattern-file=file] [\-\-format=format]
 [\-\-owner=[user][:.][group]] [\-\-no-preserve-owner] [\-\-message=message]
-[\-\-force\-local] [\-\-no\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
+[\-\-force\-local] [\-\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
 [\-\-quiet] [\-\-help] [\-\-version] [pattern...] [< archive]

 .B cpio
@@ -251,9 +251,9 @@ current volume number (starting at 1).
 In the verbose table of contents listing, show numeric UID and GID
 instead of translating them into names.
 .TP
-.I " \-\-no-absolute-filenames"
-In copy-in mode, create all files relative to the current directory,
-even if they have an absolute file name in the archive.
+.I " \-\-absolute-filenames"
+Do not strip leading file name components that contain ".."
+and leading slashes from file names in copy-in mode
 .TP
 .I " \-\-no-preserve-owner"
 In copy-in mode and copy-pass mode, do not change the ownership of the
@@ -46,7 +46,7 @@ extern int no_chown_flag;
 extern int sparse_flag;
 extern int quiet_flag;
 extern int only_verify_crc_flag;
-extern int no_abs_paths_flag;
+extern int abs_paths_flag;

 extern int last_header_start;
 extern int copy_matching_files;
@@ -98,8 +98,8 @@ int quiet_flag = FALSE;
   actually extract the files. */
 int only_verify_crc_flag = FALSE;

-/* If TRUE, don't use any absolute paths, prefix them by `./'.  */
-int no_abs_paths_flag = FALSE;
+/* If TRUE, allow any absolute paths */
+int abs_paths_flag = FALSE;

 #ifdef DEBUG_CPIO
 /* If TRUE, print debugging information.  */
@@ -56,7 +56,7 @@ struct option long_opts[] =
  {"list", 0, &table_flag, TRUE},
  {"make-directories", 0, &create_dir_flag, TRUE},
  {"message", 1, 0, 'M'},
-  {"no-absolute-filenames", 0, 0, 136},
+  {"absolute-filenames", 0, 0, 136},
  {"no-preserve-owner", 0, 0, 134},
  {"nonmatching", 0, &copy_matching_files, FALSE},
  {"numeric-uid-gid", 0, &numeric_uid, TRUE},
@@ -105,7 +105,7 @@ Usage: %s {-o|--create} [-0acvABLV] [-C bytes] [-H format] [-M message]\n\
       [--unconditional] [--verbose] [--block-size=blocks] [--swap-halfwords]\n\
       [--io-size=bytes] [--pattern-file=file] [--format=format]\n\
       [--owner=[user][:.][group]] [--no-preserve-owner] [--message=message]\n\
-       [--force-local] [--no-absolute-filenames] [--sparse] [--only-verify-crc]\n\
+       [--force-local] [--absolute-filenames] [--sparse] [--only-verify-crc]\n\
       [--quiet] [--help] [--version] [pattern...] [< archive]\n",
 	   program_name);
  fprintf (fp, "\
@@ -266,8 +266,8 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  numeric_uid = TRUE;
 	  break;

-	case 136:		/* --no-absolute-filenames */
-	  no_abs_paths_flag = TRUE;
+	case 136:		/* --absolute-filenames */
+	  abs_paths_flag = TRUE;
 	  break;
 	
 	case 134:		/* --no-preserve-owner */
@@ -414,7 +414,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  || retain_time_flag || no_chown_flag || set_owner_flag
 	  || set_group_flag || swap_bytes_flag || swap_halfwords_flag
 	  || (append_flag && !(archive_name || output_archive_name))
-	  || rename_batch_file || no_abs_paths_flag
+	  || rename_batch_file || abs_paths_flag
 	  || input_archive_name || (archive_name && output_archive_name))
 	usage (stderr, 2);
      if (archive_format == arf_unknown)
@@ -429,7 +429,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
      if (argc - 1 != optind || archive_format != arf_unknown
 	  || swap_bytes_flag || swap_halfwords_flag
 	  || table_flag || rename_flag || append_flag
-	  || rename_batch_file || no_abs_paths_flag)
+	  || rename_batch_file || abs_paths_flag)
 	usage (stderr, 2);
      directory_name = argv[optind];
    }
@@ -109,14 +109,12 @@ elif [ -f /bin/domainname ]; then
    /usr/bin/ypcat passwd 2>/dev/null | cat - /etc/passwd | grep "^$LOGNAME:" |
      cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
    ORIGINATOR="`cat $TEMP`"
-    rm -f $TEMP
  fi
 fi

 if [ "$ORIGINATOR" = "" ]; then
  grep "^$LOGNAME:" /etc/passwd | cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
  ORIGINATOR="`cat $TEMP`"
-  rm -f $TEMP
 fi

 if [ -n "$ORGANIZATION" ]; then
@@ -116,7 +116,7 @@ password_entry_parseline (cvsroot_canonical, warn, linenumber, linebuf)

 	if (isspace(*(linebuf + 1)))
 	    /* special case since strtoul ignores leading white space */
-	    entry_version = 0;
+	    q = linebuf + 1;
 	else
 	    entry_version = strtoul (linebuf + 1, &q, 10);

@@ -385,6 +385,7 @@ patch_fileproc (callerdat, finfo)
    struct utimbuf t;
    char *vers_tag, *vers_head;
    char *rcs = NULL;
+    char *rcs_orig = NULL;
    RCSNode *rcsfile;
    FILE *fp1, *fp2, *fp3;
    int ret = 0;
@@ -415,7 +416,7 @@ patch_fileproc (callerdat, finfo)
    if ((rcsfile->flags & VALID) && (rcsfile->flags & INATTIC))
 	isattic = 1;

-    rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
+    rcs_orig = rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
    (void) sprintf (rcs, "%s%s", finfo->file, RCSEXT);

    /* if vers_head is NULL, may have been removed from the release */
@@ -757,8 +758,8 @@ failed to read diff file header %s for %s: end of file", tmpfile3, rcs);
 	free (vers_tag);
    if (vers_head != NULL)
 	free (vers_head);
-    if (rcs != NULL)
-	free (rcs);
+    if (rcs_orig)
+	free (rcs_orig);
    return ret;
 }

@@ -3040,8 +3040,7 @@ RCS_getdate (rcs, date, force_tag_match)
    if (retval != NULL)
 	return (retval);

-    if (!force_tag_match ||
-	(vers != NULL && RCS_datecmp (vers->date, date) <= 0))
+    if (vers && (!force_tag_match || RCS_datecmp (vers->date, date) <= 0))
 	return xstrdup (vers->version);
    else
 	return NULL;
@@ -4138,7 +4137,7 @@ RCS_checkout (rcs, workfile, rev, nametag, options, sout, pfn, callerdat)
    size_t len;
    int free_value = 0;
    char *log = NULL;
-    size_t loglen;
+    size_t loglen = 0;
    Node *vp = NULL;
 #ifdef PRESERVE_PERMISSIONS_SUPPORT
    uid_t rcs_owner = (uid_t) -1;
@@ -7456,7 +7455,7 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)

 		for (ln = 0; ln < headlines.nlines; ++ln)
 		{
-		    char buf[80];
+		    char *buf;
 		    /* Period which separates year from month in date.  */
 		    char *ym;
 		    /* Period which separates month from day in date.  */
@@ -7467,10 +7466,12 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 		    if (prvers == NULL)
 			prvers = vers;

+		    buf = xmalloc (strlen (prvers->version) + 24);
 		    sprintf (buf, "%-12s (%-8.8s ",
 			     prvers->version,
 			     prvers->author);
 		    cvs_output (buf, 0);
+		    free (buf);

 		    /* Now output the date.  */
 		    ym = strchr (prvers->date, '.');
@@ -381,27 +381,27 @@ mconvert(union VALUETYPE *p, struct magic *m)
 		return 1;
 	case STRING:
 		{
-			int n;
+			size_t len;

 			/* Null terminate and eat *trailing* return */
 			p->s[sizeof(p->s) - 1] = '\0';
-			n = strlen(p->s) - 1;
-			if (p->s[n] == '\n')
-				p->s[n] = '\0';
+			len = strlen(p->s);
+			if (len-- && p->s[len] == '\n')
+				p->s[len] = '\0';
 			return 1;
 		}
 	case PSTRING:
 		{
 			char *ptr1 = p->s, *ptr2 = ptr1 + 1;
-			int n = *p->s;
-			if (n >= sizeof(p->s))
-				n = sizeof(p->s) - 1;
-			while (n--)
+			size_t len = *p->s;
+			if (len >= sizeof(p->s))
+				len = sizeof(p->s) - 1;
+			while(len--)
 				*ptr1++ = *ptr2++;
 			*ptr1 = '\0';
-			n = strlen(p->s) - 1;
-			if (p->s[n] == '\n')
-				p->s[n] = '\0';
+			len = strlen(p->s);
+			if (len-- && p->s[len] == '\n')
+				p->s[len] = '0';
 			return 1;
 		}
 	case BESHORT:
@@ -118,11 +118,18 @@ int main FUNCTION((argc, argv), int argc AND char *argv[])
  struct opie opie;
  int rval, n = 499, i, mode = MODE_DEFAULT, force = 0;
  char seed[OPIE_SEED_MAX+1];
+  char *username;
+  uid_t ruid;
  struct passwd *pp;

  memset(seed, 0, sizeof(seed));

-  if (!(pp = getpwnam(getlogin()))) {
+  ruid = getuid();
+  username = getlogin();
+  pp = getpwnam(username);
+  if (username == NULL || pp == NULL || pp->pw_uid != ruid)
+    pp = getpwuid(ruid);
+  if (pp == NULL) {
    fprintf(stderr, "Who are you?");
    return 1;
  }
@@ -145,6 +145,7 @@ sm_flush(fp, timeout)
 				return SM_IO_EOF;
 			}
 			SM_IO_WR_TIMEOUT(fp, fd, *timeout);
+			t = 0;
 		}
 	}
 	return 0;
@@ -192,7 +192,7 @@ extern const char SmFileMagic[];
 	else \
 	{ \
 		(time)->tv_sec = (val) / 1000; \
-		(time)->tv_usec = ((val) - ((time)->tv_sec * 1000)) * 10; \
+		(time)->tv_usec = ((val) - ((time)->tv_sec * 1000)) * 1000; \
 	} \
 	if ((val) == SM_TIME_FOREVER) \
 	{ \
@@ -276,7 +276,7 @@ extern const char SmFileMagic[];
 	else \
 	{ \
 		sm_io_to.tv_sec = (to) / 1000; \
-		sm_io_to.tv_usec = ((to) - (sm_io_to.tv_sec * 1000)) * 10; \
+		sm_io_to.tv_usec = ((to) - (sm_io_to.tv_sec * 1000)) * 1000; \
 	} \
 	if (FD_SETSIZE > 0 && (fd) >= FD_SETSIZE) \
 	{ \
@@ -289,8 +289,11 @@ extern const char SmFileMagic[];
 	FD_SET((fd), &sm_io_x_mask); \
 	if (gettimeofday(&sm_io_to_before, NULL) < 0) \
 		return SM_IO_EOF; \
-	sm_io_to_sel = select((fd) + 1, NULL, &sm_io_to_mask, &sm_io_x_mask, \
-			      &sm_io_to); \
+	do \
+	{	\
+		sm_io_to_sel = select((fd) + 1, NULL, &sm_io_to_mask, \
+					&sm_io_x_mask, &sm_io_to); \
+	} while (sm_io_to_sel < 0 && errno == EINTR); \
 	if (sm_io_to_sel < 0) \
 	{ \
 		/* something went wrong, errno set */ \
@@ -305,10 +308,9 @@ extern const char SmFileMagic[];
 	/* else loop again */ \
 	if (gettimeofday(&sm_io_to_after, NULL) < 0) \
 		return SM_IO_EOF; \
-	timersub(&sm_io_to_before, &sm_io_to_after, &sm_io_to_diff); \
-	timersub(&sm_io_to, &sm_io_to_diff, &sm_io_to); \
-	(to) -= (sm_io_to.tv_sec * 1000); \
-	(to) -= (sm_io_to.tv_usec / 10); \
+	timersub(&sm_io_to_after, &sm_io_to_before, &sm_io_to_diff); \
+	(to) -= (sm_io_to_diff.tv_sec * 1000); \
+	(to) -= (sm_io_to_diff.tv_usec / 1000); \
 	if ((to) < 0) \
 		(to) = 0; \
 }
@@ -76,8 +76,11 @@ static int sm_lflush __P((SM_FILE_T *, int *));
 	FD_SET((fd), &sm_io_x_mask);					\
 	if (gettimeofday(&sm_io_to_before, NULL) < 0)			\
 		return SM_IO_EOF;					\
-	(sel_ret) = select((fd) + 1, &sm_io_to_mask, NULL,		\
-			   &sm_io_x_mask, (to));			\
+	do								\
+	{								\
+		(sel_ret) = select((fd) + 1, &sm_io_to_mask, NULL,	\
+			   	&sm_io_x_mask, (to));			\
+	} while ((sel_ret) < 0 && errno == EINTR);			\
 	if ((sel_ret) < 0)						\
 	{								\
 		/* something went wrong, errno set */			\
@@ -94,7 +97,7 @@ static int sm_lflush __P((SM_FILE_T *, int *));
 	/* calulate wall-clock time used */				\
 	if (gettimeofday(&sm_io_to_after, NULL) < 0)			\
 		return SM_IO_EOF;					\
-	timersub(&sm_io_to_before, &sm_io_to_after, &sm_io_to_diff);	\
+	timersub(&sm_io_to_after, &sm_io_to_before, &sm_io_to_diff);	\
 	timersub((to), &sm_io_to_diff, (to));				\
 }

@@ -15,7 +15,6 @@

 SM_RCSID("@(#)$Id: collect.c,v 8.254 2004/04/05 18:41:38 ca Exp $")

-static void	collecttimeout __P((time_t));
 static void	eatfrom __P((char *volatile, ENVELOPE *));
 static void	collect_doheader __P((ENVELOPE *));
 static SM_FILE_T *collect_dfopen __P((ENVELOPE *));
@@ -263,10 +262,6 @@ collect_dfopen(e)
 **		If data file cannot be created, the process is terminated.
 */

-static jmp_buf	CtxCollectTimeout;
-static bool	volatile CollectProgress;
-static SM_EVENT	*volatile CollectTimeout = NULL;
-
 /* values for input state machine */
 #define IS_NORM		0	/* middle of line */
 #define IS_BOL		1	/* beginning of line */
@@ -288,27 +283,31 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	register ENVELOPE *e;
 	bool rsetsize;
 {
-	register SM_FILE_T *volatile df;
-	volatile bool ignrdot;
-	volatile time_t dbto;
-	register char *volatile bp;
-	volatile int c;
-	volatile bool inputerr;
+	register SM_FILE_T *df;
+	bool ignrdot;
+	time_t dbto;
+	register char *bp;
+	int c;
+	bool inputerr;
 	bool headeronly;
-	char *volatile buf;
-	volatile int buflen;
-	volatile int istate;
-	volatile int mstate;
-	volatile int hdrslen;
-	volatile int numhdrs;
-	volatile int afd;
-	unsigned char *volatile pbp;
+	char *buf;
+	int buflen;
+	int istate;
+	int mstate;
+	int hdrslen;
+	int numhdrs;
+	int afd;
+	unsigned char *pbp;
 	unsigned char peekbuf[8];
 	char bufbuf[MAXLINE];

 	df = NULL;
 	ignrdot = smtpmode ? false : IgnrDot;
-	dbto = smtpmode ? TimeOuts.to_datablock : 0;
+
+	/* timeout for I/O functions is in milliseconds */
+	dbto = smtpmode ? (TimeOuts.to_datablock * 1000)
+			: SM_TIME_FOREVER;
+	sm_io_setinfo(fp, SM_IO_WHAT_TIMEOUT, &dbto);
 	c = SM_IO_EOF;
 	inputerr = false;
 	headeronly = hdrp != NULL;
@@ -320,7 +319,6 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	pbp = peekbuf;
 	istate = IS_BOL;
 	mstate = SaveFrom ? MS_HEADER : MS_UFROM;
-	CollectProgress = false;

 	/*
 	**  Tell ARPANET to go ahead.
@@ -341,32 +339,6 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	**	the larger picture (e.g., header versus body).
 	*/

-	if (dbto != 0)
-	{
-		/* handle possible input timeout */
-		if (setjmp(CtxCollectTimeout) != 0)
-		{
-			if (LogLevel > 2)
-				sm_syslog(LOG_NOTICE, e->e_id,
-					  "timeout waiting for input from %s during message collect",
-					  CURHOSTNAME);
-			errno = 0;
-			if (smtpmode)
-			{
-				/*
-				**  Override e_message in usrerr() as this
-				**  is the reason for failure that should
-				**  be logged for undelivered recipients.
-				*/
-
-				e->e_message = NULL;
-			}
-			usrerr("451 4.4.1 timeout waiting for input during message collect");
-			goto readerr;
-		}
-		CollectTimeout = sm_setevent(dbto, collecttimeout, dbto);
-	}
-
 	if (rsetsize)
 		e->e_msgsize = 0;
 	for (;;)
@@ -390,9 +362,26 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 						sm_io_clearerr(fp);
 						continue;
 					}
+
+					/* timeout? */
+					if (c == SM_IO_EOF && errno == EAGAIN
+					    && smtpmode)
+					{
+						/*
+						**  Override e_message in
+						**  usrerr() as this is the
+						**  reason for failure that
+						**  should be logged for
+						**  undelivered recipients.
+						*/
+
+						e->e_message = NULL;
+						errno = 0;
+						inputerr = true;
+						goto readabort;
+					}
 					break;
 				}
-				CollectProgress = true;
 				if (TrafficLogFile != NULL && !headeronly)
 				{
 					if (istate == IS_BOL)
@@ -539,6 +528,18 @@ bufferchar:
 					buflen *= 2;
 				else
 					buflen += MEMCHUNKSIZE;
+				if (buflen <= 0)
+				{
+					sm_syslog(LOG_NOTICE, e->e_id,
+						  "header overflow from %s during message collect",
+						  CURHOSTNAME);
+					errno = 0;
+					e->e_flags |= EF_CLRQUEUE;
+					e->e_status = "5.6.0";
+					usrerrenh(e->e_status,
+						  "552 Headers too large");
+					goto discard;
+				}
 				buf = xalloc(buflen);
 				memmove(buf, obuf, bp - obuf);
 				bp = &buf[bp - obuf];
@@ -582,6 +583,7 @@ bufferchar:
 					usrerrenh(e->e_status,
 						  "552 Headers too large (%d max)",
 						  MaxHeadersLength);
+  discard:
 					mstate = MS_DISCARD;
 				}
 			}
@@ -621,6 +623,24 @@ nextstate:
 				sm_io_clearerr(fp);
 				errno = 0;
 				c = sm_io_getc(fp, SM_TIME_DEFAULT);
+
+				/* timeout? */
+				if (c == SM_IO_EOF && errno == EAGAIN
+				    && smtpmode)
+				{
+					/*
+					**  Override e_message in
+					**  usrerr() as this is the
+					**  reason for failure that
+					**  should be logged for
+					**  undelivered recipients.
+					*/
+
+					e->e_message = NULL;
+					errno = 0;
+					inputerr = true;
+					goto readabort;
+				}
 			} while (c == SM_IO_EOF && errno == EINTR);
 			if (c != SM_IO_EOF)
 				(void) sm_io_ungetc(fp, SM_TIME_DEFAULT, c);
@@ -630,8 +650,12 @@ nextstate:
 				continue;
 			}

