o Merge FreeBSD-SA-06:14.fpu.

Approved by:	so (cperciva)

Makefile.inc1

@@ -531,7 +531,7 @@ update:
 	@echo "--------------------------------------------------------------"
 	@echo ">>> Updating ${.CURDIR} from cvs repository" ${CVSROOT}
 	@echo "--------------------------------------------------------------"
-	cd ${.CURDIR}; cvs -q update -rRELENG_4 -P -d
+	cd ${.CURDIR}; cvs -q update -rRELENG_4_8 -P -d
 .endif
 
 #

UPDATING

@@ -8,6 +8,176 @@ A reverse chronology since 4.0 was released is included, followed by
 the common items quick how-tos, followed by entries for versions of
 -current prior to 4.0 Release.
 
+This is for the 4.8 release branch.  All entries since 4.8 are an
+itemized list of commits to this branch, numbered from the beginning.
+
+The security advisories related to various patches contain information
+on how to build/install a minimal set of binaries and start/stop a
+minimal number of processes, if possible, for that patch.  For those
+updates that don't have an advisory, or to be safe, you can do a full
+build and install as described in the COMMON ITEMS section.
+
+20060421:	p40	FreeBSD-SA-06:14.fpu
+	Correct a local information leakage bug affecting AMD FPUs.
+
+20060323:	p39	FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie
+	Add missing code needed for the detection of IPSec packet
+	replays. [06:11]
+
+	Correctly identify the user running opiepasswd(1) when the login
+	name differs from the account name. [06:12]
+
+20060302:	p38	FreeBSD-SA-06:10.nfs
+	Correct a remote kernel panic when processing zero-length RPC
+	records via TCP.
+
+20060118:	p37	FreeBSD-SA-06:01.texindex, FreeBSD-SA-06:02.ee,
+			FreeBSD-SA-06:03.cpio
+	Correct insecure temporary file usage in texindex. [06:01]
+
+	Correct insecure temporary file usage in ee. [06:02]
+
+	Correct a race condition when setting file permissions,
+	sanitize file names by default, and fix a buffer overflow
+	when handling files larger than 4GB in cpio. [06:03]
+
+20051013:	p36	FreeBSD-SA-05:21.openssl
+	Correct a man-in-the-middle SSL version rollback vulnerability.
+
+20050910:	p35	FreeBSD-SA-05:20.cvsbug
+	Correct insecure temporary file usage.
+
+20050702:	p34	FreeBSD-SA-05:14.bzip2, FreeBSD-SA-05:15.tcp
+	Correct bzip2 denial of service and permission race vulnerabilities.
+
+	Correct TCP connection stall denial of service vulnerabilities.
+
+20050610:	p33	FreeBSD-SA-05:11.gzip
+	Correct directory traversal and race condition vulnerabilities in gzip.
+
+20050512:	p32	FreeBSD-SA-05:06.iir, FreeBSD-SA-05:07.ldt,
+			FreeBSD-SA-05:08.kmem
+	Correct overly liberal permissions on /dev/iir.
+
+	Correctly validate inputs to the i386_get_ldt syscall.
+
+	Correct several local kernel memory disclosure bugs.
+
+20050426:	p31	FreeBSD-SA-05:05.cvs
+	Correct several vulnerabilities in CVS.
+
+20050421:	p30	FreeBSD-SA-05:04.ifconf
+	Zero a buffer in ifconf() in order to avoid accidental
+	disclosure of kernel memory to userland.
+
+20050404:	p29	FreeBSD-SA-05:02.sendfile
+	Correct kernel memory disclosure bug in sendfile(2).
+
+20050328:	p28	FreeBSD-SA-05:01.telnet
+	Correct buffer overflows in telnet(1).
+
+20041201:	p27	FreeBSD-SA-04:17.procfs
+	Fix a tainted pointer dereference in procfs(5) and linprocfs(5)
+	which could allow a local attacker to panic a system and/or read
+	from kernel memory.
+
+20041118:	p26	FreeBSD-SA-04:16.fetch
+	Correct a buffer overflow in fetch(1) which could allow a
+	mallicious server to execute arbitrary code on the client.
+
+20040919:	p25	FreeBSD-SA-04:14.cvs
+	Correct several vulnerabilities in CVS (CAN-2004-0414,
+	CAN-2004-0416, CAN-2004-0417, CAN-2004-0418, CAN-2004-0778).
+
+20040630:	p24	FreeBSD-SA-04:13.linux
+	Correct an input validation error in the linux binary
+	compatibility code.
+
+20040607:	p23	FreeBSD-SA-04:12.jailroute
+	Correct a user validation error which could allow a jailed
+	super-user to manipulate routing tables.
+
+20040526:	p22	FreeBSD-SA-04:11.msync
+	Fix a bug in msync(2) which could cause it to discard dirty
+	pages.
+
+	NOTE: In some cases involving NFS, the incorrect behaviour may
+	actually be preferrable.  Setting the vm.old_msync sysctl
+	variable to 1 will revert msync(2) to its old behaviour.
+
+20040519:       p21	FreeBSD-SA-04:10.cvs
+	Correct a heap overflow in cvs's pserver protocol parser.
+
+20040505:	p20	FreeBSD-SA-04:09.kadmind
+	Correct a heap buffer overflow in k5admind's Kerberos IV support.
+
+20040505:	p19	FreeBSD-SA-04:08.heimdal
+	Correctly validate the transited field in Kerberos tickets.
+
+20040415:       p18      FreeBSD-SA-04:07.cvs
+	Correct some path validation errors in CVS.
+
+20040317:	p17	FreeBSD-SA-04:05.openssl
+	Correct a denial-of-service vulnerability in OpenSSL.
+
+20040302:	p16	FreeBSD-SA-04:04.tcp
+	Limit TCP segment reassembly queue size.
+
+20040205:	p15	FreeBSD-SA-04:02.shmat
+	Correct a reference counting bug in shmat(2).
+
+20040202:
+	Fixed a syntax issue in gensetdefs(8) sources which tripped up
+	newer compilers.  This has no impact on security, but allows
+	cross-building 4.8 on a 5.x system.
+
+20031126:	p14	FreeBSD-SA-03:19.bind
+	Corrected remote denial-of-service vulnerability in named(8).
+
+20031003:	p13	FreeBSD-SA-03:18.openssl
+	Corrected vulnerabilities in OpenSSL ASN.1 parsing.
+
+20031003:	p12	FreeBSD-SA-03:17.procfs
+	Correct integer underflows/overflows in procfs(5) and linprocfs(5).
+
+20031002:	p11	FreeBSD-SA-03:16.filedesc
+	Correct a reference counting bug in readv(2).
+
+20030924:	p10	FreeBSD-SA-03:14.arp
+	Updated fix for arplookup bug.
+
+20030924:       p9	FreeBSD-SA-03:15.openssh
+	Fix PAM-related bugs in OpenSSH's challenge/response code.
+
+20030923:	p8	FreeBSD-SA-03:14.arp
+	Fix a bug in arplookup(), whereby a hostile party on a locally
+	attached network could exhaust kernel memory, and cause a system
+	panic, by sending a flood of spoofed ARP requests.
+
+20030917:	p7	FreeBSD-SA-03:13.sendmail
+	Fix another address parsing buffer overflow.
+
+20030916:	p6	FreeBSD-SA-03:12.openssh
+	Follow-up fixes for OpenSSH oversized packet buffer handling.
+
+20030916:	p5	FreeBSD-SA-03:12.openssh
+	OpenSSH oversized packet buffer handling corrected.
+
+20030825:	p4	FreeBSD-SA-03:11.sendmail
+	Sendmail DNS map problem corrected.
+
+20030810:	p3	FreeBSD-SA-03:10.iBCS2
+	iBCS2 system call translator for statfs leaked information.
+
+20030810:	p2	FreeBSD-SA-03:09.signal
+	Repair range-checking errors in signal handling.
+
+20030804:	p1	FreeBSD-SA-03:08.realpath
+	Correct a single byte buffer overflow in realpath(3).
+
+20030403:
+	FreeBSD 4.8-RELEASE.
+
 20030214:
 	OpenSSL 0.97 has been imported, and the libcrypto/libssl
 	library versions have been bumped.

contrib/bind/Version

@@ -1 +1 @@
-8.3.4-REL
+8.3.4-REL-p1

contrib/bind/bin/named/ns_resp.c

@@ -272,7 +272,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 	u_int qtype, qclass;
 	int restart;	/* flag for processing cname response */
 	int validanswer, dbflags;
-	int cname, lastwascname, externalcname;
+	int cname, lastwascname, externalcname, cachenegative;
 	int count, founddata, foundname;
 	int buflen;
 	int newmsglen;
@@ -912,6 +912,7 @@ tcp_retry:
 	cname = 0;
 	lastwascname = 0;
 	externalcname = 0;
+	cachenegative = 1;
 	strcpy(aname, qname);
 
 	if (count) {
@@ -981,6 +982,7 @@ tcp_retry:
 						 name);
 				db_detach(&dp);
 				validanswer = 0;
+				cachenegative = 0;
 				continue;
 			}
 			if (type == T_CNAME &&
@@ -1011,6 +1013,7 @@ tcp_retry:
 				 "last was cname, ignoring auth. and add.");
 				db_detach(&dp);
 				validanswer = 0;
+				cachenegative = 0;
 				break;
 			}
 			if (i < arfirst) {
@@ -1026,6 +1029,7 @@ tcp_retry:
 							sin_ntoa(from));
 						db_detach(&dp);
 						validanswer = 0;
+						cachenegative = 0;
 						continue;
 					} else if (!ns_samedomain(name,
 							       qp->q_domain)) {
@@ -1039,6 +1043,7 @@ tcp_retry:
 							 sin_ntoa(from));
 						db_detach(&dp);
 						validanswer = 0;
+						cachenegative = 0;
 						continue;
 					}
 					if (type == T_NS) {
@@ -1231,8 +1236,9 @@ tcp_retry:
 	     )
 	    )
 	{
-		cache_n_resp(msg, msglen, from, qp->q_name,
-			     qp->q_class, qp->q_type);
+		if (cachenegative)
+			cache_n_resp(msg, msglen, from, qp->q_name,
+				     qp->q_class, qp->q_type);
 
 		if (!qp->q_cmsglen && validanswer) {
 			ns_debug(ns_log_default, 3,

contrib/bzip2/bzip2.c

@@ -312,6 +312,7 @@ static void    compressedStreamEOF   ( void )    NORETURN;
 
 static void    copyFileName ( Char*, Char* );
 static void*   myMalloc     ( Int32 );
+static int     applySavedFileAttrToOutputFile ( int fd );
 
 
 
@@ -457,6 +458,10 @@ void compressStream ( FILE *stream, FILE *zStream )
    ret = fflush ( zStream );
    if (ret == EOF) goto errhandler_io;
    if (zStream != stdout) {
+      int fd = fileno ( zStream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
       ret = fclose ( zStream );
       outputHandleJustInCase = NULL;
       if (ret == EOF) goto errhandler_io;
@@ -525,6 +530,7 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
    UChar   obuf[5000];
    UChar   unused[BZ_MAX_UNUSED];
    Int32   nUnused;
+   void*   unusedTmpV;
    UChar*  unusedTmp;
 
    nUnused = 0;
@@ -554,9 +560,10 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
       }
       if (bzerr != BZ_STREAM_END) goto errhandler;
 
-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
       if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );
 
+      unusedTmp = (UChar*)unusedTmpV;
       for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
 
       BZ2_bzReadClose ( &bzerr, bzf );
@@ -567,6 +574,12 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
 
    closeok:
    if (ferror(zStream)) goto errhandler_io;
+   if ( stream != stdout) {
+      int fd = fileno ( stream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
+   }
    ret = fclose ( zStream );
    if (ret == EOF) goto errhandler_io;
 
@@ -639,6 +652,7 @@ Bool testStream ( FILE *zStream )
    UChar   obuf[5000];
    UChar   unused[BZ_MAX_UNUSED];
    Int32   nUnused;
+   void*   unusedTmpV;
    UChar*  unusedTmp;
 
    nUnused = 0;
@@ -662,9 +676,10 @@ Bool testStream ( FILE *zStream )
       }
       if (bzerr != BZ_STREAM_END) goto errhandler;
 
-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
       if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );
 
+      unusedTmp = (UChar*)unusedTmpV;
       for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
 
       BZ2_bzReadClose ( &bzerr, bzf );
@@ -1125,7 +1140,7 @@ void saveInputFileMetaInfo ( Char *srcName )
 
 
 static 
-void applySavedMetaInfoToOutputFile ( Char *dstName )
+void applySavedTimeInfoToOutputFile ( Char *dstName )
 {
 #  if BZ_UNIX
    IntNative      retVal;
@@ -1134,16 +1149,26 @@ void applySavedMetaInfoToOutputFile ( Char *dstName )
    uTimBuf.actime = fileMetaInfo.st_atime;
    uTimBuf.modtime = fileMetaInfo.st_mtime;
 
-   retVal = chmod ( dstName, fileMetaInfo.st_mode );
-   ERROR_IF_NOT_ZERO ( retVal );
-
    retVal = utime ( dstName, &uTimBuf );
    ERROR_IF_NOT_ZERO ( retVal );
+#  endif
+}
 
-   retVal = chown ( dstName, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
+static 
+int applySavedFileAttrToOutputFile ( int fd )
+{
+#  if BZ_UNIX
+   IntNative      retVal;
+
+   retVal = fchmod ( fd, fileMetaInfo.st_mode );
+   if (retVal != 0)
+       return retVal;
+
+   (void) fchown ( fd, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
    /* chown() will in many cases return with EPERM, which can
       be safely ignored.
    */
+   return 0;
 #  endif
 }
 
@@ -1366,7 +1391,7 @@ void compress ( Char *name )
 
    /*--- If there was an I/O error, we won't get here. ---*/
    if ( srcMode == SM_F2F ) {
-      applySavedMetaInfoToOutputFile ( outName );
+      applySavedTimeInfoToOutputFile ( outName );
       deleteOutputOnInterrupt = False;
       if ( !keepInputFiles ) {
          IntNative retVal = remove ( inName );
@@ -1544,7 +1569,7 @@ void uncompress ( Char *name )
    /*--- If there was an I/O error, we won't get here. ---*/
    if ( magicNumberOK ) {
       if ( srcMode == SM_F2F ) {
-         applySavedMetaInfoToOutputFile ( outName );
+         applySavedTimeInfoToOutputFile ( outName );
          deleteOutputOnInterrupt = False;
          if ( !keepInputFiles ) {
             IntNative retVal = remove ( inName );

contrib/bzip2/bzlib.c

@@ -574,8 +574,11 @@ int BZ_API(BZ2_bzDecompressInit)
 
 
 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_FAST ( DState* s )
+Bool unRLE_obuf_to_output_FAST ( DState* s )
 {
    UChar k1;
 
@@ -584,7 +587,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -594,10 +597,13 @@ void unRLE_obuf_to_output_FAST ( DState* s )
             s->strm->total_out_lo32++;
             if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
          }
-   
+
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
                
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -667,6 +673,10 @@ void unRLE_obuf_to_output_FAST ( DState* s )
                cs_avail_out--;
             }
          }   
+         /* Only caused by corrupt data stream? */
+         if (c_nblock_used > s_save_nblockPP)
+            return True;
+
          /* can a new run be started? */
          if (c_nblock_used == s_save_nblockPP) {
             c_state_out_len = 0; goto return_notr;
@@ -712,6 +722,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
       s->strm->avail_out    = cs_avail_out;
       /* end save */
    }
+   return False;
 }
 
 
@@ -732,8 +743,11 @@ __inline__ Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab )
 
 
 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_SMALL ( DState* s )
+Bool unRLE_obuf_to_output_SMALL ( DState* s )
 {
    UChar k1;
 
@@ -742,7 +756,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -754,8 +768,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
          }
    
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
-               
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -788,7 +805,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -800,7 +817,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
          }
    
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -830,6 +851,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
 /*---------------------------------------------------*/
 int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
 {
+   Bool    corrupt;
    DState* s;
    if (strm == NULL) return BZ_PARAM_ERROR;
    s = strm->state;
@@ -840,12 +862,13 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
       if (s->state == BZ_X_IDLE) return BZ_SEQUENCE_ERROR;
       if (s->state == BZ_X_OUTPUT) {
          if (s->smallDecompress)
-            unRLE_obuf_to_output_SMALL ( s ); else
-            unRLE_obuf_to_output_FAST  ( s );
+            corrupt = unRLE_obuf_to_output_SMALL ( s ); else
+            corrupt = unRLE_obuf_to_output_FAST  ( s );
+         if (corrupt) return BZ_DATA_ERROR;
          if (s->nblock_used == s->save_nblock+1 && s->state_out_len == 0) {
             BZ_FINALISE_CRC ( s->calculatedBlockCRC );
             if (s->verbosity >= 3) 
-               VPrintf2 ( " {0x%x, 0x%x}", s->storedBlockCRC, 
+               VPrintf2 ( " {0x%08x, 0x%08x}", s->storedBlockCRC, 
                           s->calculatedBlockCRC );
             if (s->verbosity >= 2) VPrintf0 ( "]" );
             if (s->calculatedBlockCRC != s->storedBlockCRC)
@@ -863,7 +886,7 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
          Int32 r = BZ2_decompress ( s );
          if (r == BZ_STREAM_END) {
             if (s->verbosity >= 3)
-               VPrintf2 ( "\n    combined CRCs: stored = 0x%x, computed = 0x%x", 
+               VPrintf2 ( "\n    combined CRCs: stored = 0x%08x, computed = 0x%08x", 
                           s->storedCombinedCRC, s->calculatedCombinedCRC );
             if (s->calculatedCombinedCRC != s->storedCombinedCRC)
                return BZ_DATA_ERROR;

contrib/bzip2/compress.c

@@ -488,9 +488,11 @@ void sendMTFValues ( EState* s )
       /*--
         Recompute the tables based on the accumulated frequencies.
       --*/
+      /* maxLen was changed from 20 to 17 in bzip2-1.0.3.  See 
+         comment in huffman.c for details. */
       for (t = 0; t < nGroups; t++)
          BZ2_hbMakeCodeLengths ( &(s->len[t][0]), &(s->rfreq[t][0]), 
-                                 alphaSize, 20 );
+                                 alphaSize, 17 /*20*/ );
    }
 
 
@@ -527,7 +529,7 @@ void sendMTFValues ( EState* s )
          if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
          if (s->len[t][i] < minLen) minLen = s->len[t][i];
       }
-      AssertH ( !(maxLen > 20), 3004 );
+      AssertH ( !(maxLen > 17 /*20*/ ), 3004 );
       AssertH ( !(minLen < 1),  3005 );
       BZ2_hbAssignCodes ( &(s->code[t][0]), &(s->len[t][0]), 
                           minLen, maxLen, alphaSize );
@@ -651,8 +653,8 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
       if (s->blockNo > 1) s->numZ = 0;
 
       if (s->verbosity >= 2)
-         VPrintf4( "    block %d: crc = 0x%8x, "
-                   "combined CRC = 0x%8x, size = %d\n",
+         VPrintf4( "    block %d: crc = 0x%08x, "
+                   "combined CRC = 0x%08x, size = %d\n",
                    s->blockNo, s->blockCRC, s->combinedCRC, s->nblock );
 
       BZ2_blockSort ( s );
@@ -703,7 +705,7 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
       bsPutUChar ( s, 0x50 ); bsPutUChar ( s, 0x90 );
       bsPutUInt32 ( s, s->combinedCRC );
       if (s->verbosity >= 2)
-         VPrintf1( "    final combined CRC = 0x%x\n   ", s->combinedCRC );
+         VPrintf1( "    final combined CRC = 0x%08x\n   ", s->combinedCRC );
       bsFinishWrite ( s );
    }
 }

contrib/bzip2/decompress.c

@@ -524,17 +524,23 @@ Int32 BZ2_decompress ( DState* s )
       if (s->origPtr < 0 || s->origPtr >= nblock)
          RETURN(BZ_DATA_ERROR);
 
+      /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      s->cftab[0] = 0;
+      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
+      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+      for (i = 0; i <= 256; i++) {
+         if (s->cftab[i] < 0 || s->cftab[i] > nblock) {
+            /* s->cftab[i] can legitimately be == nblock */
+            RETURN(BZ_DATA_ERROR);
+         }
+      }
+
       s->state_out_len = 0;
       s->state_out_ch  = 0;
       BZ_INITIALISE_CRC ( s->calculatedBlockCRC );
       s->state = BZ_X_OUTPUT;
       if (s->verbosity >= 2) VPrintf0 ( "rt+rld" );
 
-      /*-- Set up cftab to facilitate generation of T^(-1) --*/
-      s->cftab[0] = 0;
-      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
-      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
-
       if (s->smallDecompress) {
 
          /*-- Make a copy of cftab, used in generation of T --*/

contrib/bzip2/huffman.c

@@ -162,7 +162,24 @@ void BZ2_hbMakeCodeLengths ( UChar *len,
       
       if (! tooLong) break;
 
-      for (i = 1; i < alphaSize; i++) {
+      /* 17 Oct 04: keep-going condition for the following loop used
+         to be 'i < alphaSize', which missed the last element,
+         theoretically leading to the possibility of the compressor
+         looping.  However, this count-scaling step is only needed if
+         one of the generated Huffman code words is longer than
+         maxLen, which up to and including version 1.0.2 was 20 bits,
+         which is extremely unlikely.  In version 1.0.3 maxLen was
+         changed to 17 bits, which has minimal effect on compression
+         ratio, but does mean this scaling step is used from time to
+         time, enough to verify that it works.
+
+         This means that bzip2-1.0.3 and later will only produce
+         Huffman codes with a maximum length of 17 bits.  However, in
+         order to preserve backwards compatibility with bitstreams
+         produced by versions pre-1.0.3, the decompressor must still
+         handle lengths of up to 20. */
+
+      for (i = 1; i <= alphaSize; i++) {
          j = weight[i] >> 8;
          j = 1 + (j / 2);
          weight[i] = j << 8;

contrib/cpio/copyin.c

@@ -46,6 +46,19 @@ $FreeBSD$
 #define lchown chown
 #endif
 
+# ifndef DIRECTORY_SEPARATOR
+#  define DIRECTORY_SEPARATOR '/'
+# endif
+
+# ifndef ISSLASH
+#  define ISSLASH(C) ((C) == DIRECTORY_SEPARATOR)
+# endif
+
+# ifndef FILE_SYSTEM_PREFIX_LEN
+#  define FILE_SYSTEM_PREFIX_LEN(Filename) 0
+# endif
+
+
 static void read_pattern_file ();
 static void tape_skip_padding ();
 static void defer_copyin ();
@@ -376,6 +389,54 @@ swab_array (ptr, count)
 /* Current time for verbose table.  */
 static time_t current_time;
 
