Correct multiple vulnerabilities in OpenSSH.

Security: FreeBSD-SA-06:22.openssh Approved by: so (simon)
Correct problem in the 2006-09-28 patch concerning the handling of
2026-10-28 19:34:43 +01:00 · 2006-09-30 19:58:07 +00:00 · 2006-09-29 13:46:41 +00:00 · 2006-09-28 13:06:23 +00:00 · 2006-09-19 14:13:53 +00:00 · 2006-09-06 21:23:16 +00:00
275 changed files with 6028 additions and 48881 deletions
@@ -83,7 +83,7 @@ CLEANDIR=	cleandir
 .endif

 CVS?=		cvs
-CVSFLAGS?=	-r RELENG_5 -P -d -I!
+CVSFLAGS?=	-r RELENG_5_4 -P -d -I!
 SUP?=		/usr/local/bin/cvsup
 SUPFLAGS?=	-g -L 2 -P -
 .if defined(SUPHOST)
@@ -6,7 +6,147 @@ done items, please see the COMMON ITEMS: section later in the file.

 Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running
-portupgrade.
+portupgrade.  Important recent entries: 20040724 (default X changes).
+
+20060930:	p22	FreeBSD-SA-06:22.openssh
+	Correct multiple vulnerabilities in sshd(8).
+
+20060929:	p21	FreeBSD-SA-06:23.openssl
+	Correct problem in the 2006-09-28 patch concerning the handling of
+	excessively large DH moduli.
+
+20060928:	p20	FreeBSD-SA-06:23.openssl
+	Correct multiple vulnerabilities in crypto(3).
+	Limit the size of public keys used in order to protect applications
+	from a denial of service via insane key sizes.
+
+20060919:	p19	FreeBSD-SA-06:21.gzip
+	Correct multiple vulnerabilities in gzip(1).
+
+20060906:	p18	FreeBSD-SA-06:19.openssl, FreeBSD-SA-06:20.bind
+	Correct incorrect PKCS#1 v1.5 padding validation in
+	crypto(3). [06:19]
+
+	Correct multiple denial-of-service vulnerabilities in BIND related to
+	SIG Query Processing and Excessive Recursive Queries. [06:20]
+
+20060823:	p17	FreeBSD-SA-06:18.ppp
+	Correct buffer overflow in the handling of LCP options in ppp(4).
+
+20060614:	p16	FreeBSD-SA-06:17.sendmail
+	Correct a bug in the handling of multipart messages by sendmail(8)
+	which can allow a malformed message to crash a sendmail queue
+	processing process.
+
+20060531:	p15	FreeBSD-SA-06:15.ypserv, FreeBSD-SA-06:16.smbfs
+	Enable inadvertantly disabled "securenet" access controls in
+	ypserv. [06:15]
+
+	Correct a bug in the handling of backslash characters in smbfs
+	which can allow an attacker to escape from a chroot(2). [06:16]
+
+20060419:	p14	FreeBSD-SA-06:14.fpu
+	Correct a local information leakage bug affecting AMD FPUs.
+
+20060322:	p13	FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie,
+			FreeBSD-SA-06:13.sendmail
+	Add missing code needed for the detection of IPSec packet
+	replays. [06:11]
+
+	Correctly identify the user running opiepasswd(1) when the login
+	name differs from the account name. [06:12]
+
+	Modify timeout handling logic in sendmail(8) to correct a reported
+	signal handling race condition. [06:13]
+
+20060301:	p12	FreeBSD-SA-06:09.openssh, FreeBSD-SA-06:10.nfs
+	Correct a remote DoS in OpenSSH when using PAM and privilege
+	separation. [06:09]
+
+	Correct a remote kernel panic when processing zero-length RPC
+	records via TCP. [06:10]
+
+20060201:	p11	FreeBSD-SA-06:08.sack
+	Avoid an infinite loop in sack scoreboard processing which can
+	result from memory exhaustion.
+
+20060125:	p10	FreeBSD-SA-06:07.pf
+	Correct an error in pf handling of IP packet fragments which
+	could result in a kernel panic.
+
+20060111:	p9	FreeBSD-SA-06:01.texindex, FreeBSD-SA-06:02.ee,
+			FreeBSD-SA-06:03.cpio
+	Correct insecure temporary file usage in texindex. [06:01]
+
+	Correct insecure temporary file usage in ee. [06:02]
+
+	Correct a race condition when setting file permissions,
+	sanitize file names by default, and fix a buffer overflow
+	when handling files larger than 4GB in cpio. [06:03]
+
+20051011:	p8	FreeBSD-SA-05:21.openssl
+	Correct a man-in-the-middle SSL version rollback vulnerability.
+
+20050907:	p7	FreeBSD-SA-05:20.cvsbug
+	Correct insecure temporary file usage.
+
+20050727:	p6	FreeBSD-SA-05:18.zlib, FreeBSD-SA-05:19.ipsec
+	Correct buffer overflow when handling certain deflated data
+	streams.
+
+	Correct errors in the implementation of the AES-XCBC-MAC IPsec
+	authentication algorithm.
+
+20050720:	p5	FreeBSD-SA-05:17.devfs
+	Correct devfs ruleset bypass.
+
+20050706:	p4	FreeBSD-SA-05:16.zlib
+	Correct buffer overflow when handling corrupt deflated data streams.
+
+20050629:	p3	FreeBSD-SA-05:13.ipfw, FreeBSD-SA-05:14.bzip2,
+			FreeBSD-SA-05:15.tcp
+	Correct ipfw packet matching errors with address tables.
+
+	Correct bzip2 denial of service and permission race vulnerabilities.
+
+	Correct TCP connection stall denial of service vulnerabilities.
+
+20050608:	p2	FreeBSD-SA-05:10.tcpdump, FreeBSD-SA-05:11.gzip
+	Correct several denial-of-service vulnerabilities in tcpdump.
+
+	Correct directory traversal and race condition vulnerabilities in gzip.
+
+20050513:	p1  	FreeBSD-SA-05:09.htt
+	Add a knob for disabling/enabling HTT.  Default off due to information
+	disclosure on multi-user systems.
+
+20050509:
+	FreeBSD 5.4-RELEASE.
+
+20050507:		FreeBSD-SA-05:08.kmem
+	Correct two issues which missed from the earlier commit.
+
+20050506:		FreeBSD-SA-05:08.kmem
+	Correct several local kernel memory disclosure bugs.
+
+20050506:		FreeBSD-SA-05:07.ldt
+	Correctly validate inputs to the i386_get_ldt syscall.
+
+20050506:		FreeBSD-SA-05:06.iir
+	Correct overly liberal permissions on /dev/iir.
+
+20050422:		FreeBSD-SA-05:05.cvs
+	Correct several vulnerabilities in CVS.
+
+20050414:		FreeBSD-SA-05:04.ifconf
+	Zero a buffer in ifconf() in order to avoid accidental
+	disclosure of kernel memory to userland.
+
+20050406:		FreeBSD-SA-05:03.amd64
+	Correctly initialize the I/O permission bitmap on amd64.
+
+20050404:		FreeBSD-SA-05:02.sendfile
+	Correct kernel memory disclosure bug in sendfile(2).

 20050302:
 	The full packet destination manipulation for 'ipfw fwd' is
@@ -1845,19 +1985,19 @@ COMMON ITEMS:
 	# space on /.

 	<make sure you have good level 0 dumps>
-	<maybe fix /etc/fstab>					[1]
-	make buildworld						[2]
-	make buildkernel KERNCONF=YOUR_KERNEL_HERE		[3]
-	cp sys/${MACHINE}/conf/GENERIC.hints /boot/device.hints [4]
+	<maybe fix /etc/fstab>				[7]
+	make buildworld					[9]
+	make buildkernel KERNCONF=YOUR_KERNEL_HERE	[8]
+	cp sys/${MACHINE}/conf/GENERIC.hints /boot/device.hints [2]
 	make installkernel KERNCONF=YOUR_KERNEL_HERE
-	cd sys/boot ; make STRIP="" install			[5]
-								[6]
-	<reboot in single user>					[7]
-	/usr/src/etc/rc.d/preseedrandom				[8]
-	mergemaster -p						[9]
+	cd sys/boot ; make STRIP="" install			[6]
+							[1]
+	<reboot in single user>				[3]
+	/usr/src/etc/rc.d/preseedrandom				[10]
+	mergemaster -p					[5]
 	rm -rf /usr/include/g++
 	make installworld
-	mergemaster -i						[10]
+	mergemaster -i					[4]
 	<reboot>

 	Make sure that you've read the UPDATING file to understand the
@@ -1872,92 +2012,72 @@ COMMON ITEMS:
 	messages there.  If in doubt, please track -stable which has
 	much fewer pitfalls.

-	If you have any ports or packages installed on the system, please
-	see /usr/ports/UPDATING.  The following items are known to cause
-	problems with the upgrade:
-	(a) Kerberos upgrades are hard, and evidentally don't work.  More
-	    on this later.
-	(b) Old ports and packages can sometimes have subtle problems with
-	    newer libraries.  portupgrade -f is recommended where possible
-	    after the upgrade.  portupgrade -P will be faster since it uses
-	    packages.  There are many known issues with running a mix of
-	    4.x built packages and 5.x built packages, and this avoids them.
-	(c) Perl based ports may also have the wrong version of perl hard
-	    coded into the headers.  Spamassassin is one such port.
-	(d) Startup scripts have significantly changed.  Make sure that you
-	    verify that all expected daemons start.  Modifications of /etc/rc*
-	    (except rc.conf) may cause problems.
-	(e) Device names have changed and MAKEDEV is gone.
-	(f) The boot loader defaults have changed, which may cause confusion.
+	[1] If you have third party modules, such as vmware, you
+	should disable them at this point so they don't crash your
+	system on reboot.

-	[1] Before you upgrade, please make sure that you are not using
-	compatibility slices.  These are device names of the form, on i386 and
-	other architectures that use MBR slicing, /dev/ad0a without the actual
-	slice name.  Chances are excellent that these will break.  You
-	generally must update these entries to use the post FreeBSD 2.x form
-	of /dev/ad0s1a.
+	[2] If you have legacy ISA devices, you may need to create
+	your own device.hints to reflect your unique hardware
+	configuration.

-	[2] When checking out sources, you must include the -P flag to have
-	cvs prune empty directories. Also, if CPUTYPE is defined in your
-	/etc/make.conf, make sure to use the "?=" instead of the "="
-	assignment operator, so that buildworld can override the CPUTYPE if it
-	needs to.  In case you would like to avoid installing new packages of
-	everything, you might want to uncomment the "COMPAT4X= YES" entry, so
-	that 4.x compatibility libraries are built which should allow you to
-	continue using your existing software for a while.
-
-	[3] In order to have a kernel that can run the 4.x or earlier binaries
-	needed to do an installworld, you must include the COMPAT_FREEBSD4
-	option in your kernel.  Failure to do so may leave you with a system
-	that is hard to boot to recover.  If you have a.out binaries, then you
-	need to add COMPAT_AOUT option too.  If you are updating a system
-	that's been updated from 2.x and/or 3.x in the past, enable both of
-	these to be safe.
-
-	[4] If you have legacy ISA devices, you may need to create your own
-	device.hints to reflect your unique hardware configuration.
-
-	[5] 4.x boot loader can be used to boot a 5.x system, however it is
-	difficult to do that at best.  If you wish to try, then you should
-	interrupt the boot and at the ok prompt type:
-		ok unload
-		ok boot /boot/kernel/kernel
-	If this fails to work, you must install a new boot loader as described
-	here.
-
-	[6] If you have third party modules, such as vmware, you should
-	disable them at this point so they don't crash your system on reboot.
-
-	[7] From the bootblocks, boot -s, and then do
+	[3] From the bootblocks, boot -s, and then do
 		fsck -p
 		mount -u /
 		mount -a
 		cd /usr/src
 		adjkerntz -i		# if CMOS is wall time
-	Also, when doing a major release upgrade, it is required that you boot
-	into single user mode to do the installworld.  For the 4.x -> 5.x
-	upgrade, you will also see many messages about needing to recompile
-	your userland.  These are harmless and can be ignored while you
-	proceed to the next step.
+	Also, when doing a major release upgrade, it is required that
+	you boot into single user mode to do the installworld.
+	For the 4.x -> 5.x upgrade, you will also see many messages about
+	needing to recompile your userland.  These are harmless and can
+	be ignored while you proceed to the next step.

-	[8] In order to create temporary files, /dev/random must be
+	[4] Note: This step is non-optional.  Failure to do this step
+	can result in a significant reduction in the functionality of the
+	system.  Attempting to do it by hand is not recommended and those
+	that pursue this avenue should read this file carefully, as well
+	as the archives of freebsd-current and freebsd-hackers mailing lists
+	for potential gotchas.
+
+	[5] Usually this step is a noop.  However, from time to time
+	you may need to do this if you get unknown user in the following
+	step.  It never hurts to do it all the time.  You may need to
+	install a new mergemaster (cd src/usr.sbin/mergemaster && make
+	install) after the buildworld before this step if you last updated
+	from current before 20020224 or from -stable before 20020408.
+
+	[6] 4.x boot loader can be used to boot a 5.x system, however
+	it is difficult to do that at best.  If you wish to try, then
+	you should interrupt the boot and at the ok prompt type:
+		ok unload
+		ok boot /boot/kernel/kernel
+	If this fails to work, you must install a new boot loader as
+	described here.
+
+	[7] Before you upgrade, please make sure that you are not using
+	compatibility slices.  These are device names of the form, on i386
+	and other architectures that use MBR slicing, /dev/ad0a without the
+	actual slice name.  Chances are excellent that these will break.
+	You generally must update these entries to use the post FreeBSD
+	2.x form of /dev/ad0s1a.
+
+	[8] In order to have a kernel that can run the 4.x binaries
+	needed to do an installworld, you must include the COMPAT_FREEBSD4
+	option in your kernel.  Failure to do so may leave you with a system
+	that is hard to boot to recover.
+
+	[9] When checking out sources, you must include the -P flag to have
+	cvs prune empty directories. Also, if CPUTYPE is defined in your
+	/etc/make.conf, make sure to use the "?=" instead of the "=" assignment
+	operator, so that buildworld can override the CPUTYPE if it needs to.
+	In case you would like to avoid installing new packages of everything,
+	you might want to uncomment the "COMPAT4X=	YES" entry, so that 4.x
+	compatibility libraries are built which should allow you to continue
+	using your existing software for a while.
+
+	[10] In order to create temporary files, /dev/random must be
 	initialized by feeding data into it.  /usr/src/etc/rc.d/preseedrandom
 	takes care of this.
-
-	[9] Usually this step is a noop.  However, from time to time you may
-	need to do this if you get unknown user in the following step.  It
-	never hurts to do it all the time.  You may need to install a new
-	mergemaster (cd src/usr.sbin/mergemaster && make install) after the
-	buildworld before this step if you last updated from current before
-	20020224 or from -stable before 20020408.
-
-	[10] Note: This step is non-optional.  Failure to do this step can
-	result in a significant reduction in the functionality of the system.
-	Attempting to do it by hand is not recommended and those that pursue
-	this avenue should read this file carefully, as well as the archives
-	of freebsd-current and freebsd-hackers mailing lists for potential
-	gotchas.
-
 FORMAT:

 This file contains a list, in reverse chronological order, of major
@@ -103,7 +103,7 @@ The options are as follows:
 .Bl -tag -width indent
 .It Fl a
 Display information about other users' processes as well as your own.
-This will skip any processes which do not have a controlling teminal,
+This will skip any processes which do not have a controlling terminal,
 unless the
 .Fl x
 option is also specified.
@@ -2389,7 +2389,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		is_zone = ISC_FALSE;

 		qtype = event->qtype;
-		if (qtype == dns_rdatatype_rrsig)
+		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 			type = dns_rdatatype_any;
 		else
 			type = qtype;
@@ -2430,7 +2430,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	/*
 	 * If it's a SIG query, we'll iterate the node.
 	 */
-	if (qtype == dns_rdatatype_rrsig)
+	if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 		type = dns_rdatatype_any;
 	else
 		type = qtype;
@@ -728,7 +728,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 		INSIST(result != ISC_R_SUCCESS ||
 		       dns_rdataset_isassociated(event->rdataset) ||
 		       fctx->type == dns_rdatatype_any ||
-		       fctx->type == dns_rdatatype_rrsig);
+		       fctx->type == dns_rdatatype_rrsig ||
+		       fctx->type == dns_rdatatype_sig);