-			/* trim off trailing CRLF or NL */
 			SM_ASSERT(bp > buf);
+
+			/* guaranteed by isheader(buf) */
+			SM_ASSERT(*(bp - 1) != '\n' || bp > buf + 1);
+
+			/* trim off trailing CRLF or NL */
 			if (*--bp != '\n' || *--bp != '\r')
 				bp++;
 			*bp = '\0';
@@ -697,10 +721,6 @@ readerr:
 		inputerr = true;
 	}

-	/* reset global timer */
-	if (CollectTimeout != NULL)
-		sm_clrevent(CollectTimeout);
-
 	if (headeronly)
 		return;

@@ -786,6 +806,7 @@ readerr:
 	}

 	/* An EOF when running SMTP is an error */
+  readabort:
 	if (inputerr && (OpMode == MD_SMTP || OpMode == MD_DAEMON))
 	{
 		char *host;
@@ -808,13 +829,14 @@ readerr:
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
 		if (sm_io_eof(fp))
-			usrerr("451 4.4.1 collect: %s on connection from %s, from=%s",
+			usrerr("421 4.4.1 collect: %s on connection from %s, from=%s",
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
 		else
-			syserr("451 4.4.1 collect: %s on connection from %s, from=%s",
+			syserr("421 4.4.1 collect: %s on connection from %s, from=%s",
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
+		flush_errors(true);

 		/* don't return an error indication */
 		e->e_to = NULL;
@@ -907,39 +929,6 @@ readerr:
 	}
 }

-static void
-collecttimeout(timeout)
-	time_t timeout;
-{
-	int save_errno = errno;
-
-	/*
-	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
-	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
-	**	DOING.
-	*/
-
-	if (CollectProgress)
-	{
-		/* reset the timeout */
-		CollectTimeout = sm_sigsafe_setevent(timeout, collecttimeout,
-						     timeout);
-		CollectProgress = false;
-	}
-	else
-	{
-		/* event is done */
-		CollectTimeout = NULL;
-	}
-
-	/* if no progress was made or problem resetting event, die now */
-	if (CollectTimeout == NULL)
-	{
-		errno = ETIMEDOUT;
-		longjmp(CtxCollectTimeout, 1);
-	}
-	errno = save_errno;
-}
 /*
 **  DFERROR -- signal error on writing the data file.
 **
@@ -5290,8 +5290,8 @@ sm_syslog(level, id, fmt, va_alist)
 	va_dcl
 #endif /* __STDC__ */
 {
-	static char *buf = NULL;
-	static size_t bufsize;
+	char *buf;
+	size_t bufsize;
 	char *begin, *end;
 	int save_errno;
 	int seq = 1;
@@ -5315,11 +5315,8 @@ sm_syslog(level, id, fmt, va_alist)
 	else
 		idlen = strlen(id) + SyslogPrefixLen;

-	if (buf == NULL)
-	{
-		buf = buf0;
-		bufsize = sizeof buf0;
-	}
+	buf = buf0;
+	bufsize = sizeof buf0;

 	for (;;)
 	{
@@ -5361,8 +5358,8 @@ sm_syslog(level, id, fmt, va_alist)
 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
 					     "%s: %s\n", id, newstring);
 #endif /* LOG */
-		if (buf == buf0)
-			buf = NULL;
+		if (buf != buf0)
+			sm_free(buf);
 		errno = save_errno;
 		return;
 	}
@@ -5426,8 +5423,8 @@ sm_syslog(level, id, fmt, va_alist)
 		(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
 				     "%s[%d]: %s\n", id, seq, begin);
 #endif /* LOG */
-	if (buf == buf0)
-		buf = NULL;
+	if (buf != buf0)
+		sm_free(buf);
 	errno = save_errno;
 }
 /*
@@ -3257,16 +3257,33 @@ do_transfer:
 	}
 	else if (!clever)
 	{
+		bool ok;
+
 		/*
 		**  Format and send message.
 		*/

-		putfromline(mci, e);
-		(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
-		(*e->e_putbody)(mci, e, NULL);
+		rcode = EX_OK;
+		errno = 0;
+		ok = putfromline(mci, e);
+		if (ok)
+			ok = (*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
+		if (ok)
+			ok = (*e->e_putbody)(mci, e, NULL);

-		/* get the exit status */
+		/*
+		**  Ignore an I/O error that was caused by EPIPE.
+		**  Some broken mailers don't read the entire body
+		**  but just exit() thus causing an I/O error.
+		*/
+
+		if (!ok && (sm_io_error(mci->mci_out) && errno == EPIPE))
+			ok = true;
+
+		/* (always) get the exit status */
 		rcode = endmailer(mci, e, pv);
+		if (!ok)
+			rcode = EX_TEMPFAIL;
 		if (rcode == EX_TEMPFAIL && SmtpError[0] == '\0')
 		{
 			/*
@@ -4414,13 +4431,13 @@ logdelivery(m, mci, dsn, status, ctladdr, xstart, e)
 **		e -- the envelope.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		outputs some text to fp.
 */

-void
+bool
 putfromline(mci, e)
 	register MCI *mci;
 	ENVELOPE *e;
@@ -4430,7 +4447,7 @@ putfromline(mci, e)
 	char xbuf[MAXLINE];

 	if (bitnset(M_NHDR, mci->mci_mailer->m_flags))
-		return;
+		return true;

 	mci->mci_flags |= MCIF_INHEADER;

@@ -4471,8 +4488,9 @@ putfromline(mci, e)
 		}
 	}
 	expand(template, buf, sizeof buf, e);
-	putxline(buf, strlen(buf), mci, PXLF_HEADER);
+	return putxline(buf, strlen(buf), mci, PXLF_HEADER);
 }
+
 /*
 **  PUTBODY -- put the body of a message.
 **
@@ -4483,7 +4501,7 @@ putfromline(mci, e)
 **			not be permitted in the resulting message.
 **
 **	Returns:
-**		none.
+**		true iff message was written successfully
 **
 **	Side Effects:
 **		The message is written onto fp.
@@ -4494,13 +4512,15 @@ putfromline(mci, e)
 #define OS_CR		1	/* read a carriage return */
 #define OS_INLINE	2	/* putting rest of line */

-void
+bool
 putbody(mci, e, separator)
 	register MCI *mci;
 	register ENVELOPE *e;
 	char *separator;
 {
 	bool dead = false;
+	bool ioerr = false;
+	int save_errno;
 	char buf[MAXLINE];
 #if MIME8TO7
 	char *boundaries[MAXMIMENESTING + 1];
@@ -4530,10 +4550,12 @@ putbody(mci, e, separator)
 	{
 		if (bitset(MCIF_INHEADER, mci->mci_flags))
 		{
-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;
 			mci->mci_flags &= ~MCIF_INHEADER;
 		}
-		putline("<<< No Message Collected >>>", mci);
+		if (!putline("<<< No Message Collected >>>", mci))
+			goto writeerr;
 		goto endofmessage;
 	}

@@ -4562,26 +4584,31 @@ putbody(mci, e, separator)
 		*/

 		/* make sure it looks like a MIME message */
-		if (hvalue("MIME-Version", e->e_header) == NULL)
-			putline("MIME-Version: 1.0", mci);
+		if (hvalue("MIME-Version", e->e_header) == NULL &&
+		    !putline("MIME-Version: 1.0", mci))
+			goto writeerr;

 		if (hvalue("Content-Type", e->e_header) == NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 					   "Content-Type: text/plain; charset=%s",
 					   defcharset(e));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* now do the hard work */
 		boundaries[0] = NULL;
 		mci->mci_flags |= MCIF_INHEADER;
-		(void) mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER);
+		if (mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER, 0) ==
+								SM_IO_EOF)
+			goto writeerr;
 	}
 # if MIME7TO8
 	else if (bitset(MCIF_CVT7TO8, mci->mci_flags))
 	{
-		(void) mime7to8(mci, e->e_header, e);
+		if (!mime7to8(mci, e->e_header, e))
+			goto writeerr;
 	}
 # endif /* MIME7TO8 */
 	else if (MaxMimeHeaderLength > 0 || MaxMimeFieldLength > 0)
@@ -4603,8 +4630,9 @@ putbody(mci, e, separator)
 		if (bitset(EF_DONT_MIME, e->e_flags))
 			SuprErrs = true;

-		(void) mime8to7(mci, e->e_header, e, boundaries,
-				M87F_OUTER|M87F_NO8TO7);
+		if (mime8to7(mci, e->e_header, e, boundaries,
+				M87F_OUTER|M87F_NO8TO7, 0) == SM_IO_EOF)
+			goto writeerr;

 		/* restore SuprErrs */
 		SuprErrs = oldsuprerrs;
@@ -4624,7 +4652,8 @@ putbody(mci, e, separator)

 		if (bitset(MCIF_INHEADER, mci->mci_flags))
 		{
-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;
 			mci->mci_flags &= ~MCIF_INHEADER;
 		}

@@ -4715,11 +4744,6 @@ putbody(mci, e, separator)
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos++;
 				}
 				for (xp = buf; xp < bp; xp++)
@@ -4732,11 +4756,6 @@ putbody(mci, e, separator)
 						dead = true;
 						break;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 				}
 				if (dead)
 					continue;
@@ -4747,11 +4766,6 @@ putbody(mci, e, separator)
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						break;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos = 0;
 				}
 				else
@@ -4785,11 +4799,6 @@ putbody(mci, e, separator)
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						continue;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}

 					if (TrafficLogFile != NULL)
 					{
@@ -4851,11 +4860,6 @@ putch:
 							dead = true;
 							continue;
 						}
-						else
-						{
-							/* record progress for DATA timeout */
-							DataProgress = true;
-						}
 						pos++;
 						continue;
 					}
@@ -4871,11 +4875,6 @@ putch:
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}

 					if (TrafficLogFile != NULL)
 					{
@@ -4901,11 +4900,6 @@ putch:
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						continue;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos = 0;
 					ostate = OS_HEAD;
 				}
@@ -4923,11 +4917,6 @@ putch:
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos++;
 					ostate = OS_INLINE;
 				}
@@ -4954,11 +4943,6 @@ putch:
 					dead = true;
 					break;
 				}
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 			}
 			pos += bp - buf;
 		}
@@ -4968,11 +4952,9 @@ putch:
 				(void) sm_io_fputs(TrafficLogFile,
 						   SM_TIME_DEFAULT,
 						   mci->mci_mailer->m_eol);
-			(void) sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
-					   mci->mci_mailer->m_eol);
-
-			/* record progress for DATA timeout */
-			DataProgress = true;
+			if (sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
+					   mci->mci_mailer->m_eol) == SM_IO_EOF)
+				goto writeerr;
 		}
 	}

@@ -4982,6 +4964,7 @@ putch:
 		       qid_printqueue(e->e_dfqgrp, e->e_dfqdir),
 		       DATAFL_LETTER, e->e_id);
 		ExitStat = EX_IOERR;
+		ioerr = true;
 	}

 endofmessage:
@@ -4996,23 +4979,35 @@ endofmessage:
 	**  offset to match.
 	*/

+	save_errno = errno;
 	if (e->e_dfp != NULL)
 		(void) bfrewind(e->e_dfp);

 	/* some mailers want extra blank line at end of message */
 	if (!dead && bitnset(M_BLANKEND, mci->mci_mailer->m_flags) &&
 	    buf[0] != '\0' && buf[0] != '\n')
-		putline("", mci);
-
-	(void) sm_io_flush(mci->mci_out, SM_TIME_DEFAULT);
-	if (sm_io_error(mci->mci_out) && errno != EPIPE)
 	{
-		syserr("putbody: write error");
-		ExitStat = EX_IOERR;
+		if (!putline("", mci))
+			goto writeerr;
 	}

-	errno = 0;
+	if (!dead &&
+	    (sm_io_flush(mci->mci_out, SM_TIME_DEFAULT) == SM_IO_EOF ||
+	     (sm_io_error(mci->mci_out) && errno != EPIPE)))
+	{
+		save_errno = errno;
+		syserr("putbody: write error");
+		ExitStat = EX_IOERR;
+		ioerr = true;
+	}
+
+	errno = save_errno;
+	return !dead && !ioerr;
+
+  writeerr:
+	return false;
 }
+
 /*
 **  MAILFILE -- Send a message to a file.
 **
@@ -5543,14 +5538,14 @@ mailfile(filename, mailer, ctladdr, sfflags, e)
 		}
 #endif /* MIME7TO8 */

-		putfromline(&mcibuf, e);
-		(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER);
-		(*e->e_putbody)(&mcibuf, e, NULL);
-		putline("\n", &mcibuf);
-		if (sm_io_flush(f, SM_TIME_DEFAULT) != 0 ||
+		if (!putfromline(&mcibuf, e) ||
+		    !(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER) ||
+		    !(*e->e_putbody)(&mcibuf, e, NULL) ||
+		    !putline("\n", &mcibuf) ||
+		    (sm_io_flush(f, SM_TIME_DEFAULT) != 0 ||
 		    (SuperSafe != SAFE_NO &&
 		     fsync(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL)) < 0) ||
-		    sm_io_error(f))
+		    sm_io_error(f)))
 		{
 			setstat(EX_IOERR);
 #if !NOFTRUNCATE
@@ -6107,86 +6102,23 @@ starttls(m, mci, e)
 ssl_retry:
 	if ((result = SSL_connect(clt_ssl)) <= 0)
 	{
-		int i;
-		bool timedout;
-		time_t left;
-		time_t now = curtime();
-		struct timeval tv;
+		int i, ssl_err;

-		/* what to do in this case? */
-		i = SSL_get_error(clt_ssl, result);
+		ssl_err = SSL_get_error(clt_ssl, result);
+		i = tls_retry(clt_ssl, rfd, wfd, tlsstart,
+			TimeOuts.to_starttls, ssl_err, "client");
+		if (i > 0)
+			goto ssl_retry;

-		/*
-		**  For SSL_ERROR_WANT_{READ,WRITE}:
-		**  There is not a complete SSL record available yet
-		**  or there is only a partial SSL record removed from
-		**  the network (socket) buffer into the SSL buffer.
-		**  The SSL_connect will only succeed when a full
-		**  SSL record is available (assuming a "real" error
-		**  doesn't happen). To handle when a "real" error
-		**  does happen the select is set for exceptions too.
-		**  The connection may be re-negotiated during this time
-		**  so both read and write "want errors" need to be handled.
-		**  A select() exception loops back so that a proper SSL
-		**  error message can be gotten.
-		*/
-
-		left = TimeOuts.to_starttls - (now - tlsstart);
-		timedout = left <= 0;
-		if (!timedout)
-		{
-			tv.tv_sec = left;
-			tv.tv_usec = 0;
-		}
-
-		if (!timedout && FD_SETSIZE > 0 &&
-		    (rfd >= FD_SETSIZE ||
-		     (i == SSL_ERROR_WANT_WRITE && wfd >= FD_SETSIZE)))
-		{
-			if (LogLevel > 5)
-			{
-				sm_syslog(LOG_ERR, e->e_id,
-					  "STARTTLS=client, error: fd %d/%d too large",
-					  rfd, wfd);
-			if (LogLevel > 8)
-				tlslogerr("client");
-			}
-			errno = EINVAL;
-			goto tlsfail;
-		}
-		if (!timedout && i == SSL_ERROR_WANT_READ)
-		{
-			fd_set ssl_maskr, ssl_maskx;
-
-			FD_ZERO(&ssl_maskr);
-			FD_SET(rfd, &ssl_maskr);
-			FD_ZERO(&ssl_maskx);
-			FD_SET(rfd, &ssl_maskx);
-			if (select(rfd + 1, &ssl_maskr, NULL, &ssl_maskx, &tv)
-			    > 0)
-				goto ssl_retry;
-		}
-		if (!timedout && i == SSL_ERROR_WANT_WRITE)
-		{
-			fd_set ssl_maskw, ssl_maskx;
-
-			FD_ZERO(&ssl_maskw);
-			FD_SET(wfd, &ssl_maskw);
-			FD_ZERO(&ssl_maskx);
-			FD_SET(rfd, &ssl_maskx);
-			if (select(wfd + 1, NULL, &ssl_maskw, &ssl_maskx, &tv)
-			    > 0)
-				goto ssl_retry;
-		}
 		if (LogLevel > 5)
 		{
-			sm_syslog(LOG_ERR, e->e_id,
-				  "STARTTLS=client, error: connect failed=%d, SSL_error=%d, timedout=%d, errno=%d",
-				  result, i, (int) timedout, errno);
+			sm_syslog(LOG_WARNING, NOQID,
+				  "STARTTLS=client, error: connect failed=%d, SSL_error=%d, errno=%d, retry=%d",
+				  result, ssl_err, errno, i);
 			if (LogLevel > 8)
 				tlslogerr("client");
 		}
-tlsfail:
+
 		SSL_free(clt_ssl);
 		clt_ssl = NULL;
 		return EX_SOFTWARE;
@@ -19,7 +19,7 @@ SM_RCSID("@(#)$Id: headers.c,v 8.286 2004/07/08 17:57:32 ca Exp $")
 static HDR	*allocheader __P((char *, char *, int, SM_RPOOL_T *));
 static size_t	fix_mime_header __P((HDR *, ENVELOPE *));
 static int	priencode __P((char *));
-static void	put_vanilla_header __P((HDR *, char *, MCI *));
+static bool	put_vanilla_header __P((HDR *, char *, MCI *));

 /*
 **  SETUPHEADERS -- initialize headers in symbol table
@@ -994,7 +994,6 @@ logsender(e, msgid)
 	char *name;
 	register char *sbp;
 	register char *p;
-	int l;
 	char hbuf[MAXNAME + 1];
 	char sbuf[MAXLINE + 1];
 	char mbuf[MAXNAME + 1];
@@ -1003,6 +1002,8 @@ logsender(e, msgid)
 	/* XXX do we still need this? sm_syslog() replaces control chars */
 	if (msgid != NULL)
 	{
+		size_t l;
+
 		l = strlen(msgid);
 		if (l > sizeof mbuf - 1)
 			l = sizeof mbuf - 1;
@@ -1542,13 +1543,13 @@ crackaddr(addr, e)
 **		flags -- MIME conversion flags.
 **
 **	Returns:
-**		none.
+**		success
 **
 **	Side Effects:
 **		none.
 */

-void
+bool
 putheader(mci, hdr, e, flags)
 	register MCI *mci;
 	HDR *hdr;
@@ -1683,7 +1684,8 @@ putheader(mci, hdr, e, flags)
 		{
 			if (tTd(34, 11))
 				sm_dprintf("\n");
-			put_vanilla_header(h, p, mci);
+			if (!put_vanilla_header(h, p, mci))
+				goto writeerr;
 			continue;
 		}

@@ -1742,7 +1744,8 @@ putheader(mci, hdr, e, flags)
 				/* no other recipient headers: truncate value */
 				(void) sm_strlcpyn(obuf, sizeof obuf, 2,
 						   h->h_field, ":");
-				putline(obuf, mci);
+				if (!putline(obuf, mci))
+					goto writeerr;
 			}
 			continue;
 		}
@@ -1761,7 +1764,8 @@ putheader(mci, hdr, e, flags)
 		}
 		else
 		{
-			put_vanilla_header(h, p, mci);
+			if (!put_vanilla_header(h, p, mci))
+				goto writeerr;
 		}
 	}