+/* Return a safer suffix of FILE_NAME, or "." if it has no safer
+   suffix.  Check for fully specified file names and other atrocities.  */
+
+static const char *
+safer_name_suffix (char const *file_name)
+{
+  char const *p;
+
+  /* Skip file system prefixes, leading file name components that contain
+     "..", and leading slashes.  */
+
+  size_t prefix_len = FILE_SYSTEM_PREFIX_LEN (file_name);
+
+  for (p = file_name + prefix_len; *p;)
+    {
+      if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
+       prefix_len = p + 2 - file_name;
+
+      do
+       {
+         char c = *p++;
+         if (ISSLASH (c))
+           break;
+       }
+      while (*p);
+    }
+
+  for (p = file_name + prefix_len; ISSLASH (*p); p++)
+    continue;
+  prefix_len = p - file_name;
+
+  if (prefix_len)
+    {
+      char *prefix = alloca (prefix_len + 1);
+      memcpy (prefix, file_name, prefix_len);
+      prefix[prefix_len] = '\0';
+
+
+      error (0, 0, "Removing leading `%s' from member names", prefix);
+    }
+
+  if (!*p)
+    p = ".";
+
+  return p;
+}
+
+
 /* Read the collection from standard input and create files
    in the file system.  */
 
@@ -396,6 +457,7 @@ process_copy_in ()
   int in_file_des;		/* Input file descriptor.  */
   char skip_file;		/* Flag for use with patterns.  */
   int existing_dir;		/* True if file is a dir & already exists.  */
+  mode_t existing_mode;
   int i;			/* Loop index variable.  */
   char *link_name = NULL;	/* Name of hard and symbolic links.  */
 #ifdef HPUX_CDF
@@ -494,18 +556,11 @@ process_copy_in ()
 
       /* Do we have to ignore absolute paths, and if so, does the filename
          have an absolute path?  */
-      if (no_abs_paths_flag && file_hdr.c_name && file_hdr.c_name [0] == '/')
+      if (!abs_paths_flag && file_hdr.c_name && file_hdr.c_name[0])
 	{
-	  char *p;
+	  const char *p = safer_name_suffix (file_hdr.c_name);
 
-	  p = file_hdr.c_name;
-	  while (*p == '/')
-	    ++p;
-	  if (*p == '\0')
-	    {
-	      strcpy (file_hdr.c_name, ".");
-	    }
-	  else
+	  if (p != file_hdr.c_name)
 	    {
 	      char *non_abs_name;
 
@@ -642,6 +697,7 @@ process_copy_in ()
 		     we are trying to create, don't complain about
 		     it.  */
 		  existing_dir = TRUE;
+		  existing_mode = file_stat.st_mode;
 		}
 	      else if (!unconditional_flag
 		       && file_hdr.c_mtime <= file_stat.st_mtime)
@@ -778,8 +834,6 @@ process_copy_in ()
 		    }
 		  copy_files_tape_to_disk (in_file_des, out_file_des, file_hdr.c_filesize);
 		  disk_empty_output_buffer (out_file_des);
-		  if (close (out_file_des) < 0)
-		    error (0, errno, "%s", file_hdr.c_name);
 
 		  if (archive_format == arf_crcascii)
 		    {
@@ -789,13 +843,15 @@ process_copy_in ()
 		    }
 		  /* File is now copied; set attributes.  */
 		  if (!no_chown_flag)
-		    if ((chown (file_hdr.c_name,
+		    if ((fchown (out_file_des,
 				set_owner_flag ? set_owner : file_hdr.c_uid,
 			   set_group_flag ? set_group : file_hdr.c_gid) < 0)
 			&& errno != EPERM)
 		      error (0, errno, "%s", file_hdr.c_name);
 		  /* chown may have turned off some permissions we wanted. */
-		  if (chmod (file_hdr.c_name, (int) file_hdr.c_mode) < 0)
+		  if (fchmod (out_file_des, (int) file_hdr.c_mode) < 0)
+		    error (0, errno, "%s", file_hdr.c_name);
+		  if (close (out_file_des) < 0)
 		    error (0, errno, "%s", file_hdr.c_name);
 		  if (retain_time_flag)
 		    {
@@ -847,14 +903,23 @@ process_copy_in ()
 		      cdf_flag = 1;
 		    }
 #endif
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      else
-		res = 0;
+		{
+		  if (!no_chown_flag && (existing_mode & 077) != 0
+		     && chmod (file_hdr.c_name, existing_mode & 07700) < 0)
+		   {
+		     error (0, errno, "%s: chmod", file_hdr.c_name);
+		     return;
+		   }
+		   res = 0;
+		}
+
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      if (res < 0)
 		{
@@ -936,20 +1001,20 @@ process_copy_in ()
 	      
 #ifdef CP_IFIFO
 	      if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 	      else
 #endif
-		res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 		      makedev (file_hdr.c_rdev_maj, file_hdr.c_rdev_min));
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
 #ifdef CP_IFIFO
 		  if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 		  else
 #endif
-		    res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		    res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 				 makedev (file_hdr.c_rdev_maj,
 					  file_hdr.c_rdev_min));
 		}
@@ -1376,18 +1441,18 @@ create_final_defers ()
 	  continue;
 	}
 
-      if (close (out_file_des) < 0)
-	error (0, errno, "%s", d->header.c_name);
-
+  
       /* File is now copied; set attributes.  */
       if (!no_chown_flag)
-	if ((chown (d->header.c_name,
+	if ((fchown (out_file_des,
 		    set_owner_flag ? set_owner : d->header.c_uid,
 	       set_group_flag ? set_group : d->header.c_gid) < 0)
 	    && errno != EPERM)
 	  error (0, errno, "%s", d->header.c_name);
       /* chown may have turned off some permissions we wanted. */
-      if (chmod (d->header.c_name, (int) d->header.c_mode) < 0)
+      if (fchmod (out_file_des, (int) d->header.c_mode) < 0)
+	error (0, errno, "%s", d->header.c_name);
+      if (close (out_file_des) < 0)
 	error (0, errno, "%s", d->header.c_name);
       if (retain_time_flag)
 	{

contrib/cpio/copyout.c

@@ -49,12 +49,13 @@ write_out_header (file_hdr, out_des)
     {
       char ascii_header[112];
       char *magic_string;
+      int ret;
 
       if (archive_format == arf_crcascii)
 	magic_string = "070702";
       else
 	magic_string = "070701";
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%6s%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx",
 	       magic_string,
 	       file_hdr->c_ino, file_hdr->c_mode, file_hdr->c_uid,
@@ -62,6 +63,10 @@ write_out_header (file_hdr, out_des)
 	     file_hdr->c_filesize, file_hdr->c_dev_maj, file_hdr->c_dev_min,
 	   file_hdr->c_rdev_maj, file_hdr->c_rdev_min, file_hdr->c_namesize,
 	       file_hdr->c_chksum);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
       tape_buffered_write (ascii_header, out_des, 110L);
 
       /* Write file name to output.  */
@@ -71,6 +76,7 @@ write_out_header (file_hdr, out_des)
   else if (archive_format == arf_oldascii || archive_format == arf_hpoldascii)
     {
       char ascii_header[78];
+      int ret;
 #ifndef __MSDOS__
       dev_t dev;
       dev_t rdev;
@@ -112,7 +118,7 @@ write_out_header (file_hdr, out_des)
       if ((file_hdr->c_ino >> 16) != 0)
 	error (0, 0, "%s: truncating inode number", file_hdr->c_name);
 
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%06o%06o%06lo%06lo%06lo%06lo%06lo%06o%011lo%06lo%011lo",
 	       file_hdr->c_magic & 0xFFFF, dev & 0xFFFF,
 	       file_hdr->c_ino & 0xFFFF, file_hdr->c_mode & 0xFFFF,
@@ -120,6 +126,10 @@ write_out_header (file_hdr, out_des)
 	       file_hdr->c_nlink & 0xFFFF, rdev & 0xFFFF,
 	       file_hdr->c_mtime, file_hdr->c_namesize & 0xFFFF,
 	       file_hdr->c_filesize);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
       tape_buffered_write (ascii_header, out_des, 76L);
 
       /* Write file name to output.  */
@@ -258,6 +268,14 @@ process_copy_out ()
 	  file_hdr.c_dev_maj = major (file_stat.st_dev);
 	  file_hdr.c_dev_min = minor (file_stat.st_dev);
 	  file_hdr.c_ino = file_stat.st_ino;
+
+	  /* Skip files larger than 4GB which will cause problems on
+	     64bit platforms (and just not work on 32bit). */
+	  if (file_stat.st_size > 0xffffffff) {
+	    error (0, 0, "%s: skipping >4GB file", input_name.ds_string);
+	    continue;
+	  }
+
 	  /* For POSIX systems that don't define the S_IF macros,
 	     we can't assume that S_ISfoo means the standard Unix
 	     S_IFfoo bit(s) are set.  So do it manually, with a

contrib/cpio/copypass.c

@@ -173,18 +173,18 @@ process_copy_pass ()
 	      disk_empty_output_buffer (out_file_des);
 	      if (close (in_file_des) < 0)
 		error (0, errno, "%s", input_name.ds_string);
-	      if (close (out_file_des) < 0)
-		error (0, errno, "%s", output_name.ds_string);
 
 	      /* Set the attributes of the new file.  */
 	      if (!no_chown_flag)
-		if ((chown (output_name.ds_string,
+		if ((fchown (out_file_des,
 			    set_owner_flag ? set_owner : in_file_stat.st_uid,
 		      set_group_flag ? set_group : in_file_stat.st_gid) < 0)
 		    && errno != EPERM)
 		  error (0, errno, "%s", output_name.ds_string);
 	      /* chown may have turned off some permissions we wanted. */
-	      if (chmod (output_name.ds_string, in_file_stat.st_mode) < 0)
+	      if (fchmod (out_file_des, in_file_stat.st_mode) < 0)
+		error (0, errno, "%s", output_name.ds_string);
+	      if (close (out_file_des) < 0)
 		error (0, errno, "%s", output_name.ds_string);
 	      if (reset_time_flag)
 		{
@@ -223,15 +223,24 @@ process_copy_pass ()
 		  cdf_flag = 1;
 		}
 #endif
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 
 	    }
 	  else
-	    res = 0;
+            {
+              if (!no_chown_flag && (out_file_stat.st_mode & 077) != 0
+                  && chmod (output_name.ds_string, out_file_stat.st_mode & 07700) < 0)
+                {
+                  error (0, errno, "%s: chmod", output_name.ds_string);
+                  continue;
+                }
+              res = 0;
+            }
+
 	  if (res < 0 && create_dir_flag)
 	    {
 	      create_all_directories (output_name.ds_string);
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 	    }
 	  if (res < 0)
 	    {
@@ -297,20 +306,20 @@ process_copy_pass ()
 	    {
 #ifdef S_ISFIFO
 	      if (S_ISFIFO (in_file_stat.st_mode))
-		res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 	      else
 #endif
-		res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 			     in_file_stat.st_rdev);
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (output_name.ds_string);
 #ifdef S_ISFIFO
 		  if (S_ISFIFO (in_file_stat.st_mode))
-		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 		  else
 #endif
-		    res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		    res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 				 in_file_stat.st_rdev);
 		}
 	      if (res < 0)

contrib/cpio/cpio.1

@@ -19,7 +19,7 @@ cpio \- copy files to and from archives
 [\-\-unconditional] [\-\-verbose] [\-\-block-size=blocks] [\-\-swap-halfwords]
 [\-\-io-size=bytes] [\-\-pattern-file=file] [\-\-format=format]
 [\-\-owner=[user][:.][group]] [\-\-no-preserve-owner] [\-\-message=message]
-[\-\-force\-local] [\-\-no\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
+[\-\-force\-local] [\-\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
 [\-\-quiet] [\-\-help] [\-\-version] [pattern...] [< archive]
 
 .B cpio
@@ -251,9 +251,9 @@ current volume number (starting at 1).
 In the verbose table of contents listing, show numeric UID and GID
 instead of translating them into names.
 .TP
-.I " \-\-no-absolute-filenames"
-In copy-in mode, create all files relative to the current directory,
-even if they have an absolute file name in the archive.
+.I " \-\-absolute-filenames"
+Do not strip leading file name components that contain ".."
+and leading slashes from file names in copy-in mode
 .TP
 .I " \-\-no-preserve-owner"
 In copy-in mode and copy-pass mode, do not change the ownership of the

contrib/cpio/extern.h

@@ -46,7 +46,7 @@ extern int no_chown_flag;
 extern int sparse_flag;
 extern int quiet_flag;
 extern int only_verify_crc_flag;
-extern int no_abs_paths_flag;
+extern int abs_paths_flag;
 
 extern int last_header_start;
 extern int copy_matching_files;

contrib/cpio/global.c

@@ -98,8 +98,8 @@ int quiet_flag = FALSE;
    actually extract the files. */
 int only_verify_crc_flag = FALSE;
 
-/* If TRUE, don't use any absolute paths, prefix them by `./'.  */
-int no_abs_paths_flag = FALSE;
+/* If TRUE, allow any absolute paths */
+int abs_paths_flag = FALSE;
 
 #ifdef DEBUG_CPIO
 /* If TRUE, print debugging information.  */

contrib/cpio/main.c

@@ -56,7 +56,7 @@ struct option long_opts[] =
   {"list", 0, &table_flag, TRUE},
   {"make-directories", 0, &create_dir_flag, TRUE},
   {"message", 1, 0, 'M'},
-  {"no-absolute-filenames", 0, 0, 136},
+  {"absolute-filenames", 0, 0, 136},
   {"no-preserve-owner", 0, 0, 134},
   {"nonmatching", 0, &copy_matching_files, FALSE},
   {"numeric-uid-gid", 0, &numeric_uid, TRUE},
@@ -105,7 +105,7 @@ Usage: %s {-o|--create} [-0acvABLV] [-C bytes] [-H format] [-M message]\n\
        [--unconditional] [--verbose] [--block-size=blocks] [--swap-halfwords]\n\
        [--io-size=bytes] [--pattern-file=file] [--format=format]\n\
        [--owner=[user][:.][group]] [--no-preserve-owner] [--message=message]\n\
-       [--force-local] [--no-absolute-filenames] [--sparse] [--only-verify-crc]\n\
+       [--force-local] [--absolute-filenames] [--sparse] [--only-verify-crc]\n\
        [--quiet] [--help] [--version] [pattern...] [< archive]\n",
 	   program_name);
   fprintf (fp, "\
@@ -266,8 +266,8 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  numeric_uid = TRUE;
 	  break;
 
-	case 136:		/* --no-absolute-filenames */
-	  no_abs_paths_flag = TRUE;
+	case 136:		/* --absolute-filenames */
+	  abs_paths_flag = TRUE;
 	  break;
 	
 	case 134:		/* --no-preserve-owner */
@@ -414,7 +414,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  || retain_time_flag || no_chown_flag || set_owner_flag
 	  || set_group_flag || swap_bytes_flag || swap_halfwords_flag
 	  || (append_flag && !(archive_name || output_archive_name))
-	  || rename_batch_file || no_abs_paths_flag
+	  || rename_batch_file || abs_paths_flag
 	  || input_archive_name || (archive_name && output_archive_name))
 	usage (stderr, 2);
       if (archive_format == arf_unknown)
@@ -429,7 +429,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
       if (argc - 1 != optind || archive_format != arf_unknown
 	  || swap_bytes_flag || swap_halfwords_flag
 	  || table_flag || rename_flag || append_flag
-	  || rename_batch_file || no_abs_paths_flag)
+	  || rename_batch_file || abs_paths_flag)
 	usage (stderr, 2);
       directory_name = argv[optind];
     }

contrib/cvs/lib/xsize.h

@@ -0,0 +1,110 @@
+/* xsize.h -- Checked size_t computations.
+
+   Copyright (C) 2003 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+#ifndef _XSIZE_H
+#define _XSIZE_H
+
+/* Get size_t.  */
+#include <stddef.h>
+
+/* Get SIZE_MAX.  */
+#include <limits.h>
+#if HAVE_STDINT_H
+# include <stdint.h>
+#else
+#define SIZE_MAX UINT_MAX /* XXX */
+#endif
+
+/* The size of memory objects is often computed through expressions of
+   type size_t. Example:
+      void* p = malloc (header_size + n * element_size).
+   These computations can lead to overflow.  When this happens, malloc()
+   returns a piece of memory that is way too small, and the program then
+   crashes while attempting to fill the memory.
+   To avoid this, the functions and macros in this file check for overflow.
+   The convention is that SIZE_MAX represents overflow.
+   malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
+   implementation that uses mmap --, it's recommended to use size_overflow_p()
+   or size_in_bounds_p() before invoking malloc().
+   The example thus becomes:
+      size_t size = xsum (header_size, xtimes (n, element_size));
+      void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
+*/
+
+/* Convert an arbitrary value >= 0 to type size_t.  */
+#define xcast_size_t(N) \
+  ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
+
+/* Sum of two sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum (size_t size1, size_t size2)
+{
+  size_t sum = size1 + size2;
+  return (sum >= size1 ? sum : SIZE_MAX);
+}
+
+/* Sum of three sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum3 (size_t size1, size_t size2, size_t size3)
+{
+  return xsum (xsum (size1, size2), size3);
+}
+
+/* Sum of four sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
+{
+  return xsum (xsum (xsum (size1, size2), size3), size4);
+}
+
+/* Maximum of two sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xmax (size_t size1, size_t size2)
+{
+  /* No explicit check is needed here, because for any n:
+     max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX.  */
+  return (size1 >= size2 ? size1 : size2);
+}
+
+/* Multiplication of a count with an element size, with overflow check.
+   The count must be >= 0 and the element size must be > 0.
+   This is a macro, not an inline function, so that it works correctly even
+   when N is of a wider tupe and N > SIZE_MAX.  */
+#define xtimes(N, ELSIZE) \
+  ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
+
+/* Check for overflow.  */
+#define size_overflow_p(SIZE) \
+  ((SIZE) == SIZE_MAX)
+/* Check against overflow.  */
+#define size_in_bounds_p(SIZE) \
+  ((SIZE) != SIZE_MAX)
+
+#endif /* _XSIZE_H */

contrib/cvs/src/client.c

@@ -1054,6 +1054,19 @@ call_in_directory (pathname, func, data)
     char *rdirp;
     int reposdirname_absolute;
 
+    /* For security reasons, if PATHNAME is absolute or attemps to ascend
+     * outside of the current sanbbox, we abort.  The server should not send us
+     * anything but relative paths which remain inside the sandbox here.
+     * Anything less means a trojan CVS server could create and edit arbitrary
+     * files on the client.
+     */
+    if (isabsolute (pathname) || pathname_levels (pathname) > 0)
+    {
+	error (0, 0,
+		"Server attempted to update a file via an invalid pathname:");
+	error (1, 0, "`%s'.", pathname);
+    }
+
     reposname = NULL;
     read_line (&reposname);
     assert (reposname != NULL);

contrib/cvs/src/commit.c

@@ -481,7 +481,12 @@ commit (argc, argv)
 	   operate on, and only work with those files in the future.
 	   This saves time--we don't want to search the file system
 	   of the working directory twice.  */
-	find_args.argv = (char **) xmalloc (find_args.argc * sizeof (char **));
+	if (size_overflow_p (xtimes (find_args.argc, sizeof (char **))))
+	{
+	    find_args.argc = 0;
+	    return 0;
+	}
+	find_args.argv = xmalloc (xtimes (find_args.argc, sizeof (char **)));
 	find_args.argc = 0;
 	walklist (find_args.ulist, copy_ulist, &find_args);
 

contrib/cvs/src/cvs.h

@@ -41,6 +41,10 @@
 #include "popen.h"
 #endif
 
+/* Begin GNULIB headers.  */
+#include "xsize.h"
+/* End GNULIB headers.  */
+
 #ifdef STDC_HEADERS
 #include <stdlib.h>
 #else

contrib/cvs/src/cvsbug.in

@@ -85,9 +85,9 @@ fi
 
 [ -z "$TMPDIR" ] && TMPDIR=/tmp
 
-TEMP=$TMPDIR/p$$
-BAD=$TMPDIR/pbad$$
-REF=$TMPDIR/pf$$
+TEMP="`/usr/bin/mktemp $TMPDIR/p.XXXXXX`"
+BAD="`/usr/bin/mktemp $TMPDIR/pbad.XXXXXX`"
+REF="`/usr/bin/mktemp $TMPDIR/pf.XXXXXX`"
 
 if [ -z "$LOGNAME" -a -n "$USER" ]; then
   LOGNAME=$USER
@@ -108,14 +108,12 @@ elif [ -f /bin/domainname ]; then
     /usr/bin/ypcat passwd 2>/dev/null | cat - /etc/passwd | grep "^$LOGNAME:" |
       cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
     ORIGINATOR="`cat $TEMP`"
-    rm -f $TEMP
   fi
 fi
 
 if [ "$ORIGINATOR" = "" ]; then
   grep "^$LOGNAME:" /etc/passwd | cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
   ORIGINATOR="`cat $TEMP`"
-  rm -f $TEMP
 fi
 
 if [ -n "$ORGANIZATION" ]; then

contrib/cvs/src/filesubr.c

@@ -988,8 +988,14 @@ expand_wild (argc, argv, pargc, pargv)
     char ***pargv;
 {
     int i;
+    if (size_overflow_p (xtimes (argc, sizeof (char *)))) {
+	*pargc = 0;
+	*pargv = NULL;
+	error (0, 0, "expand_wild: too many arguments");
+	return;
+    }
     *pargc = argc;
-    *pargv = (char **) xmalloc (argc * sizeof (char *));
+    *pargv = xmalloc (xtimes (argc, sizeof (char *)));
     for (i = 0; i < argc; ++i)
 	(*pargv)[i] = xstrdup (argv[i]);
 }

contrib/cvs/src/history.c

@@ -414,8 +414,11 @@ history (argc, argv)
 		working = 1;
 		break;
 	    case 'X':			/* Undocumented debugging flag */
+#ifdef DEBUG
 		histfile = optarg;
+#endif
 		break;
+
 	    case 'D':			/* Since specified date */
 		if (*since_rev || *since_tag || *backto)
 		{
@@ -890,9 +893,13 @@ save_user (name)
 {
     if (user_count == user_max)
     {
-	user_max += USER_INCREMENT;
-	user_list = (char **) xrealloc ((char *) user_list,
-					(int) user_max * sizeof (char *));
+	user_max = xsum (user_max, USER_INCREMENT);
+	if (size_overflow_p (xtimes (user_max, sizeof (char *))))
+	{
+	    error (0, 0, "save_user: too many users");
+	    return;
+	}
+	user_list = xrealloc (user_list, xtimes (user_max, sizeof (char *)));
     }
     user_list[user_count++] = xstrdup (name);
 }
@@ -920,9 +927,13 @@ save_file (dir, name, module)
 
     if (file_count == file_max)
     {
-	file_max += FILE_INCREMENT;
-	file_list = (struct file_list_str *) xrealloc ((char *) file_list,
-						   file_max * sizeof (*fl));
+	file_max = xsum (file_max, FILE_INCREMENT);
+	if (size_overflow_p (xtimes (file_max, sizeof (*fl))))
+	{
+	    error (0, 0, "save_file: too many files");
+	    return;
+	}
+	file_list = xrealloc (file_list, xtimes (file_max, sizeof (*fl)));
     }
     fl = &file_list[file_count++];
     fl->l_file = cp = xmalloc (strlen (dir) + strlen (name) + 2);
@@ -961,9 +972,13 @@ save_module (module)
 {
     if (mod_count == mod_max)
     {
-	mod_max += MODULE_INCREMENT;
-	mod_list = (char **) xrealloc ((char *) mod_list,
-				       mod_max * sizeof (char *));
+	mod_max = xsum (mod_max, MODULE_INCREMENT);
+	if (size_overflow_p (xtimes (mod_max, sizeof (char *))))
+	{
+	    error (0, 0, "save_module: too many modules");
+	    return;
+	}
+	mod_list = xrealloc (mod_list, xtimes (mod_max, sizeof (char *)));
     }
     mod_list[mod_count++] = xstrdup (module);
 }

contrib/cvs/src/login.c

@@ -125,7 +125,7 @@ password_entry_parseline (cvsroot_canonical, warn, linenumber, linebuf)
 
 	if (isspace(*(linebuf + 1)))
 	    /* special case since strtoul ignores leading white space */
-	    entry_version = 0;
+	    q = linebuf + 1;
 	else
 	    entry_version = strtoul (linebuf + 1, &q, 10);
 

contrib/cvs/src/modules.c

@@ -159,6 +159,32 @@ do_module (db, mname, m_type, msg, callback_proc, where, shorten,
     }
 #endif
 