 		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
 	}
@@ -3151,7 +3152,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if (hevent != NULL) {
 		if (!negative && !chaining &&
 		    (fctx->type == dns_rdatatype_any ||
-		     fctx->type == dns_rdatatype_rrsig)) {
+		     fctx->type == dns_rdatatype_rrsig ||
+		     fctx->type == dns_rdatatype_sig)) {
 			/*
 			 * Don't bind rdatasets; the caller
 			 * will iterate the node.
@@ -3263,7 +3265,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if (!ISC_LIST_EMPTY(fctx->validators)) {
 		INSIST(!negative);
 		INSIST(fctx->type == dns_rdatatype_any ||
-		       fctx->type == dns_rdatatype_rrsig);
+		       fctx->type == dns_rdatatype_rrsig ||
+		       fctx->type == dns_rdatatype_sig);
 		/*
 		 * Don't send a response yet - we have
 		 * more rdatasets that still need to
@@ -3409,14 +3412,15 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 				return (result);
 			anodep = &event->node;
 			/*
-			 * If this is an ANY or SIG query, we're not going
-			 * to return any rdatasets, unless we encountered
+			 * If this is an ANY, SIG or RRSIG query, we're not
+			 * going to return any rdatasets, unless we encountered
 			 * a CNAME or DNAME as "the answer".  In this case,
 			 * we're going to return DNS_R_CNAME or DNS_R_DNAME
 			 * and we must set up the rdatasets.
 			 */
 			if ((fctx->type != dns_rdatatype_any &&
-			    fctx->type != dns_rdatatype_rrsig) ||
+			     fctx->type != dns_rdatatype_rrsig &&
+			     fctx->type != dns_rdatatype_sig) ||
 			    (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
 				ardataset = event->rdataset;
 				asigrdataset = event->sigrdataset;
@@ -3475,7 +3479,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 		 */
 		if (secure_domain && rdataset->trust != dns_trust_glue) {
 			/*
-			 * SIGs are validated as part of validating the
+			 * RRSIGs are validated as part of validating the
 			 * type they cover.
 			 */
 			if (rdataset->type == dns_rdatatype_rrsig)
@@ -3545,7 +3549,8 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {

 			if (ANSWER(rdataset) && need_validation) {
 				if (fctx->type != dns_rdatatype_any &&
-				    fctx->type != dns_rdatatype_rrsig) {
+				    fctx->type != dns_rdatatype_rrsig &&
+				    fctx->type != dns_rdatatype_sig) {
 					/*
 					 * This is The Answer.  We will
 					 * validate it, but first we cache
@@ -3740,23 +3745,28 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		  isc_result_t *eresultp)
 {
 	isc_result_t result;
+	dns_rdataset_t rdataset;
+
+	if (ardataset == NULL) {
+		dns_rdataset_init(&rdataset);
+		ardataset = &rdataset;
+	}
 	result = dns_ncache_add(message, cache, node, covers, now,
 				maxttl, ardataset);
-	if (result == DNS_R_UNCHANGED) {
+	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
 		/*
-		 * The data in the cache are better than the negative cache
-		 * entry we're trying to add.
+		 * If the cache now contains a negative entry and we
+		 * care about whether it is DNS_R_NCACHENXDOMAIN or
+		 * DNS_R_NCACHENXRRSET then extract it.
 		 */
-		if (ardataset != NULL && ardataset->type == 0) {
+		if (ardataset->type == 0) {
 			/*
-			 * The cache data is also a negative cache
-			 * entry.
+			 * The cache data is a negative cache entry.
 			 */
 			if (NXDOMAIN(ardataset))
 				*eresultp = DNS_R_NCACHENXDOMAIN;
 			else
 				*eresultp = DNS_R_NCACHENXRRSET;
-			result = ISC_R_SUCCESS;
 		} else {
 			/*
 			 * Either we don't care about the nature of the
@@ -3768,14 +3778,11 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 			 * XXXRTH  There's a CNAME/DNAME problem here.
 			 */
 			*eresultp = ISC_R_SUCCESS;
-			result = ISC_R_SUCCESS;
 		}
-	} else if (result == ISC_R_SUCCESS) {
-		if (NXDOMAIN(ardataset))
-			*eresultp = DNS_R_NCACHENXDOMAIN;
-		else
-			*eresultp = DNS_R_NCACHENXRRSET;
+		result = ISC_R_SUCCESS;
 	}
+	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
+		dns_rdataset_disassociate(ardataset);

 	return (result);
 }
@@ -312,6 +312,7 @@ static void    compressedStreamEOF   ( void )    NORETURN;

 static void    copyFileName ( Char*, Char* );
 static void*   myMalloc     ( Int32 );
+static int     applySavedFileAttrToOutputFile ( int fd );



@@ -457,6 +458,10 @@ void compressStream ( FILE *stream, FILE *zStream )
   ret = fflush ( zStream );
   if (ret == EOF) goto errhandler_io;
   if (zStream != stdout) {
+      int fd = fileno ( zStream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
      ret = fclose ( zStream );
      outputHandleJustInCase = NULL;
      if (ret == EOF) goto errhandler_io;
@@ -525,6 +530,7 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
   UChar   obuf[5000];
   UChar   unused[BZ_MAX_UNUSED];
   Int32   nUnused;
+   void*   unusedTmpV;
   UChar*  unusedTmp;

   nUnused = 0;
@@ -554,9 +560,10 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
      }
      if (bzerr != BZ_STREAM_END) goto errhandler;

-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
      if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );

+      unusedTmp = (UChar*)unusedTmpV;
      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];

      BZ2_bzReadClose ( &bzerr, bzf );
@@ -567,6 +574,12 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )

   closeok:
   if (ferror(zStream)) goto errhandler_io;
+   if ( stream != stdout) {
+      int fd = fileno ( stream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
+   }
   ret = fclose ( zStream );
   if (ret == EOF) goto errhandler_io;

@@ -639,6 +652,7 @@ Bool testStream ( FILE *zStream )
   UChar   obuf[5000];
   UChar   unused[BZ_MAX_UNUSED];
   Int32   nUnused;
+   void*   unusedTmpV;
   UChar*  unusedTmp;

   nUnused = 0;
@@ -662,9 +676,10 @@ Bool testStream ( FILE *zStream )
      }
      if (bzerr != BZ_STREAM_END) goto errhandler;

-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
      if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );

+      unusedTmp = (UChar*)unusedTmpV;
      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];

      BZ2_bzReadClose ( &bzerr, bzf );
@@ -1125,7 +1140,7 @@ void saveInputFileMetaInfo ( Char *srcName )


 static 
-void applySavedMetaInfoToOutputFile ( Char *dstName )
+void applySavedTimeInfoToOutputFile ( Char *dstName )
 {
 #  if BZ_UNIX
   IntNative      retVal;
@@ -1134,16 +1149,26 @@ void applySavedMetaInfoToOutputFile ( Char *dstName )
   uTimBuf.actime = fileMetaInfo.st_atime;
   uTimBuf.modtime = fileMetaInfo.st_mtime;

-   retVal = chmod ( dstName, fileMetaInfo.st_mode );
-   ERROR_IF_NOT_ZERO ( retVal );
-
   retVal = utime ( dstName, &uTimBuf );
   ERROR_IF_NOT_ZERO ( retVal );
+#  endif
+}

-   retVal = chown ( dstName, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
+static 
+int applySavedFileAttrToOutputFile ( int fd )
+{
+#  if BZ_UNIX
+   IntNative      retVal;
+
+   retVal = fchmod ( fd, fileMetaInfo.st_mode );
+   if (retVal != 0)
+       return retVal;
+
+   (void) fchown ( fd, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
   /* chown() will in many cases return with EPERM, which can
      be safely ignored.
   */
+   return 0;
 #  endif
 }

@@ -1366,7 +1391,7 @@ void compress ( Char *name )

   /*--- If there was an I/O error, we won't get here. ---*/
   if ( srcMode == SM_F2F ) {
-      applySavedMetaInfoToOutputFile ( outName );
+      applySavedTimeInfoToOutputFile ( outName );
      deleteOutputOnInterrupt = False;
      if ( !keepInputFiles ) {
         IntNative retVal = remove ( inName );
@@ -1544,7 +1569,7 @@ void uncompress ( Char *name )
   /*--- If there was an I/O error, we won't get here. ---*/
   if ( magicNumberOK ) {
      if ( srcMode == SM_F2F ) {
-         applySavedMetaInfoToOutputFile ( outName );
+         applySavedTimeInfoToOutputFile ( outName );
         deleteOutputOnInterrupt = False;
         if ( !keepInputFiles ) {
            IntNative retVal = remove ( inName );
@@ -574,8 +574,11 @@ int BZ_API(BZ2_bzDecompressInit)


 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_FAST ( DState* s )
+Bool unRLE_obuf_to_output_FAST ( DState* s )
 {
   UChar k1;

@@ -584,7 +587,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -594,10 +597,13 @@ void unRLE_obuf_to_output_FAST ( DState* s )
            s->strm->total_out_lo32++;
            if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
         }
-   
+
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
               
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -667,6 +673,10 @@ void unRLE_obuf_to_output_FAST ( DState* s )
               cs_avail_out--;
            }
         }   
+         /* Only caused by corrupt data stream? */
+         if (c_nblock_used > s_save_nblockPP)
+            return True;
+
         /* can a new run be started? */
         if (c_nblock_used == s_save_nblockPP) {
            c_state_out_len = 0; goto return_notr;
@@ -712,6 +722,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
      s->strm->avail_out    = cs_avail_out;
      /* end save */
   }
+   return False;
 }


@@ -732,8 +743,11 @@ __inline__ Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab )


 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_SMALL ( DState* s )
+Bool unRLE_obuf_to_output_SMALL ( DState* s )
 {
   UChar k1;

@@ -742,7 +756,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -754,8 +768,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
         }
   
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
-               
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -788,7 +805,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
      while (True) {
         /* try to finish existing run */
         while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
            if (s->state_out_len == 0) break;
            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -800,7 +817,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
         }
   
         /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
   
         s->state_out_len = 1;
         s->state_out_ch = s->k0;
@@ -830,6 +851,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
 /*---------------------------------------------------*/
 int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
 {
+   Bool    corrupt;
   DState* s;
   if (strm == NULL) return BZ_PARAM_ERROR;
   s = strm->state;
@@ -840,12 +862,13 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
      if (s->state == BZ_X_IDLE) return BZ_SEQUENCE_ERROR;
      if (s->state == BZ_X_OUTPUT) {
         if (s->smallDecompress)
-            unRLE_obuf_to_output_SMALL ( s ); else
-            unRLE_obuf_to_output_FAST  ( s );
+            corrupt = unRLE_obuf_to_output_SMALL ( s ); else
+            corrupt = unRLE_obuf_to_output_FAST  ( s );
+         if (corrupt) return BZ_DATA_ERROR;
         if (s->nblock_used == s->save_nblock+1 && s->state_out_len == 0) {
            BZ_FINALISE_CRC ( s->calculatedBlockCRC );
            if (s->verbosity >= 3) 
-               VPrintf2 ( " {0x%x, 0x%x}", s->storedBlockCRC, 
+               VPrintf2 ( " {0x%08x, 0x%08x}", s->storedBlockCRC, 
                          s->calculatedBlockCRC );
            if (s->verbosity >= 2) VPrintf0 ( "]" );
            if (s->calculatedBlockCRC != s->storedBlockCRC)
@@ -863,7 +886,7 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
         Int32 r = BZ2_decompress ( s );
         if (r == BZ_STREAM_END) {
            if (s->verbosity >= 3)
-               VPrintf2 ( "\n    combined CRCs: stored = 0x%x, computed = 0x%x", 
+               VPrintf2 ( "\n    combined CRCs: stored = 0x%08x, computed = 0x%08x", 
                          s->storedCombinedCRC, s->calculatedCombinedCRC );
            if (s->calculatedCombinedCRC != s->storedCombinedCRC)
               return BZ_DATA_ERROR;
@@ -488,9 +488,11 @@ void sendMTFValues ( EState* s )
      /*--
        Recompute the tables based on the accumulated frequencies.
      --*/
+      /* maxLen was changed from 20 to 17 in bzip2-1.0.3.  See 
+         comment in huffman.c for details. */
      for (t = 0; t < nGroups; t++)
         BZ2_hbMakeCodeLengths ( &(s->len[t][0]), &(s->rfreq[t][0]), 
-                                 alphaSize, 20 );
+                                 alphaSize, 17 /*20*/ );
   }


@@ -527,7 +529,7 @@ void sendMTFValues ( EState* s )
         if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
         if (s->len[t][i] < minLen) minLen = s->len[t][i];
      }
-      AssertH ( !(maxLen > 20), 3004 );
+      AssertH ( !(maxLen > 17 /*20*/ ), 3004 );
      AssertH ( !(minLen < 1),  3005 );
      BZ2_hbAssignCodes ( &(s->code[t][0]), &(s->len[t][0]), 
                          minLen, maxLen, alphaSize );
@@ -651,8 +653,8 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
      if (s->blockNo > 1) s->numZ = 0;

      if (s->verbosity >= 2)
-         VPrintf4( "    block %d: crc = 0x%8x, "
-                   "combined CRC = 0x%8x, size = %d\n",
+         VPrintf4( "    block %d: crc = 0x%08x, "
+                   "combined CRC = 0x%08x, size = %d\n",
                   s->blockNo, s->blockCRC, s->combinedCRC, s->nblock );

      BZ2_blockSort ( s );
@@ -703,7 +705,7 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
      bsPutUChar ( s, 0x50 ); bsPutUChar ( s, 0x90 );
      bsPutUInt32 ( s, s->combinedCRC );
      if (s->verbosity >= 2)
-         VPrintf1( "    final combined CRC = 0x%x\n   ", s->combinedCRC );
+         VPrintf1( "    final combined CRC = 0x%08x\n   ", s->combinedCRC );
      bsFinishWrite ( s );
   }
 }
@@ -524,17 +524,23 @@ Int32 BZ2_decompress ( DState* s )
      if (s->origPtr < 0 || s->origPtr >= nblock)
         RETURN(BZ_DATA_ERROR);

+      /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      s->cftab[0] = 0;
+      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
+      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+      for (i = 0; i <= 256; i++) {
+         if (s->cftab[i] < 0 || s->cftab[i] > nblock) {
+            /* s->cftab[i] can legitimately be == nblock */
+            RETURN(BZ_DATA_ERROR);
+         }
+      }
+
      s->state_out_len = 0;
      s->state_out_ch  = 0;
      BZ_INITIALISE_CRC ( s->calculatedBlockCRC );
      s->state = BZ_X_OUTPUT;
      if (s->verbosity >= 2) VPrintf0 ( "rt+rld" );

-      /*-- Set up cftab to facilitate generation of T^(-1) --*/
-      s->cftab[0] = 0;
-      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
-      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
-
      if (s->smallDecompress) {

         /*-- Make a copy of cftab, used in generation of T --*/
@@ -162,7 +162,24 @@ void BZ2_hbMakeCodeLengths ( UChar *len,
      
      if (! tooLong) break;

-      for (i = 1; i < alphaSize; i++) {
+      /* 17 Oct 04: keep-going condition for the following loop used
+         to be 'i < alphaSize', which missed the last element,
+         theoretically leading to the possibility of the compressor
+         looping.  However, this count-scaling step is only needed if
+         one of the generated Huffman code words is longer than
+         maxLen, which up to and including version 1.0.2 was 20 bits,
+         which is extremely unlikely.  In version 1.0.3 maxLen was
+         changed to 17 bits, which has minimal effect on compression
+         ratio, but does mean this scaling step is used from time to
+         time, enough to verify that it works.
+
+         This means that bzip2-1.0.3 and later will only produce
+         Huffman codes with a maximum length of 17 bits.  However, in
+         order to preserve backwards compatibility with bitstreams
+         produced by versions pre-1.0.3, the decompressor must still
+         handle lengths of up to 20. */
+
+      for (i = 1; i <= alphaSize; i++) {
         j = weight[i] >> 8;
         j = 1 + (j / 2);
         weight[i] = j << 8;
@@ -46,6 +46,19 @@ $FreeBSD$
 #define lchown chown
 #endif

+# ifndef DIRECTORY_SEPARATOR
+#  define DIRECTORY_SEPARATOR '/'
+# endif
+
+# ifndef ISSLASH
+#  define ISSLASH(C) ((C) == DIRECTORY_SEPARATOR)
+# endif
+
+# ifndef FILE_SYSTEM_PREFIX_LEN
+#  define FILE_SYSTEM_PREFIX_LEN(Filename) 0
+# endif
+
+
 static void read_pattern_file ();
 static void tape_skip_padding ();
 static void defer_copyin ();
@@ -376,6 +389,54 @@ swab_array (ptr, count)
 /* Current time for verbose table.  */
 static time_t current_time;

+/* Return a safer suffix of FILE_NAME, or "." if it has no safer
+   suffix.  Check for fully specified file names and other atrocities.  */
+
+static const char *
+safer_name_suffix (char const *file_name)
+{
+  char const *p;
+
+  /* Skip file system prefixes, leading file name components that contain
+     "..", and leading slashes.  */
+
+  size_t prefix_len = FILE_SYSTEM_PREFIX_LEN (file_name);
+
+  for (p = file_name + prefix_len; *p;)
+    {
+      if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
+       prefix_len = p + 2 - file_name;
+
+      do
+       {
+         char c = *p++;
+         if (ISSLASH (c))
+           break;
+       }
+      while (*p);
+    }
+
+  for (p = file_name + prefix_len; ISSLASH (*p); p++)
+    continue;
+  prefix_len = p - file_name;
+
+  if (prefix_len)
+    {
+      char *prefix = alloca (prefix_len + 1);
+      memcpy (prefix, file_name, prefix_len);
+      prefix[prefix_len] = '\0';
+
+
+      error (0, 0, "Removing leading `%s' from member names", prefix);
+    }
+
+  if (!*p)
+    p = ".";
+
+  return p;
+}
+
+
 /* Read the collection from standard input and create files
   in the file system.  */