@@ -1778,18 +1782,25 @@ putheader(mci, hdr, e, flags)
 	    !bitset(MCIF_CVT8TO7|MCIF_CVT7TO8|MCIF_INMIME, mci->mci_flags) &&
 	    hvalue("MIME-Version", e->e_header) == NULL)
 	{
-		putline("MIME-Version: 1.0", mci);
+		if (!putline("MIME-Version: 1.0", mci))
+			goto writeerr;
 		if (hvalue("Content-Type", e->e_header) == NULL)
 		{
 			(void) sm_snprintf(obuf, sizeof obuf,
 					"Content-Type: text/plain; charset=%s",
 					defcharset(e));
-			putline(obuf, mci);
+			if (!putline(obuf, mci))
+				goto writeerr;
 		}
-		if (hvalue("Content-Transfer-Encoding", e->e_header) == NULL)
-			putline("Content-Transfer-Encoding: 8bit", mci);
+		if (hvalue("Content-Transfer-Encoding", e->e_header) == NULL
+		    && !putline("Content-Transfer-Encoding: 8bit", mci))
+			goto writeerr;
 	}
 #endif /* MIME8TO7 */
+	return true;
+
+  writeerr:
+	return false;
 }
 /*
 **  PUT_VANILLA_HEADER -- output a fairly ordinary header
@@ -1800,10 +1811,10 @@ putheader(mci, hdr, e, flags)
 **		mci -- the connection info for output
 **
 **	Returns:
-**		none.
+**		success
 */

-static void
+static bool
 put_vanilla_header(h, v, mci)
 	HDR *h;
 	char *v;
@@ -1834,7 +1845,8 @@ put_vanilla_header(h, v, mci)
 			l = SPACELEFT(obuf, obp) - 1;

 		(void) sm_snprintf(obp, SPACELEFT(obuf, obp), "%.*s", l, v);
-		putxline(obuf, strlen(obuf), mci, putflags);
+		if (!putxline(obuf, strlen(obuf), mci, putflags))
+			goto writeerr;
 		v += l + 1;
 		obp = obuf;
 		if (*v != ' ' && *v != '\t')
@@ -1844,7 +1856,10 @@ put_vanilla_header(h, v, mci)
 	/* XXX This is broken for SPACELEFT()==0 */
 	(void) sm_snprintf(obp, SPACELEFT(obuf, obp), "%.*s",
 			   (int) (SPACELEFT(obuf, obp) - 1), v);
-	putxline(obuf, strlen(obuf), mci, putflags);
+	return putxline(obuf, strlen(obuf), mci, putflags);
+
+  writeerr:
+	return false;
 }
 /*
 **  COMMAIZE -- output a header field, making a comma-translated list.
@@ -1857,13 +1872,13 @@ put_vanilla_header(h, v, mci)
 **		e -- the envelope containing the message.
 **
 **	Returns:
-**		none.
+**		success
 **
 **	Side Effects:
 **		outputs "p" to file "fp".
 */

-void
+bool
 commaize(h, p, oldstyle, mci, e)
 	register HDR *h;
 	register char *p;
@@ -2002,13 +2017,6 @@ commaize(h, p, oldstyle, mci, e)
 		}
 		name = denlstring(name, false, true);

-		/*
-		**  record data progress so DNS timeouts
-		**  don't cause DATA timeouts
-		*/
-
-		DataProgress = true;
-
 		/* output the name with nice formatting */
 		opos += strlen(name);
 		if (!firstone)
@@ -2016,7 +2024,8 @@ commaize(h, p, oldstyle, mci, e)
 		if (opos > omax && !firstone)
 		{
 			(void) sm_strlcpy(obp, ",\n", SPACELEFT(obuf, obp));
-			putxline(obuf, strlen(obuf), mci, putflags);
+			if (!putxline(obuf, strlen(obuf), mci, putflags))
+				goto writeerr;
 			obp = obuf;
 			(void) sm_strlcpy(obp, "        ", sizeof obuf);
 			opos = strlen(obp);
@@ -2038,8 +2047,12 @@ commaize(h, p, oldstyle, mci, e)
 		*obp = '\0';
 	else
 		obuf[sizeof obuf - 1] = '\0';
-	putxline(obuf, strlen(obuf), mci, putflags);
+	return putxline(obuf, strlen(obuf), mci, putflags);
+
+  writeerr:
+	return false;
 }
+
 /*
 **  COPYHEADER -- copy header list
 **
@@ -80,12 +80,14 @@ static bool	MapNLtoCRLF;
 **		boundaries -- the currently pending message boundaries.
 **			NULL if we are processing the outer portion.
 **		flags -- to tweak processing.
+**		level -- recursion level.
 **
 **	Returns:
 **		An indicator of what terminated the message part:
 **		  MBT_FINAL -- the final boundary
 **		  MBT_INTERMED -- an intermediate boundary
 **		  MBT_NOTSEP -- an end of file
+**		  SM_IO_EOF -- I/O error occurred
 */

 struct args
@@ -95,12 +97,13 @@ struct args
 };

 int
-mime8to7(mci, header, e, boundaries, flags)
+mime8to7(mci, header, e, boundaries, flags, level)
 	register MCI *mci;
 	HDR *header;
 	register ENVELOPE *e;
 	char **boundaries;
 	int flags;
+	int level;
 {
 	register char *p;
 	int linelen;
@@ -121,6 +124,18 @@ mime8to7(mci, header, e, boundaries, flags)
 	char pvpbuf[MAXLINE];
 	extern unsigned char MimeTokenTab[256];

+	if (level > MAXMIMENESTING)
+	{
+		if (!bitset(EF_TOODEEP, e->e_flags))
+		{
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, level=%d\n",
+					   level);
+			usrerr("mime8to7: recursion level %d exceeded",
+				level);
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
+		}
+	}
 	if (tTd(43, 1))
 	{
 		sm_dprintf("mime8to7: flags = %x, boundaries =", flags);
@@ -241,7 +256,9 @@ mime8to7(mci, header, e, boundaries, flags)
 	*/

 	if (sm_strcasecmp(type, "multipart") == 0 &&
-	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)))
+	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)) &&
+	    !bitset(EF_TOODEEP, e->e_flags)
+	   )
 	{

 		if (sm_strcasecmp(subtype, "digest") == 0)
@@ -285,10 +302,13 @@ mime8to7(mci, header, e, boundaries, flags)
 		}
 		if (i >= MAXMIMENESTING)
 		{
-			usrerr("mime8to7: multipart nesting boundary too deep");
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, i=%d\n", i);
+			if (!bitset(EF_TOODEEP, e->e_flags))
+				usrerr("mime8to7: multipart nesting boundary too deep");

 			/* avoid bounce loops */
-			e->e_flags |= EF_DONT_MIME;
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
 		}
 		else
 		{
@@ -298,7 +318,8 @@ mime8to7(mci, header, e, boundaries, flags)
 		mci->mci_flags |= MCIF_INMIME;

 		/* skip the early "comment" prologue */
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		bt = MBT_FINAL;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
@@ -307,8 +328,9 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putxline(buf, strlen(buf), mci,
-				 PXLF_MAPFROM|PXLF_STRIP8BIT);
+			if (!putxline(buf, strlen(buf), mci,
+					PXLF_MAPFROM|PXLF_STRIP8BIT))
+				goto writeerr;
 			if (tTd(43, 99))
 				sm_dprintf("  ...%s", buf);
 		}
@@ -319,19 +341,25 @@ mime8to7(mci, header, e, boundaries, flags)
 			auto HDR *hdr = NULL;

 			(void) sm_strlcpyn(buf, sizeof buf, 2, "--", bbuf);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			if (tTd(43, 35))
 				sm_dprintf("  ...%s\n", buf);
 			collect(e->e_dfp, false, &hdr, e, false);
 			if (tTd(43, 101))
 				putline("+++after collect", mci);
-			putheader(mci, hdr, e, flags);
+			if (!putheader(mci, hdr, e, flags))
+				goto writeerr;
 			if (tTd(43, 101))
 				putline("+++after putheader", mci);
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
+			if (bt == SM_IO_EOF)
+				goto writeerr;
 		}
 		(void) sm_strlcpyn(buf, sizeof buf, 3, "--", bbuf, "--");
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (tTd(43, 35))
 			sm_dprintf("  ...%s\n", buf);
 		boundaries[i] = NULL;
@@ -344,8 +372,9 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putxline(buf, strlen(buf), mci,
-				 PXLF_MAPFROM|PXLF_STRIP8BIT);
+			if (!putxline(buf, strlen(buf), mci,
+					PXLF_MAPFROM|PXLF_STRIP8BIT))
+				goto writeerr;
 			if (tTd(43, 99))
 				sm_dprintf("  ...%s", buf);
 		}
@@ -365,7 +394,8 @@ mime8to7(mci, header, e, boundaries, flags)

 	if (sm_strcasecmp(type, "message") == 0)
 	{
-		if (!wordinclass(subtype, 's'))
+		if (!wordinclass(subtype, 's') ||
+		    bitset(EF_TOODEEP, e->e_flags))
 		{
 			flags |= M87F_NO8BIT;
 		}
@@ -373,19 +403,23 @@ mime8to7(mci, header, e, boundaries, flags)
 		{
 			auto HDR *hdr = NULL;

-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;

 			mci->mci_flags |= MCIF_INMIME;
 			collect(e->e_dfp, false, &hdr, e, false);
 			if (tTd(43, 101))
 				putline("+++after collect", mci);
-			putheader(mci, hdr, e, flags);
+			if (!putheader(mci, hdr, e, flags))
+				goto writeerr;
 			if (tTd(43, 101))
 				putline("+++after putheader", mci);
 			if (hvalue("MIME-Version", hdr) == NULL &&
-			    !bitset(M87F_NO8TO7, flags))
-				putline("MIME-Version: 1.0", mci);
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			    !bitset(M87F_NO8TO7, flags) &&
+			    !putline("MIME-Version: 1.0", mci))
+				goto writeerr;
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
 			mci->mci_flags &= ~MCIF_INMIME;
 			return bt;
 		}
@@ -480,11 +514,13 @@ mime8to7(mci, header, e, boundaries, flags)

 			(void) sm_snprintf(buf, sizeof buf,
 				"Content-Transfer-Encoding: %.200s", cte);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			if (tTd(43, 36))
 				sm_dprintf("  ...%s\n", buf);
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
 			!= NULL)
@@ -492,7 +528,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 		if (sm_io_eof(e->e_dfp))
 			bt = MBT_FINAL;
@@ -505,12 +542,13 @@ mime8to7(mci, header, e, boundaries, flags)

 		if (tTd(43, 36))
 			sm_dprintf("  ...Content-Transfer-Encoding: base64\n");
-		putline("Content-Transfer-Encoding: base64", mci);
+		if (!putline("Content-Transfer-Encoding: base64", mci))
+			goto writeerr;
 		(void) sm_snprintf(buf, sizeof buf,
 			"X-MIME-Autoconverted: from 8bit to base64 by %s id %s",
 			MyHostName, e->e_id);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline(buf, mci) || !putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while ((c1 = mime_getchar_crlf(e->e_dfp, boundaries, &bt)) !=
 			SM_IO_EOF)
@@ -518,7 +556,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			if (linelen > 71)
 			{
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = 0;
 				bp = buf;
 			}
@@ -548,7 +587,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			*bp++ = Base64Code[c2 & 0x3f];
 		}
 		*bp = '\0';
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 	}
 	else
 	{
@@ -571,12 +611,14 @@ mime8to7(mci, header, e, boundaries, flags)

 		if (tTd(43, 36))
 			sm_dprintf("  ...Content-Transfer-Encoding: quoted-printable\n");
-		putline("Content-Transfer-Encoding: quoted-printable", mci);
+		if (!putline("Content-Transfer-Encoding: quoted-printable",
+				mci))
+			goto writeerr;
 		(void) sm_snprintf(buf, sizeof buf,
 			"X-MIME-Autoconverted: from 8bit to quoted-printable by %s id %s",
 			MyHostName, e->e_id);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline(buf, mci) || !putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		fromstate = 0;
 		c2 = '\n';
@@ -598,7 +640,8 @@ mime8to7(mci, header, e, boundaries, flags)
 					*bp++ = Base16Code['.' & 0x0f];
 				}
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = fromstate = 0;
 				bp = buf;
 				c2 = c1;
@@ -627,7 +670,8 @@ mime8to7(mci, header, e, boundaries, flags)
 					c2 = '\n';
 				*bp++ = '=';
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = fromstate = 0;
 				bp = buf;
 				if (c2 == '.')
@@ -665,13 +709,17 @@ mime8to7(mci, header, e, boundaries, flags)
 		if (linelen > 0 || boundaries[0] != NULL)
 		{
 			*bp = '\0';
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 	}
 	if (tTd(43, 3))
 		sm_dprintf("\t\t\tmime8to7=>%s (basic)\n", MimeBoundaryNames[bt]);
 	return bt;
+
+  writeerr:
+	return SM_IO_EOF;
 }
 /*
 **  MIME_GETCHAR -- get a character for MIME processing
@@ -954,7 +1002,7 @@ static int	mime_fromqp __P((unsigned char *, unsigned char **, int));
 **		e -- envelope.
 **
 **	Returns:
-**		none.
+**		true iff body was written successfully
 */

 static char index_64[128] =
@@ -971,7 +1019,7 @@ static char index_64[128] =

 # define CHAR64(c)  (((c) < 0 || (c) > 127) ? -1 : index_64[(c)])

-void
+bool
 mime7to8(mci, header, e)
 	register MCI *mci;
 	HDR *header;
@@ -1004,25 +1052,31 @@ mime7to8(mci, header, e)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"Content-Transfer-Encoding: %s", p);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
 			!= NULL)
-			putline(buf, mci);
-		return;
+		{
+			if (!putline(buf, mci))
+				goto writeerr;
+		}
+		return true;
 	}
 	cataddr(pvp, NULL, buf, sizeof buf, '\0');
 	cte = sm_rpool_strdup_x(e->e_rpool, buf);

 	mci->mci_flags |= MCIF_INHEADER;
-	putline("Content-Transfer-Encoding: 8bit", mci);
+	if (!putline("Content-Transfer-Encoding: 8bit", mci))
+		goto writeerr;
 	(void) sm_snprintf(buf, sizeof buf,
 		"X-MIME-Autoconverted: from %.200s to 8bit by %s id %s",
 		cte, MyHostName, e->e_id);
-	putline(buf, mci);
-	putline("", mci);
+	if (!putline(buf, mci) || !putline("", mci))
+		goto writeerr;
 	mci->mci_flags &= ~MCIF_INHEADER;

 	/*
@@ -1086,7 +1140,8 @@ mime7to8(mci, header, e)
 		if (*fbufp++ == '\n' || fbufp >= &fbuf[MAXLINE])	\
 		{							\
 			CHK_EOL;					\
-			putxline((char *) fbuf, fbufp - fbuf, mci, pxflags); \
+			if (!putxline((char *) fbuf, fbufp - fbuf, mci, pxflags)) \
+				goto writeerr;				\
 			pxflags &= ~PXLF_NOADDEOL;			\
 			fbufp = fbuf;					\
 		}	\
@@ -1123,8 +1178,11 @@ again:
 				continue;

 			if (fbufp - fbuf > 0)
-				putxline((char *) fbuf, fbufp - fbuf - 1, mci,
-					 pxflags);
+			{
+				if (!putxline((char *) fbuf, fbufp - fbuf - 1,
+						mci, pxflags))
+					goto writeerr;
+			}
 			fbufp = fbuf;
 			if (off >= 0 && buf[off] != '\0')
 			{
@@ -1140,7 +1198,8 @@ again:
 	if (fbufp > fbuf)
 	{
 		*fbufp = '\0';
-		putxline((char *) fbuf, fbufp - fbuf, mci, pxflags);
+		if (!putxline((char *) fbuf, fbufp - fbuf, mci, pxflags))
+			goto writeerr;
 	}

 	/*
@@ -1150,10 +1209,15 @@ again:
 	**  but so is auto-converting MIME in the first place.
 	*/

-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;

 	if (tTd(43, 3))
 		sm_dprintf("\t\t\tmime7to8 => %s to 8bit done\n", cte);
+	return true;
+
+  writeerr:
+	return false;
 }
 /*
 **  The following is based on Borenstein's "codes.c" module, with simplifying
@@ -1337,7 +1337,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 					/* $&{x} replacement */
 					char *mval = macvalue(rp[1], e);
 					char **xpvp;
-					int trsize = 0;
+					size_t trsize = 0;
 					static size_t pvpb1_size = 0;
 					static char **pvpb1 = NULL;
 					char pvpbuf[PSBUFSIZE];
@@ -1352,7 +1352,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 					/* save the remainder of the input */
 					for (xpvp = pvp; *xpvp != NULL; xpvp++)
 						trsize += sizeof *xpvp;
-					if ((size_t) trsize > pvpb1_size)
+					if (trsize > pvpb1_size)
 					{
 						if (pvpb1 != NULL)
 							sm_free(pvpb1);
@@ -1407,7 +1407,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 		{
 			char **hbrvp;
 			char **xpvp;
-			int trsize;
+			size_t trsize;
 			char *replac;
 			int endtoken;
 			STAB *map;
@@ -1509,7 +1509,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 				*++arg_rvp = NULL;

 			/* save the remainder of the input string */
-			trsize = (int) (avp - rvp + 1) * sizeof *rvp;
+			trsize = (avp - rvp + 1) * sizeof *rvp;
 			memmove((char *) pvpb1, (char *) rvp, trsize);

 			/* look it up */
@@ -2936,7 +2936,7 @@ rscheck(rwset, p1, p2, e, flags, logl, host, logid)
 	char *logid;
 {
 	char *volatile buf;
-	int bufsize;
+	size_t bufsize;
 	int saveexitstat;
 	int volatile rstat = EX_OK;
 	char **pvp;
@@ -3150,7 +3150,7 @@ rscap(rwset, p1, p2, e, pvp, pvpbuf, size)
 	int size;
 {
 	char *volatile buf;
-	int bufsize;
+	size_t bufsize;
 	int volatile rstat = EX_OK;
 	int rsno;
 	bool saveQuickAbort = QuickAbort;
@@ -15,7 +15,7 @@

 SM_RCSID("@(#)$Id: savemail.c,v 8.303 2004/01/14 02:56:51 ca Exp $")

-static void	errbody __P((MCI *, ENVELOPE *, char *));
+static bool	errbody __P((MCI *, ENVELOPE *, char *));
 static bool	pruneroute __P((char *));

 /*
@@ -432,12 +432,13 @@ savemail(e, sendbody)
 			p = macvalue('g', e);
 			macdefine(&e->e_macro, A_PERM, 'g', e->e_sender);

-			putfromline(&mcibuf, e);
-			(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER);
-			(*e->e_putbody)(&mcibuf, e, NULL);
-			putline("\n", &mcibuf); /* XXX EOL from FileMailer? */
-			(void) sm_io_flush(fp, SM_TIME_DEFAULT);
-			if (sm_io_error(fp) ||
+			if (!putfromline(&mcibuf, e) ||
+			    !(*e->e_puthdr)(&mcibuf, e->e_header, e,
+					M87F_OUTER) ||
+			    !(*e->e_putbody)(&mcibuf, e, NULL) ||
+			    !putline("\n", &mcibuf) ||
+			    sm_io_flush(fp, SM_TIME_DEFAULT) == SM_IO_EOF ||
+			    sm_io_error(fp) ||
 			    sm_io_close(fp, SM_TIME_DEFAULT) < 0)
 				state = ESM_PANIC;
 			else
@@ -732,14 +733,14 @@ returntosender(msg, returnq, flags, e)
 **		separator -- any possible MIME separator (unused).
 **
 **	Returns:
-**		none
+**		success
 **
 **	Side Effects:
 **		Outputs the body of an error message.
 */

 /* ARGSUSED2 */
-static void
+static bool
 errbody(mci, e, separator)
 	register MCI *mci;
 	register ENVELOPE *e;
@@ -757,14 +758,16 @@ errbody(mci, e, separator)

 	if (bitset(MCIF_INHEADER, mci->mci_flags))
 	{
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 	}
 	if (e->e_parent == NULL)
 	{
 		syserr("errbody: null parent");
-		putline("   ----- Original message lost -----\n", mci);
-		return;
+		if (!putline("   ----- Original message lost -----\n", mci))
+			goto writeerr;
+		return true;
 	}