+    /* Similarly for directories that attempt to step above the root of the
+     * repository.
+     */
+    if (pathname_levels (mname) > 0)
+	error (1, 0, "up-level in module reference (`..') invalid: `%s'.",
+		mname);
+
+
+    /* Don't process absolute directories.  Anything else could be a security
+     * problem.  Before this check was put in place:
+     *
+     *   $ cvs -d:fork:/cvsroot co /foo
+     *   cvs server: warning: cannot make directory CVS in /: Permission denied
+     *   cvs [server aborted]: cannot make directory /foo: Permission denied
+     *   $
+     */
+    if (isabsolute (mname))
+	error (1, 0, "Absolute module reference invalid: `%s'", mname);
+
+    /* Similarly for directories that attempt to step above the root of the
+     * repository.
+     */
+    if (pathname_levels (mname) > 0)
+	error (1, 0, "up-level in module reference (`..') invalid: `%s'.",
+		mname);
+
     /* if this is a directory to ignore, add it to that list */
     if (mname[0] == '!' && mname[1] != '\0')
     {

contrib/cvs/src/patch.c

@@ -375,6 +375,7 @@ patch_fileproc (callerdat, finfo)
     struct utimbuf t;
     char *vers_tag, *vers_head;
     char *rcs = NULL;
+    char *rcs_orig = NULL;
     RCSNode *rcsfile;
     FILE *fp1, *fp2, *fp3;
     int ret = 0;
@@ -404,7 +405,7 @@ patch_fileproc (callerdat, finfo)
     if ((rcsfile->flags & VALID) && (rcsfile->flags & INATTIC))
 	isattic = 1;
 
-    rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
+    rcs_orig = rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
     (void) sprintf (rcs, "%s%s", finfo->file, RCSEXT);
 
     /* if vers_head is NULL, may have been removed from the release */
@@ -743,8 +744,8 @@ failed to read diff file header %s for %s: end of file", tmpfile3, rcs);
 	free (vers_tag);
     if (vers_head != NULL)
 	free (vers_head);
-    if (rcs != NULL)
-	free (rcs);
+    if (rcs_orig)
+	free (rcs_orig);
     return (ret);
 }
 

contrib/cvs/src/rcs.c

@@ -3034,8 +3034,7 @@ RCS_getdate (rcs, date, force_tag_match)
     if (retval != NULL)
 	return (retval);
 
-    if (!force_tag_match ||
-	(vers != NULL && RCS_datecmp (vers->date, date) <= 0))
+    if (vers && (!force_tag_match || RCS_datecmp (vers->date, date) <= 0))
 	return (xstrdup (vers->version));
     else
 	return (NULL);
@@ -4118,7 +4117,7 @@ RCS_checkout (rcs, workfile, rev, nametag, options, sout, pfn, callerdat)
     size_t len;
     int free_value = 0;
     char *log = NULL;
-    size_t loglen;
+    size_t loglen = 0;
     Node *vp = NULL;
 #ifdef PRESERVE_PERMISSIONS_SUPPORT
     uid_t rcs_owner = (uid_t) -1;
@@ -7398,7 +7397,7 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 
 		for (ln = 0; ln < headlines.nlines; ++ln)
 		{
-		    char buf[80];
+		    char *buf;
 		    /* Period which separates year from month in date.  */
 		    char *ym;
 		    /* Period which separates month from day in date.  */
@@ -7409,10 +7408,12 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 		    if (prvers == NULL)
 			prvers = vers;
 
+		    buf = xmalloc (strlen (prvers->version) + 24);
 		    sprintf (buf, "%-12s (%-8.8s ",
 			     prvers->version,
 			     prvers->author);
 		    cvs_output (buf, 0);
+		    free (buf);
 
 		    /* Now output the date.  */
 		    ym = strchr (prvers->date, '.');

contrib/cvs/src/server.c

@@ -927,7 +927,7 @@ serve_max_dotdot (arg)
     int i;
     char *p;
 
-    if (lim < 0)
+    if (lim < 0 || lim > 10000)
 	return;
     p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10);
     if (p == NULL)
@@ -1647,9 +1647,28 @@ serve_unchanged (arg)
 	    && strlen (arg) == cp - name
 	    && strncmp (arg, name, cp - name) == 0)
 	{
-	    timefield = strchr (cp + 1, '/') + 1;
-	    if (*timefield != '=')
+	    if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
 	    {
+		/* We didn't find the record separator or it is followed by
+		 * the end of the string, so just exit.
+		 */
+		if (alloc_pending (80))
+		    sprintf (pending_error_text,
+		             "E Malformed Entry encountered.");
+		return;
+	    }
+	    /* If the time field is not currently empty, then one of
+	     * serve_modified, serve_is_modified, & serve_unchanged were
+	     * already called for this file.  We would like to ignore the
+	     * reinvocation silently or, better yet, exit with an error
+	     * message, but we just avoid the copy-forward and overwrite the
+	     * value from the last invocation instead.  See the comment below
+	     * for more.
+	     */
+	    if (*timefield == '/')
+	    {
+		/* Copy forward one character.  Space was allocated for this
+		 * already in serve_entry().  */
 		cp = timefield + strlen (timefield);
 		cp[1] = '\0';
 		while (cp > timefield)
@@ -1657,8 +1676,17 @@ serve_unchanged (arg)
 		    *cp = cp[-1];
 		    --cp;
 		}
-		*timefield = '=';
 	    }
+	    /* If *TIMEFIELD wasn't "/", we assume that it was because of
+	     * multiple calls to Is-Modified & Unchanged by the client and
+	     * just overwrite the value from the last call.  Technically, we
+	     * should probably either ignore calls after the first or send the
+	     * client an error, since the client/server protocol specification
+	     * specifies that only one call to either Is-Modified or Unchanged
+	     * is allowed, but broken versions of WinCVS & TortoiseCVS rely on
+	     * this behavior.
+	     */
+	    *timefield = '=';
 	    break;
 	}
     }
@@ -1691,9 +1719,28 @@ serve_is_modified (arg)
 	    && strlen (arg) == cp - name
 	    && strncmp (arg, name, cp - name) == 0)
 	{
-	    timefield = strchr (cp + 1, '/') + 1;
-	    if (!(timefield[0] == 'M' && timefield[1] == '/'))
+	    if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
 	    {
+		/* We didn't find the record separator or it is followed by
+		 * the end of the string, so just exit.
+		 */
+		if (alloc_pending (80))
+		    sprintf (pending_error_text,
+		             "E Malformed Entry encountered.");
+		return;
+	    }
+	    /* If the time field is not currently empty, then one of
+	     * serve_modified, serve_is_modified, & serve_unchanged were
+	     * already called for this file.  We would like to ignore the
+	     * reinvocation silently or, better yet, exit with an error
+	     * message, but we just avoid the copy-forward and overwrite the
+	     * value from the last invocation instead.  See the comment below
+	     * for more.
+	     */
+	    if (*timefield == '/')
+	    {
+		/* Copy forward one character.  Space was allocated for this
+		 * already in serve_entry().  */
 		cp = timefield + strlen (timefield);
 		cp[1] = '\0';
 		while (cp > timefield)
@@ -1701,8 +1748,17 @@ serve_is_modified (arg)
 		    *cp = cp[-1];
 		    --cp;
 		}
-		*timefield = 'M';
 	    }
+	    /* If *TIMEFIELD wasn't "/", we assume that it was because of
+	     * multiple calls to Is-Modified & Unchanged by the client and
+	     * just overwrite the value from the last call.  Technically, we
+	     * should probably either ignore calls after the first or send the
+	     * client an error, since the client/server protocol specification
+	     * specifies that only one call to either Is-Modified or Unchanged
+	     * is allowed, but broken versions of WinCVS & TortoiseCVS rely on
+	     * this behavior.
+	     */
+	    *timefield = 'M';
 	    if (kopt != NULL)
 	    {
 		if (alloc_pending (strlen (name) + 80))
@@ -1757,8 +1813,29 @@ serve_entry (arg)
 {
     struct an_entry *p;
     char *cp;
+    int i = 0;
     if (error_pending()) return;
-    p = (struct an_entry *) xmalloc (sizeof (struct an_entry));
+
+    /* Verify that the entry is well-formed.  This can avoid problems later.
+     * At the moment we only check that the Entry contains five slashes in
+     * approximately the correct locations since some of the code makes
+     * assumptions about this.
+     */
+    cp = arg;
+    if (*cp == 'D') cp++;
+    while (i++ < 5)
+    {
+	if (!cp || *cp != '/')
+	{
+	    if (alloc_pending (80))
+		sprintf (pending_error_text,
+			 "E protocol error: Malformed Entry");
+	    return;
+	}
+	cp = strchr (cp + 1, '/');
+    }
+
+    p = xmalloc (sizeof (struct an_entry));
     if (p == NULL)
     {
 	pending_error = ENOMEM;
@@ -1990,6 +2067,9 @@ serve_notify (arg)
     {
 	char *cp;
 
+	if (!data[0])
+	    goto error;
+
 	if (strchr (data, '+'))
 	    goto error;
 
@@ -2122,6 +2202,14 @@ serve_argument (arg)
 
     if (error_pending()) return;
 
+    if (argument_count >= 10000)
+    {
+	if (alloc_pending (80))
+	    sprintf (pending_error_text, 
+		     "E Protocol error: too many arguments");
+	return;
+    }
+
     if (argument_vector_size <= argument_count)
     {
 	argument_vector_size *= 2;
@@ -2152,6 +2240,14 @@ serve_argumentx (arg)
 
     if (error_pending()) return;
 
+    if (argument_count <= 1) 
+    {
+	if (alloc_pending (80))
+	    sprintf (pending_error_text,
+		     "E Protocol error: called argumentx without prior call to argument");
+	return;
+    }
+
     p = argument_vector[argument_count - 1];
     p = xrealloc (p, strlen (p) + 1 + strlen (arg) + 1);
     if (p == NULL)
@@ -2508,7 +2604,7 @@ check_command_legal_p (cmd_name)
                     save some code here...  -kff */
 
                  /* Chop newline by hand, for strcmp()'s sake. */
-                 if (linebuf[num_red - 1] == '\n')
+                 if (num_red > 0 && linebuf[num_red - 1] == '\n')
                      linebuf[num_red - 1] = '\0';
 
                  if (strcmp (linebuf, CVS_Username) == 0)
@@ -2563,7 +2659,7 @@ check_command_legal_p (cmd_name)
          while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
          {
              /* Chop newline by hand, for strcmp()'s sake. */
-             if (linebuf[num_red - 1] == '\n')
+             if (num_red > 0 && linebuf[num_red - 1] == '\n')
                  linebuf[num_red - 1] = '\0';
 
              if (strcmp (linebuf, CVS_Username) == 0)

contrib/cvs/src/wrapper.c

@@ -238,6 +238,30 @@ wrap_unparse_rcs_options (line, first_call_p)
 }
 #endif /* SERVER_SUPPORT || CLIENT_SUPPORT */
 
+/*
+ * Remove fmt str specifier other than %% or %s. And allow
+ * only max_s %s specifiers
+ */
+wrap_clean_fmt_str(char *fmt, int max_s)
+{
+    while (*fmt) {
+	if (fmt[0] == '%' && fmt[1])
+	{
+	    if (fmt[1] == '%') 
+		fmt++;
+	    else
+		if (fmt[1] == 's' && max_s > 0)
+		{
+		    max_s--;
+		    fmt++;
+		} else 
+		    *fmt = ' ';
+	}
+	fmt++;
+    }
+    return;
+}
+
 /*
  * Open a file and read lines, feeding each line to a line parser. Arrange
  * for keeping a temporary list of wrappers at the end, if the "temp"
@@ -558,9 +582,8 @@ wrap_tocvs_process_file(fileName)
     args = xmalloc (strlen (e->tocvsFilter)
 		    + strlen (fileName)
 		    + strlen (buf));
-    /* FIXME: sprintf will blow up if the format string contains items other
-       than %s, or contains too many %s's.  We should instead be parsing
-       e->tocvsFilter ourselves and giving a real error.  */
+
+    wrap_clean_fmt_str(e->tocvsFilter, 2);
     sprintf (args, e->tocvsFilter, fileName, buf);
     run_setup (args);
     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL|RUN_REALLY );
@@ -592,9 +615,8 @@ wrap_fromcvs_process_file(fileName)
 
     args = xmalloc (strlen (e->fromcvsFilter)
 		    + strlen (fileName));
-    /* FIXME: sprintf will blow up if the format string contains items other
-       than %s, or contains too many %s's.  We should instead be parsing
-       e->fromcvsFilter ourselves and giving a real error.  */
+
+    wrap_clean_fmt_str(e->fromcvsFilter, 1);
     sprintf (args, e->fromcvsFilter, fileName);
     run_setup (args);
     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL );

contrib/isc-dhcp/client/dhclient.c

@@ -94,7 +94,7 @@ int main (argc, argv, envp)
 	int argc;
 	char **argv, **envp;
 {
-	int i;
+	int i, e;
 	struct servent *ent;
 	struct interface_info *ip;
 	struct client_state *client;
@@ -111,8 +111,11 @@ int main (argc, argv, envp)
 	int no_dhclient_db = 0;
 	int no_dhclient_pid = 0;
 	int no_dhclient_script = 0;
+	FILE *pidfd;
+	pid_t oldpid;
 	char *s;
 
+	oldpid = 0;
 	/* Make sure we have stdin, stdout and stderr. */
 	i = open ("/dev/null", O_RDWR);
 	if (i == 0)
@@ -253,15 +256,18 @@ int main (argc, argv, envp)
 
 	/* first kill of any currently running client */
 	if (release_mode) {
-	        /* XXX inelegant hack to prove concept */
-		char command[1024];
 
-#if !defined (NO_SNPRINTF)
-		snprintf (command, 1024, "kill `cat %s`", path_dhclient_pid);
-#else
-		sprintf (command, "kill `cat %s`", path_dhclient_pid);
-#endif
-		system (command);
+		if ((pidfd = fopen(path_dhclient_pid, "r")) != NULL) {
+			e = fscanf(pidfd, "%d", &oldpid);
+
+			if (e != 0 && e != EOF) {
+				if (oldpid) {
+					if (kill(oldpid, SIGKILL) == 0)
+						unlink(path_dhclient_pid);
+				}
+			}
+			fclose(pidfd);
+		}
 	}
 
 	if (!quiet) {

contrib/lukemftpd/libnetbsd/strsuftoll.c

@@ -1,254 +0,0 @@
-/*	$NetBSD: strsuftoll.c,v 1.1 2002/11/29 12:58:17 lukem Exp $	*/
-/*-
- * Copyright (c) 2001-2002 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Luke Mewburn.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *        This product includes software developed by the NetBSD
- *        Foundation, Inc. and its contributors.
- * 4. Neither the name of The NetBSD Foundation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-/*-
- * Copyright (c) 1991, 1993, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Keith Muller of the University of California, San Diego and Lance
- * Visser of Convex Computer Corporation.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-
-#if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: strsuftoll.c,v 1.1 2002/11/29 12:58:17 lukem Exp $");
-#endif /* LIBC_SCCS and not lint */
-
-#ifdef _LIBC
-#include "namespace.h"
-#endif
-
-#if HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#if !HAVE_STRSUFTOLL
-
-#include <sys/types.h>
-#include <sys/time.h>
-
-#include <assert.h>
-#include <ctype.h>
-#include <err.h>
-#include <errno.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#ifdef _LIBC
-# define _STRSUFTOLL	_strsuftoll
-# define _STRSUFTOLLX	_strsuftollx
-# ifdef __weak_alias
-__weak_alias(strsuftoll, _strsuftoll)
-__weak_alias(strsuftollx, _strsuftollx)
-# endif
-#else /* !LIBC */
-# define _STRSUFTOLL	strsuftoll
-# define _STRSUFTOLLX	strsuftollx
-#endif /* !LIBC */
-
-/*
- * Convert an expression of the following forms to a (u)int64_t.
- * 	1) A positive decimal number.
- *	2) A positive decimal number followed by a b (mult by 512).
- *	3) A positive decimal number followed by a k (mult by 1024).
- *	4) A positive decimal number followed by a m (mult by 1048576).
- *	5) A positive decimal number followed by a w (mult by sizeof int)
- *	6) Two or more positive decimal numbers (with/without k,b or w).
- *	   separated by x (also * for backwards compatibility), specifying
- *	   the product of the indicated values.
- * Returns the result upon successful conversion, or exits with an
- * appropriate error.
- * 
- */
-/* LONGLONG */
-long long
-_STRSUFTOLL(const char *desc, const char *val,
-    long long min, long long max)
-{
-	long long result;
-	char	errbuf[100];
-
-	result = strsuftollx(desc, val, min, max, errbuf, sizeof(errbuf));
-	if (*errbuf != '\0')
-		errx(1, "%s", errbuf);
-	return (result);
-}
-
-/*
- * As strsuftoll(), but returns the error message into the provided buffer
- * rather than exiting with it.
- */
-/* LONGLONG */
-long long
-_STRSUFTOLLX(const char *desc, const char *val,
-    long long min, long long max, char *ebuf, size_t ebuflen)
-{
-	long long num, t;
-	char	*expr;
-
-	_DIAGASSERT(desc != NULL);
-	_DIAGASSERT(val != NULL);
-	_DIAGASSERT(ebuf != NULL);
-
-	errno = 0;
-	ebuf[0] = '\0';
-
-	while (isspace((unsigned char)*val))	/* Skip leading space */
-		val++;
-
-	num = strtoll(val, &expr, 0);
-	if (errno == ERANGE)
-		goto erange;			/* Overflow */
-
-	if (expr == val)			/* No digits */
-		goto badnum;
-
-	switch (*expr) {
-	case 'b':
-		t = num;
-		num *= 512;			/* 1 block */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	case 'k':
-		t = num;
-		num *= 1024;			/* 1 kilobyte */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	case 'm':
-		t = num;
-		num *= 1048576;			/* 1 megabyte */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	case 'g':
-		t = num;
-		num *= 1073741824;		/* 1 gigabyte */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	case 't':
-		t = num;
-		num *= 1099511627776LL;		/* 1 terabyte */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	case 'w':
-		t = num;
-		num *= sizeof(int);		/* 1 word */
-		if (t > num)
-			goto erange;
-		++expr;
-		break;
-	}
-
-	switch (*expr) {
-	case '\0':
-		break;
-	case '*':				/* Backward compatible */
-	case 'x':
-		t = num;
-		num *= strsuftollx(desc, expr + 1, min, max, ebuf, ebuflen);
-		if (*ebuf != '\0')
-			return (0);
-		if (t > num) {
- erange:	 	
-			snprintf(ebuf, ebuflen,
-			    "%s: %s", desc, strerror(ERANGE));
-			return (0);
-		}
-		break;
-	default:
- badnum:	snprintf(ebuf, ebuflen,
-		    "%s `%s': illegal number", desc, val);
-		return (0);
-	}
-	if (num < min) {
-			/* LONGLONG */
-		snprintf(ebuf, ebuflen, "%s %lld is less than %lld.",
-		    desc, (long long)num, (long long)min);
-		return (0);
-	}
-	if (num > max) {
-			/* LONGLONG */
-		snprintf(ebuf, ebuflen,
-		    "%s %lld is greater than %lld.",
-		    desc, (long long)num, (long long)min);
-		return (0);
-	}
-	*ebuf = '\0';
-	return (num);
-}
-
-#endif /* !HAVE_STRSUFTOLL */

contrib/lukemftpd/src/Makefile

@@ -1,46 +0,0 @@
-#	$NetBSD: Makefile,v 1.49 2002/08/22 00:09:38 christos Exp $
-#	@(#)Makefile	8.2 (Berkeley) 4/4/94
-
-.include <bsd.own.mk>
-
-PROG=	ftpd
-SRCS=	cmds.c conf.c ftpd.c ftpcmd.y logutmp.c logwtmp.c popen.c
-CPPFLAGS+=-I${.CURDIR} -DSUPPORT_UTMP -DSUPPORT_UTMPX
-DPADD+=	${LIBCRYPT} ${LIBUTIL}
-LDADD+=	-lcrypt -lutil
-MAN=	ftpd.conf.5 ftpusers.5 ftpd.8
-MLINKS=	ftpusers.5 ftpchroot.5
-
-# for `internal' ls
-SRCS+=	ls.c cmp.c print.c stat_flags.c util.c
-.PATH:	${NETBSDSRCDIR}/bin/ls
-
-CPPFLAGS+=-DINET6
-.include <bsd.own.mk>
-
-WARNS=2
-
-.if (${USE_SKEY} != "no")
-CPPFLAGS+=-DSKEY
-DPADD+= ${LIBSKEY}
-LDADD+= -lskey
-.endif
-
-ftpd.o ftpcmd.o: version.h
-
-# XXX Kerberos support is broken right now.
-#.PATH:	${NETBSDSRCDIR}/usr.bin/login
-
-#.ifdef KERBEROS5
-#SRCS+=	k5login.c
-#CPPFLAGS+=-DKERBEROS5
-#DPADD+= ${LIBKRB5} ${LIBK5CRYPTO} ${LIBCOM_ERR}
-#LDADD+= -lkrb5 -lk5crypto -lcom_err
-#.else
-#SRCS+=	klogin.c
-#CPPFLAGS+=-DKERBEROS
-#DPADD+= ${LIBKRB} ${LIBDES} ${LIBCOM_ERR}
-#LDADD+= -lkrb -kdes -lcom_err
-#.endif
-
-.include <bsd.prog.mk>

contrib/opie/opiepasswd.c

@@ -118,11 +118,18 @@ int main FUNCTION((argc, argv), int argc AND char *argv[])
   struct opie opie;
   int rval, n = 499, i, mode = MODE_DEFAULT, force = 0;
   char seed[OPIE_SEED_MAX+1];
+  char *username;
+  uid_t ruid;
   struct passwd *pp;
 
   memset(seed, 0, sizeof(seed));
 