@@ -396,6 +457,7 @@ process_copy_in ()
  int in_file_des;		/* Input file descriptor.  */
  char skip_file;		/* Flag for use with patterns.  */
  int existing_dir;		/* True if file is a dir & already exists.  */
+  mode_t existing_mode;
  int i;			/* Loop index variable.  */
  char *link_name = NULL;	/* Name of hard and symbolic links.  */
 #ifdef HPUX_CDF
@@ -494,18 +556,11 @@ process_copy_in ()

      /* Do we have to ignore absolute paths, and if so, does the filename
         have an absolute path?  */
-      if (no_abs_paths_flag && file_hdr.c_name && file_hdr.c_name [0] == '/')
+      if (!abs_paths_flag && file_hdr.c_name && file_hdr.c_name[0])
 	{
-	  char *p;
+	  const char *p = safer_name_suffix (file_hdr.c_name);

-	  p = file_hdr.c_name;
-	  while (*p == '/')
-	    ++p;
-	  if (*p == '\0')
-	    {
-	      strcpy (file_hdr.c_name, ".");
-	    }
-	  else
+	  if (p != file_hdr.c_name)
 	    {
 	      char *non_abs_name;

@@ -642,6 +697,7 @@ process_copy_in ()
 		     we are trying to create, don't complain about
 		     it.  */
 		  existing_dir = TRUE;
+		  existing_mode = file_stat.st_mode;
 		}
 	      else if (!unconditional_flag
 		       && file_hdr.c_mtime <= file_stat.st_mtime)
@@ -778,8 +834,6 @@ process_copy_in ()
 		    }
 		  copy_files_tape_to_disk (in_file_des, out_file_des, file_hdr.c_filesize);
 		  disk_empty_output_buffer (out_file_des);
-		  if (close (out_file_des) < 0)
-		    error (0, errno, "%s", file_hdr.c_name);

 		  if (archive_format == arf_crcascii)
 		    {
@@ -789,13 +843,15 @@ process_copy_in ()
 		    }
 		  /* File is now copied; set attributes.  */
 		  if (!no_chown_flag)
-		    if ((chown (file_hdr.c_name,
+		    if ((fchown (out_file_des,
 				set_owner_flag ? set_owner : file_hdr.c_uid,
 			   set_group_flag ? set_group : file_hdr.c_gid) < 0)
 			&& errno != EPERM)
 		      error (0, errno, "%s", file_hdr.c_name);
 		  /* chown may have turned off some permissions we wanted. */
-		  if (chmod (file_hdr.c_name, (int) file_hdr.c_mode) < 0)
+		  if (fchmod (out_file_des, (int) file_hdr.c_mode) < 0)
+		    error (0, errno, "%s", file_hdr.c_name);
+		  if (close (out_file_des) < 0)
 		    error (0, errno, "%s", file_hdr.c_name);
 		  if (retain_time_flag)
 		    {
@@ -847,14 +903,23 @@ process_copy_in ()
 		      cdf_flag = 1;
 		    }
 #endif
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      else
-		res = 0;
+		{
+		  if (!no_chown_flag && (existing_mode & 077) != 0
+		     && chmod (file_hdr.c_name, existing_mode & 07700) < 0)
+		   {
+		     error (0, errno, "%s: chmod", file_hdr.c_name);
+		     return;
+		   }
+		   res = 0;
+		}
+
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      if (res < 0)
 		{
@@ -936,20 +1001,20 @@ process_copy_in ()
 	      
 #ifdef CP_IFIFO
 	      if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 	      else
 #endif
-		res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 		      makedev (file_hdr.c_rdev_maj, file_hdr.c_rdev_min));
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
 #ifdef CP_IFIFO
 		  if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 		  else
 #endif
-		    res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		    res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 				 makedev (file_hdr.c_rdev_maj,
 					  file_hdr.c_rdev_min));
 		}
@@ -1376,18 +1441,18 @@ create_final_defers ()
 	  continue;
 	}

-      if (close (out_file_des) < 0)
-	error (0, errno, "%s", d->header.c_name);
-
+  
      /* File is now copied; set attributes.  */
      if (!no_chown_flag)
-	if ((chown (d->header.c_name,
+	if ((fchown (out_file_des,
 		    set_owner_flag ? set_owner : d->header.c_uid,
 	       set_group_flag ? set_group : d->header.c_gid) < 0)
 	    && errno != EPERM)
 	  error (0, errno, "%s", d->header.c_name);
      /* chown may have turned off some permissions we wanted. */
-      if (chmod (d->header.c_name, (int) d->header.c_mode) < 0)
+      if (fchmod (out_file_des, (int) d->header.c_mode) < 0)
+	error (0, errno, "%s", d->header.c_name);
+      if (close (out_file_des) < 0)
 	error (0, errno, "%s", d->header.c_name);
      if (retain_time_flag)
 	{
@@ -49,12 +49,13 @@ write_out_header (file_hdr, out_des)
    {
      char ascii_header[112];
      char *magic_string;
+      int ret;

      if (archive_format == arf_crcascii)
 	magic_string = "070702";
      else
 	magic_string = "070701";
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%6s%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx",
 	       magic_string,
 	       file_hdr->c_ino, file_hdr->c_mode, file_hdr->c_uid,
@@ -62,6 +63,10 @@ write_out_header (file_hdr, out_des)
 	     file_hdr->c_filesize, file_hdr->c_dev_maj, file_hdr->c_dev_min,
 	   file_hdr->c_rdev_maj, file_hdr->c_rdev_min, file_hdr->c_namesize,
 	       file_hdr->c_chksum);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
      tape_buffered_write (ascii_header, out_des, 110L);

      /* Write file name to output.  */
@@ -71,6 +76,7 @@ write_out_header (file_hdr, out_des)
  else if (archive_format == arf_oldascii || archive_format == arf_hpoldascii)
    {
      char ascii_header[78];
+      int ret;
 #ifndef __MSDOS__
      dev_t dev;
      dev_t rdev;
@@ -112,7 +118,7 @@ write_out_header (file_hdr, out_des)
      if ((file_hdr->c_ino >> 16) != 0)
 	error (0, 0, "%s: truncating inode number", file_hdr->c_name);

-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%06o%06o%06lo%06lo%06lo%06lo%06lo%06o%011lo%06lo%011lo",
 	       file_hdr->c_magic & 0xFFFF, dev & 0xFFFF,
 	       file_hdr->c_ino & 0xFFFF, file_hdr->c_mode & 0xFFFF,
@@ -120,6 +126,10 @@ write_out_header (file_hdr, out_des)
 	       file_hdr->c_nlink & 0xFFFF, rdev & 0xFFFF,
 	       file_hdr->c_mtime, file_hdr->c_namesize & 0xFFFF,
 	       file_hdr->c_filesize);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
      tape_buffered_write (ascii_header, out_des, 76L);

      /* Write file name to output.  */
@@ -258,6 +268,14 @@ process_copy_out ()
 	  file_hdr.c_dev_maj = major (file_stat.st_dev);
 	  file_hdr.c_dev_min = minor (file_stat.st_dev);
 	  file_hdr.c_ino = file_stat.st_ino;
+
+	  /* Skip files larger than 4GB which will cause problems on
+	     64bit platforms (and just not work on 32bit). */
+	  if (file_stat.st_size > 0xffffffff) {
+	    error (0, 0, "%s: skipping >4GB file", input_name.ds_string);
+	    continue;
+	  }
+
 	  /* For POSIX systems that don't define the S_IF macros,
 	     we can't assume that S_ISfoo means the standard Unix
 	     S_IFfoo bit(s) are set.  So do it manually, with a
@@ -174,18 +174,18 @@ process_copy_pass ()
 	      disk_empty_output_buffer (out_file_des);
 	      if (close (in_file_des) < 0)
 		error (0, errno, "%s", input_name.ds_string);
-	      if (close (out_file_des) < 0)
-		error (0, errno, "%s", output_name.ds_string);

 	      /* Set the attributes of the new file.  */
 	      if (!no_chown_flag)
-		if ((chown (output_name.ds_string,
+		if ((fchown (out_file_des,
 			    set_owner_flag ? set_owner : in_file_stat.st_uid,
 		      set_group_flag ? set_group : in_file_stat.st_gid) < 0)
 		    && errno != EPERM)
 		  error (0, errno, "%s", output_name.ds_string);
 	      /* chown may have turned off some permissions we wanted. */
-	      if (chmod (output_name.ds_string, in_file_stat.st_mode) < 0)
+	      if (fchmod (out_file_des, in_file_stat.st_mode) < 0)
+		error (0, errno, "%s", output_name.ds_string);
+	      if (close (out_file_des) < 0)
 		error (0, errno, "%s", output_name.ds_string);
 	      if (reset_time_flag)
 		{
@@ -224,15 +224,24 @@ process_copy_pass ()
 		  cdf_flag = 1;
 		}
 #endif
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);

 	    }
 	  else
-	    res = 0;
+            {
+              if (!no_chown_flag && (out_file_stat.st_mode & 077) != 0
+                  && chmod (output_name.ds_string, out_file_stat.st_mode & 07700) < 0)
+                {
+                  error (0, errno, "%s: chmod", output_name.ds_string);
+                  continue;
+                }
+              res = 0;
+            }
+
 	  if (res < 0 && create_dir_flag)
 	    {
 	      create_all_directories (output_name.ds_string);
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 	    }
 	  if (res < 0)
 	    {
@@ -298,20 +307,20 @@ process_copy_pass ()
 	    {
 #ifdef S_ISFIFO
 	      if (S_ISFIFO (in_file_stat.st_mode))
-		res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 	      else
 #endif
-		res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 			     in_file_stat.st_rdev);
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (output_name.ds_string);
 #ifdef S_ISFIFO
 		  if (S_ISFIFO (in_file_stat.st_mode))
-		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 		  else
 #endif
-		    res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		    res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 				 in_file_stat.st_rdev);
 		}
 	      if (res < 0)
@@ -19,7 +19,7 @@ cpio \- copy files to and from archives
 [\-\-unconditional] [\-\-verbose] [\-\-block-size=blocks] [\-\-swap-halfwords]
 [\-\-io-size=bytes] [\-\-pattern-file=file] [\-\-format=format]
 [\-\-owner=[user][:.][group]] [\-\-no-preserve-owner] [\-\-message=message]
-[\-\-force\-local] [\-\-no\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
+[\-\-force\-local] [\-\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
 [\-\-quiet] [\-\-help] [\-\-version] [pattern...] [< archive]

 .B cpio
@@ -251,9 +251,9 @@ current volume number (starting at 1).
 In the verbose table of contents listing, show numeric UID and GID
 instead of translating them into names.
 .TP
-.I " \-\-no-absolute-filenames"
-In copy-in mode, create all files relative to the current directory,
-even if they have an absolute file name in the archive.
+.I " \-\-absolute-filenames"
+Do not strip leading file name components that contain ".."
+and leading slashes from file names in copy-in mode
 .TP
 .I " \-\-no-preserve-owner"
 In copy-in mode and copy-pass mode, do not change the ownership of the
@@ -46,7 +46,7 @@ extern int no_chown_flag;
 extern int sparse_flag;
 extern int quiet_flag;
 extern int only_verify_crc_flag;
-extern int no_abs_paths_flag;
+extern int abs_paths_flag;

 extern int last_header_start;
 extern int copy_matching_files;
@@ -98,8 +98,8 @@ int quiet_flag = FALSE;
   actually extract the files. */
 int only_verify_crc_flag = FALSE;

-/* If TRUE, don't use any absolute paths, prefix them by `./'.  */
-int no_abs_paths_flag = FALSE;
+/* If TRUE, allow any absolute paths */
+int abs_paths_flag = FALSE;

 #ifdef DEBUG_CPIO
 /* If TRUE, print debugging information.  */
@@ -56,7 +56,7 @@ struct option long_opts[] =
  {"list", 0, &table_flag, TRUE},
  {"make-directories", 0, &create_dir_flag, TRUE},
  {"message", 1, 0, 'M'},
-  {"no-absolute-filenames", 0, 0, 136},
+  {"absolute-filenames", 0, 0, 136},
  {"no-preserve-owner", 0, 0, 134},
  {"nonmatching", 0, &copy_matching_files, FALSE},
  {"numeric-uid-gid", 0, &numeric_uid, TRUE},
@@ -105,7 +105,7 @@ Usage: %s {-o|--create} [-0acvABLV] [-C bytes] [-H format] [-M message]\n\
       [--unconditional] [--verbose] [--block-size=blocks] [--swap-halfwords]\n\
       [--io-size=bytes] [--pattern-file=file] [--format=format]\n\
       [--owner=[user][:.][group]] [--no-preserve-owner] [--message=message]\n\
-       [--force-local] [--no-absolute-filenames] [--sparse] [--only-verify-crc]\n\
+       [--force-local] [--absolute-filenames] [--sparse] [--only-verify-crc]\n\
       [--quiet] [--help] [--version] [pattern...] [< archive]\n",
 	   program_name);
  fprintf (fp, "\
@@ -266,8 +266,8 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  numeric_uid = TRUE;
 	  break;

-	case 136:		/* --no-absolute-filenames */
-	  no_abs_paths_flag = TRUE;
+	case 136:		/* --absolute-filenames */
+	  abs_paths_flag = TRUE;
 	  break;
 	
 	case 134:		/* --no-preserve-owner */
@@ -414,7 +414,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  || retain_time_flag || no_chown_flag || set_owner_flag
 	  || set_group_flag || swap_bytes_flag || swap_halfwords_flag
 	  || (append_flag && !(archive_name || output_archive_name))
-	  || rename_batch_file || no_abs_paths_flag
+	  || rename_batch_file || abs_paths_flag
 	  || input_archive_name || (archive_name && output_archive_name))
 	usage (stderr, 2);
      if (archive_format == arf_unknown)
@@ -429,7 +429,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
      if (argc - 1 != optind || archive_format != arf_unknown
 	  || swap_bytes_flag || swap_halfwords_flag
 	  || table_flag || rename_flag || append_flag
-	  || rename_batch_file || no_abs_paths_flag)
+	  || rename_batch_file || abs_paths_flag)
 	usage (stderr, 2);
      directory_name = argv[optind];
    }
@@ -109,14 +109,12 @@ elif [ -f /bin/domainname ]; then
    /usr/bin/ypcat passwd 2>/dev/null | cat - /etc/passwd | grep "^$LOGNAME:" |
      cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
    ORIGINATOR="`cat $TEMP`"
-    rm -f $TEMP
  fi
 fi

 if [ "$ORIGINATOR" = "" ]; then
  grep "^$LOGNAME:" /etc/passwd | cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
  ORIGINATOR="`cat $TEMP`"
-  rm -f $TEMP
 fi

 if [ -n "$ORGANIZATION" ]; then
@@ -116,7 +116,7 @@ password_entry_parseline (cvsroot_canonical, warn, linenumber, linebuf)

 	if (isspace(*(linebuf + 1)))
 	    /* special case since strtoul ignores leading white space */
-	    entry_version = 0;
+	    q = linebuf + 1;
 	else
 	    entry_version = strtoul (linebuf + 1, &q, 10);

@@ -385,6 +385,7 @@ patch_fileproc (callerdat, finfo)
    struct utimbuf t;
    char *vers_tag, *vers_head;
    char *rcs = NULL;
+    char *rcs_orig = NULL;
    RCSNode *rcsfile;
    FILE *fp1, *fp2, *fp3;
    int ret = 0;
@@ -415,7 +416,7 @@ patch_fileproc (callerdat, finfo)
    if ((rcsfile->flags & VALID) && (rcsfile->flags & INATTIC))
 	isattic = 1;

-    rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
+    rcs_orig = rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
    (void) sprintf (rcs, "%s%s", finfo->file, RCSEXT);

    /* if vers_head is NULL, may have been removed from the release */
@@ -757,8 +758,8 @@ failed to read diff file header %s for %s: end of file", tmpfile3, rcs);
 	free (vers_tag);
    if (vers_head != NULL)
 	free (vers_head);
-    if (rcs != NULL)
-	free (rcs);
+    if (rcs_orig)
+	free (rcs_orig);
    return ret;
 }

@@ -3041,8 +3041,7 @@ RCS_getdate (rcs, date, force_tag_match)
    if (retval != NULL)
 	return (retval);

-    if (!force_tag_match ||
-	(vers != NULL && RCS_datecmp (vers->date, date) <= 0))
+    if (vers && (!force_tag_match || RCS_datecmp (vers->date, date) <= 0))
 	return xstrdup (vers->version);
    else
 	return NULL;
@@ -4139,7 +4138,7 @@ RCS_checkout (rcs, workfile, rev, nametag, options, sout, pfn, callerdat)
    size_t len;
    int free_value = 0;
    char *log = NULL;
-    size_t loglen;
+    size_t loglen = 0;
    Node *vp = NULL;
 #ifdef PRESERVE_PERMISSIONS_SUPPORT
    uid_t rcs_owner = (uid_t) -1;
@@ -7457,7 +7456,7 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)

 		for (ln = 0; ln < headlines.nlines; ++ln)
 		{
-		    char buf[80];
+		    char *buf;
 		    /* Period which separates year from month in date.  */
 		    char *ym;
 		    /* Period which separates month from day in date.  */
@@ -7468,10 +7467,12 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 		    if (prvers == NULL)
 			prvers = vers;

+		    buf = xmalloc (strlen (prvers->version) + 24);
 		    sprintf (buf, "%-12s (%-8.8s ",
 			     prvers->version,
 			     prvers->author);
 		    cvs_output (buf, 0);
+		    free (buf);