 	/*
@@ -773,11 +776,12 @@ errbody(mci, e, separator)

 	if (e->e_msgboundary != NULL)
 	{
-		putline("This is a MIME-encapsulated message", mci);
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "--", e->e_msgboundary);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline("This is a MIME-encapsulated message", mci) ||
+		    !putline("", mci) ||
+		    !putline(buf, mci) ||
+		    !putline("", mci))
+			goto writeerr;
 	}

 	/*
@@ -799,31 +803,36 @@ errbody(mci, e, separator)
 	if (!pm_notify && q == NULL &&
 	    !bitset(EF_FATALERRS|EF_SENDRECEIPT, e->e_parent->e_flags))
 	{
-		putline("    **********************************************",
-			mci);
-		putline("    **      THIS IS A WARNING MESSAGE ONLY      **",
-			mci);
-		putline("    **  YOU DO NOT NEED TO RESEND YOUR MESSAGE  **",
-			mci);
-		putline("    **********************************************",
-			mci);
-		putline("", mci);
+		if (!putline("    **********************************************",
+			mci) ||
+		    !putline("    **      THIS IS A WARNING MESSAGE ONLY      **",
+			mci) ||
+		    !putline("    **  YOU DO NOT NEED TO RESEND YOUR MESSAGE  **",
+			mci) ||
+		    !putline("    **********************************************",
+			mci) ||
+		    !putline("", mci))
+			goto writeerr;
 	}
 	(void) sm_snprintf(buf, sizeof buf,
 		"The original message was received at %s",
 		arpadate(ctime(&e->e_parent->e_ctime)));
-	putline(buf, mci);
+	if (!putline(buf, mci))
+		goto writeerr;
 	expand("from \201_", buf, sizeof buf, e->e_parent);
-	putline(buf, mci);
+	if (!putline(buf, mci))
+		goto writeerr;

 	/* include id in postmaster copies */
 	if (pm_notify && e->e_parent->e_id != NULL)
 	{
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "with id ",
 			e->e_parent->e_id);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 	}
-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;

 	/*
 	**  Output error message header (if specified and available).
@@ -849,17 +858,19 @@ errbody(mci, e, separator)
 				{
 					translate_dollars(buf);
 					expand(buf, buf, sizeof buf, e);
-					putline(buf, mci);
+					if (!putline(buf, mci))
+						goto writeerr;
 				}
 				(void) sm_io_close(xfile, SM_TIME_DEFAULT);
-				putline("\n", mci);
+				if (!putline("\n", mci))
+					goto writeerr;
 			}
 		}
 		else
 		{
 			expand(ErrMsgFile, buf, sizeof buf, e);
-			putline(buf, mci);
-			putline("", mci);
+			if (!putline(buf, mci) || !putline("", mci))
+				goto writeerr;
 		}
 	}

@@ -877,21 +888,24 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had permanent fatal errors -----",
-				mci);
+			if (!putline("   ----- The following addresses had permanent fatal errors -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_strlcpy(buf, shortenstring(q->q_paddr, MAXSHORTSTR),
 				  sizeof buf);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_rstatus != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (reason: %s)",
 				shortenstring(exitstat(q->q_rstatus),
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 		if (q->q_alias != NULL)
 		{
@@ -899,11 +913,12 @@ errbody(mci, e, separator)
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/* transient non-fatal errors */
 	printheader = true;
@@ -917,25 +932,28 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had transient non-fatal errors -----",
-				mci);
+			if (!putline("   ----- The following addresses had transient non-fatal errors -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_strlcpy(buf, shortenstring(q->q_paddr, MAXSHORTSTR),
 				  sizeof buf);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_alias != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/* successful delivery notifications */
 	printheader = true;
@@ -968,25 +986,28 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had successful delivery notifications -----",
-				mci);
+			if (!putline("   ----- The following addresses had successful delivery notifications -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_snprintf(buf, sizeof buf, "%s  (%s)",
 			 shortenstring(q->q_paddr, MAXSHORTSTR), p);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_alias != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/*
 	**  Output transcript of errors
@@ -995,8 +1016,9 @@ errbody(mci, e, separator)
 	(void) sm_io_flush(smioout, SM_TIME_DEFAULT);
 	if (e->e_parent->e_xfp == NULL)
 	{
-		putline("   ----- Transcript of session is unavailable -----\n",
-			mci);
+		if (!putline("   ----- Transcript of session is unavailable -----\n",
+				mci))
+			goto writeerr;
 	}
 	else
 	{
@@ -1007,11 +1029,12 @@ errbody(mci, e, separator)
 		while (sm_io_fgets(e->e_parent->e_xfp, SM_TIME_DEFAULT, buf,
 				   sizeof buf) != NULL)
 		{
-			if (printheader)
-				putline("   ----- Transcript of session follows -----\n",
-					mci);
+			if (printheader && !putline("   ----- Transcript of session follows -----\n",
+						mci))
+				goto writeerr;
 			printheader = false;
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
 	errno = 0;
@@ -1023,11 +1046,12 @@ errbody(mci, e, separator)

 	if (e->e_msgboundary != NULL)
 	{
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "--", e->e_msgboundary);
-		putline(buf, mci);
-		putline("Content-Type: message/delivery-status", mci);
-		putline("", mci);
+		if (!putline("", mci) ||
+		    !putline(buf, mci) ||
+		    !putline("Content-Type: message/delivery-status", mci) ||
+		    !putline("", mci))
+			goto writeerr;

 		/*
 		**  Output per-message information.
@@ -1039,13 +1063,15 @@ errbody(mci, e, separator)
 			(void) sm_snprintf(buf, sizeof buf,
 					"Original-Envelope-Id: %.800s",
 					xuntextify(e->e_parent->e_envid));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* Reporting-MTA: is us (required) */
 		(void) sm_snprintf(buf, sizeof buf,
 				   "Reporting-MTA: dns; %.800s", MyHostName);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;

 		/* DSN-Gateway: not relevant since we are not translating */

@@ -1059,13 +1085,15 @@ errbody(mci, e, separator)
 			(void) sm_snprintf(buf, sizeof buf,
 					"Received-From-MTA: %s; %.800s",
 					p, RealHostName);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* Arrival-Date: -- when it arrived here */
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "Arrival-Date: ",
 				arpadate(ctime(&e->e_parent->e_ctime)));
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;

 		/* Deliver-By-Date: -- when it should have been delivered */
 		if (IS_DLVR_BY(e->e_parent))
@@ -1076,7 +1104,8 @@ errbody(mci, e, separator)
 			(void) sm_strlcpyn(buf, sizeof buf, 2,
 					"Deliver-By-Date: ",
 					arpadate(ctime(&dbyd)));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/*
@@ -1119,7 +1148,8 @@ errbody(mci, e, separator)
 			else
 				continue;

-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;

 			/* Original-Recipient: -- passed from on high */
 			if (q->q_orcpt != NULL)
@@ -1127,7 +1157,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Original-Recipient: %.800s",
 						q->q_orcpt);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Figure out actual recipient */
@@ -1176,7 +1207,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						   "Final-Recipient: %s",
 						   q->q_finalrcpt);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* X-Actual-Recipient: -- the real problem address */
@@ -1187,13 +1219,15 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						   "X-Actual-Recipient: %s",
 						   actual);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Action: -- what happened? */
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Action: ",
 				action);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Status: -- what _really_ happened? */
 			if (q->q_status != NULL)
@@ -1205,7 +1239,8 @@ errbody(mci, e, separator)
 			else
 				p = "2.0.0";
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Status: ", p);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Remote-MTA: -- who was I talking to? */
 			if (q->q_statmta != NULL)
@@ -1219,7 +1254,8 @@ errbody(mci, e, separator)
 				p = &buf[strlen(buf) - 1];
 				if (*p == '.')
 					*p = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Diagnostic-Code: -- actual result from other end */
@@ -1231,7 +1267,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Diagnostic-Code: %s; %.800s",
 						p, q->q_rstatus);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Last-Attempt-Date: -- fine granularity */
@@ -1240,7 +1277,8 @@ errbody(mci, e, separator)
 			(void) sm_strlcpyn(buf, sizeof buf, 2,
 					"Last-Attempt-Date: ",
 					arpadate(ctime(&q->q_statdate)));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Will-Retry-Until: -- for delayed messages only */
 			if (QS_IS_QUEUEUP(q->q_state))
@@ -1252,7 +1290,8 @@ errbody(mci, e, separator)
 				(void) sm_strlcpyn(buf, sizeof buf, 2,
 					 "Will-Retry-Until: ",
 					 arpadate(ctime(&xdate)));
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}
 		}
 	}
@@ -1262,7 +1301,8 @@ errbody(mci, e, separator)
 	**  Output text of original message
 	*/

-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;
 	if (bitset(EF_HAS_DF, e->e_parent->e_flags))
 	{
 		sendbody = !bitset(EF_NO_BODY_RETN, e->e_parent->e_flags) &&
@@ -1270,21 +1310,27 @@ errbody(mci, e, separator)

 		if (e->e_msgboundary == NULL)
 		{
-			if (sendbody)
-				putline("   ----- Original message follows -----\n", mci);
-			else
-				putline("   ----- Message header follows -----\n", mci);
+			if (!putline(
+				sendbody
+				? "   ----- Original message follows -----\n"
+				: "   ----- Message header follows -----\n",
+				mci))
+			{
+				goto writeerr;
+			}
 		}
 		else
 		{
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "--",
 					e->e_msgboundary);

-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Content-Type: ",
 					sendbody ? "message/rfc822"
 						 : "text/rfc822-headers");
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			p = hvalue("Content-Transfer-Encoding",
 				   e->e_parent->e_header);
@@ -1298,43 +1344,62 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Content-Transfer-Encoding: %s",
 						p);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		save_errno = errno;
-		putheader(mci, e->e_parent->e_header, e->e_parent, M87F_OUTER);
+		if (!putheader(mci, e->e_parent->e_header, e->e_parent,
+				M87F_OUTER))
+			goto writeerr;
 		errno = save_errno;
 		if (sendbody)
-			putbody(mci, e->e_parent, e->e_msgboundary);
+		{
+			if (!putbody(mci, e->e_parent, e->e_msgboundary))
+				goto writeerr;
+		}
 		else if (e->e_msgboundary == NULL)
 		{
-			putline("", mci);
-			putline("   ----- Message body suppressed -----", mci);
+			if (!putline("", mci) ||
+			    !putline("   ----- Message body suppressed -----",
+					mci))
+			{
+				goto writeerr;
+			}
 		}
 	}
 	else if (e->e_msgboundary == NULL)
 	{
-		putline("  ----- No message was collected -----\n", mci);
+		if (!putline("  ----- No message was collected -----\n", mci))
+			goto writeerr;
 	}

 	if (e->e_msgboundary != NULL)
 	{
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 3, "--", e->e_msgboundary,
 				   "--");
-		putline(buf, mci);
+		if (!putline("", mci) || !putline(buf, mci))
+			goto writeerr;
 	}
-	putline("", mci);
-	(void) sm_io_flush(mci->mci_out, SM_TIME_DEFAULT);
+	if (!putline("", mci) ||
+	    sm_io_flush(mci->mci_out, SM_TIME_DEFAULT) == SM_IO_EOF)
+			goto writeerr;

 	/*
 	**  Cleanup and exit
 	*/

 	if (errno != 0)
+	{
+  writeerr:
 		syserr("errbody: I/O error");
+		return false;
+	}
+	return true;
 }
+
 /*
 **  SMTPTODSN -- convert SMTP to DSN status code
 **
@@ -808,13 +808,13 @@ extern struct hdrinfo	HdrInfo[];
 /* functions */
 extern void	addheader __P((char *, char *, int, ENVELOPE *));
 extern unsigned long	chompheader __P((char *, int, HDR **, ENVELOPE *));
-extern void	commaize __P((HDR *, char *, bool, MCI *, ENVELOPE *));
+extern bool	commaize __P((HDR *, char *, bool, MCI *, ENVELOPE *));
 extern HDR	*copyheader __P((HDR *, SM_RPOOL_T *));
 extern void	eatheader __P((ENVELOPE *, bool, bool));
 extern char	*hvalue __P((char *, HDR *));
 extern void	insheader __P((int, char *, char *, int, ENVELOPE *));
 extern bool	isheader __P((char *));
-extern void	putfromline __P((MCI *, ENVELOPE *));
+extern bool	putfromline __P((MCI *, ENVELOPE *));
 extern void	setupheaders __P((void));

 /*
@@ -869,9 +869,9 @@ struct envelope
 	short		e_sendmode;	/* message send mode */
 	short		e_errormode;	/* error return mode */
 	short		e_timeoutclass;	/* message timeout class */
-	void		(*e_puthdr)__P((MCI *, HDR *, ENVELOPE *, int));
+	bool		(*e_puthdr)__P((MCI *, HDR *, ENVELOPE *, int));
 					/* function to put header of message */
-	void		(*e_putbody)__P((MCI *, ENVELOPE *, char *));
+	bool		(*e_putbody)__P((MCI *, ENVELOPE *, char *));
 					/* function to put body of message */
 	ENVELOPE	*e_parent;	/* the message this one encloses */
 	ENVELOPE	*e_sibling;	/* the next envelope of interest */
@@ -941,6 +941,7 @@ struct envelope
 #define EF_TOOBIG	0x02000000L	/* message is too big */
 #define EF_SPLIT	0x04000000L	/* envelope has been split */
 #define EF_UNSAFE	0x08000000L	/* unsafe: read from untrusted source */
+#define EF_TOODEEP	0x10000000L	/* message is nested too deep */

 #define DLVR_NOTIFY	0x01
 #define DLVR_RETURN	0x02
@@ -964,8 +965,8 @@ extern void	dropenvelope __P((ENVELOPE *, bool, bool));
 extern ENVELOPE	*newenvelope __P((ENVELOPE *, ENVELOPE *, SM_RPOOL_T *));
 extern void	clrsessenvelope __P((ENVELOPE *));
 extern void	printenvflags __P((ENVELOPE *));
-extern void	putbody __P((MCI *, ENVELOPE *, char *));
-extern void	putheader __P((MCI *, HDR *, ENVELOPE *, int));
+extern bool	putbody __P((MCI *, ENVELOPE *, char *));
+extern bool	putheader __P((MCI *, HDR *, ENVELOPE *, int));

 /*
 **  Message priority classes.
@@ -1646,8 +1647,8 @@ EXTERN unsigned long	PrivacyFlags;	/* privacy flags */
 #define M87F_NO8TO7		0x0004	/* don't do 8->7 bit conversions */

 /* functions */
-extern void	mime7to8 __P((MCI *, HDR *, ENVELOPE *));
-extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int));
+extern bool	mime7to8 __P((MCI *, HDR *, ENVELOPE *));
+extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int, int));

 /*
 **  Flags passed to returntosender.
@@ -2140,7 +2141,6 @@ EXTERN bool	ColonOkInAddr;	/* single colon legal in address */
 #if !defined(_USE_SUN_NSSWITCH_) && !defined(_USE_DEC_SVC_CONF_)
 EXTERN bool	ConfigFileRead;	/* configuration file has been read */
 #endif /* !defined(_USE_SUN_NSSWITCH_) && !defined(_USE_DEC_SVC_CONF_) */
-EXTERN bool	volatile DataProgress;	/* have we sent anything since last check */
 EXTERN bool	DisConnected;	/* running with OutChannel redirect to transcript file */
 EXTERN bool	DontExpandCnames;	/* do not $[...$] expand CNAMEs */
 EXTERN bool	DontInitGroups;	/* avoid initgroups() because of NIS cost */
@@ -2513,8 +2513,8 @@ extern void	printopenfds __P((bool));
 extern void	printqueue __P((void));
 extern void	printrules __P((void));
 extern pid_t	prog_open __P((char **, int *, ENVELOPE *));
-extern void	putline __P((char *, MCI *));
-extern void	putxline __P((char *, size_t, MCI *, int));
+extern bool	putline __P((char *, MCI *));
+extern bool	putxline __P((char *, size_t, MCI *, int));
 extern void	queueup_macros __P((int, SM_FILE_T *, ENVELOPE *));
 extern void	readcf __P((char *, bool, ENVELOPE *));
 extern SIGFUNC_DECL	reapchild __P((int));
@@ -515,6 +515,125 @@ tls_close(fp)
 /* maximum number of retries for TLS related I/O due to handshakes */
 # define MAX_TLS_IOS	4

+/*
+**  TLS_RETRY -- check whether a failed SSL operation can be retried
+**
+**	Parameters:
+**		ssl -- TLS structure
+**		rfd -- read fd
+**		wfd -- write fd
+**		tlsstart -- start time of TLS operation
+**		timeout -- timeout for TLS operation
+**		err -- SSL error
+**		where -- description of operation
+**
+**	Results:
+**		>0 on success
+**		0 on timeout
+**		<0 on error
+*/
+
+int
+tls_retry(ssl, rfd, wfd, tlsstart, timeout, err, where)
+	SSL *ssl;
+	int rfd;
+	int wfd;
+	time_t tlsstart;
+	int timeout;
+	int err;
+	const char *where;
+{
+	int ret;
+	time_t left;
+	time_t now = curtime();
+	struct timeval tv;
+
+	ret = -1;
+
+	/*
+	**  For SSL_ERROR_WANT_{READ,WRITE}:
+	**  There is not a complete SSL record available yet
+	**  or there is only a partial SSL record removed from
+	**  the network (socket) buffer into the SSL buffer.
+	**  The SSL_connect will only succeed when a full
+	**  SSL record is available (assuming a "real" error
+	**  doesn't happen). To handle when a "real" error
+	**  does happen the select is set for exceptions too.
+	**  The connection may be re-negotiated during this time
+	**  so both read and write "want errors" need to be handled.
+	**  A select() exception loops back so that a proper SSL
+	**  error message can be gotten.
+	*/
+
+	left = timeout - (now - tlsstart);
+	if (left <= 0)
+		return 0;	/* timeout */
+	tv.tv_sec = left;
+	tv.tv_usec = 0;
+
+	if (LogLevel > 14)
+	{
+		sm_syslog(LOG_INFO, NOQID,
+			  "STARTTLS=%s, info: fds=%d/%d, err=%d",
+			  where, rfd, wfd, err);
+	}
+
+	if (FD_SETSIZE > 0 &&
+	    ((err == SSL_ERROR_WANT_READ && rfd >= FD_SETSIZE) ||
+	     (err == SSL_ERROR_WANT_WRITE && wfd >= FD_SETSIZE)))
+	{
+		if (LogLevel > 5)
+		{
+			sm_syslog(LOG_ERR, NOQID,
+				  "STARTTLS=%s, error: fd %d/%d too large",
+				  where, rfd, wfd);
+		if (LogLevel > 8)
+			tlslogerr(where);
+		}
+		errno = EINVAL;
+	}
+	else if (err == SSL_ERROR_WANT_READ)
+	{
+		fd_set ssl_maskr, ssl_maskx;
+
+		FD_ZERO(&ssl_maskr);
+		FD_SET(rfd, &ssl_maskr);
+		FD_ZERO(&ssl_maskx);
+		FD_SET(rfd, &ssl_maskx);
+		do
+		{
+			ret = select(rfd + 1, &ssl_maskr, NULL, &ssl_maskx,
+					&tv);
+		} while (ret < 0 && errno == EINTR);
+		if (ret < 0 && errno > 0)
+			ret = -errno;
+	}
+	else if (err == SSL_ERROR_WANT_WRITE)
+	{
+		fd_set ssl_maskw, ssl_maskx;
+
+		FD_ZERO(&ssl_maskw);
+		FD_SET(wfd, &ssl_maskw);
+		FD_ZERO(&ssl_maskx);
+		FD_SET(rfd, &ssl_maskx);
+		do
+		{
+			ret = select(wfd + 1, NULL, &ssl_maskw, &ssl_maskx,
+					&tv);
+		} while (ret < 0 && errno == EINTR);
+		if (ret < 0 && errno > 0)
+			ret = -errno;
+	}
+	return ret;
+}
+
+/* errno to force refill() etc to stop (see IS_IO_ERROR()) */
+#ifdef ETIMEDOUT
+# define SM_ERR_TIMEOUT	ETIMEDOUT
+#else /* ETIMEDOUT */
+# define SM_ERR_TIMEOUT	EIO
+#endif /* ETIMEDOUT */
+
 /*
 **  TLS_READ -- read secured information for the caller
 **
@@ -536,38 +655,42 @@ tls_read(fp, buf, size)
 	char *buf;
 	size_t size;
 {
-	int r;
-	static int again = MAX_TLS_IOS;
+	int r, rfd, wfd, try, ssl_err;
 	struct tls_obj *so = (struct tls_obj *) fp->f_cookie;
+	time_t tlsstart;
 	char *err;