-  if (!(pp = getpwnam(getlogin()))) {
+  ruid = getuid();
+  username = getlogin();
+  pp = getpwnam(username);
+  if (username == NULL || pp == NULL || pp->pw_uid != ruid)
+    pp = getpwuid(ruid);
+  if (pp == NULL) {
     fprintf(stderr, "Who are you?");
     return 1;
   }

contrib/sendmail/src/conf.c

@@ -329,6 +329,8 @@ setdefaults(e)
 	DontProbeInterfaces = DPI_PROBEALL;
 	DoubleBounceAddr = "postmaster";
 	MaxHeadersLength = MAXHDRSLEN;
+	MaxMimeHeaderLength = MAXLINE;
+	MaxMimeFieldLength = MaxMimeHeaderLength / 2;
 	MaxForwardEntries = 0;
 	FastSplit = 1;
 #if SASL

contrib/sendmail/src/parseaddr.c

@@ -608,7 +608,7 @@ unsigned char	TokTypeNoC[256] =
 };
 
 
-#define NOCHAR		-1	/* signal nothing in lookahead token */
+#define NOCHAR		(-1)	/* signal nothing in lookahead token */
 
 char **
 prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
@@ -694,22 +694,31 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 				/* see if there is room */
 				if (q >= &pvpbuf[pvpbsize - 5])
 				{
+	addrtoolong:
 					usrerr("553 5.1.1 Address too long");
 					if (strlen(addr) > MAXNAME)
 						addr[MAXNAME] = '\0';
 	returnnull:
 					if (delimptr != NULL)
+					{
+						if (p > addr)
+							p--;
 						*delimptr = p;
+					}
 					CurEnv->e_to = saveto;
 					return NULL;
 				}
 
 				/* squirrel it away */
+#if !ALLOW_255
+				if ((char) c == (char) -1 && !tTd(82, 101))
+					c &= 0x7f;
+#endif /* !ALLOW_255 */
 				*q++ = c;
 			}
 
 			/* read a new input character */
-			c = *p++;
+			c = (*p++) & 0x00ff;
 			if (c == '\0')
 			{
 				/* diagnose and patch up bad syntax */
@@ -764,6 +773,9 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 				}
 				else if (c != '!' || state == QST)
 				{
+					/* see if there is room */
+					if (q >= &pvpbuf[pvpbsize - 5])
+						goto addrtoolong;
 					*q++ = '\\';
 					continue;
 				}
@@ -849,6 +861,9 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 		/* new token */
 		if (tok != q)
 		{
+			/* see if there is room */
+			if (q >= &pvpbuf[pvpbsize - 5])
+				goto addrtoolong;
 			*q++ = '\0';
 			if (tTd(22, 36))
 			{

contrib/sendmail/src/sm_resolve.c

@@ -233,6 +233,7 @@ parse_dns_reply(data, len)
 			dns_free_data(r);
 			return NULL;
 		}
+		memset(*rr, 0, sizeof(**rr));
 		(*rr)->rr_domain = sm_strdup(host);
 		if ((*rr)->rr_domain == NULL)
 		{

contrib/sendmail/src/version.c

@@ -15,4 +15,4 @@
 
 SM_RCSID("@(#)$Id: version.c,v 8.104.2.14 2003/01/15 17:55:43 ca Exp $")
 
-char	Version[] = "8.12.8";
+char	Version[] = "8.12.8p2";

contrib/texinfo/util/texindex.c

@@ -381,15 +381,88 @@ For more information about these matters, see the files named COPYING.\n"),
     usage (1);
 }
 
+static char **tv;
+static int tv_alloc;
+static int tv_used;
+
+static int
+findtempname (char *tempname)
+{
+  int i;
+
+  for (i = 0; i < tv_used; i++)
+    if (strcmp (tv[i], tempname) == 0)
+	return (1);
+  return (0);
+}
+
 /* Return a name for a temporary file. */
 
 static char *
 maketempname (count)
      int count;
 {
+  static char *tempbase = NULL;
+  char *tempname;
   char tempsuffix[10];
+  int fd;
+
+  if (!tempbase)
+    {
+      tempbase = concat (tempdir, "txidxXXXXXX");
+
+      fd = mkstemp (tempbase);
+      if (fd == -1)
+        pfatal_with_name (tempbase);
+    }
+
   sprintf (tempsuffix, ".%d", count);
-  return concat (tempdir, tempbase, tempsuffix);
+  tempname = concat (tempbase, tempsuffix);
+  /*
+   * The open logic becomes a bit convoluted. If open(2) fails due to EEXIST,
+   * it's likely because somebody attempted to race us, or because we have
+   * already created this file.
+   */
+  fd = open (tempname, O_CREAT|O_EXCL|O_WRONLY, 0600);
+  if (fd == -1)
+    {
+	/*
+	 * If errno is not EEXIST, then open failed for some other reason, so
+	 * we should terminate. If errno == EEXIST AND we didn't create this
+	 * file, terminate. Otherwise, it's safe to say that errno == EEXIST
+	 * because we already created it, in this event, we can just return.
+	 */
+	if (errno != EEXIST ||
+	  (errno == EEXIST && findtempname (tempname) == 0))
+	  pfatal_with_name (tempname);
+	return (tempname);
+    }
+  else if (fd > 0)
+    {
+	close (fd);
+    }
+  if (tv == NULL)
+    {
+	tv_alloc = 16;
+	tv = calloc (tv_alloc, sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "calloc failed\n");
+	    exit (1);
+	  }
+    }
+  else if (tv_used == tv_alloc)
+    {
+	tv_alloc += 4;
+	tv = realloc (tv, tv_alloc * sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "realloc failed");
+	    exit (1);
+	  }
+    }
+  tv[tv_used++] = strdup (tempname);
+  return tempname;
 }
 
 /* Delete all temporary files up to TO_COUNT. */

crypto/heimdal/appl/telnet/telnet/telnet.c

@@ -1294,6 +1294,7 @@ slc_check()
 
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1309,6 +1310,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1322,6 +1331,9 @@ slc_end_reply()
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1415,8 +1427,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1475,9 +1487,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		void *tmp;
 		opt_replyend += OPT_REPLY_SIZE;
@@ -1503,6 +1515,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1517,6 +1531,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1547,7 +1563,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

crypto/heimdal/kadmin/version4.c

@@ -964,6 +964,8 @@ handle_v4(krb5_context context,
 	if(term_flag)
 	    exit(0);
 	if(first) {
+	    if (len < 2)
+		krb5_errx(context, 1, "received too short len (%d < 2)", len);
 	    /* first time around, we have already read len, and two
                bytes of the version string */
 	    krb5_data_alloc(&message, len);

crypto/heimdal/kdc/config.c

@@ -64,6 +64,8 @@ krb5_boolean encode_as_rep_as_tgs_rep; /* bug compatibility */
 krb5_boolean check_ticket_addresses;
 krb5_boolean allow_null_ticket_addresses;
 krb5_boolean allow_anonymous;
+int trpolicy;
+static const char *trpolicy_str;
 
 static struct getarg_strings addresses_str;	/* addresses to listen on */
 krb5_addresses explicit_addresses;
@@ -287,9 +289,8 @@ configure(int argc, char **argv)
 
     get_dbinfo();
     
-    if(max_request_str){
+    if(max_request_str)
 	max_request = parse_bytes(max_request_str, NULL);
-    }
 
     if(max_request == 0){
 	p = krb5_config_get_string (context,
@@ -352,6 +353,23 @@ configure(int argc, char **argv)
     allow_anonymous = 
 	krb5_config_get_bool(context, NULL, "kdc", 
 			     "allow-anonymous", NULL);
+    trpolicy_str = 
+	krb5_config_get_string_default(context, NULL, "always-check", "kdc", 
+				       "transited-policy", NULL);
+    if(strcasecmp(trpolicy_str, "always-check") == 0)
+	trpolicy = TRPOLICY_ALWAYS_CHECK;
+    else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0)
+	trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
+    else if(strcasecmp(trpolicy_str, "always-honour-request") == 0)
+	trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
+    else {
+	kdc_log(0, "unknown transited-policy: %s, reverting to always-check", 
+		trpolicy_str);
+	trpolicy = TRPOLICY_ALWAYS_CHECK;
+    }
+	
+	krb5_config_get_bool_default(context, NULL, TRUE, "kdc", 
+				     "enforce-transited-policy", NULL);
 #ifdef KRB4
     if(v4_realm == NULL){
 	p = krb5_config_get_string (context, NULL, 

crypto/heimdal/kdc/kdc.8

@@ -1,6 +1,6 @@
 .\" $Id: kdc.8,v 1.17 2002/08/28 21:09:05 joda Exp $
 .\"
-.Dd August 22, 2002
+.Dd October 22, 2003
 .Dt KDC 8
 .Os HEIMDAL
 .Sh NAME
@@ -128,6 +128,27 @@ Permit tickets with no addresses.  This option is only relevant when
 check-ticket-addresses is TRUE.
 .It Li allow-anonymous = Va boolean
 Permit anonymous tickets with no addresses.
+.It Li transited-policy = Xo
+.Li always-check \*(Ba
+.Li allow-per-principal |
+.Li always-honour-request
+.Xc
+This controls how KDC requests with the
+.Li disable-transited-check
+flag are handled. It can be one of:
+.Bl -tag -width "xxx" -offset indent
+.It Li always-check
+Always check transited encoding, this is the default.
+.It Li allow-per-principal
+Currently this is identical to
+.Li always-check .
+In a future release, it will be possible to mark a principal as able
+to handle unchecked requests.
+.It Li always-honour-request
+Always do what the client asked.
+In a future release, it will be possible to force a check per
+principal.
+.El
 .It encode_as_rep_as_tgs_rep = Va boolean
 Encode AS-Rep as TGS-Rep to be bug-compatible with old DCE code.  The
 Heimdal clients allow both.

crypto/heimdal/kdc/kdc_locl.h

@@ -62,6 +62,11 @@ extern krb5_boolean encode_as_rep_as_tgs_rep;
 extern krb5_boolean check_ticket_addresses;
 extern krb5_boolean allow_null_ticket_addresses;
 extern krb5_boolean allow_anonymous;
+enum { TRPOLICY_ALWAYS_CHECK,
+       TRPOLICY_ALLOW_PER_PRINCIPAL, 
+       TRPOLICY_ALWAYS_HONOUR_REQUEST };
+extern int trpolicy;
+extern int enable_v4_cross_realm;
 
 #ifdef KRB4
 extern char *v4_realm;

crypto/heimdal/kdc/kerberos5.c

@@ -355,10 +355,13 @@ get_pa_etype_info(METHOD_DATA *md, hdb_entry *client,
     
     if(n != pa.len) {
 	char *name;
-	krb5_unparse_name(context, client->principal, &name);
+	ret = krb5_unparse_name(context, client->principal, &name);
+	if (ret)
+	    name = "<unparse_name failed>";
 	kdc_log(0, "internal error in get_pa_etype_info(%s): %d != %d", 
 		name, n, pa.len);
-	free(name);
+	if (ret == 0)
+	    free(name);
 	pa.len = n;
     }
 
@@ -496,8 +499,8 @@ as_rep(KDC_REQ *req,
     krb5_enctype cetype, setype;
     EncTicketPart et;
     EncKDCRepPart ek;
-    krb5_principal client_princ, server_princ;
-    char *client_name, *server_name;
+    krb5_principal client_princ = NULL, server_princ = NULL;
+    char *client_name = NULL, *server_name = NULL;
     krb5_error_code ret = 0;
     const char *e_text = NULL;
     krb5_crypto crypto;
@@ -506,28 +509,32 @@ as_rep(KDC_REQ *req,
     memset(&rep, 0, sizeof(rep));
 
     if(b->sname == NULL){
-	server_name = "<unknown server>";
 	ret = KRB5KRB_ERR_GENERIC;
 	e_text = "No server in request";
     } else{
 	principalname2krb5_principal (&server_princ, *(b->sname), b->realm);
-	krb5_unparse_name(context, server_princ, &server_name);
+	ret = krb5_unparse_name(context, server_princ, &server_name);
+    }
+    if (ret) {
+	kdc_log(0, "AS-REQ malformed server name from %s", from);
+	goto out;
     }
     
     if(b->cname == NULL){
-	client_name = "<unknown client>";
 	ret = KRB5KRB_ERR_GENERIC;
 	e_text = "No client in request";
     } else {
 	principalname2krb5_principal (&client_princ, *(b->cname), b->realm);
-	krb5_unparse_name(context, client_princ, &client_name);
+	ret = krb5_unparse_name(context, client_princ, &client_name);
     }
+    if (ret) {
+	kdc_log(0, "AS-REQ malformed client name from %s", from);
+	goto out;
+    }
+
     kdc_log(0, "AS-REQ %s from %s for %s", 
 	    client_name, from, server_name);
 
-    if(ret)
-	goto out;
-
     ret = db_fetch(client_princ, &client);
     if(ret){
 	kdc_log(0, "UNKNOWN -- %s: %s", client_name,
@@ -559,7 +566,6 @@ as_rep(KDC_REQ *req,
 	while((pa = find_padata(req, &i, KRB5_PADATA_ENC_TIMESTAMP))){
 	    krb5_data ts_data;
 	    PA_ENC_TS_ENC p;
-	    time_t patime;
 	    size_t len;
 	    EncryptedData enc_data;
 	    Key *pa_key;
@@ -635,7 +641,6 @@ as_rep(KDC_REQ *req,
 			 client_name);
 		continue;
 	    }
-	    patime = p.patimestamp;
 	    free_PA_ENC_TS_ENC(&p);
 	    if (abs(kdc_time - p.patimestamp) > context->max_skew) {
 		ret = KRB5KDC_ERR_PREAUTH_FAILED;
@@ -716,9 +721,10 @@ as_rep(KDC_REQ *req,
 	    if (ret == 0) {
 		kdc_log(5, "Using %s/%s", cet, set);
 		free(set);
-	    } else
-		free(cet);
-	} else
+	    }
+	    free(cet);
+	}
+	if (ret != 0)
 	    kdc_log(5, "Using e-types %d/%d", cetype, setype);
     }
     
@@ -841,13 +847,8 @@ as_rep(KDC_REQ *req,
 	copy_HostAddresses(b->addresses, et.caddr);
     }
     
-    {
-	krb5_data empty_string;
-      
-	krb5_data_zero(&empty_string); 
-	et.transited.tr_type = DOMAIN_X500_COMPRESS;
-	et.transited.contents = empty_string;
-    }
+    et.transited.tr_type = DOMAIN_X500_COMPRESS;
+    krb5_data_zero(&et.transited.contents); 
      
     copy_EncryptionKey(&et.key, &ek.key);
 
@@ -914,8 +915,8 @@ as_rep(KDC_REQ *req,
 		       client->kvno, &ckey->key, &e_text, reply);
     free_EncTicketPart(&et);
     free_EncKDCRepPart(&ek);
-    free_AS_REP(&rep);
   out:
+    free_AS_REP(&rep);
     if(ret){
 	krb5_mk_error(context,
 		      ret,
@@ -929,9 +930,11 @@ as_rep(KDC_REQ *req,
 	ret = 0;
     }
   out2:
-    krb5_free_principal(context, client_princ);
+    if (client_princ)
+	krb5_free_principal(context, client_princ);
     free(client_name);
-    krb5_free_principal(context, server_princ);
+    if (server_princ)
+	krb5_free_principal(context, server_princ);
     free(server_name);
     if(client)
 	free_ent(client);
@@ -1054,33 +1057,35 @@ check_tgs_flags(KDC_REQ_BODY *b, EncTicketPart *tgt, EncTicketPart *et)
 }
 
 static krb5_error_code
-fix_transited_encoding(TransitedEncoding *tr, 
+fix_transited_encoding(krb5_boolean check_policy,
+		       TransitedEncoding *tr, 
+		       EncTicketPart *et, 
 		       const char *client_realm, 
 		       const char *server_realm, 
 		       const char *tgt_realm)
 {
     krb5_error_code ret = 0;
-    if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)){
-	char **realms = NULL, **tmp;
-	int num_realms = 0;
-	int i;
-	if(tr->tr_type && tr->contents.length != 0) {
-	    if(tr->tr_type != DOMAIN_X500_COMPRESS){
-		kdc_log(0, "Unknown transited type: %u", 
-			tr->tr_type);
-		return KRB5KDC_ERR_TRTYPE_NOSUPP;
-	    }
-	    ret = krb5_domain_x500_decode(context, 
-					  tr->contents,
-					  &realms, 
-					  &num_realms,
-					  client_realm,
-					  server_realm);
-	    if(ret){
-		krb5_warn(context, ret, "Decoding transited encoding");
-		return ret;
-	    }
-	}
+    char **realms, **tmp;
+    int num_realms;
+    int i;
+
+    if(tr->tr_type != DOMAIN_X500_COMPRESS) {
+	kdc_log(0, "Unknown transited type: %u", tr->tr_type);
+	return KRB5KDC_ERR_TRTYPE_NOSUPP;
+    }
+
+    ret = krb5_domain_x500_decode(context, 
+				  tr->contents,
+				  &realms, 
+				  &num_realms,
+				  client_realm,
+				  server_realm);
+    if(ret){
+	krb5_warn(context, ret, "Decoding transited encoding");
+	return ret;
+    }
+    if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
+	/* not us, so add the previous realm to transited set */
 	if (num_realms < 0 || num_realms + 1 > UINT_MAX/sizeof(*realms)) {
 	    ret = ERANGE;
 	    goto free_realms;
@@ -1097,16 +1102,46 @@ fix_transited_encoding(TransitedEncoding *tr,
 	    goto free_realms;
 	}
 	num_realms++;
-	free_TransitedEncoding(tr);
-	tr->tr_type = DOMAIN_X500_COMPRESS;
-	ret = krb5_domain_x500_encode(realms, num_realms, &tr->contents);
-	if(ret)
-	    krb5_warn(context, ret, "Encoding transited encoding");
-    free_realms:
-	for(i = 0; i < num_realms; i++)
-	    free(realms[i]);
-	free(realms);
     }
+    if(num_realms == 0) {
+	if(strcmp(client_realm, server_realm)) 
+	    kdc_log(0, "cross-realm %s -> %s", client_realm, server_realm);
+    } else {
+	size_t l = 0;
+	char *rs;
+	for(i = 0; i < num_realms; i++)
+	    l += strlen(realms[i]) + 2;
+	rs = malloc(l);
+	if(rs != NULL) {
+	    *rs = '\0';
+	    for(i = 0; i < num_realms; i++) {
+		if(i > 0)
+		    strlcat(rs, ", ", l);
+		strlcat(rs, realms[i], l);
+	    }
+	    kdc_log(0, "cross-realm %s -> %s via [%s]", client_realm, server_realm, rs);
+	    free(rs);
+	}
+    }
+    if(check_policy) {
+	ret = krb5_check_transited(context, client_realm, 
+				   server_realm, 
+				   realms, num_realms, NULL);
+	if(ret) {
+	    krb5_warn(context, ret, "cross-realm %s -> %s", 
+		      client_realm, server_realm);
+	    goto free_realms;
+	}
+	et->flags.transited_policy_checked = 1;
+    }
+    et->transited.tr_type = DOMAIN_X500_COMPRESS;
+    ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
+    if(ret)
+	krb5_warn(context, ret, "Encoding transited encoding");
+  free_realms:
+    for(i = 0; i < num_realms; i++)
+	free(realms[i]);
+    free(realms);
     return ret;
 }
 
@@ -1172,18 +1207,35 @@ tgs_make_reply(KDC_REQ_BODY *b,
     
     ret = check_tgs_flags(b, tgt, &et);
     if(ret)
-	return ret;
+	goto out;
 
-    copy_TransitedEncoding(&tgt->transited, &et.transited);
-    ret = fix_transited_encoding(&et.transited,
+    /* We should check the transited encoding if:
+       1) the request doesn't ask not to be checked
+       2) globally enforcing a check
+       3) principal requires checking
+       4) we allow non-check per-principal, but principal isn't marked as allowing this
+       5) we don't globally allow this
+    */
+
+#define GLOBAL_FORCE_TRANSITED_CHECK		(trpolicy == TRPOLICY_ALWAYS_CHECK)
+#define GLOBAL_ALLOW_PER_PRINCIPAL		(trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
+#define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK	(trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
+/* these will consult the database in future release */
+#define PRINCIPAL_FORCE_TRANSITED_CHECK(P)		0
+#define PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(P)	0
+
+    ret = fix_transited_encoding(!f.disable_transited_check ||
+				 GLOBAL_FORCE_TRANSITED_CHECK ||
+				 PRINCIPAL_FORCE_TRANSITED_CHECK(server) ||
+				 !((GLOBAL_ALLOW_PER_PRINCIPAL && 
+				    PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(server)) ||
+				   GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK),
+				 &tgt->transited, &et,
 				 *krb5_princ_realm(context, client_principal),
 				 *krb5_princ_realm(context, server->principal),
 				 *krb5_princ_realm(context, krbtgt->principal));
-    if(ret){
-	free_TransitedEncoding(&et.transited);
-	return ret;
-    }
-
+    if(ret)
+	goto out;
 
     copy_Realm(krb5_princ_realm(context, server->principal), 
 	       &rep.ticket.realm);
@@ -1278,7 +1330,7 @@ tgs_make_reply(KDC_REQ_BODY *b,
        DES3? */
     ret = encode_reply(&rep, &et, &ek, etype, adtkt ? 0 : server->kvno, ekey,
 		       0, &tgt->key, e_text, reply);
-out:
+  out:
     free_TGS_REP(&rep);
     free_TransitedEncoding(&et.transited);
     if(et.starttime)
@@ -1380,13 +1432,13 @@ get_krbtgt_realm(const PrincipalName *p)
 }
 
 static Realm
-find_rpath(Realm r)
+find_rpath(Realm crealm, Realm srealm)
 {
     const char *new_realm = krb5_config_get_string(context,
 						   NULL,
-						   "libdefaults", 
-						   "capath", 
-						   r, 
+						   "capaths", 
+						   crealm,
+						   srealm,
 						   NULL);
     return (Realm)new_realm;
 }
@@ -1456,10 +1508,14 @@ tgs_rep2(KDC_REQ_BODY *b,
 
     if(ret) {
 	char *p;
-	krb5_unparse_name(context, princ, &p);
+	ret = krb5_unparse_name(context, princ, &p);
+	if (ret != 0)
+	    p = "<unparse_name failed>";
+	krb5_free_principal(context, princ);
 	kdc_log(0, "Ticket-granting ticket not found in database: %s: %s",
 		p, krb5_get_err_text(context, ret));
-	free(p);
+	if (ret == 0)
+	    free(p);
 	ret = KRB5KRB_AP_ERR_NOT_US;
 	goto out2;
     }
@@ -1468,12 +1524,16 @@ tgs_rep2(KDC_REQ_BODY *b,
        *ap_req.ticket.enc_part.kvno != krbtgt->kvno){
 	char *p;
 