 		    /* Now output the date.  */
 		    ym = strchr (prvers->date, '.');
@@ -118,11 +118,18 @@ int main FUNCTION((argc, argv), int argc AND char *argv[])
  struct opie opie;
  int rval, n = 499, i, mode = MODE_DEFAULT, force = 0;
  char seed[OPIE_SEED_MAX+1];
+  char *username;
+  uid_t ruid;
  struct passwd *pp;

  memset(seed, 0, sizeof(seed));

-  if (!(pp = getpwnam(getlogin()))) {
+  ruid = getuid();
+  username = getlogin();
+  pp = getpwnam(username);
+  if (username == NULL || pp == NULL || pp->pw_uid != ruid)
+    pp = getpwuid(ruid);
+  if (pp == NULL) {
    fprintf(stderr, "Who are you?");
    return 1;
  }
@@ -145,6 +145,7 @@ sm_flush(fp, timeout)
 				return SM_IO_EOF;
 			}
 			SM_IO_WR_TIMEOUT(fp, fd, *timeout);
+			t = 0;
 		}
 	}
 	return 0;
@@ -192,7 +192,7 @@ extern const char SmFileMagic[];
 	else \
 	{ \
 		(time)->tv_sec = (val) / 1000; \
-		(time)->tv_usec = ((val) - ((time)->tv_sec * 1000)) * 10; \
+		(time)->tv_usec = ((val) - ((time)->tv_sec * 1000)) * 1000; \
 	} \
 	if ((val) == SM_TIME_FOREVER) \
 	{ \
@@ -276,7 +276,7 @@ extern const char SmFileMagic[];
 	else \
 	{ \
 		sm_io_to.tv_sec = (to) / 1000; \
-		sm_io_to.tv_usec = ((to) - (sm_io_to.tv_sec * 1000)) * 10; \
+		sm_io_to.tv_usec = ((to) - (sm_io_to.tv_sec * 1000)) * 1000; \
 	} \
 	if (FD_SETSIZE > 0 && (fd) >= FD_SETSIZE) \
 	{ \
@@ -289,8 +289,11 @@ extern const char SmFileMagic[];
 	FD_SET((fd), &sm_io_x_mask); \
 	if (gettimeofday(&sm_io_to_before, NULL) < 0) \
 		return SM_IO_EOF; \
-	sm_io_to_sel = select((fd) + 1, NULL, &sm_io_to_mask, &sm_io_x_mask, \
-			      &sm_io_to); \
+	do \
+	{	\
+		sm_io_to_sel = select((fd) + 1, NULL, &sm_io_to_mask, \
+					&sm_io_x_mask, &sm_io_to); \
+	} while (sm_io_to_sel < 0 && errno == EINTR); \
 	if (sm_io_to_sel < 0) \
 	{ \
 		/* something went wrong, errno set */ \
@@ -305,10 +308,9 @@ extern const char SmFileMagic[];
 	/* else loop again */ \
 	if (gettimeofday(&sm_io_to_after, NULL) < 0) \
 		return SM_IO_EOF; \
-	timersub(&sm_io_to_before, &sm_io_to_after, &sm_io_to_diff); \
-	timersub(&sm_io_to, &sm_io_to_diff, &sm_io_to); \
-	(to) -= (sm_io_to.tv_sec * 1000); \
-	(to) -= (sm_io_to.tv_usec / 10); \
+	timersub(&sm_io_to_after, &sm_io_to_before, &sm_io_to_diff); \
+	(to) -= (sm_io_to_diff.tv_sec * 1000); \
+	(to) -= (sm_io_to_diff.tv_usec / 1000); \
 	if ((to) < 0) \
 		(to) = 0; \
 }
@@ -76,8 +76,11 @@ static int sm_lflush __P((SM_FILE_T *, int *));
 	FD_SET((fd), &sm_io_x_mask);					\
 	if (gettimeofday(&sm_io_to_before, NULL) < 0)			\
 		return SM_IO_EOF;					\
-	(sel_ret) = select((fd) + 1, &sm_io_to_mask, NULL,		\
-			   &sm_io_x_mask, (to));			\
+	do								\
+	{								\
+		(sel_ret) = select((fd) + 1, &sm_io_to_mask, NULL,	\
+			   	&sm_io_x_mask, (to));			\
+	} while ((sel_ret) < 0 && errno == EINTR);			\
 	if ((sel_ret) < 0)						\
 	{								\
 		/* something went wrong, errno set */			\
@@ -94,7 +97,7 @@ static int sm_lflush __P((SM_FILE_T *, int *));
 	/* calulate wall-clock time used */				\
 	if (gettimeofday(&sm_io_to_after, NULL) < 0)			\
 		return SM_IO_EOF;					\
-	timersub(&sm_io_to_before, &sm_io_to_after, &sm_io_to_diff);	\
+	timersub(&sm_io_to_after, &sm_io_to_before, &sm_io_to_diff);	\
 	timersub((to), &sm_io_to_diff, (to));				\
 }

@@ -15,7 +15,6 @@

 SM_RCSID("@(#)$Id: collect.c,v 8.260 2004/11/30 23:29:15 ca Exp $")

-static void	collecttimeout __P((int));
 static void	eatfrom __P((char *volatile, ENVELOPE *));
 static void	collect_doheader __P((ENVELOPE *));
 static SM_FILE_T *collect_dfopen __P((ENVELOPE *));
@@ -263,10 +262,6 @@ collect_dfopen(e)
 **		If data file cannot be created, the process is terminated.
 */

-static jmp_buf	CtxCollectTimeout;
-static bool	volatile CollectProgress;
-static SM_EVENT	*volatile CollectTimeout = NULL;
-
 /* values for input state machine */
 #define IS_NORM		0	/* middle of line */
 #define IS_BOL		1	/* beginning of line */
@@ -288,27 +283,31 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	register ENVELOPE *e;
 	bool rsetsize;
 {
-	register SM_FILE_T *volatile df;
-	volatile bool ignrdot;
-	volatile int dbto;
-	register char *volatile bp;
-	volatile int c;
-	volatile bool inputerr;
+	register SM_FILE_T *df;
+	bool ignrdot;
+	int dbto;
+	register char *bp;
+	int c;
+	bool inputerr;
 	bool headeronly;
-	char *volatile buf;
-	volatile int buflen;
-	volatile int istate;
-	volatile int mstate;
-	volatile int hdrslen;
-	volatile int numhdrs;
-	volatile int afd;
-	unsigned char *volatile pbp;
+	char *buf;
+	int buflen;
+	int istate;
+	int mstate;
+	int hdrslen;
+	int numhdrs;
+	int afd;
+	unsigned char *pbp;
 	unsigned char peekbuf[8];
 	char bufbuf[MAXLINE];

 	df = NULL;
 	ignrdot = smtpmode ? false : IgnrDot;
-	dbto = smtpmode ? (int) TimeOuts.to_datablock : 0;
+
+	/* timeout for I/O functions is in milliseconds */
+	dbto = smtpmode ? ((int) TimeOuts.to_datablock * 1000)
+			: SM_TIME_FOREVER;
+	sm_io_setinfo(fp, SM_IO_WHAT_TIMEOUT, &dbto);
 	c = SM_IO_EOF;
 	inputerr = false;
 	headeronly = hdrp != NULL;
@@ -320,7 +319,6 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	pbp = peekbuf;
 	istate = IS_BOL;
 	mstate = SaveFrom ? MS_HEADER : MS_UFROM;
-	CollectProgress = false;

 	/*
 	**  Tell ARPANET to go ahead.
@@ -341,32 +339,6 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 	**	the larger picture (e.g., header versus body).
 	*/

-	if (dbto != 0)
-	{
-		/* handle possible input timeout */
-		if (setjmp(CtxCollectTimeout) != 0)
-		{
-			if (LogLevel > 2)
-				sm_syslog(LOG_NOTICE, e->e_id,
-					  "timeout waiting for input from %s during message collect",
-					  CURHOSTNAME);
-			errno = 0;
-			if (smtpmode)
-			{
-				/*
-				**  Override e_message in usrerr() as this
-				**  is the reason for failure that should
-				**  be logged for undelivered recipients.
-				*/
-
-				e->e_message = NULL;
-			}
-			usrerr("451 4.4.1 timeout waiting for input during message collect");
-			goto readerr;
-		}
-		CollectTimeout = sm_setevent(dbto, collecttimeout, dbto);
-	}
-
 	if (rsetsize)
 		e->e_msgsize = 0;
 	for (;;)
@@ -390,9 +362,26 @@ collect(fp, smtpmode, hdrp, e, rsetsize)
 						sm_io_clearerr(fp);
 						continue;
 					}
+
+					/* timeout? */
+					if (c == SM_IO_EOF && errno == EAGAIN
+					    && smtpmode)
+					{
+						/*
+						**  Override e_message in
+						**  usrerr() as this is the
+						**  reason for failure that
+						**  should be logged for
+						**  undelivered recipients.
+						*/
+
+						e->e_message = NULL;
+						errno = 0;
+						inputerr = true;
+						goto readabort;
+					}
 					break;
 				}
-				CollectProgress = true;
 				if (TrafficLogFile != NULL && !headeronly)
 				{
 					if (istate == IS_BOL)
@@ -538,6 +527,18 @@ bufferchar:
 					buflen *= 2;
 				else
 					buflen += MEMCHUNKSIZE;
+				if (buflen <= 0)
+				{
+					sm_syslog(LOG_NOTICE, e->e_id,
+						  "header overflow from %s during message collect",
+						  CURHOSTNAME);
+					errno = 0;
+					e->e_flags |= EF_CLRQUEUE;
+					e->e_status = "5.6.0";
+					usrerrenh(e->e_status,
+						  "552 Headers too large");
+					goto discard;
+				}
 				buf = xalloc(buflen);
 				memmove(buf, obuf, bp - obuf);
 				bp = &buf[bp - obuf];
@@ -581,6 +582,7 @@ bufferchar:
 					usrerrenh(e->e_status,
 						  "552 Headers too large (%d max)",
 						  MaxHeadersLength);
+  discard:
 					mstate = MS_DISCARD;
 				}
 			}
@@ -620,6 +622,24 @@ nextstate:
 				sm_io_clearerr(fp);
 				errno = 0;
 				c = sm_io_getc(fp, SM_TIME_DEFAULT);
+
+				/* timeout? */
+				if (c == SM_IO_EOF && errno == EAGAIN
+				    && smtpmode)
+				{
+					/*
+					**  Override e_message in
+					**  usrerr() as this is the
+					**  reason for failure that
+					**  should be logged for
+					**  undelivered recipients.
+					*/
+
+					e->e_message = NULL;
+					errno = 0;
+					inputerr = true;
+					goto readabort;
+				}
 			} while (c == SM_IO_EOF && errno == EINTR);
 			if (c != SM_IO_EOF)
 				(void) sm_io_ungetc(fp, SM_TIME_DEFAULT, c);
@@ -629,8 +649,12 @@ nextstate:
 				continue;
 			}

-			/* trim off trailing CRLF or NL */
 			SM_ASSERT(bp > buf);
+
+			/* guaranteed by isheader(buf) */
+			SM_ASSERT(*(bp - 1) != '\n' || bp > buf + 1);
+
+			/* trim off trailing CRLF or NL */
 			if (*--bp != '\n' || *--bp != '\r')
 				bp++;
 			*bp = '\0';
@@ -696,10 +720,6 @@ readerr:
 		inputerr = true;
 	}

-	/* reset global timer */
-	if (CollectTimeout != NULL)
-		sm_clrevent(CollectTimeout);
-
 	if (headeronly)
 		return;

@@ -785,6 +805,7 @@ readerr:
 	}

 	/* An EOF when running SMTP is an error */
+  readabort:
 	if (inputerr && (OpMode == MD_SMTP || OpMode == MD_DAEMON))
 	{
 		char *host;
@@ -807,13 +828,14 @@ readerr:
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
 		if (sm_io_eof(fp))
-			usrerr("451 4.4.1 collect: %s on connection from %s, from=%s",
+			usrerr("421 4.4.1 collect: %s on connection from %s, from=%s",
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
 		else
-			syserr("451 4.4.1 collect: %s on connection from %s, from=%s",
+			syserr("421 4.4.1 collect: %s on connection from %s, from=%s",
 				problem, host,
 				shortenstring(e->e_from.q_paddr, MAXSHORTSTR));
+		flush_errors(true);

 		/* don't return an error indication */
 		e->e_to = NULL;
@@ -906,39 +928,6 @@ readerr:
 	}
 }

-static void
-collecttimeout(timeout)
-	int timeout;
-{
-	int save_errno = errno;
-
-	/*
-	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
-	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
-	**	DOING.
-	*/
-
-	if (CollectProgress)
-	{
-		/* reset the timeout */
-		CollectTimeout = sm_sigsafe_setevent(timeout, collecttimeout,
-						     timeout);
-		CollectProgress = false;
-	}
-	else
-	{
-		/* event is done */
-		CollectTimeout = NULL;
-	}
-
-	/* if no progress was made or problem resetting event, die now */
-	if (CollectTimeout == NULL)
-	{
-		errno = ETIMEDOUT;
-		longjmp(CtxCollectTimeout, 1);
-	}
-	errno = save_errno;
-}
 /*
 **  DFERROR -- signal error on writing the data file.
 **
@@ -5299,8 +5299,8 @@ sm_syslog(level, id, fmt, va_alist)
 	va_dcl
 #endif /* __STDC__ */
 {
-	static char *buf = NULL;
-	static size_t bufsize;
+	char *buf;
+	size_t bufsize;
 	char *begin, *end;
 	int save_errno;
 	int seq = 1;
@@ -5324,11 +5324,8 @@ sm_syslog(level, id, fmt, va_alist)
 	else
 		idlen = strlen(id) + SyslogPrefixLen;

-	if (buf == NULL)
-	{
-		buf = buf0;
-		bufsize = sizeof buf0;
-	}
+	buf = buf0;
+	bufsize = sizeof buf0;

 	for (;;)
 	{
@@ -5370,8 +5367,8 @@ sm_syslog(level, id, fmt, va_alist)
 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
 					     "%s: %s\n", id, newstring);
 #endif /* LOG */
-		if (buf == buf0)
-			buf = NULL;
+		if (buf != buf0)
+			sm_free(buf);
 		errno = save_errno;
 		return;
 	}
@@ -5435,8 +5432,8 @@ sm_syslog(level, id, fmt, va_alist)
 		(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
 				     "%s[%d]: %s\n", id, seq, begin);
 #endif /* LOG */
-	if (buf == buf0)
-		buf = NULL;
+	if (buf != buf0)
+		sm_free(buf);
 	errno = save_errno;
 }
 /*
@@ -3257,16 +3257,33 @@ do_transfer:
 	}
 	else if (!clever)
 	{
+		bool ok;
+
 		/*
 		**  Format and send message.
 		*/

-		putfromline(mci, e);
-		(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
-		(*e->e_putbody)(mci, e, NULL);
+		rcode = EX_OK;
+		errno = 0;
+		ok = putfromline(mci, e);
+		if (ok)
+			ok = (*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
+		if (ok)
+			ok = (*e->e_putbody)(mci, e, NULL);

-		/* get the exit status */
+		/*
+		**  Ignore an I/O error that was caused by EPIPE.
+		**  Some broken mailers don't read the entire body
+		**  but just exit() thus causing an I/O error.
+		*/
+
+		if (!ok && (sm_io_error(mci->mci_out) && errno == EPIPE))
+			ok = true;
+
+		/* (always) get the exit status */
 		rcode = endmailer(mci, e, pv);
+		if (!ok)
+			rcode = EX_TEMPFAIL;
 		if (rcode == EX_TEMPFAIL && SmtpError[0] == '\0')
 		{
 			/*
@@ -4420,13 +4437,13 @@ logdelivery(m, mci, dsn, status, ctladdr, xstart, e)
 **		e -- the envelope.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		outputs some text to fp.
 */

-void
+bool
 putfromline(mci, e)
 	register MCI *mci;
 	ENVELOPE *e;
@@ -4436,7 +4453,7 @@ putfromline(mci, e)
 	char xbuf[MAXLINE];

 	if (bitnset(M_NHDR, mci->mci_mailer->m_flags))
-		return;
+		return true;

 	mci->mci_flags |= MCIF_INHEADER;

@@ -4477,8 +4494,9 @@ putfromline(mci, e)
 		}
 	}
 	expand(template, buf, sizeof buf, e);
-	putxline(buf, strlen(buf), mci, PXLF_HEADER);
+	return putxline(buf, strlen(buf), mci, PXLF_HEADER);
 }
+
 /*
 **  PUTBODY -- put the body of a message.
 **
@@ -4489,7 +4507,7 @@ putfromline(mci, e)
 **			not be permitted in the resulting message.
 **
 **	Returns:
-**		none.
+**		true iff message was written successfully
 **
 **	Side Effects:
 **		The message is written onto fp.
@@ -4500,13 +4518,15 @@ putfromline(mci, e)
 #define OS_CR		1	/* read a carriage return */
 #define OS_INLINE	2	/* putting rest of line */