+	try = 99;
+	err = NULL;
+	tlsstart = curtime();
+
+  retry:
 	r = SSL_read(so->con, (char *) buf, size);

 	if (r > 0)
-	{
-		again = MAX_TLS_IOS;
 		return r;
-	}

 	err = NULL;
-	switch (SSL_get_error(so->con, r))
+	switch (ssl_err = SSL_get_error(so->con, r))
 	{
 	  case SSL_ERROR_NONE:
 	  case SSL_ERROR_ZERO_RETURN:
-		again = MAX_TLS_IOS;
 		break;
 	  case SSL_ERROR_WANT_WRITE:
-		if (--again <= 0)
-			err = "read W BLOCK";
-		else
-			errno = EAGAIN;
-		break;
+		err = "read W BLOCK";
+		/* FALLTHROUGH */
 	  case SSL_ERROR_WANT_READ:
-		if (--again <= 0)
+		if (err == NULL)
 			err = "read R BLOCK";
-		else
-			errno = EAGAIN;
+		rfd = SSL_get_rfd(so->con);
+		wfd = SSL_get_wfd(so->con);
+		try = tls_retry(so->con, rfd, wfd, tlsstart,
+				TimeOuts.to_datablock, ssl_err, "read");
+		if (try > 0)
+			goto retry;
+		errno = SM_ERR_TIMEOUT;
 		break;
+
 	  case SSL_ERROR_WANT_X509_LOOKUP:
 		err = "write X BLOCK";
 		break;
@@ -600,15 +723,22 @@ tls_read(fp, buf, size)
 		int save_errno;

 		save_errno = (errno == 0) ? EIO : errno;
-		again = MAX_TLS_IOS;
-		if (LogLevel > 9)
+		if (try == 0 && save_errno == SM_ERR_TIMEOUT)
+		{
+			if (LogLevel > 7)
+				sm_syslog(LOG_WARNING, NOQID,
+					  "STARTTLS: read error=timeout");
+		}
+		else if (LogLevel > 8)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: read error=%s (%d), errno=%d, get_error=%s",
+				  "STARTTLS: read error=%s (%d), errno=%d, get_error=%s, retry=%d, ssl_err=%d",
 				  err, r, errno,
-				  ERR_error_string(ERR_get_error(), NULL));
+				  ERR_error_string(ERR_get_error(), NULL), try,
+				  ssl_err);
 		else if (LogLevel > 7)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: read error=%s (%d)", err, r);
+				  "STARTTLS: read error=%s (%d), retry=%d, ssl_err=%d",
+				  err, r, errno, try, ssl_err);
 		errno = save_errno;
 	}
 	return r;
@@ -635,36 +765,39 @@ tls_write(fp, buf, size)
 	const char *buf;
 	size_t size;
 {
-	int r;
-	static int again = MAX_TLS_IOS;
+	int r, rfd, wfd, try, ssl_err;
 	struct tls_obj *so = (struct tls_obj *) fp->f_cookie;
+	time_t tlsstart;
 	char *err;

+	try = 99;
+	err = NULL;
+	tlsstart = curtime();
+
+  retry:
 	r = SSL_write(so->con, (char *) buf, size);

 	if (r > 0)
-	{
-		again = MAX_TLS_IOS;
 		return r;
-	}
 	err = NULL;
-	switch (SSL_get_error(so->con, r))
+	switch (ssl_err = SSL_get_error(so->con, r))
 	{
 	  case SSL_ERROR_NONE:
 	  case SSL_ERROR_ZERO_RETURN:
-		again = MAX_TLS_IOS;
 		break;
 	  case SSL_ERROR_WANT_WRITE:
-		if (--again <= 0)
-			err = "write W BLOCK";
-		else
-			errno = EAGAIN;
-		break;
+		err = "read W BLOCK";
+		/* FALLTHROUGH */
 	  case SSL_ERROR_WANT_READ:
-		if (--again <= 0)
-			err = "write R BLOCK";
-		else
-			errno = EAGAIN;
+		if (err == NULL)
+			err = "read R BLOCK";
+		rfd = SSL_get_rfd(so->con);
+		wfd = SSL_get_wfd(so->con);
+		try = tls_retry(so->con, rfd, wfd, tlsstart,
+				DATA_PROGRESS_TIMEOUT, ssl_err, "write");
+		if (try > 0)
+			goto retry;
+		errno = SM_ERR_TIMEOUT;
 		break;
 	  case SSL_ERROR_WANT_X509_LOOKUP:
 		err = "write X BLOCK";
@@ -697,15 +830,22 @@ tls_write(fp, buf, size)
 		int save_errno;

 		save_errno = (errno == 0) ? EIO : errno;
-		again = MAX_TLS_IOS;
-		if (LogLevel > 9)
+		if (try == 0 && save_errno == SM_ERR_TIMEOUT)
+		{
+			if (LogLevel > 7)
+				sm_syslog(LOG_WARNING, NOQID,
+					  "STARTTLS: write error=timeout");
+		}
+		else if (LogLevel > 8)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: write error=%s (%d), errno=%d, get_error=%s",
+				  "STARTTLS: write error=%s (%d), errno=%d, get_error=%s, retry=%d, ssl_err=%d",
 				  err, r, errno,
-				  ERR_error_string(ERR_get_error(), NULL));
+				  ERR_error_string(ERR_get_error(), NULL), try,
+				  ssl_err);
 		else if (LogLevel > 7)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: write error=%s (%d)", err, r);
+				  "STARTTLS: write error=%s (%d), errno=%d, retry=%d, ssl_err=%d",
+				  err, r, errno, try, ssl_err);
 		errno = save_errno;
 	}
 	return r;
@@ -17,6 +17,8 @@ extern int	sfdcsasl __P((SM_FILE_T **, SM_FILE_T **, sasl_conn_t *));
 #endif /* SASL */

 # if STARTTLS
+extern int	tls_retry __P((SSL *, int, int, time_t, int, int,
+				const char *));
 extern int	sfdctls __P((SM_FILE_T **, SM_FILE_T **, SSL *));
 # endif /* STARTTLS */

@@ -503,7 +503,6 @@ smtp(nullserver, d_flags, e)
 #endif /* SASL */
 	int r;
 #if STARTTLS
-	int fdfl;
 	int rfd, wfd;
 	volatile bool tls_active = false;
 	volatile bool smtps = bitnset(D_SMTPS, d_flags);
@@ -1693,97 +1692,26 @@ smtp(nullserver, d_flags, e)
 #  define SSL_ACC(s)	SSL_accept(s)

 			tlsstart = curtime();
-			fdfl = fcntl(rfd, F_GETFL);
-			if (fdfl != -1)
-				fcntl(rfd, F_SETFL, fdfl|O_NONBLOCK);
  ssl_retry:
 			if ((r = SSL_ACC(srv_ssl)) <= 0)
 			{
-				int i;
-				bool timedout;
-				time_t left;
-				time_t now = curtime();
-				struct timeval tv;
+				int i, ssl_err;

-				/* what to do in this case? */
-				i = SSL_get_error(srv_ssl, r);
+				ssl_err = SSL_get_error(srv_ssl, r);
+				i = tls_retry(srv_ssl, rfd, wfd, tlsstart,
+						TimeOuts.to_starttls, ssl_err,
+						"server");
+				if (i > 0)
+					goto ssl_retry;

-				/*
-				**  For SSL_ERROR_WANT_{READ,WRITE}:
-				**  There is no SSL record available yet
-				**  or there is only a partial SSL record
-				**  removed from the network (socket) buffer
-				**  into the SSL buffer. The SSL_accept will
-				**  only succeed when a full SSL record is
-				**  available (assuming a "real" error
-				**  doesn't happen). To handle when a "real"
-				**  error does happen the select is set for
-				**  exceptions too.
-				**  The connection may be re-negotiated
-				**  during this time so both read and write
-				**  "want errors" need to be handled.
-				**  A select() exception loops back so that
-				**  a proper SSL error message can be gotten.
-				*/
-
-				left = TimeOuts.to_starttls - (now - tlsstart);
-				timedout = left <= 0;
-				if (!timedout)
-				{
-					tv.tv_sec = left;
-					tv.tv_usec = 0;
-				}
-
-				if (!timedout && FD_SETSIZE > 0 &&
-				    (rfd >= FD_SETSIZE ||
-				     (i == SSL_ERROR_WANT_WRITE &&
-				      wfd >= FD_SETSIZE)))
-				{
-					if (LogLevel > 5)
-					{
-						sm_syslog(LOG_ERR, NOQID,
-							  "STARTTLS=server, error: fd %d/%d too large",
-							  rfd, wfd);
-						if (LogLevel > 8)
-							tlslogerr("server");
-					}
-					goto tlsfail;
-				}
-
-				/* XXX what about SSL_pending() ? */
-				if (!timedout && i == SSL_ERROR_WANT_READ)
-				{
-					fd_set ssl_maskr, ssl_maskx;
-
-					FD_ZERO(&ssl_maskr);
-					FD_SET(rfd, &ssl_maskr);
-					FD_ZERO(&ssl_maskx);
-					FD_SET(rfd, &ssl_maskx);
-					if (select(rfd + 1, &ssl_maskr, NULL,
-						   &ssl_maskx, &tv) > 0)
-						goto ssl_retry;
-				}
-				if (!timedout && i == SSL_ERROR_WANT_WRITE)
-				{
-					fd_set ssl_maskw, ssl_maskx;
-
-					FD_ZERO(&ssl_maskw);
-					FD_SET(wfd, &ssl_maskw);
-					FD_ZERO(&ssl_maskx);
-					FD_SET(rfd, &ssl_maskx);
-					if (select(wfd + 1, NULL, &ssl_maskw,
-						   &ssl_maskx, &tv) > 0)
-						goto ssl_retry;
-				}
 				if (LogLevel > 5)
 				{
 					sm_syslog(LOG_WARNING, NOQID,
-						  "STARTTLS=server, error: accept failed=%d, SSL_error=%d, timedout=%d, errno=%d",
-						  r, i, (int) timedout, errno);
+						  "STARTTLS=server, error: accept failed=%d, SSL_error=%d, errno=%d, retry=%d",
+						  r, ssl_err, errno, i);
 					if (LogLevel > 8)
 						tlslogerr("server");
 				}
-tlsfail:
 				tls_ok_srv = false;
 				SSL_free(srv_ssl);
 				srv_ssl = NULL;
@@ -1798,9 +1726,6 @@ tlsfail:
 				goto doquit;
 			}

-			if (fdfl != -1)
-				fcntl(rfd, F_SETFL, fdfl);
-
 			/* ignore return code for now, it's in {verify} */
 			(void) tls_get_info(srv_ssl, true,
 					    CurSmtpClient,
@@ -19,7 +19,6 @@ SM_RCSID("@(#)$Id: usersmtp.c,v 8.451 2004/03/01 21:50:36 ca Exp $")


 extern void	markfailure __P((ENVELOPE *, ADDRESS *, MCI *, int, bool));
-static void	datatimeout __P((void));
 static void	esmtp_check __P((char *, bool, MAILER *, MCI *, ENVELOPE *));
 static void	helo_options __P((char *, bool, MAILER *, MCI *, ENVELOPE *));
 static int	smtprcptstat __P((ADDRESS *, MAILER *, MCI *, ENVELOPE *));
@@ -2493,9 +2492,6 @@ smtprcptstat(to, m, mci, e)
 **		exit status corresponding to DATA command.
 */

-static jmp_buf	CtxDataTimeout;
-static SM_EVENT	*volatile DataTimeout = NULL;
-
 int
 smtpdata(m, mci, e, ctladdr, xstart)
 	MAILER *m;
@@ -2617,43 +2613,22 @@ smtpdata(m, mci, e, ctladdr, xstart)
 	**  factor.  The main thing is that it should not be infinite.
 	*/

-	if (setjmp(CtxDataTimeout) != 0)
-	{
-		mci->mci_errno = errno;
-		mci->mci_state = MCIS_ERROR;
-		mci_setstat(mci, EX_TEMPFAIL, "4.4.2", NULL);
-
-		/*
-		**  If putbody() couldn't finish due to a timeout,
-		**  rewind it here in the timeout handler.  See
-		**  comments at the end of putbody() for reasoning.
-		*/
-
-		if (e->e_dfp != NULL)
-			(void) bfrewind(e->e_dfp);
-
-		errno = mci->mci_errno;
-		syserr("451 4.4.1 timeout writing message to %s", CurHostName);
-		smtpquit(m, mci, e);
-		return EX_TEMPFAIL;
-	}
-
 	if (tTd(18, 101))
 	{
 		/* simulate a DATA timeout */
-		timeout = 1;
+		timeout = 10;
 	}
 	else
-		timeout = DATA_PROGRESS_TIMEOUT;
-
-	DataTimeout = sm_setevent(timeout, datatimeout, 0);
+		timeout = DATA_PROGRESS_TIMEOUT * 1000;
+	sm_io_setinfo(mci->mci_out, SM_IO_WHAT_TIMEOUT, &timeout);


 	/*
 	**  Output the actual message.
 	*/

-	(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
+	if (!(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER))
+		goto writeerr;

 	if (tTd(18, 101))
 	{
@@ -2661,14 +2636,13 @@ smtpdata(m, mci, e, ctladdr, xstart)
 		(void) sleep(2);
 	}

-	(*e->e_putbody)(mci, e, NULL);
+	if (!(*e->e_putbody)(mci, e, NULL))
+		goto writeerr;

 	/*
 	**  Cleanup after sending message.
 	*/

-	if (DataTimeout != NULL)
-		sm_clrevent(DataTimeout);

 #if PIPELINING
 	}
@@ -2708,7 +2682,9 @@ smtpdata(m, mci, e, ctladdr, xstart)
 	}

 	/* terminate the message */
-	(void) sm_io_fprintf(mci->mci_out, SM_TIME_DEFAULT, ".%s", m->m_eol);
+	if (sm_io_fprintf(mci->mci_out, SM_TIME_DEFAULT, ".%s", m->m_eol) ==
+								SM_IO_EOF)
+		goto writeerr;
 	if (TrafficLogFile != NULL)
 		(void) sm_io_fprintf(TrafficLogFile, SM_TIME_DEFAULT,
 				     "%05d >>> .\n", (int) CurrentPid);
@@ -2758,50 +2734,27 @@ smtpdata(m, mci, e, ctladdr, xstart)
 			  shortenstring(SmtpReplyBuffer, 403));
 	}
 	return rstat;
-}

-static void
-datatimeout()
-{
-	int save_errno = errno;
+  writeerr:
+	mci->mci_errno = errno;
+	mci->mci_state = MCIS_ERROR;
+	mci_setstat(mci, EX_TEMPFAIL, "4.4.2", NULL);

 	/*
-	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
-	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
-	**	DOING.
+	**  If putbody() couldn't finish due to a timeout,
+	**  rewind it here in the timeout handler.  See
+	**  comments at the end of putbody() for reasoning.
 	*/

-	if (DataProgress)
-	{
-		time_t timeout;
+	if (e->e_dfp != NULL)
+		(void) bfrewind(e->e_dfp);

-		/* check back again later */
-		if (tTd(18, 101))
-		{
-			/* simulate a DATA timeout */
-			timeout = 1;
-		}
-		else
-			timeout = DATA_PROGRESS_TIMEOUT;
-
-		/* reset the timeout */
-		DataTimeout = sm_sigsafe_setevent(timeout, datatimeout, 0);
-		DataProgress = false;
-	}
-	else
-	{
-		/* event is done */
-		DataTimeout = NULL;
-	}
-
-	/* if no progress was made or problem resetting event, die now */
-	if (DataTimeout == NULL)
-	{
-		errno = ETIMEDOUT;
-		longjmp(CtxDataTimeout, 1);
-	}
-	errno = save_errno;
+	errno = mci->mci_errno;
+	syserr("451 4.4.1 timeout writing message to %s", CurHostName);
+	smtpquit(m, mci, e);
+	return EX_TEMPFAIL;
 }
+
 /*
 **  SMTPGETSTAT -- get status code from DATA in LMTP
 **
@@ -455,6 +455,8 @@ xalloc(sz)
 {
 	register char *p;

+	SM_REQUIRE(sz >= 0);
+
 	/* some systems can't handle size zero mallocs */
 	if (sz <= 0)
 		sz = 1;
@@ -969,18 +971,18 @@ fixcrlf(line, stripnl)
 **		mci -- the mailer connection information.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		output of l to mci->mci_out.
 */

-void
+bool
 putline(l, mci)
 	register char *l;
 	register MCI *mci;
 {
-	putxline(l, strlen(l), mci, PXLF_MAPFROM);
+	return putxline(l, strlen(l), mci, PXLF_MAPFROM);
 }
 /*
 **  PUTXLINE -- putline with flags bits.
@@ -999,13 +1001,13 @@ putline(l, mci)
 **		    PXLF_NOADDEOL -- don't add an EOL if one wasn't present.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		output of l to mci->mci_out.
 */