-	krb5_unparse_name (context, princ, &p);
+	ret = krb5_unparse_name (context, princ, &p);
+	krb5_free_principal(context, princ);
+	if (ret != 0)
+	    p = "<unparse_name failed>";
 	kdc_log(0, "Ticket kvno = %d, DB kvno = %d (%s)", 
 		*ap_req.ticket.enc_part.kvno,
 		krbtgt->kvno,
 		p);
-	free (p);
+	if (ret == 0)
+	    free (p);
 	ret = KRB5KRB_AP_ERR_BADKEYVER;
 	goto out2;
     }
@@ -1657,9 +1717,13 @@ tgs_rep2(KDC_REQ_BODY *b,
 	}
 
 	principalname2krb5_principal(&sp, *s, r);
-	krb5_unparse_name(context, sp, &spn);	
+	ret = krb5_unparse_name(context, sp, &spn);	
+	if (ret)
+	    goto out;
 	principalname2krb5_principal(&cp, tgt->cname, tgt->crealm);
-	krb5_unparse_name(context, cp, &cpn);
+	ret = krb5_unparse_name(context, cp, &cpn);
+	if (ret)
+	    goto out;
 	unparse_flags (KDCOptions2int(b->kdc_options), KDCOptions_units,
 		       opt_str, sizeof(opt_str));
 	if(*opt_str)
@@ -1676,7 +1740,7 @@ tgs_rep2(KDC_REQ_BODY *b,
 
 	    if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
 		if(loop++ < 2) {
-		    new_rlm = find_rpath(req_rlm);
+		    new_rlm = find_rpath(tgt->crealm, req_rlm);
 		    if(new_rlm) {
 			kdc_log(5, "krbtgt for realm %s not found, trying %s", 
 				req_rlm, new_rlm);
@@ -1684,7 +1748,9 @@ tgs_rep2(KDC_REQ_BODY *b,
 			free(spn);
 			krb5_make_principal(context, &sp, r, 
 					    KRB5_TGS_NAME, new_rlm, NULL);
-			krb5_unparse_name(context, sp, &spn);	
+			ret = krb5_unparse_name(context, sp, &spn);	
+			if (ret)
+			    goto out;
 			goto server_lookup;
 		    }
 		}
@@ -1697,7 +1763,9 @@ tgs_rep2(KDC_REQ_BODY *b,
 		    free(spn);
 		    krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
 					realms[0], NULL);
-		    krb5_unparse_name(context, sp, &spn);
+		    ret = krb5_unparse_name(context, sp, &spn);
+		    if (ret)
+			goto out;
 		    krb5_free_host_realm(context, realms);
 		    goto server_lookup;
 		}
@@ -1725,6 +1793,18 @@ tgs_rep2(KDC_REQ_BODY *b,
 	}
 #endif
 
+	if(strcmp(krb5_principal_get_realm(context, sp),
+		  krb5_principal_get_comp_string(context, krbtgt->principal, 1)) != 0) {
+	    char *tpn;
+	    ret = krb5_unparse_name(context, krbtgt->principal, &tpn);
+	    kdc_log(0, "Request with wrong krbtgt: %s", (ret == 0) ? tpn : "<unknown>");
+	    if(ret == 0)
+		free(tpn);
+	    ret = KRB5KRB_AP_ERR_NOT_US;
+	    goto out;
+	    
+	}
+
 	ret = check_flags(client, cpn, server, spn, FALSE);
 	if(ret)
 	    goto out;

crypto/heimdal/lib/krb5/krb5-protos.h

@@ -520,6 +520,15 @@ krb5_change_password (
 	krb5_data */*result_code_string*/,
 	krb5_data */*result_string*/);
 
+krb5_error_code
+krb5_check_transited (
+	krb5_context /*context*/,
+	krb5_const_realm /*client_realm*/,
+	krb5_const_realm /*server_realm*/,
+	krb5_realm */*realms*/,
+	int /*num_realms*/,
+	int */*bad_realm*/);
+
 krb5_error_code
 krb5_check_transited_realms (
 	krb5_context /*context*/,

crypto/heimdal/lib/krb5/rd_req.c

@@ -129,6 +129,32 @@ krb5_decode_ap_req(krb5_context context,
     return 0;
 }
 
+static krb5_error_code
+check_transited(krb5_context context, Ticket *ticket, EncTicketPart *enc)
+{
+    char **realms;
+    int num_realms;
+    krb5_error_code ret;
+	    
+    if(enc->transited.tr_type != DOMAIN_X500_COMPRESS)
+	return KRB5KDC_ERR_TRTYPE_NOSUPP;
+
+    if(enc->transited.contents.length == 0)
+	return 0;
+
+    ret = krb5_domain_x500_decode(context, enc->transited.contents, 
+				  &realms, &num_realms, 
+				  enc->crealm,
+				  ticket->realm);
+    if(ret)
+	return ret;
+    ret = krb5_check_transited(context, enc->crealm, 
+			       ticket->realm, 
+			       realms, num_realms, NULL);
+    free(realms);
+    return ret;
+}
+
 krb5_error_code
 krb5_decrypt_ticket(krb5_context context,
 		    Ticket *ticket,
@@ -161,6 +187,14 @@ krb5_decrypt_ticket(krb5_context context,
 	    krb5_clear_error_string (context);
 	    return KRB5KRB_AP_ERR_TKT_EXPIRED;
 	}
+	
+	if(!t.flags.transited_policy_checked) {
+	    ret = check_transited(context, ticket, &t);
+	    if(ret) {
+		free_EncTicketPart(&t);
+		return ret;
+	    }
+	}
     }
     
     if(out)
@@ -209,29 +243,6 @@ out:
     return ret;
 }
 
-#if 0
-static krb5_error_code
-check_transited(krb5_context context,
-		krb5_ticket *ticket)
-{
-    char **realms;
-    int num_realms;
-    krb5_error_code ret;
-
-    if(ticket->ticket.transited.tr_type != DOMAIN_X500_COMPRESS)
-	return KRB5KDC_ERR_TRTYPE_NOSUPP;
-
-    ret = krb5_domain_x500_decode(ticket->ticket.transited.contents, 
-				  &realms, &num_realms, 
-				  ticket->client->realm,
-				  ticket->server->realm);
-    if(ret)
-	return ret;
-    ret = krb5_check_transited_realms(context, realms, num_realms, NULL);
-    free(realms);
-    return ret;
-}
-#endif
 
 krb5_error_code
 krb5_verify_ap_req(krb5_context context,

crypto/heimdal/lib/krb5/transited.c

@@ -304,6 +304,12 @@ krb5_domain_x500_decode(krb5_context context,
     struct tr_realm *p, **q;
     int ret;
     
+    if(tr.length == 0) {
+	*realms = NULL;
+	*num_realms = 0;
+	return 0;
+    }
+
     /* split string in components */
     ret = decode_realms(context, tr.data, tr.length, &r);
     if(ret)
@@ -358,6 +364,9 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     char *s = NULL;
     int len = 0;
     int i;
+    krb5_data_zero(encoding);
+    if (num_realms == 0)
+	return 0;
     for(i = 0; i < num_realms; i++){
 	len += strlen(realms[i]);
 	if(realms[i][0] == '/')
@@ -365,6 +374,8 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     }
     len += num_realms - 1;
     s = malloc(len + 1);
+    if (s == NULL)
+	return ENOMEM;
     *s = '\0';
     for(i = 0; i < num_realms; i++){
 	if(i && i < num_realms - 1)
@@ -378,6 +389,44 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     return 0;
 }
 
+krb5_error_code
+krb5_check_transited(krb5_context context,
+		     krb5_const_realm client_realm,
+		     krb5_const_realm server_realm,
+		     krb5_realm *realms,
+		     int num_realms,
+		     int *bad_realm)
+{
+    char **tr_realms;
+    char **p;
+    int i;
+
+    if(num_realms == 0)
+	return 0;
+    
+    tr_realms = krb5_config_get_strings(context, NULL, 
+					"capaths", 
+					client_realm, 
+					server_realm, 
+					NULL);
+    for(i = 0; i < num_realms; i++) {
+	for(p = tr_realms; p && *p; p++) {
+	    if(strcmp(*p, realms[i]) == 0)
+		break;
+	}
+	if(p == NULL || *p == NULL) {
+	    krb5_config_free_strings(tr_realms);
+	    krb5_set_error_string (context, "no transit through realm %s",
+				   realms[i]);
+	    if(bad_realm)
+		*bad_realm = i;
+	    return KRB5KRB_AP_ERR_ILL_CR_TKT;
+	}
+    }
+    krb5_config_free_strings(tr_realms);
+    return 0;
+}
+
 krb5_error_code
 krb5_check_transited_realms(krb5_context context,
 			    const char *const *realms, 

crypto/kerberosIV/appl/telnet/telnet/telnet.c

@@ -1285,6 +1285,7 @@ slc_check()
 
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1300,6 +1301,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1313,6 +1322,9 @@ slc_end_reply()
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1406,8 +1418,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1460,9 +1472,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1486,6 +1498,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1500,6 +1514,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1530,7 +1546,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

crypto/openssh/auth-chall.c

@@ -93,9 +93,17 @@ verify_response(Authctxt *authctxt, const char *response)
 			xfree(info);
 		}
 		/* if we received more prompts, we're screwed */
-		res = (numprompts != 0);
+		res = (res == 0 && numprompts == 0) ? 0 : -1;
 	}
 	device->free_ctx(authctxt->kbdintctxt);
 	authctxt->kbdintctxt = NULL;
 	return res ? 0 : 1;
 }
+void
+abandon_challenge_response(Authctxt *authctxt)
+{
+	if (authctxt->kbdintctxt != NULL) {
+		device->free_ctx(authctxt->kbdintctxt);
+		authctxt->kbdintctxt = NULL;
+	}
+}

crypto/openssh/auth.h

@@ -160,6 +160,7 @@ struct passwd * getpwnamallow(const char *user);
 
 char	*get_challenge(Authctxt *);
 int	verify_response(Authctxt *, const char *);
+void	abandon_challenge_response(Authctxt *);
 
 struct passwd * auth_get_user(void);
 

crypto/openssh/auth1.c

@@ -74,7 +74,7 @@ do_authloop(Authctxt *authctxt)
 	char info[1024];
 	u_int dlen;
 	u_int ulen;
-	int type = 0;
+	int prev, type = 0;
 	struct passwd *pw = authctxt->pw;
 
 	debug("Attempting authentication for %s%.100s.",
@@ -104,8 +104,20 @@ do_authloop(Authctxt *authctxt)
 		info[0] = '\0';
 
 		/* Get a packet from the client. */
+		prev = type;
 		type = packet_read();
 
+		/*
+		 * If we started challenge-response authentication but the
+		 * next packet is not a response to our challenge, release
+		 * the resources allocated by get_challenge() (which would
+		 * normally have been released by verify_response() had we
+		 * received such a response)
+		 */
+		if (prev == SSH_CMSG_AUTH_TIS &&
+		    type != SSH_CMSG_AUTH_TIS_RESPONSE)
+			abandon_challenge_response(authctxt);
+
 		/* Process the packet. */
 		switch (type) {
 

crypto/openssh/auth2-pam-freebsd.c

@@ -134,8 +134,8 @@ pam_thread_conv(int n,
 	*resp = xmalloc(n * sizeof **resp);
 	buffer_init(&buffer);
 	for (i = 0; i < n; ++i) {
-		resp[i]->resp_retcode = 0;
-		resp[i]->resp = NULL;
+		(*resp)[i].resp_retcode = 0;
+		(*resp)[i].resp = NULL;
 		switch (msg[i]->msg_style) {
 		case PAM_PROMPT_ECHO_OFF:
 			buffer_put_cstring(&buffer, msg[i]->msg);
@@ -143,7 +143,7 @@ pam_thread_conv(int n,
 			ssh_msg_recv(ctxt->pam_csock, &buffer);
 			if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 				goto fail;
-			resp[i]->resp = buffer_get_string(&buffer, NULL);
+			(*resp)[i].resp = buffer_get_string(&buffer, NULL);
 			break;
 		case PAM_PROMPT_ECHO_ON:
 			buffer_put_cstring(&buffer, msg[i]->msg);
@@ -151,7 +151,7 @@ pam_thread_conv(int n,
 			ssh_msg_recv(ctxt->pam_csock, &buffer);
 			if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 				goto fail;
-			resp[i]->resp = buffer_get_string(&buffer, NULL);
+			(*resp)[i].resp = buffer_get_string(&buffer, NULL);
 			break;
 		case PAM_ERROR_MSG:
 			buffer_put_cstring(&buffer, msg[i]->msg);
@@ -169,8 +169,6 @@ pam_thread_conv(int n,
 	buffer_free(&buffer);
 	return (PAM_SUCCESS);
  fail:
-	while (i)
-		xfree(resp[--i]);
 	xfree(*resp);
 	*resp = NULL;
 	buffer_free(&buffer);
@@ -539,20 +537,20 @@ pam_chauthtok_conv(int n,
 	for (i = 0; i < n; ++i) {
 		switch (msg[i]->msg_style) {
 		case PAM_PROMPT_ECHO_OFF:
-			resp[i]->resp =
+			(*resp)[i].resp =
 			    read_passphrase(msg[i]->msg, RP_ALLOW_STDIN);
-			resp[i]->resp_retcode = PAM_SUCCESS;
+			(*resp)[i].resp_retcode = PAM_SUCCESS;
 			break;
 		case PAM_PROMPT_ECHO_ON:
 			fputs(msg[i]->msg, stderr);
 			fgets(input, sizeof input, stdin);
-			resp[i]->resp = xstrdup(input);
-			resp[i]->resp_retcode = PAM_SUCCESS;
+			(*resp)[i].resp = xstrdup(input);
+			(*resp)[i].resp_retcode = PAM_SUCCESS;
 			break;
 		case PAM_ERROR_MSG:
 		case PAM_TEXT_INFO:
 			fputs(msg[i]->msg, stderr);
-			resp[i]->resp_retcode = PAM_SUCCESS;
+			(*resp)[i].resp_retcode = PAM_SUCCESS;
 			break;
 		default:
 			goto fail;
@@ -560,8 +558,6 @@ pam_chauthtok_conv(int n,
 	}
 	return (PAM_SUCCESS);
  fail:
-	while (i)
-		xfree(resp[--i]);
 	xfree(*resp);
 	*resp = NULL;
 	return (PAM_CONV_ERR);

crypto/openssh/buffer.c

@@ -23,8 +23,11 @@ RCSID("$OpenBSD: buffer.c,v 1.16 2002/06/26 08:54:18 markus Exp $");
 void
 buffer_init(Buffer *buffer)
 {
-	buffer->alloc = 4096;
-	buffer->buf = xmalloc(buffer->alloc);
+	const u_int len = 4096;
+
+	buffer->alloc = 0;
+	buffer->buf = xmalloc(len);
+	buffer->alloc = len;
 	buffer->offset = 0;
 	buffer->end = 0;
 }
@@ -34,8 +37,10 @@ buffer_init(Buffer *buffer)
 void
 buffer_free(Buffer *buffer)
 {
-	memset(buffer->buf, 0, buffer->alloc);
-	xfree(buffer->buf);
+	if (buffer->alloc > 0) {
+		memset(buffer->buf, 0, buffer->alloc);
+		xfree(buffer->buf);
+	}
 }
 
 /*
@@ -69,6 +74,7 @@ buffer_append(Buffer *buffer, const void *data, u_int len)
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+	u_int newlen;
 	void *p;
 
 	if (len > 0x100000)
@@ -98,11 +104,13 @@ restart:
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	if (buffer->alloc > 0xa00000)
+	
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
 		fatal("buffer_append_space: alloc %u not supported",
-		    buffer->alloc);
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 	/* NOTREACHED */
 }

crypto/openssh/channels.c

@@ -230,12 +230,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	if (found == -1) {
 		/* There are no free slots.  Take last+1 slot and expand the array.  */
 		found = channels_alloc;
-		channels_alloc += 10;
 		if (channels_alloc > 10000)
 			fatal("channel_new: internal error: channels_alloc %d "
 			    "too big.", channels_alloc);
+		channels = xrealloc(channels,
+		    (channels_alloc + 10) * sizeof(Channel *));
+		channels_alloc += 10;
 		debug2("channel: expanding %d", channels_alloc);
-		channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
 		for (i = found; i < channels_alloc; i++)
 			channels[i] = NULL;
 	}

crypto/openssh/deattack.c

@@ -100,12 +100,12 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 
 	if (h == NULL) {
 		debug("Installing crc compensation attack detector.");
+		h = (u_int16_t *) xmalloc(l * HASH_ENTRYSIZE);
 		n = l;
-		h = (u_int16_t *) xmalloc(n * HASH_ENTRYSIZE);
 	} else {
 		if (l > n) {
+			h = (u_int16_t *) xrealloc(h, l * HASH_ENTRYSIZE);
 			n = l;
-			h = (u_int16_t *) xrealloc(h, n * HASH_ENTRYSIZE);
 		}
 	}
 

crypto/openssh/misc.c

@@ -308,18 +308,21 @@ addargs(arglist *args, char *fmt, ...)
 {
 	va_list ap;
 	char buf[1024];
+	int nalloc;
 
 	va_start(ap, fmt);
 	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 
+	nalloc = args->nalloc;
 	if (args->list == NULL) {
-		args->nalloc = 32;
+		nalloc = 32;
 		args->num = 0;
-	} else if (args->num+2 >= args->nalloc)
-		args->nalloc *= 2;
+	} else if (args->num+2 >= nalloc)
+		nalloc *= 2;
 
-	args->list = xrealloc(args->list, args->nalloc * sizeof(char *));
+	args->list = xrealloc(args->list, nalloc * sizeof(char *));
+	args->nalloc = nalloc;
 	args->list[args->num++] = xstrdup(buf);
 	args->list[args->num] = NULL;
 }

crypto/openssh/session.c

@@ -861,8 +861,9 @@ static void
 child_set_env(char ***envp, u_int *envsizep, const char *name,
 	const char *value)
 {
-	u_int i, namelen;
 	char **env;
+	u_int envsize;
+	u_int i, namelen;
 
 	/*
 	 * Find the slot where the value should be stored.  If the variable
@@ -879,12 +880,13 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
 		xfree(env[i]);
 	} else {
 		/* New variable.  Expand if necessary. */
-		if (i >= (*envsizep) - 1) {
-			if (*envsizep >= 1000)
-				fatal("child_set_env: too many env vars,"
-				    " skipping: %.100s", name);
-			(*envsizep) += 50;
-			env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
+		envsize = *envsizep;
+		if (i >= envsize - 1) {
+			if (envsize >= 1000)
+				fatal("child_set_env: too many env vars");
+			envsize += 50;
+			env = (*envp) = xrealloc(env, envsize * sizeof(char *));
+			*envsizep = envsize;
 		}
 		/* Need to set the NULL pointer at end of array beyond the new slot. */
 		env[i + 1] = NULL;

crypto/openssh/ssh-agent.c

@@ -720,7 +720,7 @@ process_message(SocketEntry *e)
 static void
 new_socket(sock_type type, int fd)
 {
-	u_int i, old_alloc;
+	u_int i, old_alloc, new_alloc;
 
 	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
 		error("fcntl O_NONBLOCK: %s", strerror(errno));
@@ -731,25 +731,26 @@ new_socket(sock_type type, int fd)
 	for (i = 0; i < sockets_alloc; i++)
 		if (sockets[i].type == AUTH_UNUSED) {
 			sockets[i].fd = fd;
-			sockets[i].type = type;
 			buffer_init(&sockets[i].input);
 			buffer_init(&sockets[i].output);
 			buffer_init(&sockets[i].request);
+			sockets[i].type = type;
 			return;
 		}
 	old_alloc = sockets_alloc;
-	sockets_alloc += 10;
+	new_alloc = sockets_alloc + 10;
 	if (sockets)
-		sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
+		sockets = xrealloc(sockets, new_alloc * sizeof(sockets[0]));
 	else
-		sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
-	for (i = old_alloc; i < sockets_alloc; i++)
+		sockets = xmalloc(new_alloc * sizeof(sockets[0]));
+	for (i = old_alloc; i < new_alloc; i++)
 		sockets[i].type = AUTH_UNUSED;
-	sockets[old_alloc].type = type;
+	sockets_alloc = new_alloc;
 	sockets[old_alloc].fd = fd;
 	buffer_init(&sockets[old_alloc].input);
 	buffer_init(&sockets[old_alloc].output);
 	buffer_init(&sockets[old_alloc].request);
+	sockets[old_alloc].type = type;
 }
 
 static int

crypto/openssh/ssh_config

@@ -35,4 +35,4 @@
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
 #   EscapeChar ~
-#   VersionAddendum FreeBSD-20030201
+#   VersionAddendum FreeBSD-20030924

crypto/openssh/ssh_config.5

@@ -616,7 +616,7 @@ host key database instead of
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20030201 .
+.Dq FreeBSD-20030924 .
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1

crypto/openssh/sshd_config

@@ -14,7 +14,7 @@
 # Note that some of FreeBSD's defaults differ from OpenBSD's, and
 # FreeBSD has a few additional options.
 