-void
+bool
 putbody(mci, e, separator)
 	register MCI *mci;
 	register ENVELOPE *e;
 	char *separator;
 {
 	bool dead = false;
+	bool ioerr = false;
+	int save_errno;
 	char buf[MAXLINE];
 #if MIME8TO7
 	char *boundaries[MAXMIMENESTING + 1];
@@ -4536,10 +4556,12 @@ putbody(mci, e, separator)
 	{
 		if (bitset(MCIF_INHEADER, mci->mci_flags))
 		{
-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;
 			mci->mci_flags &= ~MCIF_INHEADER;
 		}
-		putline("<<< No Message Collected >>>", mci);
+		if (!putline("<<< No Message Collected >>>", mci))
+			goto writeerr;
 		goto endofmessage;
 	}

@@ -4568,26 +4590,31 @@ putbody(mci, e, separator)
 		*/

 		/* make sure it looks like a MIME message */
-		if (hvalue("MIME-Version", e->e_header) == NULL)
-			putline("MIME-Version: 1.0", mci);
+		if (hvalue("MIME-Version", e->e_header) == NULL &&
+		    !putline("MIME-Version: 1.0", mci))
+			goto writeerr;

 		if (hvalue("Content-Type", e->e_header) == NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 					   "Content-Type: text/plain; charset=%s",
 					   defcharset(e));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* now do the hard work */
 		boundaries[0] = NULL;
 		mci->mci_flags |= MCIF_INHEADER;
-		(void) mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER);
+		if (mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER, 0) ==
+								SM_IO_EOF)
+			goto writeerr;
 	}
 # if MIME7TO8
 	else if (bitset(MCIF_CVT7TO8, mci->mci_flags))
 	{
-		(void) mime7to8(mci, e->e_header, e);
+		if (!mime7to8(mci, e->e_header, e))
+			goto writeerr;
 	}
 # endif /* MIME7TO8 */
 	else if (MaxMimeHeaderLength > 0 || MaxMimeFieldLength > 0)
@@ -4609,8 +4636,9 @@ putbody(mci, e, separator)
 		if (bitset(EF_DONT_MIME, e->e_flags))
 			SuprErrs = true;

-		(void) mime8to7(mci, e->e_header, e, boundaries,
-				M87F_OUTER|M87F_NO8TO7);
+		if (mime8to7(mci, e->e_header, e, boundaries,
+				M87F_OUTER|M87F_NO8TO7, 0) == SM_IO_EOF)
+			goto writeerr;

 		/* restore SuprErrs */
 		SuprErrs = oldsuprerrs;
@@ -4630,7 +4658,8 @@ putbody(mci, e, separator)

 		if (bitset(MCIF_INHEADER, mci->mci_flags))
 		{
-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;
 			mci->mci_flags &= ~MCIF_INHEADER;
 		}

@@ -4721,11 +4750,6 @@ putbody(mci, e, separator)
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos++;
 				}
 				for (xp = buf; xp < bp; xp++)
@@ -4738,11 +4762,6 @@ putbody(mci, e, separator)
 						dead = true;
 						break;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 				}
 				if (dead)
 					continue;
@@ -4753,11 +4772,6 @@ putbody(mci, e, separator)
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						break;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos = 0;
 				}
 				else
@@ -4791,11 +4805,6 @@ putbody(mci, e, separator)
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						continue;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}

 					if (TrafficLogFile != NULL)
 					{
@@ -4857,11 +4866,6 @@ putch:
 							dead = true;
 							continue;
 						}
-						else
-						{
-							/* record progress for DATA timeout */
-							DataProgress = true;
-						}
 						pos++;
 						continue;
 					}
@@ -4877,11 +4881,6 @@ putch:
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}

 					if (TrafficLogFile != NULL)
 					{
@@ -4907,11 +4906,6 @@ putch:
 							mci->mci_mailer->m_eol)
 							== SM_IO_EOF)
 						continue;
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos = 0;
 					ostate = OS_HEAD;
 				}
@@ -4929,11 +4923,6 @@ putch:
 						dead = true;
 						continue;
 					}
-					else
-					{
-						/* record progress for DATA timeout */
-						DataProgress = true;
-					}
 					pos++;
 					ostate = OS_INLINE;
 				}
@@ -4960,11 +4949,6 @@ putch:
 					dead = true;
 					break;
 				}
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 			}
 			pos += bp - buf;
 		}
@@ -4974,11 +4958,9 @@ putch:
 				(void) sm_io_fputs(TrafficLogFile,
 						   SM_TIME_DEFAULT,
 						   mci->mci_mailer->m_eol);
-			(void) sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
-					   mci->mci_mailer->m_eol);
-
-			/* record progress for DATA timeout */
-			DataProgress = true;
+			if (sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
+					   mci->mci_mailer->m_eol) == SM_IO_EOF)
+				goto writeerr;
 		}
 	}

@@ -4988,6 +4970,7 @@ putch:
 		       qid_printqueue(e->e_dfqgrp, e->e_dfqdir),
 		       DATAFL_LETTER, e->e_id);
 		ExitStat = EX_IOERR;
+		ioerr = true;
 	}

 endofmessage:
@@ -5002,23 +4985,35 @@ endofmessage:
 	**  offset to match.
 	*/

+	save_errno = errno;
 	if (e->e_dfp != NULL)
 		(void) bfrewind(e->e_dfp);

 	/* some mailers want extra blank line at end of message */
 	if (!dead && bitnset(M_BLANKEND, mci->mci_mailer->m_flags) &&
 	    buf[0] != '\0' && buf[0] != '\n')
-		putline("", mci);
-
-	(void) sm_io_flush(mci->mci_out, SM_TIME_DEFAULT);
-	if (sm_io_error(mci->mci_out) && errno != EPIPE)
 	{
-		syserr("putbody: write error");
-		ExitStat = EX_IOERR;
+		if (!putline("", mci))
+			goto writeerr;
 	}

-	errno = 0;
+	if (!dead &&
+	    (sm_io_flush(mci->mci_out, SM_TIME_DEFAULT) == SM_IO_EOF ||
+	     (sm_io_error(mci->mci_out) && errno != EPIPE)))
+	{
+		save_errno = errno;
+		syserr("putbody: write error");
+		ExitStat = EX_IOERR;
+		ioerr = true;
+	}
+
+	errno = save_errno;
+	return !dead && !ioerr;
+
+  writeerr:
+	return false;
 }
+
 /*
 **  MAILFILE -- Send a message to a file.
 **
@@ -5549,14 +5544,14 @@ mailfile(filename, mailer, ctladdr, sfflags, e)
 		}
 #endif /* MIME7TO8 */

-		putfromline(&mcibuf, e);
-		(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER);
-		(*e->e_putbody)(&mcibuf, e, NULL);
-		putline("\n", &mcibuf);
-		if (sm_io_flush(f, SM_TIME_DEFAULT) != 0 ||
+		if (!putfromline(&mcibuf, e) ||
+		    !(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER) ||
+		    !(*e->e_putbody)(&mcibuf, e, NULL) ||
+		    !putline("\n", &mcibuf) ||
+		    (sm_io_flush(f, SM_TIME_DEFAULT) != 0 ||
 		    (SuperSafe != SAFE_NO &&
 		     fsync(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL)) < 0) ||
-		    sm_io_error(f))
+		    sm_io_error(f)))
 		{
 			setstat(EX_IOERR);
 #if !NOFTRUNCATE
@@ -6114,86 +6109,23 @@ starttls(m, mci, e)
 ssl_retry:
 	if ((result = SSL_connect(clt_ssl)) <= 0)
 	{
-		int i;
-		bool timedout;
-		time_t left;
-		time_t now = curtime();
-		struct timeval tv;
+		int i, ssl_err;

-		/* what to do in this case? */
-		i = SSL_get_error(clt_ssl, result);
+		ssl_err = SSL_get_error(clt_ssl, result);
+		i = tls_retry(clt_ssl, rfd, wfd, tlsstart,
+			TimeOuts.to_starttls, ssl_err, "client");
+		if (i > 0)
+			goto ssl_retry;

-		/*
-		**  For SSL_ERROR_WANT_{READ,WRITE}:
-		**  There is not a complete SSL record available yet
-		**  or there is only a partial SSL record removed from
-		**  the network (socket) buffer into the SSL buffer.
-		**  The SSL_connect will only succeed when a full
-		**  SSL record is available (assuming a "real" error
-		**  doesn't happen). To handle when a "real" error
-		**  does happen the select is set for exceptions too.
-		**  The connection may be re-negotiated during this time
-		**  so both read and write "want errors" need to be handled.
-		**  A select() exception loops back so that a proper SSL
-		**  error message can be gotten.
-		*/
-
-		left = TimeOuts.to_starttls - (now - tlsstart);
-		timedout = left <= 0;
-		if (!timedout)
-		{
-			tv.tv_sec = left;
-			tv.tv_usec = 0;
-		}
-
-		if (!timedout && FD_SETSIZE > 0 &&
-		    (rfd >= FD_SETSIZE ||
-		     (i == SSL_ERROR_WANT_WRITE && wfd >= FD_SETSIZE)))
-		{
-			if (LogLevel > 5)
-			{
-				sm_syslog(LOG_ERR, e->e_id,
-					  "STARTTLS=client, error: fd %d/%d too large",
-					  rfd, wfd);
-			if (LogLevel > 8)
-				tlslogerr("client");
-			}
-			errno = EINVAL;
-			goto tlsfail;
-		}
-		if (!timedout && i == SSL_ERROR_WANT_READ)
-		{
-			fd_set ssl_maskr, ssl_maskx;
-
-			FD_ZERO(&ssl_maskr);
-			FD_SET(rfd, &ssl_maskr);
-			FD_ZERO(&ssl_maskx);
-			FD_SET(rfd, &ssl_maskx);
-			if (select(rfd + 1, &ssl_maskr, NULL, &ssl_maskx, &tv)
-			    > 0)
-				goto ssl_retry;
-		}
-		if (!timedout && i == SSL_ERROR_WANT_WRITE)
-		{
-			fd_set ssl_maskw, ssl_maskx;
-
-			FD_ZERO(&ssl_maskw);
-			FD_SET(wfd, &ssl_maskw);
-			FD_ZERO(&ssl_maskx);
-			FD_SET(rfd, &ssl_maskx);
-			if (select(wfd + 1, NULL, &ssl_maskw, &ssl_maskx, &tv)
-			    > 0)
-				goto ssl_retry;
-		}
 		if (LogLevel > 5)
 		{
-			sm_syslog(LOG_ERR, e->e_id,
-				  "STARTTLS=client, error: connect failed=%d, SSL_error=%d, timedout=%d, errno=%d",
-				  result, i, (int) timedout, errno);
+			sm_syslog(LOG_WARNING, NOQID,
+				  "STARTTLS=client, error: connect failed=%d, SSL_error=%d, errno=%d, retry=%d",
+				  result, ssl_err, errno, i);
 			if (LogLevel > 8)
 				tlslogerr("client");
 		}
-tlsfail:
+
 		SSL_free(clt_ssl);
 		clt_ssl = NULL;
 		return EX_SOFTWARE;
@@ -19,7 +19,7 @@ SM_RCSID("@(#)$Id: headers.c,v 8.287 2004/12/03 18:29:51 ca Exp $")
 static HDR	*allocheader __P((char *, char *, int, SM_RPOOL_T *));
 static size_t	fix_mime_header __P((HDR *, ENVELOPE *));
 static int	priencode __P((char *));
-static void	put_vanilla_header __P((HDR *, char *, MCI *));
+static bool	put_vanilla_header __P((HDR *, char *, MCI *));

 /*
 **  SETUPHEADERS -- initialize headers in symbol table
@@ -994,7 +994,6 @@ logsender(e, msgid)
 	char *name;
 	register char *sbp;
 	register char *p;
-	int l;
 	char hbuf[MAXNAME + 1];
 	char sbuf[MAXLINE + 1];
 	char mbuf[MAXNAME + 1];
@@ -1003,6 +1002,8 @@ logsender(e, msgid)
 	/* XXX do we still need this? sm_syslog() replaces control chars */
 	if (msgid != NULL)
 	{
+		size_t l;
+
 		l = strlen(msgid);
 		if (l > sizeof mbuf - 1)
 			l = sizeof mbuf - 1;
@@ -1542,13 +1543,13 @@ crackaddr(addr, e)
 **		flags -- MIME conversion flags.
 **
 **	Returns:
-**		none.
+**		success
 **
 **	Side Effects:
 **		none.
 */

-void
+bool
 putheader(mci, hdr, e, flags)
 	register MCI *mci;
 	HDR *hdr;
@@ -1683,7 +1684,8 @@ putheader(mci, hdr, e, flags)
 		{
 			if (tTd(34, 11))
 				sm_dprintf("\n");
-			put_vanilla_header(h, p, mci);
+			if (!put_vanilla_header(h, p, mci))
+				goto writeerr;
 			continue;
 		}

@@ -1742,7 +1744,8 @@ putheader(mci, hdr, e, flags)
 				/* no other recipient headers: truncate value */
 				(void) sm_strlcpyn(obuf, sizeof obuf, 2,
 						   h->h_field, ":");
-				putline(obuf, mci);
+				if (!putline(obuf, mci))
+					goto writeerr;
 			}
 			continue;
 		}
@@ -1761,7 +1764,8 @@ putheader(mci, hdr, e, flags)
 		}
 		else
 		{
-			put_vanilla_header(h, p, mci);
+			if (!put_vanilla_header(h, p, mci))
+				goto writeerr;
 		}
 	}

@@ -1778,18 +1782,25 @@ putheader(mci, hdr, e, flags)
 	    !bitset(MCIF_CVT8TO7|MCIF_CVT7TO8|MCIF_INMIME, mci->mci_flags) &&
 	    hvalue("MIME-Version", e->e_header) == NULL)
 	{
-		putline("MIME-Version: 1.0", mci);
+		if (!putline("MIME-Version: 1.0", mci))
+			goto writeerr;
 		if (hvalue("Content-Type", e->e_header) == NULL)
 		{
 			(void) sm_snprintf(obuf, sizeof obuf,
 					"Content-Type: text/plain; charset=%s",
 					defcharset(e));
-			putline(obuf, mci);
+			if (!putline(obuf, mci))
+				goto writeerr;
 		}
-		if (hvalue("Content-Transfer-Encoding", e->e_header) == NULL)
-			putline("Content-Transfer-Encoding: 8bit", mci);
+		if (hvalue("Content-Transfer-Encoding", e->e_header) == NULL
+		    && !putline("Content-Transfer-Encoding: 8bit", mci))
+			goto writeerr;
 	}
 #endif /* MIME8TO7 */
+	return true;
+
+  writeerr:
+	return false;
 }
 /*
 **  PUT_VANILLA_HEADER -- output a fairly ordinary header
@@ -1800,10 +1811,10 @@ putheader(mci, hdr, e, flags)
 **		mci -- the connection info for output
 **
 **	Returns:
-**		none.
+**		success
 */

-static void
+static bool
 put_vanilla_header(h, v, mci)
 	HDR *h;
 	char *v;
@@ -1834,7 +1845,8 @@ put_vanilla_header(h, v, mci)
 			l = SPACELEFT(obuf, obp) - 1;

 		(void) sm_snprintf(obp, SPACELEFT(obuf, obp), "%.*s", l, v);
-		putxline(obuf, strlen(obuf), mci, putflags);
+		if (!putxline(obuf, strlen(obuf), mci, putflags))
+			goto writeerr;
 		v += l + 1;
 		obp = obuf;
 		if (*v != ' ' && *v != '\t')
@@ -1844,7 +1856,10 @@ put_vanilla_header(h, v, mci)
 	/* XXX This is broken for SPACELEFT()==0 */
 	(void) sm_snprintf(obp, SPACELEFT(obuf, obp), "%.*s",
 			   (int) (SPACELEFT(obuf, obp) - 1), v);
-	putxline(obuf, strlen(obuf), mci, putflags);
+	return putxline(obuf, strlen(obuf), mci, putflags);
+
+  writeerr:
+	return false;
 }
 /*
 **  COMMAIZE -- output a header field, making a comma-translated list.
@@ -1857,13 +1872,13 @@ put_vanilla_header(h, v, mci)
 **		e -- the envelope containing the message.
 **
 **	Returns:
-**		none.
+**		success
 **
 **	Side Effects:
 **		outputs "p" to file "fp".
 */

-void
+bool
 commaize(h, p, oldstyle, mci, e)
 	register HDR *h;
 	register char *p;
@@ -2002,13 +2017,6 @@ commaize(h, p, oldstyle, mci, e)
 		}
 		name = denlstring(name, false, true);