-void
+bool
 putxline(l, len, mci, pxflags)
 	register char *l;
 	size_t len;
@@ -1057,11 +1059,6 @@ putxline(l, len, mci, pxflags)
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       '.') == SM_IO_EOF)
 					dead = true;
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 				if (TrafficLogFile != NULL)
 					(void) sm_io_putc(TrafficLogFile,
 							  SM_TIME_DEFAULT, '.');
@@ -1074,11 +1071,6 @@ putxline(l, len, mci, pxflags)
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       '>') == SM_IO_EOF)
 					dead = true;
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 				if (TrafficLogFile != NULL)
 					(void) sm_io_putc(TrafficLogFile,
 							  SM_TIME_DEFAULT,
@@ -1090,16 +1082,11 @@ putxline(l, len, mci, pxflags)
 			while (l < q)
 			{
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
-					       (unsigned char) *l++) == SM_IO_EOF)
+				       (unsigned char) *l++) == SM_IO_EOF)
 				{
 					dead = true;
 					break;
 				}
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 			}
 			if (dead)
 				break;
@@ -1115,11 +1102,6 @@ putxline(l, len, mci, pxflags)
 				dead = true;
 				break;
 			}
-			else
-			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
-			}
 			if (TrafficLogFile != NULL)
 			{
 				for (l = l_base; l < q; l++)
@@ -1143,11 +1125,9 @@ putxline(l, len, mci, pxflags)
 		{
 			if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT, '.') ==
 			    SM_IO_EOF)
-				break;
-			else
 			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
+				dead = true;
+				break;
 			}
 			if (TrafficLogFile != NULL)
 				(void) sm_io_putc(TrafficLogFile,
@@ -1160,11 +1140,9 @@ putxline(l, len, mci, pxflags)
 		{
 			if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT, '>') ==
 			    SM_IO_EOF)
-				break;
-			else
 			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
+				dead = true;
+				break;
 			}
 			if (TrafficLogFile != NULL)
 				(void) sm_io_putc(TrafficLogFile,
@@ -1182,11 +1160,6 @@ putxline(l, len, mci, pxflags)
 				dead = true;
 				break;
 			}
-			else
-			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
-			}
 		}
 		if (dead)
 			break;
@@ -1197,11 +1170,9 @@ putxline(l, len, mci, pxflags)
 		if ((!bitset(PXLF_NOADDEOL, pxflags) || !noeol) &&
 		    sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
 				mci->mci_mailer->m_eol) == SM_IO_EOF)
-			break;
-		else
 		{
-			/* record progress for DATA timeout */
-			DataProgress = true;
+			dead = true;
+			break;
 		}
 		if (l < end && *l == '\n')
 		{
@@ -1210,11 +1181,9 @@ putxline(l, len, mci, pxflags)
 			{
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       ' ') == SM_IO_EOF)
-					break;
-				else
 				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
+					dead = true;
+					break;
 				}

 				if (TrafficLogFile != NULL)
@@ -1223,10 +1192,10 @@ putxline(l, len, mci, pxflags)
 			}
 		}

-		/* record progress for DATA timeout */
-		DataProgress = true;
 	} while (l < end);
+	return !dead;
 }
+
 /*
 **  XUNLINK -- unlink a file, doing logging as appropriate.
 **
@@ -2432,6 +2401,7 @@ str2prt(s)
 				*h++ = 'r';
 				break;
 			  default:
+				SM_ASSERT(l >= 2);
 				(void) sm_snprintf(h, l, "%03o",
 					(unsigned int)((unsigned char) c));

@@ -124,6 +124,9 @@ GLOBAL size_t record_size;
 /* Boolean value.  */
 GLOBAL int absolute_names_option;

+/* Allow GNUTYPE_NAMES type? */
+GLOBAL bool allow_name_mangling_option;
+
 /* This variable tells how to interpret newer_mtime_option, below.  If zero,
   files get archived if their mtime is not less than newer_mtime_option.
   If nonzero, files get archived if *either* their ctime or mtime is not less
@@ -1219,7 +1219,13 @@ extract_archive (void)
      break;

    case GNUTYPE_NAMES:
-      extract_mangle ();
+      if (allow_name_mangling_option)
+	extract_mangle ();
+      else {
+	ERROR ((0, 0, _("GNUTYPE_NAMES mangling ignored")));
+	if (backup_option)
+	  undo_last_backup ();
+      }
      break;

    case GNUTYPE_MULTIVOL:
@@ -129,6 +129,7 @@ confirm (const char *message_action, const char *message_name)
 enum
 {
  ANCHORED_OPTION = CHAR_MAX + 1,
+  ALLOW_NAME_MANGLING_OPTION,
  BACKUP_OPTION,
  DELETE_OPTION,
  EXCLUDE_OPTION,
@@ -178,6 +179,7 @@ static struct option long_options[] =
  {"absolute-names", no_argument, 0, 'P'},
  {"absolute-paths", no_argument, 0, OBSOLETE_ABSOLUTE_NAMES},
  {"after-date", required_argument, 0, 'N'},
+  {"allow-name-mangling", no_argument, 0, ALLOW_NAME_MANGLING_OPTION},
  {"anchored", no_argument, 0, ANCHORED_OPTION},
  {"append", no_argument, 0, 'r'},
  {"atime-preserve", no_argument, &atime_preserve_option, 1},
@@ -392,6 +394,8 @@ Archive format selection:\n\
              PATTERN                at list/extract time, a globbing PATTERN\n\
  -o, --old-archive, --portability   write a V7 format archive\n\
      --posix                        write a POSIX format archive\n\
+      --allow-name-mangling          allow GNUTYPE_NAMES mangling --\n\
+                                     considered dangerous\n\
  -j, -y, --bzip, --bzip2, --bunzip2 filter the archive through bzip2\n\
  -z, --gzip, --ungzip               filter the archive through gzip\n\
  -Z, --compress, --uncompress       filter the archive through compress\n\
@@ -901,6 +905,10 @@ decode_options (int argc, char **argv)
 	set_use_compress_program_option ("compress");
 	break;

+      case ALLOW_NAME_MANGLING_OPTION:
+	allow_name_mangling_option = true;
+	break;
+
      case OBSOLETE_VERSION_CONTROL:
 	WARN ((0, 0, _("Obsolete option name replaced by --backup")));
 	/* Fall through.  */
@@ -386,6 +386,21 @@ For more information about these matters, see the files named COPYING.\n"),
    usage (1);
 }

+static char **tv;
+static int tv_alloc;
+static int tv_used;
+
+static int
+findtempname (char *tempname)
+{
+  int i;
+
+  for (i = 0; i < tv_used; i++)
+    if (strcmp (tv[i], tempname) == 0)
+	return (1);
+  return (0);
+}
+
 /* Return a name for temporary file COUNT. */

 static char *
@@ -393,11 +408,12 @@ maketempname (count)
     int count;
 {
  static char *tempbase = NULL;
+  char *tempname;
  char tempsuffix[10];
+  int fd;

  if (!tempbase)
    {
-      int fd;
      tempbase = concat (tempdir, "txidxXXXXXX");

      fd = mkstemp (tempbase);
@@ -406,7 +422,52 @@ maketempname (count)
    }

  sprintf (tempsuffix, ".%d", count);
-  return concat (tempbase, tempsuffix);
+  tempname = concat (tempbase, tempsuffix);
+  /*
+   * The open logic becomes a bit convoluted. If open(2) fails due to EEXIST,
+   * it's likely because somebody attempted to race us, or because we have
+   * already created this file.
+   */
+  fd = open (tempname, O_CREAT|O_EXCL|O_WRONLY, 0600);
+  if (fd == -1)
+    {
+	/*
+	 * If errno is not EEXIST, then open failed for some other reason, so
+	 * we should terminate. If errno == EEXIST AND we didn't create this
+	 * file, terminate. Otherwise, it's safe to say that errno == EEXIST
+	 * because we already created it, in this event, we can just return.
+	 */
+	if (errno != EEXIST ||
+	  (errno == EEXIST && findtempname (tempname) == 0))
+	  pfatal_with_name (tempname);
+	return (tempname);
+    }
+  else if (fd > 0)
+    {
+	close (fd);
+    }
+  if (tv == NULL)
+    {
+	tv_alloc = 16;
+	tv = calloc (tv_alloc, sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "calloc failed\n");
+	    exit (1);
+	  }
+    }
+  else if (tv_used == tv_alloc)
+    {
+	tv_alloc += 4;
+	tv = realloc (tv, tv_alloc * sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "realloc failed");
+	    exit (1);
+	  }
+    }
+  tv[tv_used++] = strdup (tempname);
+  return tempname;
 }


@@ -1294,6 +1294,7 @@ slc_check()


 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;

 void
@@ -1309,6 +1310,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1322,6 +1331,9 @@ slc_end_reply()
 {
    int len;

+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
    *slc_replyp++ = IAC;
    *slc_replyp++ = SE;
    len = slc_replyp - slc_reply;
@@ -1415,8 +1427,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }

-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;

@@ -1475,9 +1487,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		void *tmp;
 		opt_replyend += OPT_REPLY_SIZE;
@@ -1503,6 +1515,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1517,6 +1531,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1547,7 +1563,9 @@ env_opt_end(int emptyok)
 {
 	int len;

-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;
@@ -1285,6 +1285,7 @@ slc_check()


 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;

 void
@@ -1300,6 +1301,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1313,6 +1322,9 @@ slc_end_reply()
 {
    int len;

+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
    *slc_replyp++ = IAC;
    *slc_replyp++ = SE;
    len = slc_replyp - slc_reply;
@@ -1406,8 +1418,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }

-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;

@@ -1460,9 +1472,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1486,6 +1498,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1500,6 +1514,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1530,7 +1546,9 @@ env_opt_end(int emptyok)
 {
 	int len;

-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;
@@ -27,6 +27,24 @@ RCSID("$OpenBSD: deattack.c,v 1.18 2002/03/04 17:27:39 stevesk Exp $");
 #include "xmalloc.h"
 #include "deattack.h"

+/*
+ * CRC attack detection has a worst-case behaviour that is O(N^3) over
+ * the number of identical blocks in a packet. This behaviour can be 
+ * exploited to create a limited denial of service attack. 
+ * 
+ * However, because we are dealing with encrypted data, identical
+ * blocks should only occur every 2^35 maximally-sized packets or so. 
+ * Consequently, we can detect this DoS by looking for identical blocks
+ * in a packet.
+ *
+ * The parameter below determines how many identical blocks we will
+ * accept in a single packet, trading off between attack detection and
+ * likelihood of terminating a legitimate connection. A value of 32 
+ * corresponds to an average of 2^40 messages before an attack is
+ * misdetected
+ */
+#define MAX_IDENTICAL	32
+
 /* SSH Constants */
 #define SSH_MAXBLOCKS	(32 * 1024)
 #define SSH_BLOCKSIZE	(8)
@@ -87,7 +105,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	static u_int16_t *h = (u_int16_t *) NULL;
 	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
 	u_int32_t i, j;
-	u_int32_t l;
+	u_int32_t l, same;
 	u_char *c;
 	u_char *d;

@@ -133,7 +151,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	if (IV)
 		h[HASH(IV) & (n - 1)] = HASH_IV;

-	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
+	for (c = buf, same = j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
 		for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
 		    i = (i + 1) & (n - 1)) {
 			if (h[i] == HASH_IV) {
@@ -144,6 +162,8 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 						break;
 				}
 			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
+				if (++same > MAX_IDENTICAL)
+					return (DEATTACK_DOS_DETECTED);
 				if (check_crc(c, buf, len, IV))
 					return (DEATTACK_DETECTED);
 				else
@@ -25,6 +25,7 @@
 /* Return codes */
 #define DEATTACK_OK		0
 #define DEATTACK_DETECTED	1
+#define DEATTACK_DOS_DETECTED	2

 int	 detect_attack(u_char *, u_int32_t, u_char[8]);
 #endif
@@ -450,6 +450,11 @@ struct winsize {
 # undef HAVE_GAI_STRERROR
 #endif

+#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \
+    defined(SYSLOG_R_SAFE_IN_SIGHAND)
+# define DO_LOG_SAFE_IN_SIGHAND
+#endif
+
 #if !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY)
 # define memmove(s1, s2, n) bcopy((s2), (s1), (n))
 #endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
@@ -124,6 +124,20 @@ error(const char *fmt,...)
 	va_end(args);
 }

+void
+sigdie(const char *fmt,...)
+{
+	va_list args;
+
+#ifdef DO_LOG_SAFE_IN_SIGHAND
+	va_start(args, fmt);
+	do_log(SYSLOG_LEVEL_FATAL, fmt, args);
+	va_end(args);
+#endif
+	_exit(1);
+}
+
+
 /* Log this message (information that usually should go to the log). */

 void
@@ -55,6 +55,7 @@ LogLevel log_level_number(char *);

 void     fatal(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     error(const char *, ...) __attribute__((format(printf, 1, 2)));
+void     sigdie(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     log(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     verbose(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     debug(const char *, ...) __attribute__((format(printf, 1, 2)));
@@ -857,9 +857,16 @@ packet_read_poll1(void)
 	 * (C)1998 CORE-SDI, Buenos Aires Argentina
 	 * Ariel Futoransky(futo@core-sdi.com)
 	 */
-	if (!receive_context.plaintext &&
-	    detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED)
-		packet_disconnect("crc32 compensation attack: network attack detected");
+	if (!receive_context.plaintext) {
+		switch (detect_attack(buffer_ptr(&input), padded_len, NULL)) {
+		case DEATTACK_DETECTED:
+			packet_disconnect("crc32 compensation attack: "
+			    "network attack detected");
+		case DEATTACK_DOS_DETECTED:
+			packet_disconnect("deattack denial of "
+			    "service detected");
+		}
+	}

 	/* Decrypt data to incoming_packet. */
 	buffer_clear(&incoming_packet);
@@ -35,4 +35,4 @@
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
 #   EscapeChar ~
-#   VersionAddendum FreeBSD-20030924
+#   VersionAddendum FreeBSD-20060930
@@ -616,7 +616,7 @@ host key database instead of
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20030924 .
+.Dq FreeBSD-20060930 .
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1
@@ -309,7 +309,7 @@ grace_alarm_handler(int sig)
 	/* XXX no idea how fix this signal handler */

 	/* Log error and exit. */
-	fatal("Timeout before authentication for %s", get_remote_ipaddr());
+	sigdie("Timeout before authentication for %s", get_remote_ipaddr());
 }

 /*
@@ -14,7 +14,7 @@
 # Note that some of FreeBSD's defaults differ from OpenBSD's, and
 # FreeBSD has a few additional options.

-#VersionAddendum FreeBSD-20030924
+#VersionAddendum FreeBSD-20060930

 #Port 22
 #Protocol 2,1
@@ -647,7 +647,7 @@ The default is
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20030924 .
+.Dq FreeBSD-20060930 .
 .It Cm X11DisplayOffset
 Specifies the first display number available for
 .Nm sshd Ns 's
@@ -5,7 +5,7 @@

 #define SSH_VERSION             (ssh_version_get())
 #define SSH_VERSION_BASE        "OpenSSH_3.5p1"
-#define SSH_VERSION_ADDENDUM    "FreeBSD-20030924"
+#define SSH_VERSION_ADDENDUM    "FreeBSD-20060930"

 const char *ssh_version_get(void);
 void ssh_version_set_addendum(const char *add);
@@ -628,6 +628,9 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 		ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
 		return 0;
 	} else if(ret == -1) return -1;
+
+	ret = 0;
+
 	/* SEQUENCE, SET and "OTHER" are left in encoded form */
 	if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
 		/* Clear context cache for type OTHER because the auto clear when
@@ -70,6 +70,10 @@
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
 	
+#ifndef OPENSSL_DH_MAX_MODULUS_BITS
+# define OPENSSL_DH_MAX_MODULUS_BITS	10000
+#endif
+
 #define DH_FLAG_CACHE_MONT_P	0x01

 #ifdef  __cplusplus
@@ -200,6 +204,7 @@ void ERR_load_DH_strings(void);
 /* Reason codes. */
 #define DH_R_BAD_GENERATOR				 101
 #define DH_R_NO_PRIVATE_VALUE				 100
+#define DH_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -78,6 +78,7 @@ static ERR_STRING_DATA DH_str_functs[]=
 static ERR_STRING_DATA DH_str_reasons[]=
 	{
 {DH_R_BAD_GENERATOR                      ,"bad generator"},
+{DH_R_MODULUS_TOO_LARGE                  ,"modulus too large"},
 {DH_R_NO_PRIVATE_VALUE                   ,"no private value"},
 {0,NULL}
 	};
@@ -162,6 +162,12 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
 	BIGNUM *tmp;
 	int ret= -1;

+	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+		{
+		DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	ctx = BN_CTX_new();
 	if (ctx == NULL) goto err;
 	BN_CTX_start(ctx);
@@ -79,6 +79,10 @@
 # include <openssl/dh.h>
 #endif

+#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
+# define OPENSSL_DSA_MAX_MODULUS_BITS	10000
+#endif
+
 #define DSA_FLAG_CACHE_MONT_P	0x01

 #ifdef  __cplusplus
@@ -241,8 +245,10 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_SIG_CB					 114

 /* Reason codes. */
+#define DSA_R_BAD_Q_VALUE				 102
 #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 100
 #define DSA_R_MISSING_PARAMETERS			 101
+#define DSA_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -85,8 +85,10 @@ static ERR_STRING_DATA DSA_str_functs[]=

 static ERR_STRING_DATA DSA_str_reasons[]=
 	{
+{DSA_R_BAD_Q_VALUE                       ,"bad q value"},
 {DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
 {DSA_R_MISSING_PARAMETERS                ,"missing parameters"},
+{DSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {0,NULL}
 	};

@@ -244,6 +244,18 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 		return -1;
 		}

+	if (BN_num_bits(dsa->q) != 160)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);
+		return -1;
+		}
+
+	if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	BN_init(&u1);
 	BN_init(&u2);
 	BN_init(&t1);
@@ -26,7 +26,7 @@
 *  major minor fix final patch/beta)
 */
 #define OPENSSL_VERSION_NUMBER	0x0090704fL
-#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7d 17 Mar 2004"
+#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7d-p1 17 Mar 2004"
 #define OPENSSL_VERSION_PTEXT	" part of " OPENSSL_VERSION_TEXT


@@ -151,6 +151,17 @@ struct rsa_st
 	BN_BLINDING *blinding;
 	};

+#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+# define OPENSSL_RSA_MAX_MODULUS_BITS	16400
+#endif
+
+#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+# define OPENSSL_RSA_SMALL_MODULUS_BITS	4112
+#endif
+#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS
+# define OPENSSL_RSA_MAX_PUBEXP_BITS	72 /* exponent limit enforced for "large" modulus only */
+#endif
+
 #define RSA_3	0x3L
 #define RSA_F4	0x10001L

@@ -344,6 +355,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_INVALID_MESSAGE_LENGTH			 131
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q			 126
 #define RSA_R_KEY_SIZE_TOO_SMALL			 120
+#define RSA_R_MODULUS_TOO_LARGE				 105
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING			 113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q			 127
 #define RSA_R_OAEP_DECODING_ERROR			 121
@@ -105,6 +105,28 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	if ((ctx=BN_CTX_new()) == NULL) goto err;
@@ -505,6 +527,28 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	ctx=BN_CTX_new();
@@ -116,6 +116,7 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
 {RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
 {RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
+{RSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
 {RSA_R_N_DOES_NOT_EQUAL_P_Q              ,"n does not equal p q"},
 {RSA_R_OAEP_DECODING_ERROR               ,"oaep decoding error"},
@@ -185,6 +185,23 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
 		sig=d2i_X509_SIG(NULL,&p,(long)i);

 		if (sig == NULL) goto err;
+
+		/* Excess data can be used to create forgeries */
+		if(p != s+i)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
+		/* Parameters to the signature algorithm can also be used to
+		   create forgeries */
+		if(sig->algor->parameter
+		   && sig->algor->parameter->type != V_ASN1_NULL)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
 		sigtype=OBJ_obj2nid(sig->algor->algorithm);


@@ -268,9 +268,6 @@ int ssl23_get_client_hello(SSL *s)
 	int n=0,j;
 	int type=0;
 	int v[2];
-#ifndef OPENSSL_NO_RSA
-	int use_sslv2_strong=0;
-#endif

 	if (s->state ==	SSL23_ST_SR_CLNT_HELLO_A)
 		{
@@ -519,9 +516,7 @@ int ssl23_get_client_hello(SSL *s)
 			}

 		s->state=SSL2_ST_GET_CLIENT_HELLO_A;
-		if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||
-			use_sslv2_strong ||
-			(s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3))
+		if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)
 			s->s2->ssl2_rollback=0;
 		else
 			/* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0
@@ -538,7 +538,8 @@ static int get_server_hello(SSL *s)
 		CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
 		}