-#VersionAddendum FreeBSD-20030201
+#VersionAddendum FreeBSD-20030924
 
 #Port 22
 #Protocol 2,1

crypto/openssh/sshd_config.5

@@ -647,7 +647,7 @@ The default is
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20030201 .
+.Dq FreeBSD-20030924 .
 .It Cm X11DisplayOffset
 Specifies the first display number available for
 .Nm sshd Ns 's

crypto/openssh/version.h

@@ -5,7 +5,7 @@
 
 #define SSH_VERSION             (ssh_version_get())
 #define SSH_VERSION_BASE        "OpenSSH_3.5p1"
-#define SSH_VERSION_ADDENDUM    "FreeBSD-20030201"
+#define SSH_VERSION_ADDENDUM    "FreeBSD-20030924"
 
 const char *ssh_version_get(void);
 void ssh_version_set_addendum(const char *add);

crypto/openssl/crypto/asn1/asn1_lib.c

@@ -104,10 +104,12 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
 			l<<=7L;
 			l|= *(p++)&0x7f;
 			if (--max == 0) goto err;
+			if (l > (INT_MAX >> 7L)) goto err;
 			}
 		l<<=7L;
 		l|= *(p++)&0x7f;
 		tag=(int)l;
+		if (--max == 0) goto err;
 		}
 	else
 		{ 

crypto/openssl/crypto/asn1/tasn_dec.c

@@ -691,6 +691,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 
 int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
 {
+	ASN1_VALUE **opval = NULL;
 	ASN1_STRING *stmp;
 	ASN1_TYPE *typ = NULL;
 	int ret = 0;
@@ -705,6 +706,7 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
 			*pval = (ASN1_VALUE *)typ;
 		} else typ = (ASN1_TYPE *)*pval;
 		if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL);
+		opval = pval;
 		pval = (ASN1_VALUE **)&typ->value.ptr;
 	}
 	switch(utype) {
@@ -796,7 +798,12 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
 
 	ret = 1;
 	err:
-	if(!ret) ASN1_TYPE_free(typ);
+	if(!ret)
+		{
+		ASN1_TYPE_free(typ);
+		if (opval)
+			*opval = NULL;
+		}
 	return ret;
 }
 

crypto/openssl/crypto/opensslv.h

@@ -26,7 +26,7 @@
  *  major minor fix final patch/beta)
  */
 #define OPENSSL_VERSION_NUMBER	0x0090701fL
-#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7a Feb 19 2003"
+#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7a-p1 Feb 19 2003"
 #define OPENSSL_VERSION_PTEXT	" part of " OPENSSL_VERSION_TEXT
 
 

crypto/openssl/crypto/x509/x509_vfy.c

@@ -674,7 +674,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
 				ok=(*cb)(0,ctx);
 				if (!ok) goto end;
 				}
-			if (X509_verify(xs,pkey) <= 0)
+			else if (X509_verify(xs,pkey) <= 0)
 				/* XXX  For the final trusted self-signed cert,
 				 * this is a waste of time.  That check should
 				 * optional so that e.g. 'openssl x509' can be

crypto/openssl/ssl/s23_srvr.c

@@ -268,9 +268,6 @@ int ssl23_get_client_hello(SSL *s)
 	int n=0,j;
 	int type=0;
 	int v[2];
-#ifndef OPENSSL_NO_RSA
-	int use_sslv2_strong=0;
-#endif
 
 	if (s->state ==	SSL23_ST_SR_CLNT_HELLO_A)
 		{
@@ -519,9 +516,7 @@ int ssl23_get_client_hello(SSL *s)
 			}
 
 		s->state=SSL2_ST_GET_CLIENT_HELLO_A;
-		if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||
-			use_sslv2_strong ||
-			(s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3))
+		if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)
 			s->s2->ssl2_rollback=0;
 		else
 			/* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0

crypto/openssl/ssl/s3_pkt.c

@@ -1085,6 +1085,14 @@ start:
 			goto err;
 			}
 
+		/* Check we have a cipher to change to */
+		if (s->s3->tmp.new_cipher == NULL)
+			{
+			i=SSL_AD_UNEXPECTED_MESSAGE;
+			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+			goto err;
+			}
+
 		rr->length=0;
 
 		if (s->msg_callback)

crypto/openssl/ssl/s3_srvr.c

@@ -431,10 +431,11 @@ int ssl3_accept(SSL *s)
 			if (ret == 2)
 				s->state = SSL3_ST_SR_CLNT_HELLO_C;
 			else {
-				/* could be sent for a DH cert, even if we
-				 * have not asked for it :-) */
-				ret=ssl3_get_client_certificate(s);
-				if (ret <= 0) goto end;
+				if (s->s3->tmp.cert_request)
+					{
+					ret=ssl3_get_client_certificate(s);
+					if (ret <= 0) goto end;
+					}
 				s->init_num=0;
 				s->state=SSL3_ST_SR_KEY_EXCH_A;
 			}

crypto/telnet/telnet/telnet.c

@@ -1318,6 +1318,7 @@ slc_check(void)
 }
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1333,6 +1334,14 @@ slc_start_reply(void)
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1346,6 +1355,9 @@ slc_end_reply(void)
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1463,8 +1475,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1517,9 +1529,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1543,6 +1555,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1557,6 +1571,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1587,7 +1603,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

games/fortune/datfiles/gerrold.limerick

@@ -1,823 +0,0 @@
-%% $FreeBSD$
-%% From The War Against The Chtorr,
-%% Copyright David Gerrold, 1984-2000, all rights reserved,
-%% used with permission of the author.
-%%
-%%© This is the copyright line.
-%%Eighty-nine is the year we assign.
-%%	These verses are caroled
-%%	by one David Gerrold.
-%%All rights are reserved. This is mine. *
-%%
-A limerick of classic proportion
-should have meter and rhyme and a portion
-	of humor quite lewd,
-	and a frightfully crude,
-impossible sexual contortion.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A limerick is best when it's lewd,
-gross, titillating and crude --
-	but this one is clean,
-	unless you are seen
-reading it aloud in the nude.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I wanted to print here a medley
-of limericks so gross they were deadly,
-	but when the typesetter tried
-	to set them, he died;
-(not to mention my editor, Smedly.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I have written some limericks quite fateful,
-malicious and vicious and hateful;
-	but I've torn up the jokes
-	that will sicken most folks,
-and humanity ought to be grateful.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady named Susie,
-Who everyone thought was a floozy.
-	She liked boy scout troops
-	and Shriners, in groups;
-"What the hell?" She replied. "I'm not choosy."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A fellow who lived in West Perkin
-was always a-jerkin' his gherkin.
-	Said he, "It's not fickle
-	to play with my pickle.
-At least my gherkin's a workin'."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A proctologist name of McGee
-once bent over double to see
-	an eyeball of glass
-	he had shoved up his ass,
-"-- so I can see one that looks back at me."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Bart has a singular penis
-for his wife who is built like a Venus.
-	He awoke with a fright
-	last Saturday night:
-"Hey! Something is coming between us!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who lives in New Delhi
-has habits disgusting and smelhi.
-	She likes to eat feces
-	of various species.
-(The recipe is tattooed or her belhi.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A daisy chain isn't a riddle.
-just some folks who are happy to fiddle,
-	by twos and by threes,
-	on their backs or their knees,
-and it's fun getting caught in the middle!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lad with a marvelous bend
-has no need of a lover or friend.
-	What he does to himself
-	would fill up a shelf,
-but alas, he has come to his end.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old witch, name of Jessie
-whose crotch was all smelly and messie.
-	She enjoyed a good squirm
-	with an alien worm
--- and got stains all over her dressie!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who favors coition,
-has invented the spaceship position.
-	She lies down with ease
-	and pulls up her knees,
-and hollers, "Lift off!" and "Ignitions!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Isaac the famous seducer,
-will meet a young lass and conducer
-	to let him get fresh
-	with her quivering flesh,
-but if there isn't the time, he'll just gucer.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-And old man of Texas named Tanners
-was notorious for his bad manners.
-	When he noticed the start
-	of an imminent fart,
-he'd announce it with bullhorns and banners.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A woman who wanted to see,
-if she stood up, how far she could pee,
-	had pardon to beg,
-	when it ran down her leg,
-and formed icicles off her left knee.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A promiscuous sort was dear Laurie
-(Yes, this is that kind of story.)
-	She did it with Joe
-	and Larry and Moe
-and Curly and Howard and Morrie.
-
-And Johnny and Richard and Pritchard and Kerry
-And Lonnie and Horace and Boris and Barry
-	and Donald and Harold
-	and Ronald and Gerald
-and Tommy and Dicky and Harry.
-
-And . . . Peter and Paul and Teddy and Todd
-and Matthew and Mark and Simon and Rod
-	and Brucie and Mark
-	and Bobby and Clarck
-and she still isn't finished! My God!
-
-And David and Dennis and Huey and Ken
-and Dewey and Louie, then David again,
-	and Willy and Ben
-	and David again
-and again and again and again.
-
-And Danny and Manny and Gary and Fred
-and Mackie and Jackie and Dougie and Ned
-	and Harvey and Len
-	(then David again)
-and -- hold on just a second, she's dead!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Loo,
-who gave his dear sister a screw.
-	Said he, with aplomb,
-	"You're better than Mom."
-Said she, "That's what Dad told me too!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who didn't like flies
-managed to hide her surprise,
-	when she opened up one
-	and found it was fun.
-Now she willingly widens her thighs.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady named Nancy,
-who liked having sex, plain of fancy.
-	With lightning and thunder,
-	and a profound sense of wonder,
-But not with a partner -- much too chancy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady quite tearful.
-Of sucking a cock, she was fearful.
-	In a moment of dreard,
-	she just turned her head.
-And, boy! Did she get an earful!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A mathematician named Boris
-had a wife with a wondrous clitoris.
-	He charged a small fee
-	for his colleagues to see
-that it was made in the shape of a torus.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The ladies all had to agree
-that Mort's penis was too small to see.
-	A whore named Louise
-	sniffed, "Who will _that_ please?"
-Mort proudly submitted, "Just me!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Fisk
-whose comings and goings were brisk,
-	He hid things that were stolen
-	inside his colon,
-and said, "Hey! It's my own *."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A stunning young lady named Joan
-thought a penis was made with a bone.
-	She just didn't know
-	'twas her sexual glow
-that turned parts of men into stone.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A midwife named Flo from Arabia
-often enjoys giving baby a
-	forty-volt shock
-	to the base of the cock.
-(On a girl, she goes for the labia.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I know of a lass who's for sale.
-She's really a nice piece of tail.
-	From June to September,
-	she'll devour your member,
-but the rest of the year, she's in jail.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Miss Wilkerson thought it her duty
-to maintain her conjugal beauty.
-	She mixed up a paste
-	of industrial waste,
-and applied it to her sweet patootie.*
-
-* The facts about beauty are known,
-and well-learned by those who are grown:
-	beauty is thin,
-	it lies on the skin;
-but ugly goes down to the bone.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The punctual Cynthia Rolen
-missed a period, (or it was stolen)
-	She looked up her ass
-	with a tube made of glass,
-but found only her own semi-colon;
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A short-organ fellow named Kevin
-used a vacuum to stretch it to seven,
-	then to eight and to nine,
-	and though ten was divine,
-there will be film at eleven.*
-
-* If you think that our boy's now a stud,
-you've been fooled by the size of his pud.
-	Although twelve inches soft,
-	when it rises aloft,
-he just faints from the sheer lack of blood.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a lady named Lizard,
-who got lost in a pink candy blizzard,
-	with a fellow named Jim
-	who wanted to swim
-up her legs to visit her gizzard.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Ted,
-who had a radio put in his head.
-	Long wave or short
-	he did it for sport
--- and to improve his reception in bed.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady from Venus,
-whose body was shaped like a penis.
-	A fellow named Hunt
-	was shaped like a cunt,
-so it all worked out fine, just between us.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old bastard named Gene,
-impotent, selfish, and mean.
-	His dick was so shamed
-	by what the man claimed,
-it pretended that is was a spleen.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a fellow named Jason,
-whose horrible death I would hasten.
-	I'd feed him to worms,
-	just to see how he squirms
--- but they'd vomit his crap  in a basin.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-With a French lass, it's unwise to trifle.
-They have urges they simply can't stifle.
-	A woman of France
-	will pull down her pants
-at the sight of a towering eye-full.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-"My God!" screamed devout Mrs. Pike,
-as she fondled her stableman's spike.
-	"This is quite out of place,
-	and a great loss of face
--- but I think I have fallen in like!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A well-endower fellow from Ortening
-prepared for an evening of sportening,
-	with a boy from a disco,
-	till he lubed up his Crisco,
-and discovered, alas, it was _shortening_!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who read Sigmund Freud,
-thought her genitals underemployed;
-	so she put in a stand
-	for a seven-piece band,
-and held dances that we all enjoyed.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady named Shirley was mellow
-and she said to her eager young fellow,
-	"I prefer bagels and lox
-	to sucking off cocks,
-Or even a nice dish of Jell-O!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Helens
-afflicted with shrinkin's and swellin's.
-	His dick was so small
-	it was not there at all,
-but his balls looked like honeydew melons.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A woman who once faked a lettera
-reference by which she could gettera
-	job much improved,
-	regretted her move
-when they asked her to show her et cetera.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady of South Madagascar
-wears a bag on her head; it's to mask her.
-	A bottle of scotch
-	might loosen her crotch.
-Wait here, I'll go and I'll ask her.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Chuck is weird, let the whole world know it.
-He brought in his bucket to show it.
-	We all had a fit
-	when we saw it was shit.
-We didn't know he was planning to throw it.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-"Which partners are best? Sixty-niners.
-And better than that? Try the Shriners."
-	These are the results
-	of consenting adults,
-(and occasional like-minded minors.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady's iambic pentameter
-is thirty-two inches diameter.
-	The breadth of her scansion
-	is due to expansion
-in the pants of a critical amateur.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow from Norwich
-Who liked having sex with his porridge.
-	With sugar and cream
-	and a buttery scream --
-(The leftovers went into storage.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Jim
-who liked to get naked and swim
-	with plastic sex toys
-	shaped like pubescent boys,
-'cause he'd rather be gay than be grim.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who jogged in the breeze
-had bosoms that flapped to her knees.
-	Said she, "They're quite warm,
-	they keep me dry in a storm,
-and when it snows, I use them for skis."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old voyeur named Zeke,
-who liked to hide in the closet and peek,
-	then jump out with loud cries
-	of "Aha!" and "Surprise!"
-and point out your flaws in technique.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Rick promised to gently deflower
-a maiden who lived on South Gower,
-	(The truth is, he spread
-	her legs wide on the bed,
-and finsihed her off in an hour.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-These poems have come out of my forehead.
-The subject are all fairly torrid
-	-- except for the few
-	that will make you say, "Pugh!"
-And those are the ones that are horrid.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Juanita, the subject of scandals,
-used to use unscented candles,
-	but now thinks it nice
-	to use a device
-with batteries, buzzers, and handles.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old prune name of Ginty
-who only ate muffins and thin tea.
-	Thinking of sex
-	gave her the blecchs,
-and left her all dried up and squinty.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I have written some limericks quite fateful,
-malicious and vicious and hateful;
-	but I've torn up the jokes
-	that would sicken most folks,
-and humanity ought ot be grateful;
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Here's the tale of Benjamin Sneed:
-Where others were two'd he was three'd
-	and when they unmasked it,
-	(three balls in his basket),
-he was voted "Most Likely to Breed."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A maiden who had a third breast
-always kept her hand close to her chest,
-	and I promised her well
-	that I never woudl tell.
-(Write me privately. Name on request.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Skydiver Daniel McDopp
-used to masturbate right from the top.
-	Whenever he fell,
-	he jerked off like hell.
-He was good to the very last drop.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A necrophile name of Ned Schultz,
-often brags of his deed and exults,
-	"Tis legal, it's said,
-	to make love to the dead,
-if performed by consenting adults."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Have you ever met Jamie McBeezis?
-He does any damn thing that he pleases.
-	Says Jamie, undaunted,
-	"If you've got it,then flaunt it!"
-But he's referring to social diseases.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a nearsighted gynie
-whose glasses were sparkly and shiny;
-	but they stayed in the drawer
-	while he worked on a whore
-and tied up the tubes of her hiney.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A shepherd named Jimmie Fitzhugh,
-said to his sweetheart, "It's true.
-	Nothing is moister
-	than a fresh oister,
-unless, of course, it is ewe."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There's a reason why Barton is queer.
-When you meet him, the reason is clear.
-	A goddess named Venus
-	gave him a penis,
-but Mother Nature filled up his brassiere.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Then there was Benjamin Bright,
-a contestant on "What's My Delight?"
-	They guesses at his habits
-	with little white rabbits,
-but were stumped by his mouse and his kite.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Lutz,
-who had a remarkable putz.
-	It would sniff, it would hunt,
-	for it only liked cunt.
-Absolutely no lips, hands, or butts.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally's sex life was carefully planned.
-Said she, "I prefer to be manned.
-	Things that are anal,
-	are always so banal,
-but things that expand are just grand."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally-Jo was exceedingly vexed,
-when they said she was quite oversexed.
-	She said, "That's not true,
-	I just like to screw,
-Now, please take a number. Who's next?"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally sued for support; she was claimin'
-Phil had fathered her baby (named Damon).
-	She said, "I ought to know."
-	as she pointed below.
-"'Cause this is the box that he came in."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-We will need a computer to tally
-all the cowboys who scouted our Sally.
-	There were some on her mountains
-	and some on her fountains,
-and quite a few down in the valley.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who overly lusted
-was frequently opened and thrusted.
-	When the baby came due
-	it was female too,
-and its hymen was already busted.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-When writing these verses of mine,
-I start with a clever last line,
-	then work backward from there,
-	toward the opening pair,
-with the hope it'll all work out fine.*
-
-*only sometimes it doesn't.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a whore from St. Paul,
-who took anyone, wide, short, or tall.
-	She said to her clients,
-	"It's not really science --
-it's just that one size will fit all!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Forrest
-whose cornhole was one of the sorest.
-	Said he, "I don't mind
-	a regular grind
--- but I do wish my ass were clitorised."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-When Shakespeare awakes with a scream
-and his member a-drippin' with cream,
-	'tis just the commission
-	of nocturnal emission,
-which he dubs, "A Mid-Slumber Night-Stream."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally-Jo taught erotic correction.
-She told her student to get an erection.
-	"Put your dick in my mouth.
-	Move it north, move it south --
-Now, you're getting a sense of direction!"
-
-Her instructions were very explicit,
-and more than a little illicit:
-	"Please fill up my cunny
-	with fresh clover honey,
-and butter my buns like a biscuit."
-
-"Then wrap me up nice in a blanket,
-and I'll sit on your staff while you crank it.
-	I'll put on some feathers,
-	and laces and leathers,
-and wiggle my ass while you spank it."
-
-"Now that your fingers are stinky,
-tie me up in some chains that are clinky.
-	Bring in goats and a sheik,
-	give my titties a tweak
---and _now_, we can start getting kinky!"
-
-"Forget what the chain and the whip meant.
-Just get the straps and the slings and a shipment
-	of high-grade Vaseline,
-	and a strong trampoline,
-and allof the other equipment!"
-
-"Now, when we get all the bedsprings a-drummin',
-that's when I'll start in a-hummin',
-	then quickly, my dear,
-	put it into my ear,
-so I'll hear the sound of it comin'!"
-
-"I don't know how much this is costing,"
-said her student, still covered with frosting.
-	"But I can say with affinity
-	that I've lost my virginity.
-Quite frankly, my dear, you're _exhausting_!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a mad pilot named Lizzy,
-whose manners were said to be skizzy.
-	She could loop, she could twirl,
-	she could make your head whirl.
-She left all her men fucking dizzy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The speed of Ed's seed is unclocked
-whenever a lady's unfrocked.
-	Tho' his spirit is willin,
-	when a pussy needs fillin',
-he's a man who goes off half-cocked.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady whose name is Tirelli
-has tits made of dynamite jelli.
-	If you take on this dare,
-	you must fondle with care.
-(The detonator's south of her belli.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The fame of our Mame was her tushy,
-and the front of her cunt. (It was bushy.)
-	But I heard that her Mike
-	preferred for his spike
-the place in her face that was skwooshy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A whore with a face like a hound
-complained that her sales were down,
-	till a lover named Michael
-	bought her a cycle,
-and she peddled it all over town.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man named Levine
-who said to his lady, inclined,
-	"Thanks for the spasm,
-	it felt like orgasm;
-as a matter of fact, 'twas divine."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A king who was mad at the time,
-decreed limerick writing a crime.
-	but late in the night
-	all the poets woudl write
-verses without any rhyme or meter.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%

gnu/usr.bin/cvs/lib/config.h.proto

@@ -248,7 +248,7 @@
 #define HAVE_SIGVEC 1
 
 /* Define to 1 if you have the <stdint.h> header file. */
-#define HAVE_STDINT_H 1
+/* #undef HAVE_STDINT_H */
 
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1

gnu/usr.bin/groff/tmac/mdoc.local

@@ -52,7 +52,7 @@
 .ds doc-str-Lb-libvgl      Video Graphics Library (libvgl, \-lvgl)
 .
 .\" Default .Os value
-.ds doc-operating-system FreeBSD\~4.7
+.ds doc-operating-system FreeBSD\~4.8
 .
 .ec
 .

gnu/usr.bin/gzip/gzip.c

@@ -830,8 +830,11 @@ local void treat_file(iname)
     }
 
     close(ifd);
-    if (!to_stdout && close(ofd)) {
-	write_error();
+    if (!to_stdout) {
+        /* Copy modes, times, ownership, and remove the input file */
+        copy_stat(&istat);
+        if (close(ofd))
+	    write_error();
     }
     if (method == -1) {
 	if (!to_stdout) unlink (ofname);
@@ -851,10 +854,6 @@ local void treat_file(iname)
 	}
 	fprintf(stderr, "\n");
     }
-    /* Copy modes, times, ownership, and remove the input file */
-    if (!to_stdout) {
-	copy_stat(&istat);
-    }
 }
 
 /* ========================================================================
@@ -1257,6 +1256,7 @@ local int get_method(in)
 		/* Copy the base name. Keep a directory prefix intact. */
                 char *p = basename(ofname);
                 char *base = p;
+		char *base2;
 		for (;;) {
 		    *p = (char)get_char();
 		    if (*p++ == '\0') break;
@@ -1264,6 +1264,8 @@ local int get_method(in)
 			error("corrupted input -- file name too large");
 		    }
 		}
+		base2 = basename (base);
+		strcpy(base, base2);
                 /* If necessary, adapt the name to local OS conventions: */
                 if (!list) {
                    MAKE_LEGAL_NAME(base);
@@ -1636,12 +1638,12 @@ local void copy_stat(ifstat)
     reset_times(ofname, ifstat);
 #endif
     /* Copy the protection modes */
-    if (chmod(ofname, ifstat->st_mode & 07777)) {
+    if (fchmod(ofd, ifstat->st_mode & 07777)) {
 	WARN((stderr, "%s: ", progname));
 	if (!quiet) perror(ofname);
     }
 #ifndef NO_CHOWN
-    chown(ofname, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
+    (void) fchown(ofd, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
 #endif
     remove_ofname = 0;
     /* It's now safe to remove the input file: */

gnu/usr.bin/send-pr/send-pr.sh

@@ -262,7 +262,7 @@ TEMP=`mktemp -t pf` || exit 1
 # Catch some signals. ($xs kludge needed by Sun /bin/sh)
 xs=0
 trap 'rm -f $REF $TEMP; exit $xs' 0
-trap 'echo "$COMMAND: Aborting ..."; rm -f $REF $TEMP; xs=1; exit' 1 2 3 13 15
+trap 'SAV=`mktemp -t pr`;echo "$COMMAND: Aborting ... saving unfinished PR into $SAV"; rm -f $REF ; mv $TEMP $SAV; xs=1; exit' 1 2 3 13 15
 