-		/*
-		**  record data progress so DNS timeouts
-		**  don't cause DATA timeouts
-		*/
-
-		DataProgress = true;
-
 		/* output the name with nice formatting */
 		opos += strlen(name);
 		if (!firstone)
@@ -2016,7 +2024,8 @@ commaize(h, p, oldstyle, mci, e)
 		if (opos > omax && !firstone)
 		{
 			(void) sm_strlcpy(obp, ",\n", SPACELEFT(obuf, obp));
-			putxline(obuf, strlen(obuf), mci, putflags);
+			if (!putxline(obuf, strlen(obuf), mci, putflags))
+				goto writeerr;
 			obp = obuf;
 			(void) sm_strlcpy(obp, "        ", sizeof obuf);
 			opos = strlen(obp);
@@ -2038,8 +2047,12 @@ commaize(h, p, oldstyle, mci, e)
 		*obp = '\0';
 	else
 		obuf[sizeof obuf - 1] = '\0';
-	putxline(obuf, strlen(obuf), mci, putflags);
+	return putxline(obuf, strlen(obuf), mci, putflags);
+
+  writeerr:
+	return false;
 }
+
 /*
 **  COPYHEADER -- copy header list
 **
@@ -80,12 +80,14 @@ static bool	MapNLtoCRLF;
 **		boundaries -- the currently pending message boundaries.
 **			NULL if we are processing the outer portion.
 **		flags -- to tweak processing.
+**		level -- recursion level.
 **
 **	Returns:
 **		An indicator of what terminated the message part:
 **		  MBT_FINAL -- the final boundary
 **		  MBT_INTERMED -- an intermediate boundary
 **		  MBT_NOTSEP -- an end of file
+**		  SM_IO_EOF -- I/O error occurred
 */

 struct args
@@ -95,12 +97,13 @@ struct args
 };

 int
-mime8to7(mci, header, e, boundaries, flags)
+mime8to7(mci, header, e, boundaries, flags, level)
 	register MCI *mci;
 	HDR *header;
 	register ENVELOPE *e;
 	char **boundaries;
 	int flags;
+	int level;
 {
 	register char *p;
 	int linelen;
@@ -121,6 +124,18 @@ mime8to7(mci, header, e, boundaries, flags)
 	char pvpbuf[MAXLINE];
 	extern unsigned char MimeTokenTab[256];

+	if (level > MAXMIMENESTING)
+	{
+		if (!bitset(EF_TOODEEP, e->e_flags))
+		{
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, level=%d\n",
+					   level);
+			usrerr("mime8to7: recursion level %d exceeded",
+				level);
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
+		}
+	}
 	if (tTd(43, 1))
 	{
 		sm_dprintf("mime8to7: flags = %x, boundaries =", flags);
@@ -241,7 +256,9 @@ mime8to7(mci, header, e, boundaries, flags)
 	*/

 	if (sm_strcasecmp(type, "multipart") == 0 &&
-	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)))
+	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)) &&
+	    !bitset(EF_TOODEEP, e->e_flags)
+	   )
 	{

 		if (sm_strcasecmp(subtype, "digest") == 0)
@@ -285,10 +302,13 @@ mime8to7(mci, header, e, boundaries, flags)
 		}
 		if (i >= MAXMIMENESTING)
 		{
-			usrerr("mime8to7: multipart nesting boundary too deep");
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, i=%d\n", i);
+			if (!bitset(EF_TOODEEP, e->e_flags))
+				usrerr("mime8to7: multipart nesting boundary too deep");

 			/* avoid bounce loops */
-			e->e_flags |= EF_DONT_MIME;
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
 		}
 		else
 		{
@@ -298,7 +318,8 @@ mime8to7(mci, header, e, boundaries, flags)
 		mci->mci_flags |= MCIF_INMIME;

 		/* skip the early "comment" prologue */
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		bt = MBT_FINAL;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
@@ -307,8 +328,9 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putxline(buf, strlen(buf), mci,
-				 PXLF_MAPFROM|PXLF_STRIP8BIT);
+			if (!putxline(buf, strlen(buf), mci,
+					PXLF_MAPFROM|PXLF_STRIP8BIT))
+				goto writeerr;
 			if (tTd(43, 99))
 				sm_dprintf("  ...%s", buf);
 		}
@@ -319,19 +341,25 @@ mime8to7(mci, header, e, boundaries, flags)
 			auto HDR *hdr = NULL;

 			(void) sm_strlcpyn(buf, sizeof buf, 2, "--", bbuf);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			if (tTd(43, 35))
 				sm_dprintf("  ...%s\n", buf);
 			collect(e->e_dfp, false, &hdr, e, false);
 			if (tTd(43, 101))
 				putline("+++after collect", mci);
-			putheader(mci, hdr, e, flags);
+			if (!putheader(mci, hdr, e, flags))
+				goto writeerr;
 			if (tTd(43, 101))
 				putline("+++after putheader", mci);
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
+			if (bt == SM_IO_EOF)
+				goto writeerr;
 		}
 		(void) sm_strlcpyn(buf, sizeof buf, 3, "--", bbuf, "--");
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (tTd(43, 35))
 			sm_dprintf("  ...%s\n", buf);
 		boundaries[i] = NULL;
@@ -344,8 +372,9 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putxline(buf, strlen(buf), mci,
-				 PXLF_MAPFROM|PXLF_STRIP8BIT);
+			if (!putxline(buf, strlen(buf), mci,
+					PXLF_MAPFROM|PXLF_STRIP8BIT))
+				goto writeerr;
 			if (tTd(43, 99))
 				sm_dprintf("  ...%s", buf);
 		}
@@ -365,7 +394,8 @@ mime8to7(mci, header, e, boundaries, flags)

 	if (sm_strcasecmp(type, "message") == 0)
 	{
-		if (!wordinclass(subtype, 's'))
+		if (!wordinclass(subtype, 's') ||
+		    bitset(EF_TOODEEP, e->e_flags))
 		{
 			flags |= M87F_NO8BIT;
 		}
@@ -373,19 +403,23 @@ mime8to7(mci, header, e, boundaries, flags)
 		{
 			auto HDR *hdr = NULL;

-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;

 			mci->mci_flags |= MCIF_INMIME;
 			collect(e->e_dfp, false, &hdr, e, false);
 			if (tTd(43, 101))
 				putline("+++after collect", mci);
-			putheader(mci, hdr, e, flags);
+			if (!putheader(mci, hdr, e, flags))
+				goto writeerr;
 			if (tTd(43, 101))
 				putline("+++after putheader", mci);
 			if (hvalue("MIME-Version", hdr) == NULL &&
-			    !bitset(M87F_NO8TO7, flags))
-				putline("MIME-Version: 1.0", mci);
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			    !bitset(M87F_NO8TO7, flags) &&
+			    !putline("MIME-Version: 1.0", mci))
+				goto writeerr;
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
 			mci->mci_flags &= ~MCIF_INMIME;
 			return bt;
 		}
@@ -480,11 +514,13 @@ mime8to7(mci, header, e, boundaries, flags)

 			(void) sm_snprintf(buf, sizeof buf,
 				"Content-Transfer-Encoding: %.200s", cte);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			if (tTd(43, 36))
 				sm_dprintf("  ...%s\n", buf);
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
 			!= NULL)
@@ -492,7 +528,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			bt = mimeboundary(buf, boundaries);
 			if (bt != MBT_NOTSEP)
 				break;
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 		if (sm_io_eof(e->e_dfp))
 			bt = MBT_FINAL;
@@ -505,12 +542,13 @@ mime8to7(mci, header, e, boundaries, flags)

 		if (tTd(43, 36))
 			sm_dprintf("  ...Content-Transfer-Encoding: base64\n");
-		putline("Content-Transfer-Encoding: base64", mci);
+		if (!putline("Content-Transfer-Encoding: base64", mci))
+			goto writeerr;
 		(void) sm_snprintf(buf, sizeof buf,
 			"X-MIME-Autoconverted: from 8bit to base64 by %s id %s",
 			MyHostName, e->e_id);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline(buf, mci) || !putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while ((c1 = mime_getchar_crlf(e->e_dfp, boundaries, &bt)) !=
 			SM_IO_EOF)
@@ -518,7 +556,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			if (linelen > 71)
 			{
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = 0;
 				bp = buf;
 			}
@@ -548,7 +587,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			*bp++ = Base64Code[c2 & 0x3f];
 		}
 		*bp = '\0';
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 	}
 	else
 	{
@@ -571,12 +611,14 @@ mime8to7(mci, header, e, boundaries, flags)

 		if (tTd(43, 36))
 			sm_dprintf("  ...Content-Transfer-Encoding: quoted-printable\n");
-		putline("Content-Transfer-Encoding: quoted-printable", mci);
+		if (!putline("Content-Transfer-Encoding: quoted-printable",
+				mci))
+			goto writeerr;
 		(void) sm_snprintf(buf, sizeof buf,
 			"X-MIME-Autoconverted: from 8bit to quoted-printable by %s id %s",
 			MyHostName, e->e_id);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline(buf, mci) || !putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		fromstate = 0;
 		c2 = '\n';
@@ -598,7 +640,8 @@ mime8to7(mci, header, e, boundaries, flags)
 					*bp++ = Base16Code['.' & 0x0f];
 				}
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = fromstate = 0;
 				bp = buf;
 				c2 = c1;
@@ -627,7 +670,8 @@ mime8to7(mci, header, e, boundaries, flags)
 					c2 = '\n';
 				*bp++ = '=';
 				*bp = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 				linelen = fromstate = 0;
 				bp = buf;
 				if (c2 == '.')
@@ -665,13 +709,17 @@ mime8to7(mci, header, e, boundaries, flags)
 		if (linelen > 0 || boundaries[0] != NULL)
 		{
 			*bp = '\0';
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 	}
 	if (tTd(43, 3))
 		sm_dprintf("\t\t\tmime8to7=>%s (basic)\n", MimeBoundaryNames[bt]);
 	return bt;
+
+  writeerr:
+	return SM_IO_EOF;
 }
 /*
 **  MIME_GETCHAR -- get a character for MIME processing
@@ -958,7 +1006,7 @@ static int	mime_fromqp __P((unsigned char *, unsigned char **, int));
 **		e -- envelope.
 **
 **	Returns:
-**		none.
+**		true iff body was written successfully
 */

 static char index_64[128] =
@@ -975,7 +1023,7 @@ static char index_64[128] =

 # define CHAR64(c)  (((c) < 0 || (c) > 127) ? -1 : index_64[(c)])

-void
+bool
 mime7to8(mci, header, e)
 	register MCI *mci;
 	HDR *header;
@@ -1008,25 +1056,31 @@ mime7to8(mci, header, e)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"Content-Transfer-Encoding: %s", p);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 		while (sm_io_fgets(e->e_dfp, SM_TIME_DEFAULT, buf, sizeof buf)
 			!= NULL)
-			putline(buf, mci);
-		return;
+		{
+			if (!putline(buf, mci))
+				goto writeerr;
+		}
+		return true;
 	}
 	cataddr(pvp, NULL, buf, sizeof buf, '\0');
 	cte = sm_rpool_strdup_x(e->e_rpool, buf);

 	mci->mci_flags |= MCIF_INHEADER;
-	putline("Content-Transfer-Encoding: 8bit", mci);
+	if (!putline("Content-Transfer-Encoding: 8bit", mci))
+		goto writeerr;
 	(void) sm_snprintf(buf, sizeof buf,
 		"X-MIME-Autoconverted: from %.200s to 8bit by %s id %s",
 		cte, MyHostName, e->e_id);
-	putline(buf, mci);
-	putline("", mci);
+	if (!putline(buf, mci) || !putline("", mci))
+		goto writeerr;
 	mci->mci_flags &= ~MCIF_INHEADER;

 	/*
@@ -1090,7 +1144,8 @@ mime7to8(mci, header, e)
 		if (*fbufp++ == '\n' || fbufp >= &fbuf[MAXLINE])	\
 		{							\
 			CHK_EOL;					\
-			putxline((char *) fbuf, fbufp - fbuf, mci, pxflags); \
+			if (!putxline((char *) fbuf, fbufp - fbuf, mci, pxflags)) \
+				goto writeerr;				\
 			pxflags &= ~PXLF_NOADDEOL;			\
 			fbufp = fbuf;					\
 		}	\
@@ -1127,8 +1182,11 @@ again:
 				continue;

 			if (fbufp - fbuf > 0)
-				putxline((char *) fbuf, fbufp - fbuf - 1, mci,
-					 pxflags);
+			{
+				if (!putxline((char *) fbuf, fbufp - fbuf - 1,
+						mci, pxflags))
+					goto writeerr;
+			}
 			fbufp = fbuf;
 			if (off >= 0 && buf[off] != '\0')
 			{
@@ -1144,7 +1202,8 @@ again:
 	if (fbufp > fbuf)
 	{
 		*fbufp = '\0';
-		putxline((char *) fbuf, fbufp - fbuf, mci, pxflags);
+		if (!putxline((char *) fbuf, fbufp - fbuf, mci, pxflags))
+			goto writeerr;
 	}

 	/*
@@ -1154,10 +1213,15 @@ again:
 	**  but so is auto-converting MIME in the first place.
 	*/

-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;

 	if (tTd(43, 3))
 		sm_dprintf("\t\t\tmime7to8 => %s to 8bit done\n", cte);
+	return true;
+
+  writeerr:
+	return false;
 }
 /*
 **  The following is based on Borenstein's "codes.c" module, with simplifying
@@ -1337,7 +1337,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 					/* $&{x} replacement */
 					char *mval = macvalue(rp[1], e);
 					char **xpvp;
-					int trsize = 0;
+					size_t trsize = 0;
 					static size_t pvpb1_size = 0;
 					static char **pvpb1 = NULL;
 					char pvpbuf[PSBUFSIZE];
@@ -1352,7 +1352,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 					/* save the remainder of the input */
 					for (xpvp = pvp; *xpvp != NULL; xpvp++)
 						trsize += sizeof *xpvp;
-					if ((size_t) trsize > pvpb1_size)
+					if (trsize > pvpb1_size)
 					{
 						if (pvpb1 != NULL)
 							sm_free(pvpb1);
@@ -1407,7 +1407,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 		{
 			char **hbrvp;
 			char **xpvp;
-			int trsize;
+			size_t trsize;
 			char *replac;
 			int endtoken;
 			STAB *map;
@@ -1509,7 +1509,7 @@ rewrite(pvp, ruleset, reclevel, e, maxatom)
 				*++arg_rvp = NULL;

 			/* save the remainder of the input string */
-			trsize = (int) (avp - rvp + 1) * sizeof *rvp;
+			trsize = (avp - rvp + 1) * sizeof *rvp;
 			memmove((char *) pvpb1, (char *) rvp, trsize);

 			/* look it up */
@@ -2936,7 +2936,7 @@ rscheck(rwset, p1, p2, e, flags, logl, host, logid)
 	char *logid;
 {
 	char *volatile buf;
-	int bufsize;
+	size_t bufsize;
 	int saveexitstat;
 	int volatile rstat = EX_OK;
 	char **pvp;
@@ -3150,7 +3150,7 @@ rscap(rwset, p1, p2, e, pvp, pvpbuf, size)
 	int size;
 {
 	char *volatile buf;
-	int bufsize;
+	size_t bufsize;
 	int volatile rstat = EX_OK;
 	int rsno;
 	bool saveQuickAbort = QuickAbort;
@@ -15,7 +15,7 @@

 SM_RCSID("@(#)$Id: savemail.c,v 8.304 2004/10/06 21:36:06 ca Exp $")

-static void	errbody __P((MCI *, ENVELOPE *, char *));
+static bool	errbody __P((MCI *, ENVELOPE *, char *));
 static bool	pruneroute __P((char *));

 /*
@@ -432,12 +432,13 @@ savemail(e, sendbody)
 			p = macvalue('g', e);
 			macdefine(&e->e_macro, A_PERM, 'g', e->e_sender);

-			putfromline(&mcibuf, e);
-			(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER);
-			(*e->e_putbody)(&mcibuf, e, NULL);
-			putline("\n", &mcibuf); /* XXX EOL from FileMailer? */
-			(void) sm_io_flush(fp, SM_TIME_DEFAULT);
-			if (sm_io_error(fp) ||
+			if (!putfromline(&mcibuf, e) ||
+			    !(*e->e_puthdr)(&mcibuf, e->e_header, e,
+					M87F_OUTER) ||
+			    !(*e->e_putbody)(&mcibuf, e, NULL) ||
+			    !putline("\n", &mcibuf) ||
+			    sm_io_flush(fp, SM_TIME_DEFAULT) == SM_IO_EOF ||
+			    sm_io_error(fp) ||
 			    sm_io_close(fp, SM_TIME_DEFAULT) < 0)
 				state = ESM_PANIC;
 			else
@@ -732,14 +733,14 @@ returntosender(msg, returnq, flags, e)
 **		separator -- any possible MIME separator (unused).
 **
 **	Returns:
-**		none
+**		success
 **
 **	Side Effects:
 **		Outputs the body of an error message.
 */

 /* ARGSUSED2 */
-static void
+static bool
 errbody(mci, e, separator)
 	register MCI *mci;
 	register ENVELOPE *e;
@@ -757,14 +758,16 @@ errbody(mci, e, separator)

 	if (bitset(MCIF_INHEADER, mci->mci_flags))
 	{
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		mci->mci_flags &= ~MCIF_INHEADER;
 	}
 	if (e->e_parent == NULL)
 	{
 		syserr("errbody: null parent");
-		putline("   ----- Original message lost -----\n", mci);
-		return;
+		if (!putline("   ----- Original message lost -----\n", mci))
+			goto writeerr;
+		return true;
 	}

 	/*
@@ -773,11 +776,12 @@ errbody(mci, e, separator)

 	if (e->e_msgboundary != NULL)
 	{
-		putline("This is a MIME-encapsulated message", mci);
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "--", e->e_msgboundary);
-		putline(buf, mci);
-		putline("", mci);
+		if (!putline("This is a MIME-encapsulated message", mci) ||
+		    !putline("", mci) ||
+		    !putline(buf, mci) ||
+		    !putline("", mci))
+			goto writeerr;
 	}