-	if (s->session->peer != s->session->sess_cert->peer_key->x509)
+	if (s->session->sess_cert == NULL 
+      || s->session->peer != s->session->sess_cert->peer_key->x509)
 		/* can't happen */
 		{
 		ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
@@ -1722,7 +1722,7 @@ static int ssl3_get_client_key_exchange(SSL *s)

                if (kssl_ctx->client_princ)
                        {
-                        int len = strlen(kssl_ctx->client_princ);
+                        size_t len = strlen(kssl_ctx->client_princ);
                        if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
                                {
                                s->session->krb5_client_princ_len = len;
@@ -1166,7 +1166,7 @@ char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
 		c=sk_SSL_CIPHER_value(sk,i);
 		for (cp=c->name; *cp; )
 			{
-			if (len-- == 0)
+			if (len-- <= 0)
 				{
 				*p='\0';
 				return(buf);
@@ -1318,6 +1318,7 @@ slc_check(void)
 }

 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;

 void
@@ -1333,6 +1334,14 @@ slc_start_reply(void)
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1346,6 +1355,9 @@ slc_end_reply(void)
 {
    int len;

+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
    *slc_replyp++ = IAC;
    *slc_replyp++ = SE;
    len = slc_replyp - slc_reply;
@@ -1463,8 +1475,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }

-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;

@@ -1517,9 +1529,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1543,6 +1555,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1557,6 +1571,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1587,7 +1603,9 @@ env_opt_end(int emptyok)
 {
 	int len;

-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;
@@ -460,7 +460,7 @@ wt*)
 	;;

 # Individual slices.
-aacd*s*|ad*s*|ar*s*|afd*s*|amrd*s*|da*s*|fla*s*|idad*s*|md*s*|mlxd*s*|pst*s*|twed*s*|vn*s*|wd*s*|wfd*s*)
+aacd*s*|ad*s*|ar*s*|afd*s*|amrd*s*|da*s*|fla*s*|idad*s*|ipsd*s*|md*s*|mlxd*s*|pst*s*|twed*s*|vn*s*|wd*s*|wfd*s*)
 	umask $disk_umask
 	case $i in
 	aacd*s*) name=aacd; chr=151;;
@@ -471,6 +471,7 @@ aacd*s*|ad*s*|ar*s*|afd*s*|amrd*s*|da*s*|fla*s*|idad*s*|md*s*|mlxd*s*|pst*s*|twe
 	da*s*) name=da;  chr=13;;
 	fla*s*) name=fla; chr=102;;
 	idad*s*) name=idad; chr=109;;
+	ipsd*s*) name=ipsd; chr=176;;
 	md*s*) name=md;  chr=95;;
 	mlxd*s*) name=mlxd; chr=131;;
 	pst*s*) name=pst; chr=168;;
@@ -480,7 +481,7 @@ aacd*s*|ad*s*|ar*s*|afd*s*|amrd*s*|da*s*|fla*s*|idad*s*|md*s*|mlxd*s*|pst*s*|twe
 	wfd*s*) name=wfd; chr=87;;
 	esac
 	case $i in
-	aacd*s*|amrd*s*|idad*s*|mlxd*s*|twed*s*)
+	aacd*s*|amrd*s*|idad*s*|ips*s*|mlxd*s*|twed*s*)
 		unit=`expr $i : '....\([0-9]*\)s'`
 		slice=`expr $i : '....[0-9]*s\([0-9]*\)'`
 		part=`expr $i : '....[0-9]*s[0-9]*\(.*\)'`
@@ -645,7 +646,7 @@ fd*)
 	umask 77
 	;;

-aacd*|ad*|ar*|afd*|amrd*|da*|fla*|idad*|md*|mlxd*|pst*|twed*|vn*|wd*|wfd*)
+aacd*|ad*|ar*|afd*|amrd*|da*|fla*|idad*|ips*|md*|mlxd*|pst*|twed*|vn*|wd*|wfd*)
 	umask $disk_umask
 	case $i in
 	aacd*) name=aacd; chr=151;;
@@ -656,6 +657,7 @@ aacd*|ad*|ar*|afd*|amrd*|da*|fla*|idad*|md*|mlxd*|pst*|twed*|vn*|wd*|wfd*)
 	da*) name=da;  chr=13;;
 	fla*) name=fla; chr=102;;
 	idad*) name=idad; chr=109;;
+	ipsd*) name=ipsd; char=176;;
 	md*) name=md; chr=95;;
 	mlxd*) name=mlxd; chr=131;;
 	pst*) name=pst; chr=168;;
@@ -665,7 +667,7 @@ aacd*|ad*|ar*|afd*|amrd*|da*|fla*|idad*|md*|mlxd*|pst*|twed*|vn*|wd*|wfd*)
 	wfd*) name=wfd; chr=87;;
 	esac
 	case $i in
-	aacd*|amrd*|idad*|mlxd*|twed*)
+	aacd*|amrd*|idad*|ipsd*|mlxd*|twed*)
 		unit=`expr $i : '....\(.*\)'`
 		;;
 	afd*|fla*|pst*|wfd*)
@@ -1892,6 +1894,11 @@ aac*)
 	ln -fs aac$unit hpn$unit
 	;;

+ips*)
+	unit=`expr $i : 'ips\(.*\)'`
+	mknod ips$unit c 175 `unit2minor $unit`
+	;;
+
 mlx*)
 	unit=`expr $i : 'mlx\(.*\)'`
 	mknod mlx$unit c 130 `unit2minor $unit`
@@ -370,8 +370,8 @@ esac
 # after a system crash.
 #
 rm -f /tmp/.X*-lock
-rm -fr /tmp/.X11-unix
-mkdir -m 1777 /tmp/.X11-unix
+rm -fr /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix
+mkdir -m 1777 /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix

 # Snapshot any kernel -c changes back to disk here <someday>.
 # This has changed with ELF and /kernel.config.
@@ -569,6 +569,15 @@ draw:
 	if (redraw_menu) {
 	    getyx(list, old_y, old_x);
 	    wclear(list);
+
+    	    /*
+	     * Re-draw a box around the list items.  It is required
+	     * if amount of list items is smaller than height of listbox.
+	     * Otherwise un-redrawn field will be filled with default
+	     * screen attributes instead of dialog attributes.
+	     */
+	    draw_box(dialog, box_y, box_x, list_height + 2, list_width + 2, menubox_border_attr, menubox_attr);
+
 	    for (i = 0; i < max_choice; i++)
 		print_item(list, items[(scroll + i) * 3], items[(scroll + i) * 3 + 1], status[scroll + i], i, i == choice, DREF(ditems, scroll + i), list_width, item_x, check_x);
 	    print_arrows(dialog, scroll, list_height, item_no, box_x, box_y, check_x + 4, cur_x, cur_y);
@@ -54,8 +54,8 @@
 .ds doc-default-operating-system FreeBSD\~4.11
 .
 .\" FreeBSD releases not found in doc-common
-.\" .ds doc-operating-system-FreeBSD-4.11   4.11
-.\" .ds doc-operating-system-FreeBSD-5.4    5.4
+.ds doc-operating-system-FreeBSD-4.11   4.11
+.ds doc-operating-system-FreeBSD-5.4    5.4
 .
 .ec
 .
@@ -830,8 +830,11 @@ local void treat_file(iname)
    }

    close(ifd);
-    if (!to_stdout && close(ofd)) {
-	write_error();
+    if (!to_stdout) {
+        /* Copy modes, times, ownership, and remove the input file */
+        copy_stat(&istat);
+        if (close(ofd))
+	    write_error();
    }
    if (method == -1) {
 	if (!to_stdout) unlink (ofname);
@@ -851,10 +854,6 @@ local void treat_file(iname)
 	}
 	fprintf(stderr, "\n");
    }
-    /* Copy modes, times, ownership, and remove the input file */
-    if (!to_stdout) {
-	copy_stat(&istat);
-    }
 }

 /* ========================================================================
@@ -1257,6 +1256,7 @@ local int get_method(in)
 		/* Copy the base name. Keep a directory prefix intact. */
                char *p = basename(ofname);
                char *base = p;
+		char *base2;
 		for (;;) {
 		    *p = (char)get_char();
 		    if (*p++ == '\0') break;
@@ -1264,6 +1264,8 @@ local int get_method(in)
 			error("corrupted input -- file name too large");
 		    }
 		}
+		base2 = basename (base);
+		strcpy(base, base2);
                /* If necessary, adapt the name to local OS conventions: */
                if (!list) {
                   MAKE_LEGAL_NAME(base);
@@ -1636,12 +1638,12 @@ local void copy_stat(ifstat)
    reset_times(ofname, ifstat);
 #endif
    /* Copy the protection modes */
-    if (chmod(ofname, ifstat->st_mode & 07777)) {
+    if (fchmod(ofd, ifstat->st_mode & 07777)) {
 	WARN((stderr, "%s: ", progname));
 	if (!quiet) perror(ofname);
    }
 #ifndef NO_CHOWN
-    chown(ofname, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
+    (void) fchown(ofd, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
 #endif
    remove_ofname = 0;
    /* It's now safe to remove the input file: */
@@ -2,6 +2,8 @@
 * Copyright (C) 1992-1993 Jean-loup Gailly.
 * This is free software; you can redistribute it and/or modify it under the
 * terms of the GNU General Public License, see the file COPYING.
+ *
+ * $FreeBSD$
 */

 #if defined(__STDC__) || defined(PROTO)
@@ -199,6 +201,8 @@ extern int test;           /* check .z file integrity */
 extern int to_stdout;      /* output to stdout (-c) */
 extern int save_orig_name; /* set if original name must be saved */

+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
+
 #define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
 #define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))

@@ -316,7 +316,7 @@ int *m;                 /* maximum lookup bits, returns actual */
  {
    *t = (struct huft *)NULL;
    *m = 0;
-    return 0;
+    return 2;
  }


@@ -148,13 +148,17 @@ local void make_table(nchar, bitlen, tablebits, table)
    unsigned i, k, len, ch, jutbits, avail, nextcode, mask;

    for (i = 1; i <= 16; i++) count[i] = 0;
-    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;
+    for (i = 0; i < (unsigned)nchar; i++) {
+        if (bitlen[i] > 16)
+        error("Bad table (case a)\n");
+        else count[bitlen[i]]++;
+    }

    start[1] = 0;
    for (i = 1; i <= 16; i++)
 	start[i + 1] = start[i] + (count[i] << (16 - i));
-    if ((start[17] & 0xffff) != 0)
-	error("Bad table\n");
+    if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */
+	error("Bad table (case b)\n");

    jutbits = 16 - tablebits;
    for (i = 1; i <= (unsigned)tablebits; i++) {
@@ -168,15 +172,15 @@ local void make_table(nchar, bitlen, tablebits, table)

    i = start[tablebits + 1] >> jutbits;
    if (i != 0) {
-	k = 1 << tablebits;
-	while (i != k) table[i++] = 0;
+	k = MIN(1 << tablebits, DIST_BUFSIZE);
+	while (i < k) table[i++] = 0;
    }

    avail = nchar;
    mask = (unsigned) 1 << (15 - tablebits);
    for (ch = 0; ch < (unsigned)nchar; ch++) {
 	if ((len = bitlen[ch]) == 0) continue;
-	nextcode = start[len] + weight[len];
+	nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE);
 	if (len <= (unsigned)tablebits) {
 	    for (i = start[len]; i < nextcode; i++) table[i] = ch;
 	} else {
@@ -217,7 +221,7 @@ local void read_pt_len(nn, nbit, i_special)
 	for (i = 0; i < 256; i++) pt_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NPT)) {
 	    c = bitbuf >> (BITBUFSIZ - 3);
 	    if (c == 7) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
@@ -227,7 +231,7 @@ local void read_pt_len(nn, nbit, i_special)
 	    pt_len[i++] = c;
 	    if (i == i_special) {
 		c = getbits(2);
-		while (--c >= 0) pt_len[i++] = 0;
+		while (--c >= 0 && i < NPT) pt_len[i++] = 0;
 	    }
 	}
 	while (i < nn) pt_len[i++] = 0;
@@ -247,7 +251,7 @@ local void read_c_len()
 	for (i = 0; i < 4096; i++) c_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NC)) {
 	    c = pt_table[bitbuf >> (BITBUFSIZ - 8)];
 	    if (c >= NT) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
@@ -255,14 +259,14 @@ local void read_c_len()
 		    if (bitbuf & mask) c = right[c];
 		    else               c = left [c];
 		    mask >>= 1;
-		} while (c >= NT);
+		} while (c >= NT && (mask || c != left[c]));
 	    }
 	    fillbuf((int) pt_len[c]);
 	    if (c <= 2) {
 		if      (c == 0) c = 1;
 		else if (c == 1) c = getbits(4) + 3;
 		else             c = getbits(CBIT) + 20;
-		while (--c >= 0) c_len[i++] = 0;
+		while (--c >= 0 && i < NC) c_len[i++] = 0;
 	    } else c_len[i++] = c - 2;
 	}
 	while (i < NC) c_len[i++] = 0;
@@ -291,7 +295,7 @@ local unsigned decode_c()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NC);
+	} while (j >= NC && (mask || j != left[j]));
    }
    fillbuf((int) c_len[j]);
    return j;
@@ -308,7 +312,7 @@ local unsigned decode_p()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NP);
+	} while (j >= NP && (mask || j != left[j]));
    }
    fillbuf((int) pt_len[j]);
    if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));
@@ -355,7 +359,7 @@ local unsigned decode(count, buffer)
    while (--j >= 0) {
 	buffer[r] = buffer[i];
 	i = (i + 1) & (DICSIZ - 1);
-	if (++r == count) return r;
+	if (++r >= count) return r;
    }
    for ( ; ; ) {
 	c = decode_c();
@@ -365,14 +369,14 @@ local unsigned decode(count, buffer)
 	}
 	if (c <= UCHAR_MAX) {
 	    buffer[r] = c;
-	    if (++r == count) return r;
+	    if (++r >= count) return r;
 	} else {
 	    j = c - (UCHAR_MAX + 1 - THRESHOLD);
 	    i = (r - decode_p() - 1) & (DICSIZ - 1);
 	    while (--j >= 0) {
 		buffer[r] = buffer[i];
 		i = (i + 1) & (DICSIZ - 1);
-		if (++r == count) return r;
+		if (++r >= count) return r;
 	    }
 	}
    }
@@ -12,7 +12,6 @@ static char rcsid[] = "$FreeBSD$";
 #include "gzip.h"
 #include "crypt.h"

-#define MIN(a,b) ((a) <= (b) ? (a) : (b))
 /* The arguments must not have side effects. */

 #define MAX_BITLEN 25
@@ -132,7 +131,7 @@ local void read_tree()
 	/* Remember where the literals of this length start in literal[] : */
 	lit_base[len] = base;
 	/* And read the literals: */
-	for (n = leaves[len]; n > 0; n--) {
+	for (n = leaves[len]; n > 0 && base < LITERALS; n--) {
 	    literal[base++] = (uch)get_byte();
 	}
    }
@@ -168,7 +167,7 @@ local void build_tree()
    prefixp = &prefix_len[1<<peek_bits];
    for (len = 1; len <= peek_bits; len++) {
 	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
-	while (prefixes--) *--prefixp = (uch)len;
+	while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;
    }
    /* The length of all other codes is unknown: */
    while (prefixp > prefix_len) *--prefixp = 0;
@@ -16,4 +16,5 @@ powerpc
 sparc64
 standards
 threads
+usb
 www
@@ -29,6 +29,8 @@
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
+ *
+ * $FreeBSD$
 */

 #if defined(LIBC_SCCS) && !defined(lint)
@@ -143,6 +145,7 @@ const char *const sys_errlist[] = {
 	"Value too large to be stored in data type", /* 84 - EOVERFLOW */
 	"Operation canceled",			/* 85 - ECANCELED */
 	"Illegal byte sequence",		/* 86 - EILSEQ */
+	"Attribute not found",			/* 87 - ENOATTR */
 };
 int errno;
 const int sys_nerr = sizeof(sys_errlist) / sizeof(sys_errlist[0]);
@@ -32,7 +32,7 @@
 .\"     @(#)syslog.3	8.1 (Berkeley) 6/4/93
 .\" $FreeBSD$
 .\"
-.Dd June 4, 1993
+.Dd December 30, 2004
 .Dt SYSLOG 3
 .Os
 .Sh NAME
@@ -205,6 +205,8 @@ etc.
 The mail system.
 .It Dv LOG_NEWS
 The network news system.
+.It Dv LOG_NTP
+The network time protocol system.
 .It Dv LOG_SECURITY
 Security subsystems, such as
 .Xr ipfw 4 .
@@ -32,7 +32,7 @@
 .\"     @(#)intro.2	8.5 (Berkeley) 2/27/95
 .\" $FreeBSD$
 .\"
-.Dd February 27, 1995
+.Dd January 12, 2005
 .Dt INTRO 2
 .Os
 .Sh NAME
@@ -451,6 +451,8 @@ The scheduled operation was canceled.
 While decoding a multibyte character the function came along an
 invalid or an incomplete sequence of bytes or the given wide
 character is invalid.
+.It Er 87 ENOATTR Em "Attribute not found" .
+The specified extended attribute does not exist.
 .El
 .Sh DEFINITIONS
 .Bl -tag -width Ds
@@ -32,7 +32,7 @@
 .\"     @(#)stat.2	8.4 (Berkeley) 5/1/95
 .\" $FreeBSD$
 .\"
-.Dd May 1, 1995
+.Dd November 15, 2004
 .Dt STAT 2
 .Os
 .Sh NAME
@@ -115,6 +115,24 @@ struct stat {
 };
 .Ed
 .Pp
+The fields of
+.Vt "struct stat"
+related to the file system are as follows:
+.Bl -tag -width ".Va st_nlink"
+.It Va st_dev
+The numeric ID of the device containing the file.
+.It Va st_ino
+The file's inode number.
+.It Va st_nlink
+The number of hard links to the file.
+.El
+.Pp
+The
+.Va st_dev
+and
+.Va st_ino
+fields together identify the file uniquely within the system.
+.Pp
 The time-related fields of
 .Fa struct stat
 are as follows:
@@ -165,14 +183,28 @@ The size-related fields of the
 .Fa struct stat
 are as follows:
 .Bl -tag -width XXXst_blksize
-.It st_blksize
+.It Va st_size
+The file size in bytes.
+.It Va st_blksize
 The optimal I/O block size for the file.
-.It st_blocks
+.It Va st_blocks
 The actual number of blocks allocated for the file in 512-byte units.
 As short symbolic links are stored in the inode, this number may
 be zero.
 .El
 .Pp
+The access-related fields of
+.Vt "struct stat"
+are as follows:
+.Bl -tag -width ".Va st_mode"
+.It Va st_uid
+The user ID of the file's owner.
+.It Va st_gid
+The group ID of the file.
+.It Va st_mode
+Status of the file (see below).
+.El
+.Pp
 The status information word
 .Fa st_mode
 has the following bits:
@@ -199,6 +231,32 @@ For a list of access modes, see
 .Xr access 2
 and
 .Xr chmod 2 .
+The following macros are available to test whether a
+.Va st_mode
+value passed in the
+.Ar m
+argument corresponds to a file of the specified type:
+.Bl -tag -width ".Fn S_ISFIFO m"
+.It Fn S_ISBLK m
+Test for a block special file.
+.It Fn S_ISCHR m
+Test for a character special file.
+.It Fn S_ISDIR m
+Test for a directory.
+.It Fn S_ISFIFO m
+Test for a pipe or FIFO special file.
+.It Fn S_ISLNK m
+Test for a symbolic link.
+.It Fn S_ISREG m
+Test for a regular file.
+.It Fn S_ISSOCK m
+Test for a socket.
+.It Fn S_ISWHT m
+Test for a whiteout.
+.El
+.Pp
+The macros evaluate to a non-zero value if the test is true
+or to the value 0 if the test is false.
 .Sh RETURN VALUES
 .Rv -std
 .Sh COMPATIBILITY
@@ -302,6 +302,8 @@ MakeDev(struct chunk *c1, const char *path)
 	cmaj = 102, p += 3;
    else if (!strncmp(p, "idad", 4))
 	cmaj = 109, p += 4;
+    else if (!strncmp(p, "ipsd", 4))
+	cmaj = 176, p += 4;
    else if (!strncmp(p, "mlxd", 4))
 	cmaj = 131, p += 4;
    else if (!strncmp(p, "amrd", 4))
@@ -488,7 +488,7 @@ Collapse_Disk(struct disk *d)
 #ifdef PC98
 static char * device_list[] = {"wd", "aacd", "ad", "da", "afd", "fla", "idad", "mlxd", "amrd", "twed", "ar", "fd", 0};
 #else
-static char * device_list[] = {"aacd", "ad", "da", "afd", "fla", "idad", "mlxd", "amrd", "twed", "ar", "fd", 0};
+static char * device_list[] = {"aacd", "ad", "da", "afd", "fla", "idad", "ipsd", "mlxd", "amrd", "twed", "ar", "fd", 0};
 #endif

 int qstrcmp(const void* a, const void* b) {
@@ -39,7 +39,6 @@ sed	\
 	-e '/	sf	/d' \
 	-e '/	sis	/d' \
 	-e '/	ste	/d' \
-	-e '/	wx	/d' \
 	-e '/gzip/d' \
 	-e '/	sl	/d' \
 	-e '/ppp/d' \
@@ -35,3 +35,4 @@