 # If they told us to use a specific file, then do so.
 if [ -n "$IN_FILE" ]; then

lib/libc/stdlib/realpath.c

@@ -138,7 +138,8 @@ loop:
 		rootd = 0;
 
 	if (*wbuf) {
-		if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
+		if (strlen(resolved) + strlen(wbuf) + (1-rootd) + 1 >
+		    MAXPATHLEN) {
 			errno = ENAMETOOLONG;
 			goto err1;
 		}

libexec/lukemftpd/nbsd2fbsd.h

@@ -1,17 +0,0 @@
-/* $FreeBSD$ */
-
-/* XXX: Depend on our system headers protecting against multiple includes. */
-#include <paths.h>
-#undef _PATH_FTPUSERS
-
-#include <pwd.h>
-
-#define _DIAGASSERT(x)
-
-#include <sys/_types.h>
-#ifndef _SIZE_T_DECLARED
-typedef	__size_t	size_t;
-#define	_SIZE_T_DECLARED
-#endif
-long long strsuftollx(const char *, const char *,
-    long long, long long, char *, size_t);

libexec/lukemftpd/pamize.h

@@ -1,153 +0,0 @@
-/* $FreeBSD$ */
-
-
-#ifdef USE_PAM
-/*
- * the following code is stolen from imap-uw PAM authentication module and
- * login.c
- */
-#define COPY_STRING(s) (s ? strdup(s) : NULL)
-
-struct cred_t {
-	const char *uname;		/* user name */
-	const char *pass;		/* password */
-};
-typedef struct cred_t cred_t;
-
-static int
-auth_conv(int num_msg, const struct pam_message **msg,
-	  struct pam_response **resp, void *appdata)
-{
-	int i;
-	cred_t *cred = (cred_t *) appdata;
-	struct pam_response *reply;
-
-	reply = calloc(num_msg, sizeof *reply);
-	if (reply == NULL)
-		return PAM_BUF_ERR;
-
-	for (i = 0; i < num_msg; i++) {
-		switch (msg[i]->msg_style) {
-		case PAM_PROMPT_ECHO_ON:	/* assume want user name */
-			reply[i].resp_retcode = PAM_SUCCESS;
-			reply[i].resp = COPY_STRING(cred->uname);
-			/* PAM frees resp. */
-			break;
-		case PAM_PROMPT_ECHO_OFF:	/* assume want password */
-			reply[i].resp_retcode = PAM_SUCCESS;
-			reply[i].resp = COPY_STRING(cred->pass);
-			/* PAM frees resp. */
-			break;
-		case PAM_TEXT_INFO:
-		case PAM_ERROR_MSG:
-			reply[i].resp_retcode = PAM_SUCCESS;
-			reply[i].resp = NULL;
-			break;
-		default:			/* unknown message style */
-			free(reply);
-			return PAM_CONV_ERR;
-		}
-	}
-
-	*resp = reply;
-	return PAM_SUCCESS;
-}
-
-/*
- * Attempt to authenticate the user using PAM.  Returns 0 if the user is
- * authenticated, or 1 if not authenticated.  If some sort of PAM system
- * error occurs (e.g., the "/etc/pam.conf" file is missing) then this
- * function returns -1.  This can be used as an indication that we should
- * fall back to a different authentication mechanism.
- */
-static int
-auth_pam(struct passwd **ppw, const char *pass)
-{
-	pam_handle_t *pamh = NULL;
-	const char *tmpl_user;
-	const void *item;
-	int rval;
-	int e;
-	cred_t auth_cred = { (*ppw)->pw_name, pass };
-	struct pam_conv conv = { &auth_conv, &auth_cred };
-
-	e = pam_start("ftpd", (*ppw)->pw_name, &conv, &pamh);
-	if (e != PAM_SUCCESS) {
-		syslog(LOG_ERR, "pam_start: %s", pam_strerror(pamh, e));
-		return -1;
-	}
-
-	e = pam_set_item(pamh, PAM_RHOST, remotehost);
-	if (e != PAM_SUCCESS) {
-		syslog(LOG_ERR, "pam_set_item(PAM_RHOST): %s",
-			pam_strerror(pamh, e));
-		return -1;
-	}
-
-	e = pam_authenticate(pamh, 0);
-	switch (e) {
-	case PAM_SUCCESS:
-		/*
-		 * With PAM we support the concept of a "template"
-		 * user.  The user enters a login name which is
-		 * authenticated by PAM, usually via a remote service
-		 * such as RADIUS or TACACS+.  If authentication
-		 * succeeds, a different but related "template" name
-		 * is used for setting the credentials, shell, and
-		 * home directory.  The name the user enters need only
-		 * exist on the remote authentication server, but the
-		 * template name must be present in the local password
-		 * database.
-		 *
-		 * This is supported by two various mechanisms in the
-		 * individual modules.  However, from the application's
-		 * point of view, the template user is always passed
-		 * back as a changed value of the PAM_USER item.
-		 */
-		if ((e = pam_get_item(pamh, PAM_USER, &item)) ==
-		    PAM_SUCCESS) {
-			tmpl_user = (const char *) item;
-			if (strcmp((*ppw)->pw_name, tmpl_user) != 0)
-				*ppw = getpwnam(tmpl_user);
-		} else
-			syslog(LOG_ERR, "Couldn't get PAM_USER: %s",
-			    pam_strerror(pamh, e));
-		rval = 0;
-		break;
-
-	case PAM_AUTH_ERR:
-	case PAM_USER_UNKNOWN:
-	case PAM_MAXTRIES:
-		rval = 1;
-		break;
-
-	default:
-		syslog(LOG_ERR, "pam_authenticate: %s", pam_strerror(pamh, e));
-		rval = -1;
-		break;
-	}
-
-	if (rval == 0) {
-		e = pam_acct_mgmt(pamh, 0);
-		if (e == PAM_NEW_AUTHTOK_REQD) {
-			e = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
-			if (e != PAM_SUCCESS) {
-				syslog(LOG_ERR, "pam_chauthtok: %s",
-				    pam_strerror(pamh, e));
-				rval = 1;
-			}
-		} else if (e != PAM_SUCCESS) {
-			rval = 1;
-		}
-	}
-
-	if (rval != 0) {
-		if ((e = pam_end(pamh, e)) != PAM_SUCCESS) {
-			syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e));
-		}
-		pamh = NULL;
-	}
-	return rval;
-}
-
-#endif /* USE_PAM */

libexec/lukemftpd/util.h

@@ -1,3 +0,0 @@
-/* $FreeBSD$ */
-
-#include <libutil.h>

release/Makefile

@@ -25,7 +25,7 @@
 #
 # Automatic SNAP versioning:
 DATE != date +%Y%m%d
-BASE = 4.7
+BASE = 4.8
 BUILDNAME?=${BASE}-${DATE}-STABLE
 #
 #CHROOTDIR=/junk/release

release/alpha/dokern.sh

@@ -6,6 +6,7 @@
 sed	\
 	-e '/DEC_3000_300/d' \
 	-e '/DEC_3000_500/d' \
+	-e '/DEC_KN8AE/d' \
 	-e '/SOFTUPDATES/d' \
 	-e '/UFS_DIRHASH/d' \
 	-e '/MFS/d' \
@@ -19,6 +20,7 @@ sed	\
 	-e '/ICMP_BANDLIM/d' \
 	-e '/AHC_REG_PRETTY_PRINT/d' \
 	-e '/AHD_REG_PRETTY_PRINT/d' \
+	-e '/atapifd/d' \
 	-e '/atapist/d' \
 	-e '/	ncr/d' \
 	-e '/	sa/d' \

release/doc/de_DE.ISO8859-1/errata/article.sgml

@@ -8,8 +8,8 @@
 	(If we didn't do this, then the file with the datestamp might
 	not be the one that received the last change in the document.)
 
-	$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/errata/article.sgml,v 1.4.2.37 2003/02/06 22:11:34 ue Exp $
-	basiert auf: 1.1.2.93
+	$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/errata/article.sgml,v 1.4.2.42 2003/03/28 13:29:03 ue Exp $
+	basiert auf: 1.1.2.98
 -->
 
 <!DOCTYPE ARTICLE PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
@@ -171,6 +171,57 @@
       Privilegien erhalten konnte.  Weitere Informationen finden Sie
       in <ulink
       url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:44.filedesc.asc">FreeBSD-SA-02:44</ulink>.</para>
+
+    <para>Ein &uuml;ber das Netzwerk ausnutzbarer Fehler in
+      <application>CVS</application> k&ouml;nnte dazu f&uuml;hren,
+      da&szlig; ein Angreifer beliebige Programme auf dem CVS Server
+      ausf&uuml;hren kann.  Weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:01.cvs.asc">FreeBSD-SA-03:01</ulink>.</para>
+
+    <para>Durch Auswertung der Antwortzeiten von
+      <application>OpenSSL</application> w&auml;re es einem Angreifer
+      mit sehr viel Rechenleistung m&ouml;glich gewesen, unter
+      bestimmten Umst&auml;nden den Klartext der &uuml;bermittelten
+      Daten zu erhalten.  Dieser Fehler wurde in &os;
+      &release.current; durch die neue
+      <application>OpenSSL</application> Version 0.9.7 behoben.  Auf
+      den f&uuml;r Sicherheitsprobleme unterst&uuml;tzten
+      Entwicklungszweigen wurde der Fehler durch die neue
+      <application>OpenSSL</application> Version 0.9.6i behoben.
+      Weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:02.openssl.asc">FreeBSD-SA-03:02</ulink>.</para>
+
+    <para>Es ist theoretisch m&ouml;glich, da&szlig; ein Angreifer
+      den geheimen Schl&uuml;ssel ermittelt, der von der Erweiterung
+      <quote>syncookies</quote> genutzt wird.  Dadurch sinkt deren
+      Effektivit&auml;t beim Schutz vor TCP SYN Flood
+      Denial-of-Service Angriffen.  Hinweise, wie sie das Problem
+      umgehen k&ouml;nnen und weitere Informationen finden Sie in
+      <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:03.syncookies.asc">FreeBSD-SA-03:03</ulink>.</para>
+
+    <para>Durch einen Buffer-&Uuml;berlaufen in den von
+      <application>sendmail</application> genutzten Routinen zum
+      Parsen des Headers war es einen Angreifer m&ouml;glich, eine
+      speziell konstruierte Nachricht an &man.sendmail.8; zu senden
+      und so beliebige Programme ausf&uuml;hren zu lassen.  Diese
+      Programme verf&uuml;gten &uuml;ber die Rechte des Benutzer,
+      unter dessen Kennung &man.sendmail.8; lief, also typischerweise
+      <username>root</username>.  Weitere Informationen und Verweise
+      auf Patches finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:04.sendmail.asc">FreeBSD-SA-03:04</ulink>.</para>
+
+    <para>Durch einen Puffer-&Uuml;berlauf im XDR Kodierer/Dekodierer
+      war es einem Angreifer m&ouml;lich, den Service zum Absturz zu
+      bringen.  Informationen, wie Sie den Fehler beheben, finden Sie
+      in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:05.xdr.asc">FreeBSD-SA-03:05</ulink>.</para>
+
+    <para><application>OpenSSL</application> enth&auml;lt zwei
+      Schwachstellen, die erst vor kurzer Zeit bekanntgemacht wurden.
+      Informationen, wie Sie die Probleme umgehen k&ouml;nnen und
+      weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:06.openssl.asc">FreeBSD-SA-03:06</ulink>.</para>
 ]]>
   </sect1>
 

release/doc/de_DE.ISO8859-1/hardware/common/dev.sgml

@@ -28,8 +28,8 @@
 	this file to fix "missed" conversions are likely to break the
 	build.
 
-	$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/hardware/common/dev.sgml,v 1.3.2.26 2003/01/18 19:29:31 ue Exp $
-	basiert auf: 1.13.2.75
+	$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/hardware/common/dev.sgml,v 1.3.2.30 2003/03/19 10:40:36 ue Exp $
+	basiert auf: 1.13.2.79
 -->
 
 <sect1>
@@ -870,8 +870,8 @@
       </itemizedlist>
     </para>
 
-    <para arch="i386">Promise SuperTrak ATA RAID Controller (pst
-      Treiber)
+    <para arch="i386">Promise SuperTrak ATA RAID Controller
+      (&man.pst.4; Treiber)
       <itemizedlist>
         <listitem>
           <para>Promise SuperTrak SX6000 ATA RAID Controller</para>
@@ -893,7 +893,7 @@
     </para>
 
     <para arch="i386">PCI SCSI Hostadapter auf Basis des Tekram
-      TRM-S1040 SCSI Chipsatzes (trm Treiber)
+      TRM-S1040 SCSI Chipsatzes (&man.trm.4; Treiber)
       <itemizedlist>
 	<listitem>
 	  <para>Tekram DC395U/UW/F</para>
@@ -1451,7 +1451,8 @@
     </para>
 
     <para arch="i386,alpha">VIA Technologies VT3043 <quote>Rhine
-      I</quote> und VT86C100A <quote>Rhine II</quote> Fast Ethernet
+      I</quote>, VT86C100A <quote>Rhine II</quote> und
+      VT86C105/VT86C105M <quote>Rhine III</quote> Fast Ethernet
       Karten (&man.vr.4; Treiber)
       <itemizedlist>
         <listitem>
@@ -1828,7 +1829,7 @@
       </itemizedlist>
     </para>
 
-    <para arch="i386,alpha">Davicom DM9100 und DM9102 PCI Fast
+    <para arch="i386,alpha">Davicom DM9009, DM9100 und DM9102 PCI Fast
       Ethernet Karten (&man.dc.4; Treiber)
       <itemizedlist>
         <listitem>
@@ -2965,6 +2966,9 @@
       </itemizedlist>
     </para>
 
+    <para arch="i386">Creative Technologies Sound Blaster Live!
+      Familie (emu10k1 Treiber)</para>
+
     <para arch="i386">Trident 4DWave DX/NX (&man.pcm.4;
       Treiber)</para>
 

release/doc/de_DE.ISO8859-1/installation/common/install.sgml

@@ -1,8 +1,8 @@
 <!--
 
 $FreeBSD$
-$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/installation/common/install.sgml,v 1.2.2.10 2002/12/07 20:28:56 ue Exp $
-basiert auf: 1.1.2.12
+$FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/installation/common/install.sgml,v 1.2.2.11 2003/02/17 06:59:02 ue Exp $
+basiert auf: 1.1.2.13
 
 install.sgml
 
@@ -884,18 +884,15 @@ pqb0.0.1.4.0               PQB0                       PCI EIDE</screen>
             l&ouml;schen, indem Sie auf die Gr&ouml;&szlig;e der
             Partition achten).</para>
 
-          <para><application>FIPS</application> kann die FAT32 und
-            VFAT Partitionen, die von neueren Version von Windows 95
-            benutzt werden, nicht bearbeiten.  F&uuml;r diese
-            Partitionen brauchen Sie ein kommerzielles Programm wie
-            <application>Partition Magic</application>.</para>
-<!--
-Was soll mir denn das sagen???? ue
-Sorry, but this is just the breaks if you've got a Windows partition
-hogging your whole disk and you don't want to reinstall from
-scratch.</para>
--->
-        </answer>
+	  <para><application>FIPS</application> kann nicht f&uuml;r
+	    NTFS Partitionen benutzt werden.  F&uuml;r diese
+	    Partitionen brauchen Sie ein kommerzielles Programm wie
+	    <application>Partition Magic</application>.  Es mag zwar
+	    hart klingen, aber das ist halt der Preis, den Sie zahlen
+	    n&uuml;ssen, wenn eine Windows Partition Ihre gesamte
+	    Festplatte belegt und Sie nicht alles neu installieren
+	    wollen.</para>
+	</answer>
       </qandaentry>
 
       <qandaentry>

release/doc/de_DE.ISO8859-1/relnotes/common/new.sgml

@@ -1,6 +1,6 @@
 <!--
-  $FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/relnotes/common/new.sgml,v 1.3.2.118 2003/01/18 19:39:48 ue Exp $
-  basiert auf: 1.22.2.321
+  $FreeBSDde: de-docproj/relnotes/de_DE.ISO8859-1/relnotes/common/new.sgml,v 1.3.2.139 2003/03/28 13:37:04 ue Exp $
+  basiert auf: 1.22.2.346
 -->
 
 <articleinfo>
@@ -130,6 +130,9 @@
       Unterst&uuml;tzung f&uuml;r Ger&auml;te mit
       FireWire-Schnittstellen (siehe &man.firewire.4;).</para>
 
+    <para arch="pc98">Der Power Management Controller CanBe wird jetzt
+      unterst&uuml;tzt.</para>
+
     <para arch="i386,pc98">Der neue Treiber ubsa unterst&uuml;tzt den
       Belkin F5U103 USB-nach-seriell Konverter und kompatible
       Ger&auml;te.</para>
@@ -143,7 +146,21 @@
       <title>Unterst&uuml;tzung f&uuml;r Prozessoren und
 	Mainboards</title>
 
-      <para></para>
+      <para>&os; hat jetzt minimale Unterst&uuml;tzung f&uuml;r
+	HyperThreading (HTT).  SMP Kernel, die mit der Option
+	<literal>HTT</literal> erzeugt wurden, erkennen und aktivieren
+	die logischen Prozessoren auf HTT-Systemen.  Die logischen
+	Prozessoren werden vom Scheduler wie zus&auml;tzliche
+	physikalische Prozessoren behandelt.</para>
+
+      <para arch="alpha">Wenn Sie &os; auf einer AlphaServer 8200 oder
+	8400 <quote>TurboLaser</quote> benutzen, m&uuml;ssen Sie nach
+	der Installation den getty f&uuml;r die serielle Konsole
+	manuell aktiviert.  Wenn Sie das nicht tun, sieht es so aus,
+	als h&auml;tte sich Ihre Maschine aufgeh&auml;ngt, weil Sie
+	keine Login-Aufforderung erhalten.  Den notwendigen Eintrag
+	finden Sie in <filename>/etc/ttys</filename> bei
+	<literal>zs0</literal>.</para>
     </sect3>
 
     <sect3>
@@ -159,6 +176,8 @@
     <sect3>
       <title>Netzwerke und Netzwerkkarten</title>
 
+      <para>Der Treiber cm unterst&uuml;tzt jetzt IPX.</para>
+
       <para>Der Treiber &man.nge.4; unterst&uuml;tzt jetzt auch
 	&man.polling.4;.</para>
 
@@ -169,10 +188,39 @@
     <sect3>
       <title>Netzwerk-Protokolle</title>
 
+      <para>Wird in der Konfigurationsdatei f&uuml;r den
+	angepa&szlig;ten die Option <literal>FAST_IPSEC</literal>
+	verwendet, nutzt IPsec die &man.crypto.4;-Infrastruktur des
+	Kernels, inklusive der Unterst&uuml;tzung f&uuml;r
+	Hardware-Verschl&uuml;sselung.  Weitere Informationen finden
+	Sie in der Onlinehilfe zu &man.fast.ipsec.4;.
+	<note>
+	  <para>Die gleichzeitige Verwendung von
+	    <literal>FAST_IPSEC</literal> und <literal>IPSEC</literal>
+	    ist nicht m&ouml;glich.</para>
+	</note>
+
+	<note>
+	  <para>Zur Zeit kann <literal>FAST_IPSEC</literal> nicht
+	    zusammen mit IPv6 oder der Option <literal>INET6</literal>
+	    verwendet werden.</para>
+	</note>
+      </para>
+
       <para>Der neue Treiber &man.gre.4; unterst&uuml;tzt die
 	Encapsulation von IP Paketen mt GRE (RFC 1701) und die
 	minimale IP Encapsulation f&uuml;r Mobile IP (RFC
 	2004).</para>
+
+      <para>In TCP NewReno wurde ein Fehler behoben, durch den der
+	<quote>Fast Recovery</quote> Modus zu fr&uuml;h beendet wurde,
+	falls NewReno aktiviert war.</para>
+
+      <para>Die Routinen zum Zusammensetzen von fragmentierten
+	IP-Paketen arbeiten jetzt besser, wenn eine gro&szlig;e Anzahl
+	Fragmente empfangen wird.  Ziel der &Auml;nderung war, eine
+	bessere Resistenz gegen Denial-of-Service Angriffe mit
+	Paket-Fragmenten zu erreichen.</para>
     </sect3>
 
     <sect3>
@@ -182,15 +230,23 @@
 	CAM-Schicht und -Treiber (&man.cd.4;, &man.da.4;, &man.st.4;
 	und &man.pass.4;) auf ATA Ger&auml;te zuzugreifen, und
 	emuliert so SCSI-Ger&auml;te.  Um diese M&ouml;glichkeit
-	nutzen zu k&ouml;nnen, mu&szlig;  in der Konfigurationsdatei
+	nutzen zu k&ouml;nnen, mu&szlig; in der Konfigurationsdatei
 	f&uuml;r den Kernel die Anweisung <literal>device
 	atapicam</literal> stehen.  Weitergehende Informationen finden
 	Sie in &man.atapicam.4;.</para>
 
-      <para>Der Treiber &man.matcd.4; mu&szlig;te aus
-	lizenzrechtlichen Gr&uuml;nden entfernt werden.  Dies geschah
-	schon in &release.prev;, wurde aber versehentlich nicht in den
-	Release Notes erw&auml;hnt.</para>
+      <para>Der Treiber &man.matcd.4; wurde entfernt, weil es
+	rechtliche Bedenken wegen der Lizenzbestimmungen gab.  Dieses
+	Problem wird zur Zeit diskutiert und es ist denkbar, da&szlig;
+	der Treiber in einer sp&auml;ter erscheinenden &os;-Version
+	wieder vef&uuml;gbar sein wird.  Der Treiber wurde schon in
+	&release.prev; entfernt, diese Information wurde aber
+	versehentlich nicht in den Release Notes erw&auml;hnt.</para>
+
+      <para>Der Treiber &man.targ.4; wurde komplett neu geschrieben.
+	In <filename>/usr/share/examples/scsi_target</filename> steht
+	jetzt ein neuer Benutzer-Modus zur Verf&uuml;gung, der ein
+	Ger&auml;t mit direkten Zugriff emuliert.</para>
 
       <para>Der neue Treiber trm unterst&uuml;tzt SCSI-Controller auf
         Basis des Tekram TRM-S1040 SCSI Chipsatzes.</para>
@@ -220,8 +276,8 @@
     <sect3>
       <title>Zus&auml;tzliche Software</title>
 
-      <para></para>
-
+      <para><application>IPFilter</application> steht jetzt in der
+	Version 3.4.31 zur Verf&uuml;gung.</para>
     </sect3>
   </sect2>
 
@@ -242,6 +298,44 @@
       Privilegien erhalten konnte.  Weitere Informationen finden Sie
       in <ulink
       url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:44.filedesc.asc">FreeBSD-SA-02:44</ulink>.</para>
+
+    <para>Ein &uuml;ber das Netzwerk ausnutzbarer Fehler in
+      <application>CVS</application> k&ouml;nnte dazu f&uuml;hren,
+      da&szlig; ein Angreifer beliebige Programme auf dem CVS Server
+      ausf&uuml;hren kann.  Weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:01.cvs.asc">FreeBSD-SA-03:01</ulink>.</para>
+
+    <para>Durch Auswertung der Antwortzeiten von
+      <application>OpenSSL</application> w&auml;re es einem Angreifer
+      mit sehr viel Rechenleistung m&ouml;glich gewesen, unter
+      bestimmten Umst&auml;nden den Klartext der &uuml;bermittelten
+      Daten zu erhalten.  Dieser Fehler durch die neue
+      <application>OpenSSL</application> Version 0.9.7 behoben.
+      Weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:02.openssl.asc">FreeBSD-SA-03:02</ulink>.</para>
+
+    <para>Die Sicherheit und Leistung der Erweiterung
+      <quote>syncookies</quote> wurde verbessert, damit Angreifer es
+      schwerer haben, eine Verbindung zu f&auml;lschen.  Weitere
+      Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:03.syncookies.asc">FreeBSD-SA-03:03</ulink>.</para>
+
+    <para>Ein &uuml;ber das Netzwerk ausnutzbaren Puffer-&Uuml;berlauf
+      in <application>sendmail</application> wurde durch die
+      Aktualisierung von <application>sendmail</application> auf
+      Version 8.12.8 behoben.  Weitere Information finden Sie in
+      <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:04.sendmail.asc">FreeBSD-SA-03:04</ulink>.</para>
+
+    <para>In der XDR-Implementation wurde ein Fehler behoben, der es
+      einem Angreifer m&ouml;glich machte, den Dienst abst&uuml;rzen
+      zu lassen.  Weitere Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:05.xdr.asc">FreeBSD-SA-03:05</ulink>.</para>
+
+    <para>In <application>OpenSSL</application> wurden zwei vor kurzem
+      ver&ouml;ffentlichte Schwachstellen repariert.  Weitere
+      Informationen finden Sie in <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:06.openssl.asc">FreeBSD-SA-03:06</ulink>.</para>
   </sect2>
 