 	/*
@@ -799,31 +803,36 @@ errbody(mci, e, separator)
 	if (!pm_notify && q == NULL &&
 	    !bitset(EF_FATALERRS|EF_SENDRECEIPT, e->e_parent->e_flags))
 	{
-		putline("    **********************************************",
-			mci);
-		putline("    **      THIS IS A WARNING MESSAGE ONLY      **",
-			mci);
-		putline("    **  YOU DO NOT NEED TO RESEND YOUR MESSAGE  **",
-			mci);
-		putline("    **********************************************",
-			mci);
-		putline("", mci);
+		if (!putline("    **********************************************",
+			mci) ||
+		    !putline("    **      THIS IS A WARNING MESSAGE ONLY      **",
+			mci) ||
+		    !putline("    **  YOU DO NOT NEED TO RESEND YOUR MESSAGE  **",
+			mci) ||
+		    !putline("    **********************************************",
+			mci) ||
+		    !putline("", mci))
+			goto writeerr;
 	}
 	(void) sm_snprintf(buf, sizeof buf,
 		"The original message was received at %s",
 		arpadate(ctime(&e->e_parent->e_ctime)));
-	putline(buf, mci);
+	if (!putline(buf, mci))
+		goto writeerr;
 	expand("from \201_", buf, sizeof buf, e->e_parent);
-	putline(buf, mci);
+	if (!putline(buf, mci))
+		goto writeerr;

 	/* include id in postmaster copies */
 	if (pm_notify && e->e_parent->e_id != NULL)
 	{
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "with id ",
 			e->e_parent->e_id);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 	}
-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;

 	/*
 	**  Output error message header (if specified and available).
@@ -849,17 +858,19 @@ errbody(mci, e, separator)
 				{
 					translate_dollars(buf);
 					expand(buf, buf, sizeof buf, e);
-					putline(buf, mci);
+					if (!putline(buf, mci))
+						goto writeerr;
 				}
 				(void) sm_io_close(xfile, SM_TIME_DEFAULT);
-				putline("\n", mci);
+				if (!putline("\n", mci))
+					goto writeerr;
 			}
 		}
 		else
 		{
 			expand(ErrMsgFile, buf, sizeof buf, e);
-			putline(buf, mci);
-			putline("", mci);
+			if (!putline(buf, mci) || !putline("", mci))
+				goto writeerr;
 		}
 	}

@@ -877,21 +888,24 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had permanent fatal errors -----",
-				mci);
+			if (!putline("   ----- The following addresses had permanent fatal errors -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_strlcpy(buf, shortenstring(q->q_paddr, MAXSHORTSTR),
 				  sizeof buf);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_rstatus != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (reason: %s)",
 				shortenstring(exitstat(q->q_rstatus),
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 		if (q->q_alias != NULL)
 		{
@@ -899,11 +913,12 @@ errbody(mci, e, separator)
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/* transient non-fatal errors */
 	printheader = true;
@@ -917,25 +932,28 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had transient non-fatal errors -----",
-				mci);
+			if (!putline("   ----- The following addresses had transient non-fatal errors -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_strlcpy(buf, shortenstring(q->q_paddr, MAXSHORTSTR),
 				  sizeof buf);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_alias != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/* successful delivery notifications */
 	printheader = true;
@@ -968,25 +986,28 @@ errbody(mci, e, separator)

 		if (printheader)
 		{
-			putline("   ----- The following addresses had successful delivery notifications -----",
-				mci);
+			if (!putline("   ----- The following addresses had successful delivery notifications -----",
+					mci))
+				goto writeerr;
 			printheader = false;
 		}

 		(void) sm_snprintf(buf, sizeof buf, "%s  (%s)",
 			 shortenstring(q->q_paddr, MAXSHORTSTR), p);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;
 		if (q->q_alias != NULL)
 		{
 			(void) sm_snprintf(buf, sizeof buf,
 				"    (expanded from: %s)",
 				shortenstring(q->q_alias->q_paddr,
 					      MAXSHORTSTR));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
-	if (!printheader)
-		putline("", mci);
+	if (!printheader && !putline("", mci))
+		goto writeerr;

 	/*
 	**  Output transcript of errors
@@ -995,8 +1016,9 @@ errbody(mci, e, separator)
 	(void) sm_io_flush(smioout, SM_TIME_DEFAULT);
 	if (e->e_parent->e_xfp == NULL)
 	{
-		putline("   ----- Transcript of session is unavailable -----\n",
-			mci);
+		if (!putline("   ----- Transcript of session is unavailable -----\n",
+				mci))
+			goto writeerr;
 	}
 	else
 	{
@@ -1007,11 +1029,12 @@ errbody(mci, e, separator)
 		while (sm_io_fgets(e->e_parent->e_xfp, SM_TIME_DEFAULT, buf,
 				   sizeof buf) != NULL)
 		{
-			if (printheader)
-				putline("   ----- Transcript of session follows -----\n",
-					mci);
+			if (printheader && !putline("   ----- Transcript of session follows -----\n",
+						mci))
+				goto writeerr;
 			printheader = false;
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}
 	}
 	errno = 0;
@@ -1023,11 +1046,12 @@ errbody(mci, e, separator)

 	if (e->e_msgboundary != NULL)
 	{
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "--", e->e_msgboundary);
-		putline(buf, mci);
-		putline("Content-Type: message/delivery-status", mci);
-		putline("", mci);
+		if (!putline("", mci) ||
+		    !putline(buf, mci) ||
+		    !putline("Content-Type: message/delivery-status", mci) ||
+		    !putline("", mci))
+			goto writeerr;

 		/*
 		**  Output per-message information.
@@ -1039,13 +1063,15 @@ errbody(mci, e, separator)
 			(void) sm_snprintf(buf, sizeof buf,
 					"Original-Envelope-Id: %.800s",
 					xuntextify(e->e_parent->e_envid));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* Reporting-MTA: is us (required) */
 		(void) sm_snprintf(buf, sizeof buf,
 				   "Reporting-MTA: dns; %.800s", MyHostName);
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;

 		/* DSN-Gateway: not relevant since we are not translating */

@@ -1059,13 +1085,15 @@ errbody(mci, e, separator)
 			(void) sm_snprintf(buf, sizeof buf,
 					"Received-From-MTA: %s; %.800s",
 					p, RealHostName);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/* Arrival-Date: -- when it arrived here */
 		(void) sm_strlcpyn(buf, sizeof buf, 2, "Arrival-Date: ",
 				arpadate(ctime(&e->e_parent->e_ctime)));
-		putline(buf, mci);
+		if (!putline(buf, mci))
+			goto writeerr;

 		/* Deliver-By-Date: -- when it should have been delivered */
 		if (IS_DLVR_BY(e->e_parent))
@@ -1076,7 +1104,8 @@ errbody(mci, e, separator)
 			(void) sm_strlcpyn(buf, sizeof buf, 2,
 					"Deliver-By-Date: ",
 					arpadate(ctime(&dbyd)));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 		}

 		/*
@@ -1119,7 +1148,8 @@ errbody(mci, e, separator)
 			else
 				continue;

-			putline("", mci);
+			if (!putline("", mci))
+				goto writeerr;

 			/* Original-Recipient: -- passed from on high */
 			if (q->q_orcpt != NULL)
@@ -1127,7 +1157,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Original-Recipient: %.800s",
 						q->q_orcpt);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Figure out actual recipient */
@@ -1176,7 +1207,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						   "Final-Recipient: %s",
 						   q->q_finalrcpt);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* X-Actual-Recipient: -- the real problem address */
@@ -1190,13 +1222,15 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						   "X-Actual-Recipient: %s",
 						   actual);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Action: -- what happened? */
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Action: ",
 				action);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Status: -- what _really_ happened? */
 			if (q->q_status != NULL)
@@ -1208,7 +1242,8 @@ errbody(mci, e, separator)
 			else
 				p = "2.0.0";
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Status: ", p);
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Remote-MTA: -- who was I talking to? */
 			if (q->q_statmta != NULL)
@@ -1222,7 +1257,8 @@ errbody(mci, e, separator)
 				p = &buf[strlen(buf) - 1];
 				if (*p == '.')
 					*p = '\0';
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Diagnostic-Code: -- actual result from other end */
@@ -1234,7 +1270,8 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Diagnostic-Code: %s; %.800s",
 						p, q->q_rstatus);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}

 			/* Last-Attempt-Date: -- fine granularity */
@@ -1243,7 +1280,8 @@ errbody(mci, e, separator)
 			(void) sm_strlcpyn(buf, sizeof buf, 2,
 					"Last-Attempt-Date: ",
 					arpadate(ctime(&q->q_statdate)));
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			/* Will-Retry-Until: -- for delayed messages only */
 			if (QS_IS_QUEUEUP(q->q_state))
@@ -1255,7 +1293,8 @@ errbody(mci, e, separator)
 				(void) sm_strlcpyn(buf, sizeof buf, 2,
 					 "Will-Retry-Until: ",
 					 arpadate(ctime(&xdate)));
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}
 		}
 	}
@@ -1265,7 +1304,8 @@ errbody(mci, e, separator)
 	**  Output text of original message
 	*/

-	putline("", mci);
+	if (!putline("", mci))
+		goto writeerr;
 	if (bitset(EF_HAS_DF, e->e_parent->e_flags))
 	{
 		sendbody = !bitset(EF_NO_BODY_RETN, e->e_parent->e_flags) &&
@@ -1273,21 +1313,27 @@ errbody(mci, e, separator)

 		if (e->e_msgboundary == NULL)
 		{
-			if (sendbody)
-				putline("   ----- Original message follows -----\n", mci);
-			else
-				putline("   ----- Message header follows -----\n", mci);
+			if (!putline(
+				sendbody
+				? "   ----- Original message follows -----\n"
+				: "   ----- Message header follows -----\n",
+				mci))
+			{
+				goto writeerr;
+			}
 		}
 		else
 		{
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "--",
 					e->e_msgboundary);

-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;
 			(void) sm_strlcpyn(buf, sizeof buf, 2, "Content-Type: ",
 					sendbody ? "message/rfc822"
 						 : "text/rfc822-headers");
-			putline(buf, mci);
+			if (!putline(buf, mci))
+				goto writeerr;

 			p = hvalue("Content-Transfer-Encoding",
 				   e->e_parent->e_header);
@@ -1301,43 +1347,62 @@ errbody(mci, e, separator)
 				(void) sm_snprintf(buf, sizeof buf,
 						"Content-Transfer-Encoding: %s",
 						p);
-				putline(buf, mci);
+				if (!putline(buf, mci))
+					goto writeerr;
 			}
 		}
-		putline("", mci);
+		if (!putline("", mci))
+			goto writeerr;
 		save_errno = errno;
-		putheader(mci, e->e_parent->e_header, e->e_parent, M87F_OUTER);
+		if (!putheader(mci, e->e_parent->e_header, e->e_parent,
+				M87F_OUTER))
+			goto writeerr;
 		errno = save_errno;
 		if (sendbody)
-			putbody(mci, e->e_parent, e->e_msgboundary);
+		{
+			if (!putbody(mci, e->e_parent, e->e_msgboundary))
+				goto writeerr;
+		}
 		else if (e->e_msgboundary == NULL)
 		{
-			putline("", mci);
-			putline("   ----- Message body suppressed -----", mci);
+			if (!putline("", mci) ||
+			    !putline("   ----- Message body suppressed -----",
+					mci))
+			{
+				goto writeerr;
+			}
 		}
 	}
 	else if (e->e_msgboundary == NULL)
 	{
-		putline("  ----- No message was collected -----\n", mci);
+		if (!putline("  ----- No message was collected -----\n", mci))
+			goto writeerr;
 	}

 	if (e->e_msgboundary != NULL)
 	{
-		putline("", mci);
 		(void) sm_strlcpyn(buf, sizeof buf, 3, "--", e->e_msgboundary,
 				   "--");
-		putline(buf, mci);
+		if (!putline("", mci) || !putline(buf, mci))
+			goto writeerr;
 	}
-	putline("", mci);
-	(void) sm_io_flush(mci->mci_out, SM_TIME_DEFAULT);
+	if (!putline("", mci) ||
+	    sm_io_flush(mci->mci_out, SM_TIME_DEFAULT) == SM_IO_EOF)
+			goto writeerr;

 	/*
 	**  Cleanup and exit
 	*/

 	if (errno != 0)
+	{
+  writeerr:
 		syserr("errbody: I/O error");
+		return false;
+	}
+	return true;
 }
+
 /*
 **  SMTPTODSN -- convert SMTP to DSN status code
 **
@@ -809,13 +809,13 @@ extern struct hdrinfo	HdrInfo[];
 /* functions */
 extern void	addheader __P((char *, char *, int, ENVELOPE *));
 extern unsigned long	chompheader __P((char *, int, HDR **, ENVELOPE *));
-extern void	commaize __P((HDR *, char *, bool, MCI *, ENVELOPE *));
+extern bool	commaize __P((HDR *, char *, bool, MCI *, ENVELOPE *));
 extern HDR	*copyheader __P((HDR *, SM_RPOOL_T *));
 extern void	eatheader __P((ENVELOPE *, bool, bool));
 extern char	*hvalue __P((char *, HDR *));
 extern void	insheader __P((int, char *, char *, int, ENVELOPE *));
 extern bool	isheader __P((char *));
-extern void	putfromline __P((MCI *, ENVELOPE *));
+extern bool	putfromline __P((MCI *, ENVELOPE *));
 extern void	setupheaders __P((void));

 /*
@@ -870,9 +870,9 @@ struct envelope
 	short		e_sendmode;	/* message send mode */
 	short		e_errormode;	/* error return mode */
 	short		e_timeoutclass;	/* message timeout class */
-	void		(*e_puthdr)__P((MCI *, HDR *, ENVELOPE *, int));
+	bool		(*e_puthdr)__P((MCI *, HDR *, ENVELOPE *, int));
 					/* function to put header of message */
-	void		(*e_putbody)__P((MCI *, ENVELOPE *, char *));
+	bool		(*e_putbody)__P((MCI *, ENVELOPE *, char *));
 					/* function to put body of message */
 	ENVELOPE	*e_parent;	/* the message this one encloses */
 	ENVELOPE	*e_sibling;	/* the next envelope of interest */
@@ -942,6 +942,7 @@ struct envelope
 #define EF_TOOBIG	0x02000000L	/* message is too big */
 #define EF_SPLIT	0x04000000L	/* envelope has been split */
 #define EF_UNSAFE	0x08000000L	/* unsafe: read from untrusted source */
+#define EF_TOODEEP	0x10000000L	/* message is nested too deep */

 #define DLVR_NOTIFY	0x01
 #define DLVR_RETURN	0x02
@@ -965,8 +966,8 @@ extern void	dropenvelope __P((ENVELOPE *, bool, bool));
 extern ENVELOPE	*newenvelope __P((ENVELOPE *, ENVELOPE *, SM_RPOOL_T *));
 extern void	clrsessenvelope __P((ENVELOPE *));
 extern void	printenvflags __P((ENVELOPE *));
-extern void	putbody __P((MCI *, ENVELOPE *, char *));
-extern void	putheader __P((MCI *, HDR *, ENVELOPE *, int));
+extern bool	putbody __P((MCI *, ENVELOPE *, char *));
+extern bool	putheader __P((MCI *, HDR *, ENVELOPE *, int));

 /*
 **  Message priority classes.
@@ -1650,8 +1651,8 @@ EXTERN unsigned long	PrivacyFlags;	/* privacy flags */
 #define M87F_NO8TO7		0x0004	/* don't do 8->7 bit conversions */

 /* functions */
-extern void	mime7to8 __P((MCI *, HDR *, ENVELOPE *));
-extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int));
+extern bool	mime7to8 __P((MCI *, HDR *, ENVELOPE *));
+extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int, int));

 /*
 **  Flags passed to returntosender.
@@ -2145,7 +2146,6 @@ EXTERN bool	ColonOkInAddr;	/* single colon legal in address */
 #if !defined(_USE_SUN_NSSWITCH_) && !defined(_USE_DEC_SVC_CONF_)
 EXTERN bool	ConfigFileRead;	/* configuration file has been read */
 #endif /* !defined(_USE_SUN_NSSWITCH_) && !defined(_USE_DEC_SVC_CONF_) */
-EXTERN bool	volatile DataProgress;	/* have we sent anything since last check */
 EXTERN bool	DisConnected;	/* running with OutChannel redirect to transcript file */
 EXTERN bool	DontExpandCnames;	/* do not $[...$] expand CNAMEs */
 EXTERN bool	DontInitGroups;	/* avoid initgroups() because of NIS cost */
@@ -2519,8 +2519,8 @@ extern void	printopenfds __P((bool));
 extern void	printqueue __P((void));
 extern void	printrules __P((void));
 extern pid_t	prog_open __P((char **, int *, ENVELOPE *));
-extern void	putline __P((char *, MCI *));
-extern void	putxline __P((char *, size_t, MCI *, int));
+extern bool	putline __P((char *, MCI *));
+extern bool	putxline __P((char *, size_t, MCI *, int));
 extern void	queueup_macros __P((int, SM_FILE_T *, ENVELOPE *));
 extern void	readcf __P((char *, bool, ENVELOPE *));
 extern SIGFUNC_DECL	reapchild __P((int));
@@ -540,6 +540,125 @@ tls_close(fp)
 /* maximum number of retries for TLS related I/O due to handshakes */
 # define MAX_TLS_IOS	4