 #drv	filename	floppy	type	description
 txp	if_txp		2	network	"3Com 3XP Typhoon/Sidewinder (3CR990) NIC"
+em	if_em		2	network "Intel PRO/1000 adapter Gigabit Ethernet Card (``Wiseman'')"
@@ -11,17 +11,10 @@
 -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
-<!ENTITY % trademarks PUBLIC "-//FreeBSD//ENTITIES DocBook Trademark Entities//EN">
-%trademarks;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
-
 ]>

 <article>
@@ -47,6 +40,7 @@
      <year>2002</year>
      <year>2003</year>
      <year>2004</year>
+      <year>2005</year>
      <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
    </copyright>

@@ -139,36 +133,7 @@
 ]]>

 <![ %release.type.snapshot [
-
-    <para>(20 May 2004) A security problem was discovered
-      in <application>CVS</application> but the release notes
-      did not state that since it was very late in the release cycle.
-      &os; &release.prev; includes a fix for it and is not vulnerable.
-      For the details, see the security advisory
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc">FreeBSD-SA-04:10</ulink>.</para>
-
-    <para>(23 May 2004) As a side effect of closing a security problem
-      related to &man.msync.2;, the <literal>MS_INVALIDATE</literal>
-      flag no longer guarantees that all pages in the range are
-      invalidated.  This can cause problems when pages are backed by a remote file
-      (e.g. via NFS) where other machines can write to the permanent storage since
-      the local pages not being invalidated might then contain stale data.  The
-      security problem being addressed is a strictly local exploit, and only
-      allows a local user to block the writing of data to a file under certain
-      circumstances.  Users who require the old semantics of
-      <literal>MS_INVALIDATE</literal> and are not concerned with
-      the security issue being fixed can set the
-      <literal>vm.old_msync</literal> sysctl to <literal>1</literal>
-      which will revert to the old (insecure) behavior.</para>
-
-    <para>(25 May 2004) The &man.twe.4; driver was recently updated by the
-      vendor.  Problems have been reported in rare circumstances under
-      conditions that are hard to reproduce.  Work is ongoing to isolate
-      these problems and determine their source.</para>
-
-    <para>(27 May 2004) The &man.bfe.4; driver for Broadcom BCM4401
-      based Fast Ethernet adapters has been added but the release notes
-      did not mention that.</para>
+    <para>No news.</para>
 ]]>
  </sect1>
 </article>
@@ -1,12 +1,8 @@
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
 <!ENTITY % sections SYSTEM "../common/hw.ent"> %sections;
@@ -176,17 +176,15 @@
    that can boot from IDE disks and CDROMs. Check the machine
    specific section for details.</para>

-    <para>&os; 4.0 and later can be booted from the
-    distribution CDROM.  Earlier versions needed booting from a
-    2 disk floppy set.</para>
-
    <para>In order to be bootable the root partition (partition a)
    must be at offset 0 of the disk drive. This means you have to 
    use the installer's partitioning menu and start with assigning 
    partition a at offset 0 to the root partition. Subsequently layout
    the rest of the partitions to your liking. If you do not adhere
    to this rule the install will proceed just fine, but the system
-    will not be bootable from the freshly installed disk.</para>
+    will not be bootable from the freshly installed disk.  Note that fdisk
+    is not used on &os; running on Alpha, disks are directly
+    labeled using disklabel.</para>

    <para>If you don't have/want a local disk drive you can boot via
    the Ethernet.  This assumes an Ethernet adapter/chip that is
@@ -1709,7 +1707,10 @@ cd0: 250.000MB/s transfers (250.000MHz, offset 12)</programlisting>
  
      <para>AS600 has one Qlogic SCSI chip dedicated to the internal devices 
      whereas the other Qlogic SCSI chip is dedicated to external SCSI devices.
-      </para>
+      Keep the card, which apart from the two SCSI interfaces also houses 
+      the Ethernet chip by the way, in the DEC-recommended, topmost, 32bit 
+      PCI slot. You get machine checks if you plug it into one of the 64 bit
+      slots.</para>
  
      <para>In AS500 DIMMs are installed in sets of 4, in <quote>physically 
      interleaved</quote> layout. So, a bank of 4 DIMMs is <emphasis>not</emphasis>
@@ -11,6 +11,7 @@
    <year>2002</year>
    <year>2003</year>
    <year>2004</year>
+    <year>2005</year>
    <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
  </copyright>
 </articleinfo>
@@ -1,12 +1,8 @@
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
 <!ENTITY % sections SYSTEM "../common/hw.ent"> %sections;
@@ -1,12 +1,8 @@
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
 <!ENTITY % sections SYSTEM "../common/install.ent"> %sections;
@@ -1,12 +1,8 @@
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
 <!ENTITY % sections SYSTEM "../common/install.ent"> %sections;
@@ -1,14 +1,8 @@
 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
-<!ENTITY % misc PUBLIC  "-//FreeBSD//ENTITIES DocBook Miscellaneous FreeBSD Entities//EN">
-%misc;
 ]>

 <article>
@@ -25,6 +19,7 @@
      <year>2002</year>
      <year>2003</year>
      <year>2004</year>
+      <year>2005</year>
      <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
    </copyright>
  </articleinfo>
@@ -1,12 +1,8 @@
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
 <!ENTITY % sections SYSTEM "../common/relnotes.ent"> %sections;
@@ -3,7 +3,7 @@

  <pubdate>$FreeBSD$</pubdate>

-  <corpauthor>The FreeBSD Project</corpauthor>
+  <corpauthor>The &os; Project</corpauthor>

  <copyright>
    <year>2000</year>
@@ -11,7 +11,8 @@
    <year>2002</year>
    <year>2003</year>
    <year>2004</year>
-    <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
+    <year>2005</year>
+    <holder role="mailto:[email protected]">The &os; Documentation Project</holder>
  </copyright>

  <abstract>
@@ -59,7 +60,7 @@
 </sect1>

 <!--
-	The "What's New" section of the release notes. 
+	The "What's New" section of the release notes.

 	Guidelines for new entries:

@@ -91,49 +92,99 @@
  <sect2 id="security">
    <title>Security Advisories</title>

-    <para></para>
+    <para>A programming error in the &os; Linux binary
+      compatibility which allows a local attacker to read
+      or write portions of the kernel memory has been fixed.
+      For more details, see security advisory
+      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:13.linux.asc">FreeBSD-SA-04:13.linux</ulink>.</para>

+    <para>Various remotely-exploitable vulnerabilities of
+      <application>CVS</application>'s server mode including double-free,
+      integer overflow, and buffer overflow which can result
+      in information disclosure, denial-of-service, and/or possibly
+      arbitrary code execution, have been fixed via an upgrade
+      to <application>CVS</application> 1.11.17.
+      For more details, see security advisory
+      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc">FreeBSD-SA-04:14</ulink>.</para>
+
+    <para>A bug in the &man.fetch.1; utility which allows
+      a malicious HTTP server to cause arbitrary portions of the client's
+      memory to be overwritten, has been fixed.
+      For more information, see security advisory
+      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:16.fetch.asc">FreeBSD-SA-04:16</ulink>.</para>
+
+    <para>A bug in &man.procfs.5; and &man.linprocfs.5;
+      which could cause a malicious local user could perform a local
+      denial of service attack by causing a system panic, or the user
+      could read parts of kernel memory, has been fixed.
+      For more information, see security advisory
+      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:17.procfs.asc">FreeBSD-SA-04:17</ulink>.</para>
  </sect2>

  <sect2 id="kernel">
    <title>Kernel Changes</title>

    <para arch="i386">The &man.cp.4; driver has been added for Cronyx Tau-PCI
-      synchronous serial adapters.
-    </para>
+      synchronous serial adapters.</para>
+
+    <para arch="alpha">The &man.em.4; driver has been added to the kernel
+      on the installation media.</para>

    <para>A bug in &man.mmap.2; that pages marked as <literal>PROT_NONE</literal>
      may become readable under certain circumstances, has been fixed.</para>

+    <para>Bugs in <function>vm_object_madvise()</function>,
+      <function>vm_object_sync()</function>, and
+      <function>contigmalloc()</function>
+      functions in the &os; virtual memory subsystem have been fixed.
+      The bugs in <function>vm_object_madvise()</function>
+      and <function>vm_object_sync()</function> could
+      cause memory corruption in a variety of contexts, and
+      one in <function>contigmalloc()</function>
+      could cause a system panic.</para>
+
 <!-- Above this line, kernel changes ordered by manpage/variable name -->

    <sect3 id="proc">
      <title>Platform-Specific Hardware Support</title>

+      <para arch="i386">The &man.pbio.4; driver,
+	which supports direct access to
+	the Intel 8255A programmable peripheral interface (PPI)
+	chip running in mode 0 (simple I/O) has been added.</para>
+
      <para arch="alpha">Support for the floppy interface is broken on
        DS10-class systems.  The kernel probes the hardware correctly but
-        the floppy does not work properly.  Booting and installing from 
+        the floppy does not work properly.  Booting and installing from
        floppies is not affected.
      </para>

    </sect3>

-    <sect3 id="boot">
-      <title>Boot Loader Changes</title>
-
-      <para></para>
-
-<!-- Above this line, order boot loader changes by manpage/variable name-->
-
-    </sect3>
-
    <sect3 id="net-if">
      <title>Network Interface Support</title>

+      <para>The &man.axe.4; driver, which supports
+	ASIX Electronics AX88172 USB 2.0 Ethernet chipset
+	has been added.</para>
+
+      <para>The &man.bge.4; driver now supports BCM5750
+	and BCM5751.</para>
+
+      <para>The &man.em.4; driver now supports 82541ER and 82546GB
+	dual port PCI Express adapter.</para>
+
+      <para>The &man.ixgb.4; driver, which supports PCI Gigabit
+	Ethernet adapters based on the Intel 82597EX Ethernet
+	controller chips, has been added.</para>
+
      <para>The &man.ng.hub.4; Netgraph node type, which supports
        a simple packet distribution that acts like an Ethernet hub
        has been added.</para>

+      <para>A bug of jumbo frame handling in the &man.sk.4; driver
+	has been fixed.</para>
+
      <para>The &man.vr.4; driver now supports &man.polling.4;.</para>

      <para>The per-interface &man.polling.4; support has been
@@ -143,6 +194,11 @@
 	now also support this capability and it can be controlled
 	via &man.ifconfig.8;.</para>

+      <para>A system panic which occurs
+	when <varname>net.inet.ip.rtexpire</varname> and/or
+	<varname>net.inet6.ip6.rtexpire</varname> are set to
+	<literal>0</literal> has been fixed.
+
 <!-- Above this line, order network driver changes by manpage/variable name-->

    </sect3>
@@ -153,39 +209,53 @@
      <para>The random ephemeral port allocation, which come from OpenBSD
 	has been implemented.  This is enabled by default and can be disabled
 	using the <varname>net.inet.ip.portrange.randomized</varname>
-	sysctl.</para>
+	sysctl.  Note that the randomization can lead to extremely
+	fast port reuse at high connection rates, which is causing
+	problems for some users.  To retain the security advantage
+	of random ports and ensure correct operation, it is disabled
+	during periods of high connection rates.
+	More specifically, when the connection rate exceeds
+	the value of the <varname>net.inet.ip.portrange.randomcps</varname> sysctl
+	(<literal>10</literal> by default), the randomization will be disabled for
+	seconds specified in the
+	<varname>net.inet.ip.portrange.randomtime</varname> sysctl
+	(<literal>45</literal> by default).</para>

      <para>&man.ipfw.4; now supports lookup tables.  This feature is
        useful for handling large sparse address sets.</para>

+      <para>&man.ipnat.8; now allows redirect rules to work for
+	non-TCP/UDP packets.</para>
+
+      <para>The <literal>RST</literal>
+	handling of the &os; TCP stack has been improved
+	to make reset attacks as difficult as possible while
+	maintaining compatibility with the widest range of TCP stacks.
+	The algorithm is as follows.  For connections in the
+	<literal>ESTABLISHED</literal>
+	state, only resets with sequence numbers exactly matching
+	<varname>last_ack_sent</varname> will cause a reset,
+	all other segments will
+	be silently dropped. For connections in all other states,
+	a reset anywhere in the window will cause the connection
+	to be reset.  All other segments will be silently dropped.
+	Note that this breaks the RFC 793 specification and you
+	can still disable this and use the conventional behavior
+	by setting a new sysctl <varname>net.inet.tcp.insecure_rst</varname>
+	to <literal>1</literal>.</para>
    </sect3>

    <sect3 id="disks">
      <title>Disks and Storage</title>

-      <para></para>
+      <para>The &man.ips.4; driver, which supports IBM/Adaptec ServeRAID controller
+	has been added.</para>

-    </sect3>
-
-    <sect3 id="fs">
-      <title>File Systems</title>
-
-      <para></para>
-
-    </sect3>
-
-    <sect3 id="pccard">
-      <title>PCCARD Support</title>
-
-      <para></para>
-
-    </sect3>
-
-    <sect3 id="mm">
-      <title>Multimedia Support</title>
-
-      <para></para>
+      <para>The &man.mpt.4; driver now supports LSI Logic FC929X
+	Dual 2Gb/s Fibre Channel card.</para>

+      <para>The &man.trm.4; driver now supports the DC395U2W adapters
+	and problems under heavy load have been fixed.</para>
    </sect3>
  </sect2>

@@ -194,17 +264,31 @@

    <para>The &man.cron.8 daemon now accepts two new options,
      <option>-j</option> and <option>-J</option>, to enable
-      time jitter for jobs to run as unpriviliged users and the
+      time jitter for jobs to run as unprivileged users and the
      superuser, respectively.  Time jitter means that &man.cron.8
      will sleep for a small random period of time in the specified
      range before executing a job.  This feature is intended to
      smooth load peaks appearing when a lot of jobs are scheduled
      for a particular moment.</para>

-      <para>The LQM, Link Quality Monitoring support in &man.ppp.8;
-	has been reimplemented.  The LQM, which is described
-	in RFC 1989, allows PPP to keep track of the quality
-	of a running connection.</para>
+    <para>The &man.fwcontrol.8; now supports a <option>-m</option>
+      option to set the default <literal>fwmem</literal> target.</para>
+
+    <para>The <option>-C 60</option> option is now used
+      in the default <varname>$inetd_flags</varname> variable
+      in <filename>/etc/rc.conf</filename>.</para>
+
+    <para>The <application>libc</application> now supports
+      &man.eui64.3; functions.</para>
+
+    <para>The &man.ngctl.8; now supports <command>dot</command> command to
+      produce a <application>GraphViz</application> (.dot)
+      of the entire Netgraph.</para>
+
+    <para>The LQM, Link Quality Monitoring support in &man.ppp.8;
+      has been reimplemented.  The LQM, which is described
+      in RFC 1989, allows PPP to keep track of the quality
+      of a running connection.</para>

    <para>The userland &man.ppp.8; implementation now supports a <quote>set rad_alive
 	<replaceable>N</replaceable></quote> command
@@ -214,6 +298,18 @@
    <para>A bug in &man.rarpd.8; that prevents it from working properly
      when a interface has more than one IP address has been fixed.</para>

+    <para>&man.syslogd.8; now supports <literal>LOG_NTP</literal>
+      facility.</para>
+
+    <para>Several off-by-one errors and potential buffer
+      overruns in &man.pax.1; have been fixed.</para>
+
+    <para>&man.whois.1; now supports NORID (Norwegian top level registry)
+      handles, the German whois nameserver, and a <option>-k</option> flag
+      for querying <hostid role="fqdn">whois.krnic.net</hostid>
+      (the National Internet Development Agency of Korea)
+      which hold details of IP address allocations within Korea.</para>
+
 <!-- Above this line, order userland changes by manpage/variable name-->

  </sect2>
@@ -221,23 +317,49 @@
  <sect2 id="contrib">
    <title>Contributed Software</title>

-    <para><application>sendmail</application> has been updated from 
-      version 8.12.11 to version 8.13.1.</para> 
+    <para><application>CVS</application> has been updated from
+      version 1.11.5 to version 1.11.17.</para>

-  </sect2>
+    <para><application>sendmail</application> has been updated from
+      version 8.12.11 to version 8.13.1.</para>

-  <sect2 id="ports">
-    <title>Ports/Packages Collection Infrastructure</title>
-
-    <para></para>
+    <para><application>GNU patch</application> source files in
+      <filename>src/contrib/patch</filename> has been removed.
+      &os; have used the &man.patch.1; sources
+      in <filename>src/gnu/usr.bin/patch</filename> for nearly seven years.</para>

+    <para>The timezone database has been updated from the
+      <application>tzdata2004e</application> release to the
+      <application>tzdata2004g</application> release.</para>
  </sect2>

  <sect2 id="releng">
    <title>Release Engineering and Integration</title>

-    <para></para>
+    <para>The supported release of <application>GNOME</application>
+      has been updated from 2.6 to 2.8.2.
+      The list of changes for each component can be found at
+      <ulink url="http://mail.gnome.org/archives/gnome-announce-list/2004-December/msg00026.html">
+	http://mail.gnome.org/archives/gnome-announce-list/2004-December/msg00026.html</ulink>.</para>

+    <para>The supported release of <application>KDE</application>
+      has been updated from 3.2.2 to 3.3.2.</para>
+
+    <para>The supported userland package for Linux binary compatibility
+      has been updated from <filename role="package">linux_base-6</filename>
+      (based on Red Hat Linux 7.1)
+      to <filename role="package">linux_base-8</filename>
+      (based on Red Hat Linux 8.0).</para>
+
+    <para>The supported release of <application>X Window System</application>
+      has been updated to <application>XFree86</application> 4.4.0.
+      Note that Xorg X11R6.8.1 is also available in the FreeBSD Ports Collection
+      (<filename role="package">x11/xorg</filename>).</para>
+
+    <para>The <varname>NOSECURE</varname> variable in <filename>make.conf</filename>
+      has been removed because it is broken and no longer supported.
+      If you had been using the <varname>NOSECURE</varname>,
+      please now use the <varname>NOCRYPT</varname> instead.</para>
  </sect2>
 </sect1>

@@ -298,4 +420,3 @@
      files.</para>
  </important>
 </sect1>
-