   <sect2 id="userland">
@@ -257,6 +351,40 @@
       angegeben, wird die h&ouml;chste m&ouml;gliche Geschwindigkeit
       verwendet.</para>
 
+    <para arch="alpha,i386">Die Distribution
+      <filename>compat4x</filename> enth&auml;lt jetzt die in &os;
+      4.7-RELEASE enthaltenen Versionen der Bibliotheken
+      <filename>libcrypto.so.2</filename>,
+      <filename>libgmp.so.3</filename> und
+      <filename>libssl.so.2</filename>.</para>
+
+    <para>Wird &man.ftpd.8; mit der neuen Option <option>-h</option>
+      aufgerufen, werden in den Server-Meldungen keine Informationen
+      &uuml;ber das System (wie die &man.ftpd.8; Versionsnummer oder
+      der Systemname) angegeben.</para>
+
+    <para>Bei &man.ftpd.8; kann jetzt mit der neuen Option
+      <option>-P</option> angegeben werden, auf welchem Port
+      eingehende Verbindungen erwartet werden sollen.  Die Portnummer
+      f&uuml;r den Daten-Port ist nicht mehr hart verdraht, sondern
+      immer eins kleiner als die des Ports f&uuml;r die
+      Kommandos.</para>
+
+    <para>&man.ftpd.8; unterst&uuml;tzt jetzt eine erweiterte Version
+      der Datei <filename>/etc/ftpchroot</filename>.  Weitere
+      Informationen finden Sie in der ebenfalls neuen Online-Hilfe zu
+      &man.ftpchroot.5;.</para>
+
+    <para>&man.ftpd.8; unterst&uuml;tzt jetzt ein erweitertes Format
+      f&uuml;r die Namen der Home-Verzeichnis, das gleichzeitig ein
+      Startverzeichnis f&uuml;r &man.chroot.2; definiert;  dieses
+      Verzeichnis wird dann als Startpunkt f&uuml;r eine
+      &man.chroot.2;-Umgebung genutzt.  Zu diesem Zweck wird die
+      Sequenz <literal>/./</literal> genutzt, die auch von anderen
+      FTP-Servern f&uuml;r diesen Zweck genutzt wird.  Diese Sequenz
+      kann sowohl in &man.ftpchroot.5; als auch in &man.passwd.5;
+      genutzt werden.</para>
+
     <para>Das neue Programm &man.fwcontrol.8; ist ein Hilfsmittel zum
       Zugriff auf und die Kontrolle des FireWire-Subsystems.</para>
 
@@ -264,10 +392,29 @@
       Werte der in POSIX und X/Open angegebenen Variablen f&uuml;r die
       Pfad- und Systemkonfiguration ausgegeben werden.</para>
 
+    <para>Die neuen &man.ipfw.8;-Befehle <literal>enable</literal> und
+      <literal>disable</literal> k&ouml;nnen zur Kontrolle
+      verschiedener Aspekte der &man.ipfw.4;-Funktionalit&auml;t
+      genutzt werden, bis hin zur Aktivierung und Deaktivierung der
+      gesamten Firewall.  Im Vergleich mit den bereits existierenden
+      sysctl-Variablen ist dieses Interface einfacher zu bedienen und
+      besser zug&auml;nglich.</para>
+
     <para>Wird &man.make.1; mit der neuen Option <option>-C</option>
       aufgerufen, wechselt es in das angegebene Verzeichnis, bevor es
       mit der Arbeit beginnt.</para>
 
+    <para>Wird &man.mount.nfs.8; mit der neuen Option
+      <option>-c</option> aufgerufen, ruft es f&uuml;r UDP Mount
+      Points nicht mehr &man.connect.2; auf.  Diese Option mu&szlig;
+      gesetzt sein, wenn ein Server die Antworten nicht vom
+      Standardport 2049 verschickt oder die Antworten von einer
+      anderen IP-Adresse verschickt (dies kann bei Systemen mit
+      mehreren Netzwerkkarten auftreten).  Wird die Sysctl-Variable
+      <varname>vfs.nfs.nfs_ip_paranoia</varname> auf
+      <literal>0</literal> gesetzt, ist diese Option
+      standardm&auml;&szlig;ig aktiv.</para>
+
     <para>Wird bei &man.newsyslog.8; bei einem Eintrag (bzw. einer
       Gruppe von Eintr&auml;gen, bei denen die Option
       <literal>G</literal> gesetzt ist) die neue Option
@@ -281,6 +428,11 @@
       Pfadangaben auf ihre G&uuml;ltigkeit und Portabilit&auml;t
       zwischen POSIX-Systemen gepr&uuml;ft werden.</para>
 
+    <para>&man.pw.8; kann jetzt auch User anlegen, deren Namen mit dem
+      Zeichen <literal>$</literal> endet, diese &Auml;nderung dient
+      zur Vereinfachung der Administration von
+      <application>Samba</application> Servern.</para>
+
     <para>Bei &man.rarpd.8; kann jetzt mit <option>-t</option> ein
       Verzeichnis angegeben werden, das statt
       <filename>/tftpboot</filename> genutzt wird.</para>
@@ -304,35 +456,73 @@
     <sect3>
       <title>Zus&auml;tzliche Software</title>
 
+      <para><application>BIND</application> steht jetzt in der Version
+	8.3.4 zur Verf&uuml;gung.</para>
+
       <para>Alle Anwendungen aus dem <application>bzip2</application>
 	Paket sind jetzt im Basissystem verf&uuml;gbar (dies betrifft
 	speziell <command>bzip2recover</command>, das jetzt erzeugt
 	und installiert wird).</para>
 
-      <para><application>cvs</application> ist jetzt in der
-	Zwischenversion 1.11.2.1 mit Stand 1. Dezember 2002
+      <para><application>CVS</application> ist jetzt in der Version
+	1.11.5 verf&uuml;gbar.</para>
+
+      <para><application>FILE</application> steht jetzt in der Version
+	3.41 zur Verf&uuml;gung.</para>
+
+      <para><application>groff</application> und die dazu
+	geh&ouml;renden Programme sind jetzt in der FSF Version 1.18.1
 	verf&uuml;gbar.</para>
 
       <para><application>Heimdahl Kerberos</application> ist jetzt in
 	der Version 0.5.1 verf&uuml;gbar.</para>
 
+      <para>Der <application>ISC DHCP</application> Client steht jetzt
+	in der Version 3.0.1RC11 zur Verf&uuml;gung.</para>
+
+      <para><application>libz</application> steht jetzt in der Version
+	1.1.4 zur Verf&uuml;gung.</para>
+
+      <para><application>OpenSSH</application> steht jetzt in der
+	Version 3.5p1 zur Verf&uuml;gung.</para>
+
+      <para><application>OpenSSL</application> steht jetzt in der
+	Version 0.9.7a zur Verf&uuml;gung.  Die wichtigsten Neuerungen
+	sind die Unterst&uuml;tzung f&uuml;r AES und &man.crypto.4;
+	Ger&auml;te.</para>
+
+      <para><application>sendmail</application> steht jetzt in der
+	Version 8.12.8 zur Verf&uuml;gung.</para>
+
+      <para><application>tcpdump</application> steht jetzt in der
+	Version 3.7.2 zur Verf&uuml;gung.</para>
+
       <para>Die Datenbank mit den Zeitzonen steht jetzt in der Version
 	<filename>tzdata2002d</filename> zur Verf&uuml;gung.</para>
     </sect3>
 
     <sect3>
-      <title>Ports/Packages Collection</title>
-
-      <para></para>
+      <title>Infrastruktur f&uuml;r Ports und Packages</title>
 
+      <para>Die nur eine Zeile langen <filename>pkg-comment</filename>
+	Dateien wurden aus allen Ports entfernt und in das
+	<filename>Makefile</filename> des jeweiligen Ports integriert.
+	Dadurch sinken die Plattenbelegung und der Inode-Verbrauch der
+	Ports-Sammlung erheblich.</para>
     </sect3>
   </sect2>
 
   <sect2>
     <title>Erzeugung von Releases und Integration</title>
 
-    <para></para>
+    <para><application>GNOME</application> steht jetzt in der Version
+      2.2 zur Verf&uuml;gung.</para>
 
+    <para><application>KDE</application> steht jetzt in der Version
+      3.1 zur Verf&uuml;gung.</para>
+
+    <para><application>XFree86</application> steht jetzt in der
+      Version 4.3.0 zur Verf&uuml;gung.</para>
   </sect2>
 </sect1>
 
@@ -370,7 +560,7 @@
 	<command>make world</command></quote></ulink> des <ulink
 	url="http://www.FreeBSD.org/doc/de_DE.ISO8859-1/books/handbook/">FreeBSD
 	Handbuchs</ulink>.  Eine Aktualisierung einer sehr alten
-	Version von &os; kann mit Problemen verbunden sein;  in diesen
+	Version von &os; kann mit Problemen verbunden sein; in diesen
 	F&auml;llen ist es effektiver, eine bin&auml;re Aktualisierung
 	oder eine komplette Neuinstallation
 	durchzuf&uuml;hren.</para>

release/doc/en_US.ISO8859-1/share/sgml/release.dsl

@@ -71,7 +71,7 @@
               (("xfree86") (string-append u "&" "manpath=XFree86+4.2.0"))
               (("netbsd")  (string-append u "&" "manpath=NetBSD+1.5"))
               (("ports")   (string-append u "&" "manpath=FreeBSD+Ports"))
-              (else        (string-append u "&" "manpath=FreeBSD+4.7-stable")))))
+              (else        (string-append u "&" "manpath=FreeBSD+4.8-RELEASE")))))
       ]]>
 
       (define (toc-depth nd)

release/doc/share/examples/Makefile.relnotesng

@@ -12,7 +12,7 @@ UNITEXTS=	readme errata
 
 IMAGEDIR=	.imagedir
 RHOST=		freefall.freebsd.org
-RDIR=		public_html/relnotes/4-STABLE
+RDIR=		public_html/relnotes/4.8-RELEASE
 DOCDIR=		./release/doc
 LANG=		en_US.ISO8859-1
 

release/doc/share/sgml/release.ent

@@ -6,7 +6,7 @@
 
 <!-- Version of the OS we're describing.  This needs to be updated
      with each new release. -->
-<!ENTITY release.current "4.8-RC">
+<!ENTITY release.current "4.8-RELEASE">
 
 <!-- The previous version used for comparison in the "What's New"
      section.  For -CURRENT, we might point back to the last
@@ -14,19 +14,19 @@
 <!ENTITY release.prev "4.7-RELEASE">
 
 <!-- The next version to be released, usually used for snapshots. -->
-<!ENTITY release.next "4.8-RELEASE">
+<!ENTITY release.next "4.9-RELEASE">
 
 <!-- The name of this branch. -->
 <!ENTITY release.branch "4-STABLE">
 
 <!-- The URL for obtaining this version of FreeBSD. -->
-<!ENTITY release.url "http://snapshots.jp.FreeBSD.org/">
+<!ENTITY release.url "ftp://ftp.FreeBSD.org/">
 
 <!-- The type of release (usually this will be either "snapshot"
      or "release" -->
-<!ENTITY release.type "snapshot">
-<!ENTITY % release.type.snapshot "INCLUDE">
-<!ENTITY % release.type.release "IGNORE">
+<!ENTITY release.type "release">
+<!ENTITY % release.type.snapshot "IGNORE">
+<!ENTITY % release.type.release "INCLUDE">
 
 <!-- Text constants which probably don't need to be changed.-->
 

release/i386/dokern.sh

@@ -24,6 +24,7 @@ sed	-e '/pty/d' \
 	-e '/AHD_REG_PRETTY_PRINT/d' \
 	-e '/	ncr/d' \
 	-e '/	txp/d' \
+	-e '/	awi$/d' \
 	-e '/	an$/d' \
 	-e '/	wi$/d' \
 	-e '/atapist/d' \

release/i386/drivers.conf

@@ -35,11 +35,10 @@
 #
 
 #drv	filename	floppy	type	description
-amr	amr		2	disk	"AMI MegaRAID"
+aac	aac		2	disk	"Adaptec AAC RAID"
 an	if_an		2	network	"Aironet 4500/4800 802.11 PCMCIA/ISA/PCI card"
 em	if_em		2	network	"Intel(R) PRO/1000 Gigabit Ethernet"
 mlx	mlx		2	disk	"Mylex DAC960 family RAID"
-mly	mly		2	disk	"Mylex AcceleRAID/eXtremeRAID"
 wi	if_wi		2	network	"Lucent WaveLAN/IEEE 802.11 PCMCIA card"
 txp	if_txp		2	network "3Com 3cR990 (``Typhoon'') PCI Ethernet"
 twe	twe		2	disk	"3ware Escalade RAID"

release/sysinstall/config.c

@@ -596,20 +596,10 @@ configXDesktop(dialogMenuItem *self)
 	if (DITEM_STATUS(ret) != DITEM_FAILURE && gotit("startkde"))
 	    write_root_xprofile("exec startkde\n");
     }
-    else if (!strcmp(desk, "gnome")) {
-	ret = package_add("gnome");
+    else if (!strcmp(desk, "gnome2")) {
+	ret = package_add("gnome2");
 	if (DITEM_STATUS(ret) != DITEM_FAILURE && gotit("gnome-session")) {
-	    ret = package_add("sawfish-gnome");
-	    if (DITEM_STATUS(ret) != DITEM_FAILURE && gotit("sawfish"))
-		write_root_xprofile("exec gnome-session\n");
-	}
-    }
-    else if (!strcmp(desk, "enlightenment")) {
-	ret = package_add("gnomecore");
-	if (DITEM_STATUS(ret) != DITEM_FAILURE && gotit("gnome-session")) {
-	    ret = package_add("enlightenment");
-	    if (DITEM_STATUS(ret) != DITEM_FAILURE && gotit("enlightenment"))
-		write_root_xprofile("exec gnome-session\n");
+	    write_root_xprofile("exec gnome-session\n");
 	}
     }
     else if (!strcmp(desk, "afterstep")) {

release/sysinstall/menus.c

@@ -953,15 +953,13 @@ DMenu MenuXDesktops = {
 	NULL, dmenuExit },
       { "2 KDE",		"The K Desktop Environment.",
 	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=kde" },
-      { "3 GNOME + Sawfish",	"GNOME + Sawfish window manager.",
-	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=gnome" },
-      { "4 GNOME + Enlightenment","GNOME + The E window manager",
-	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=enlightenment" },
-      { "5 Afterstep",	"The Afterstep window manager",
+      { "3 GNOME 2",		"The GNOME 2 Desktop Environment",
+	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=gnome2" },
+      { "4 Afterstep",	"The Afterstep window manager",
 	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=afterstep" },
-      { "6 Windowmaker",	"The Windowmaker window manager",
+      { "5 Windowmaker",	"The Windowmaker window manager",
 	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=windowmaker" },
-      { "7 fvwm",		"The fvwm window manager",
+      { "6 fvwm",		"The fvwm window manager",
 	NULL, dmenuSetVariable, NULL, VAR_DESKSTYLE "=fvwm2" },
       { NULL } },
 };

share/examples/cvsup/standard-supfile

@@ -51,7 +51,7 @@
 *default host=CHANGE_THIS.FreeBSD.org
 *default base=/usr
 *default prefix=/usr
-*default release=cvs tag=RELENG_4
+*default release=cvs tag=RELENG_4_8
 *default delete use-rel-suffix
 
 # If your network link is a T1 or faster, comment out the following line.

share/man/man4/disc.4

@@ -1,80 +0,0 @@
-.\" Copyright (c) 1983, 1991, 1993
-.\"	The Regents of the University of California.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"	This product includes software developed by the University of
-.\"	California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\"     From: @(#)lo.4	8.1 (Berkeley) 6/5/93
-.\" $FreeBSD$
-.\"
-.Dd May 25, 2002
-.Dt DISC 4
-.Os
-.Sh NAME
-.Nm disc
-.Nd software discard network interface
-.Sh SYNOPSIS
-.Cd "device disc"
-.Sh DESCRIPTION
-The
-.Nm
-interface is a software discard mechanism which may be
-used for performance analysis and/or software testing.
-As with other network interfaces, the discard interface must have
-network addresses assigned for each address family with which it is to be used.
-These addresses
-may be set or changed with the
-.Dv SIOCSIFADDR
-.Xr ioctl 2 .
-.Pp
-Each
-.Nm
-interface is created at runtime using interface cloning.
-This is
-most easily done with the
-.Xr ifconfig 8
-.Cm create
-command or using the
-.Va cloned_interfaces
-variable in
-.Xr rc.conf 5 .
-.Sh SEE ALSO
-.Xr inet 4 ,
-.Xr intro 4
-.\" .Xr ns 4
-.Sh HISTORY
-The
-.Nm
-device appears to have been derived from the
-.Xr lo 4
-device around the time of
-.Bx 4.4 .
-This manpage was adapted from
-.Xr lo 4
-and first appeared in
-.Fx 5.0 .

share/man/man4/man4.i386/linux.4

@@ -1,124 +0,0 @@
-.\" Copyright (c) 2000 Sheldon Hearn
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\" $FreeBSD$
-.Dd August 17, 2000
-.Dt LINUX 4 i386
-.Os
-.Sh NAME
-.Nm linux
-.Nd Linux ABI support
-.Sh SYNOPSIS
-To link Linux ABI support into the kernel:
-.Cd "options COMPAT_LINUX"
-.Pp
-To load the Linux ABI support kernel module:
-.Dl kldload linux
-.Sh DESCRIPTION
-The
-.Nm
-module provides limited
-Linux ABI (application binary interface) compatibility
-for userland applications.
-The module provides the following significant facilities:
-.Bl -bullet
-.It
-An image activator
-for correctly branded
-.Xr elf 5
-executable images
-.It
-Special signal handling for activated images
-.It
-Linux to native system call translation
-.El
-.Pp
-It is important to note that the Linux ABI support
-it not provided through an emulator.
-Rather, a true (albeit limited) ABI implementation is provided.
-.Pp
-The following
-.Xr sysctl 8
-tunable variables are available:
-.Bl -tag -width compat.linux.oss_version
-.It compat.linux.osname
-Linux kernel operating system name.
-.It compat.linux.osrelease
-Linux kernel operating system release.
-.It compat.linux.oss_version
-Linux Open Sound System version.
-.El
-.Pp
-The
-.Nm
-module can be linked into the kernel statically with the
-.Dv COMPAT_LINUX
-kernel configuration option
-or loaded as required.
-The following command will load the module
-if it is neither linked into the kernel
-nor already loaded as a module:
-.Bd -literal -offset indent
-if ! kldstat -v | grep -E 'linux(aout|elf)' > /dev/null; then
-	kldload linux > /dev/null 2>&1
-fi
-.Ed
-.Pp
-Note that dynamically linked Linux executables
-will require a suitable environment in
-.Pa /compat/linux .
-Specifically, the Linux run-time linker's hints files
-should be correctly initialized.
-For this reason, it is common to execute the following commands
-to prepare the system to correctly run Linux executables:
-.Bd -literal -offset indent
-if [ -x /compat/linux/sbin/ldconfig ]; then
-	/compat/linux/sbin/ldconfig
-fi
-.Ed
-.Pp
-For information on loading the
-.Nm
-kernel loadable module automatically on system startup,
-see
-.Xr rc.conf 5 .
-This information applies
-regardless of whether the
-.Nm
-module is statically linked into the kernel
-or loaded as a module.
-.Sh FILES
-.Bl -tag -width /compat/linux/proc -compact
-.It Pa /compat/linux
-minimal Linux run-time environment
-.It Pa /compat/linux/proc
-limited Linux process file system
-.El
-.Sh SEE ALSO
-.Xr brandelf 1 ,
-.Xr elf 5 ,
-.Xr linprocfs 5
-.Sh HISTORY
-Linux ABI support first appeared in
-.Fx 2.1 .

sys/compat/linux/linux_ioctl.c

@@ -927,19 +927,21 @@ linux_ioctl_cdrom(struct proc *p, struct linux_ioctl_args *args)
 	}
 
 	case LINUX_CDROMREADTOCENTRY: {
-		struct linux_cdrom_tocentry lte, *ltep =
-		    (struct linux_cdrom_tocentry *)args->arg;
+		struct linux_cdrom_tocentry lte;
 		struct ioc_read_toc_single_entry irtse;
-		irtse.address_format = ltep->cdte_format;
-		irtse.track = ltep->cdte_track;
+
+		error = copyin((caddr_t)args->arg, &lte, sizeof(lte));
+		if (error)
+			return (error);
+		irtse.address_format = lte.cdte_format;
+		irtse.track = lte.cdte_track;
 		error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
 		if (!error) {
-			lte = *ltep;
 			lte.cdte_ctrl = irtse.entry.control;
 			lte.cdte_adr = irtse.entry.addr_type;
 			bsd_to_linux_msf_lba(irtse.address_format,
 			    &irtse.entry.addr, &lte.cdte_addr);
-			copyout(&lte, (caddr_t)args->arg, sizeof(lte));
+			error = copyout(&lte, (caddr_t)args->arg, sizeof(lte));
 		}
 		return (error);
 	}
@@ -1262,6 +1264,7 @@ static int
 linux_ioctl_console(struct proc *p, struct linux_ioctl_args *args)
 {
 	struct file *fp = p->p_fd->fd_ofiles[args->fd];
+	int error;
 
 	switch (args->cmd & 0xffff) {
 
@@ -1320,11 +1323,16 @@ linux_ioctl_console(struct proc *p, struct linux_ioctl_args *args)
 		return  (ioctl(p, (struct ioctl_args *)args));
 
 	case LINUX_VT_SETMODE: {
-		struct vt_mode *mode;
+		struct vt_mode mode;
+		error = copyin((caddr_t)args->arg, &mode, sizeof(mode));
+		if (error)
+			return (error);
+		if (!ISSIGVALID(mode.frsig) && ISSIGVALID(mode.acqsig))
+			mode.frsig = mode.acqsig;
+		error = copyout(&mode, (caddr_t)args->arg, sizeof(mode));
+		if (error)
+			return (error);
 		args->cmd = VT_SETMODE;
-		mode = (struct vt_mode *)args->arg;
-		if (!ISSIGVALID(mode->frsig) && ISSIGVALID(mode->acqsig))
-			mode->frsig = mode->acqsig;
 		return (ioctl(p, (struct ioctl_args *)args));
 	}
 

sys/conf/files

@@ -126,6 +126,7 @@ dev/aac/aac.c		optional aac
 #dev/aac/aac_debug.c	optional aac
 dev/aac/aac_disk.c	optional aac
 dev/aac/aac_pci.c	optional aac pci
+dev/aac/aac_linux.c	optional aac compat_linux
 dev/aac/aac_cam.c	optional aacp aac
 dev/advansys/adv_eisa.c	optional adv eisa
 dev/advansys/adv_pci.c	optional adv pci

sys/conf/newvers.sh

@@ -36,7 +36,7 @@
 
 TYPE="FreeBSD"
 REVISION="4.8"
-BRANCH="RC"
+BRANCH="RELEASE-p40"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"