+/*
+**  TLS_RETRY -- check whether a failed SSL operation can be retried
+**
+**	Parameters:
+**		ssl -- TLS structure
+**		rfd -- read fd
+**		wfd -- write fd
+**		tlsstart -- start time of TLS operation
+**		timeout -- timeout for TLS operation
+**		err -- SSL error
+**		where -- description of operation
+**
+**	Results:
+**		>0 on success
+**		0 on timeout
+**		<0 on error
+*/
+
+int
+tls_retry(ssl, rfd, wfd, tlsstart, timeout, err, where)
+	SSL *ssl;
+	int rfd;
+	int wfd;
+	time_t tlsstart;
+	int timeout;
+	int err;
+	const char *where;
+{
+	int ret;
+	time_t left;
+	time_t now = curtime();
+	struct timeval tv;
+
+	ret = -1;
+
+	/*
+	**  For SSL_ERROR_WANT_{READ,WRITE}:
+	**  There is not a complete SSL record available yet
+	**  or there is only a partial SSL record removed from
+	**  the network (socket) buffer into the SSL buffer.
+	**  The SSL_connect will only succeed when a full
+	**  SSL record is available (assuming a "real" error
+	**  doesn't happen). To handle when a "real" error
+	**  does happen the select is set for exceptions too.
+	**  The connection may be re-negotiated during this time
+	**  so both read and write "want errors" need to be handled.
+	**  A select() exception loops back so that a proper SSL
+	**  error message can be gotten.
+	*/
+
+	left = timeout - (now - tlsstart);
+	if (left <= 0)
+		return 0;	/* timeout */
+	tv.tv_sec = left;
+	tv.tv_usec = 0;
+
+	if (LogLevel > 14)
+	{
+		sm_syslog(LOG_INFO, NOQID,
+			  "STARTTLS=%s, info: fds=%d/%d, err=%d",
+			  where, rfd, wfd, err);
+	}
+
+	if (FD_SETSIZE > 0 &&
+	    ((err == SSL_ERROR_WANT_READ && rfd >= FD_SETSIZE) ||
+	     (err == SSL_ERROR_WANT_WRITE && wfd >= FD_SETSIZE)))
+	{
+		if (LogLevel > 5)
+		{
+			sm_syslog(LOG_ERR, NOQID,
+				  "STARTTLS=%s, error: fd %d/%d too large",
+				  where, rfd, wfd);
+		if (LogLevel > 8)
+			tlslogerr(where);
+		}
+		errno = EINVAL;
+	}
+	else if (err == SSL_ERROR_WANT_READ)
+	{
+		fd_set ssl_maskr, ssl_maskx;
+
+		FD_ZERO(&ssl_maskr);
+		FD_SET(rfd, &ssl_maskr);
+		FD_ZERO(&ssl_maskx);
+		FD_SET(rfd, &ssl_maskx);
+		do
+		{
+			ret = select(rfd + 1, &ssl_maskr, NULL, &ssl_maskx,
+					&tv);
+		} while (ret < 0 && errno == EINTR);
+		if (ret < 0 && errno > 0)
+			ret = -errno;
+	}
+	else if (err == SSL_ERROR_WANT_WRITE)
+	{
+		fd_set ssl_maskw, ssl_maskx;
+
+		FD_ZERO(&ssl_maskw);
+		FD_SET(wfd, &ssl_maskw);
+		FD_ZERO(&ssl_maskx);
+		FD_SET(rfd, &ssl_maskx);
+		do
+		{
+			ret = select(wfd + 1, NULL, &ssl_maskw, &ssl_maskx,
+					&tv);
+		} while (ret < 0 && errno == EINTR);
+		if (ret < 0 && errno > 0)
+			ret = -errno;
+	}
+	return ret;
+}
+
+/* errno to force refill() etc to stop (see IS_IO_ERROR()) */
+#ifdef ETIMEDOUT
+# define SM_ERR_TIMEOUT	ETIMEDOUT
+#else /* ETIMEDOUT */
+# define SM_ERR_TIMEOUT	EIO
+#endif /* ETIMEDOUT */
+
 /*
 **  TLS_READ -- read secured information for the caller
 **
@@ -561,38 +680,42 @@ tls_read(fp, buf, size)
 	char *buf;
 	size_t size;
 {
-	int r;
-	static int again = MAX_TLS_IOS;
+	int r, rfd, wfd, try, ssl_err;
 	struct tls_obj *so = (struct tls_obj *) fp->f_cookie;
+	time_t tlsstart;
 	char *err;

+	try = 99;
+	err = NULL;
+	tlsstart = curtime();
+
+  retry:
 	r = SSL_read(so->con, (char *) buf, size);

 	if (r > 0)
-	{
-		again = MAX_TLS_IOS;
 		return r;
-	}

 	err = NULL;
-	switch (SSL_get_error(so->con, r))
+	switch (ssl_err = SSL_get_error(so->con, r))
 	{
 	  case SSL_ERROR_NONE:
 	  case SSL_ERROR_ZERO_RETURN:
-		again = MAX_TLS_IOS;
 		break;
 	  case SSL_ERROR_WANT_WRITE:
-		if (--again <= 0)
-			err = "read W BLOCK";
-		else
-			errno = EAGAIN;
-		break;
+		err = "read W BLOCK";
+		/* FALLTHROUGH */
 	  case SSL_ERROR_WANT_READ:
-		if (--again <= 0)
+		if (err == NULL)
 			err = "read R BLOCK";
-		else
-			errno = EAGAIN;
+		rfd = SSL_get_rfd(so->con);
+		wfd = SSL_get_wfd(so->con);
+		try = tls_retry(so->con, rfd, wfd, tlsstart,
+				TimeOuts.to_datablock, ssl_err, "read");
+		if (try > 0)
+			goto retry;
+		errno = SM_ERR_TIMEOUT;
 		break;
+
 	  case SSL_ERROR_WANT_X509_LOOKUP:
 		err = "write X BLOCK";
 		break;
@@ -625,15 +748,22 @@ tls_read(fp, buf, size)
 		int save_errno;

 		save_errno = (errno == 0) ? EIO : errno;
-		again = MAX_TLS_IOS;
-		if (LogLevel > 9)
+		if (try == 0 && save_errno == SM_ERR_TIMEOUT)
+		{
+			if (LogLevel > 7)
+				sm_syslog(LOG_WARNING, NOQID,
+					  "STARTTLS: read error=timeout");
+		}
+		else if (LogLevel > 8)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: read error=%s (%d), errno=%d, get_error=%s",
+				  "STARTTLS: read error=%s (%d), errno=%d, get_error=%s, retry=%d, ssl_err=%d",
 				  err, r, errno,
-				  ERR_error_string(ERR_get_error(), NULL));
+				  ERR_error_string(ERR_get_error(), NULL), try,
+				  ssl_err);
 		else if (LogLevel > 7)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: read error=%s (%d)", err, r);
+				  "STARTTLS: read error=%s (%d), retry=%d, ssl_err=%d",
+				  err, r, errno, try, ssl_err);
 		errno = save_errno;
 	}
 	return r;
@@ -660,36 +790,39 @@ tls_write(fp, buf, size)
 	const char *buf;
 	size_t size;
 {
-	int r;
-	static int again = MAX_TLS_IOS;
+	int r, rfd, wfd, try, ssl_err;
 	struct tls_obj *so = (struct tls_obj *) fp->f_cookie;
+	time_t tlsstart;
 	char *err;

+	try = 99;
+	err = NULL;
+	tlsstart = curtime();
+
+  retry:
 	r = SSL_write(so->con, (char *) buf, size);

 	if (r > 0)
-	{
-		again = MAX_TLS_IOS;
 		return r;
-	}
 	err = NULL;
-	switch (SSL_get_error(so->con, r))
+	switch (ssl_err = SSL_get_error(so->con, r))
 	{
 	  case SSL_ERROR_NONE:
 	  case SSL_ERROR_ZERO_RETURN:
-		again = MAX_TLS_IOS;
 		break;
 	  case SSL_ERROR_WANT_WRITE:
-		if (--again <= 0)
-			err = "write W BLOCK";
-		else
-			errno = EAGAIN;
-		break;
+		err = "read W BLOCK";
+		/* FALLTHROUGH */
 	  case SSL_ERROR_WANT_READ:
-		if (--again <= 0)
-			err = "write R BLOCK";
-		else
-			errno = EAGAIN;
+		if (err == NULL)
+			err = "read R BLOCK";
+		rfd = SSL_get_rfd(so->con);
+		wfd = SSL_get_wfd(so->con);
+		try = tls_retry(so->con, rfd, wfd, tlsstart,
+				DATA_PROGRESS_TIMEOUT, ssl_err, "write");
+		if (try > 0)
+			goto retry;
+		errno = SM_ERR_TIMEOUT;
 		break;
 	  case SSL_ERROR_WANT_X509_LOOKUP:
 		err = "write X BLOCK";
@@ -722,15 +855,22 @@ tls_write(fp, buf, size)
 		int save_errno;

 		save_errno = (errno == 0) ? EIO : errno;
-		again = MAX_TLS_IOS;
-		if (LogLevel > 9)
+		if (try == 0 && save_errno == SM_ERR_TIMEOUT)
+		{
+			if (LogLevel > 7)
+				sm_syslog(LOG_WARNING, NOQID,
+					  "STARTTLS: write error=timeout");
+		}
+		else if (LogLevel > 8)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: write error=%s (%d), errno=%d, get_error=%s",
+				  "STARTTLS: write error=%s (%d), errno=%d, get_error=%s, retry=%d, ssl_err=%d",
 				  err, r, errno,
-				  ERR_error_string(ERR_get_error(), NULL));
+				  ERR_error_string(ERR_get_error(), NULL), try,
+				  ssl_err);
 		else if (LogLevel > 7)
 			sm_syslog(LOG_WARNING, NOQID,
-				  "STARTTLS: write error=%s (%d)", err, r);
+				  "STARTTLS: write error=%s (%d), errno=%d, retry=%d, ssl_err=%d",
+				  err, r, errno, try, ssl_err);
 		errno = save_errno;
 	}
 	return r;
@@ -17,6 +17,8 @@ extern int	sfdcsasl __P((SM_FILE_T **, SM_FILE_T **, sasl_conn_t *));
 #endif /* SASL */

 # if STARTTLS
+extern int	tls_retry __P((SSL *, int, int, time_t, int, int,
+				const char *));
 extern int	sfdctls __P((SM_FILE_T **, SM_FILE_T **, SSL *));
 # endif /* STARTTLS */

@@ -503,7 +503,6 @@ smtp(nullserver, d_flags, e)
 #endif /* SASL */
 	int r;
 #if STARTTLS
-	int fdfl;
 	int rfd, wfd;
 	volatile bool tls_active = false;
 	volatile bool smtps = bitnset(D_SMTPS, d_flags);
@@ -1693,97 +1692,26 @@ smtp(nullserver, d_flags, e)
 #  define SSL_ACC(s)	SSL_accept(s)

 			tlsstart = curtime();
-			fdfl = fcntl(rfd, F_GETFL);
-			if (fdfl != -1)
-				fcntl(rfd, F_SETFL, fdfl|O_NONBLOCK);
  ssl_retry:
 			if ((r = SSL_ACC(srv_ssl)) <= 0)
 			{
-				int i;
-				bool timedout;
-				time_t left;
-				time_t now = curtime();
-				struct timeval tv;
+				int i, ssl_err;

-				/* what to do in this case? */
-				i = SSL_get_error(srv_ssl, r);
+				ssl_err = SSL_get_error(srv_ssl, r);
+				i = tls_retry(srv_ssl, rfd, wfd, tlsstart,
+						TimeOuts.to_starttls, ssl_err,
+						"server");
+				if (i > 0)
+					goto ssl_retry;

-				/*
-				**  For SSL_ERROR_WANT_{READ,WRITE}:
-				**  There is no SSL record available yet
-				**  or there is only a partial SSL record
-				**  removed from the network (socket) buffer
-				**  into the SSL buffer. The SSL_accept will
-				**  only succeed when a full SSL record is
-				**  available (assuming a "real" error
-				**  doesn't happen). To handle when a "real"
-				**  error does happen the select is set for
-				**  exceptions too.
-				**  The connection may be re-negotiated
-				**  during this time so both read and write
-				**  "want errors" need to be handled.
-				**  A select() exception loops back so that
-				**  a proper SSL error message can be gotten.
-				*/
-
-				left = TimeOuts.to_starttls - (now - tlsstart);
-				timedout = left <= 0;
-				if (!timedout)
-				{
-					tv.tv_sec = left;
-					tv.tv_usec = 0;
-				}
-
-				if (!timedout && FD_SETSIZE > 0 &&
-				    (rfd >= FD_SETSIZE ||
-				     (i == SSL_ERROR_WANT_WRITE &&
-				      wfd >= FD_SETSIZE)))
-				{
-					if (LogLevel > 5)
-					{
-						sm_syslog(LOG_ERR, NOQID,
-							  "STARTTLS=server, error: fd %d/%d too large",
-							  rfd, wfd);
-						if (LogLevel > 8)
-							tlslogerr("server");
-					}
-					goto tlsfail;
-				}
-
-				/* XXX what about SSL_pending() ? */
-				if (!timedout && i == SSL_ERROR_WANT_READ)
-				{
-					fd_set ssl_maskr, ssl_maskx;
-
-					FD_ZERO(&ssl_maskr);
-					FD_SET(rfd, &ssl_maskr);
-					FD_ZERO(&ssl_maskx);
-					FD_SET(rfd, &ssl_maskx);
-					if (select(rfd + 1, &ssl_maskr, NULL,
-						   &ssl_maskx, &tv) > 0)
-						goto ssl_retry;
-				}
-				if (!timedout && i == SSL_ERROR_WANT_WRITE)
-				{
-					fd_set ssl_maskw, ssl_maskx;
-
-					FD_ZERO(&ssl_maskw);
-					FD_SET(wfd, &ssl_maskw);
-					FD_ZERO(&ssl_maskx);
-					FD_SET(rfd, &ssl_maskx);
-					if (select(wfd + 1, NULL, &ssl_maskw,
-						   &ssl_maskx, &tv) > 0)
-						goto ssl_retry;
-				}
 				if (LogLevel > 5)
 				{
 					sm_syslog(LOG_WARNING, NOQID,
-						  "STARTTLS=server, error: accept failed=%d, SSL_error=%d, timedout=%d, errno=%d",
-						  r, i, (int) timedout, errno);
+						  "STARTTLS=server, error: accept failed=%d, SSL_error=%d, errno=%d, retry=%d",
+						  r, ssl_err, errno, i);
 					if (LogLevel > 8)
 						tlslogerr("server");
 				}
-tlsfail:
 				tls_ok_srv = false;
 				SSL_free(srv_ssl);
 				srv_ssl = NULL;
@@ -1798,9 +1726,6 @@ tlsfail:
 				goto doquit;
 			}

-			if (fdfl != -1)
-				fcntl(rfd, F_SETFL, fdfl);
-
 			/* ignore return code for now, it's in {verify} */
 			(void) tls_get_info(srv_ssl, true,
 					    CurSmtpClient,
@@ -18,7 +18,6 @@ SM_RCSID("@(#)$Id: usersmtp.c,v 8.460 2005/01/11 00:24:19 ca Exp $")
 #include <sysexits.h>


-static void	datatimeout __P((int));
 static void	esmtp_check __P((char *, bool, MAILER *, MCI *, ENVELOPE *));
 static void	helo_options __P((char *, bool, MAILER *, MCI *, ENVELOPE *));
 static int	smtprcptstat __P((ADDRESS *, MAILER *, MCI *, ENVELOPE *));
@@ -2493,9 +2492,6 @@ smtprcptstat(to, m, mci, e)
 **		exit status corresponding to DATA command.
 */

-static jmp_buf	CtxDataTimeout;
-static SM_EVENT	*volatile DataTimeout = NULL;
-
 int
 smtpdata(m, mci, e, ctladdr, xstart)
 	MAILER *m;
@@ -2631,43 +2627,22 @@ smtpdata(m, mci, e, ctladdr, xstart)
 	**  factor.  The main thing is that it should not be infinite.
 	*/

-	if (setjmp(CtxDataTimeout) != 0)
-	{
-		mci->mci_errno = errno;
-		mci->mci_state = MCIS_ERROR;
-		mci_setstat(mci, EX_TEMPFAIL, "4.4.2", NULL);
-
-		/*
-		**  If putbody() couldn't finish due to a timeout,
-		**  rewind it here in the timeout handler.  See
-		**  comments at the end of putbody() for reasoning.
-		*/
-
-		if (e->e_dfp != NULL)
-			(void) bfrewind(e->e_dfp);
-
-		errno = mci->mci_errno;
-		syserr("451 4.4.1 timeout writing message to %s", CurHostName);
-		smtpquit(m, mci, e);
-		return EX_TEMPFAIL;
-	}
-
 	if (tTd(18, 101))
 	{
 		/* simulate a DATA timeout */
-		timeout = 1;
+		timeout = 10;
 	}
 	else
-		timeout = DATA_PROGRESS_TIMEOUT;
-
-	DataTimeout = sm_setevent(timeout, datatimeout, 0);
+		timeout = DATA_PROGRESS_TIMEOUT * 1000;
+	sm_io_setinfo(mci->mci_out, SM_IO_WHAT_TIMEOUT, &timeout);


 	/*
 	**  Output the actual message.
 	*/

-	(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
+	if (!(*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER))
+		goto writeerr;

 	if (tTd(18, 101))
 	{
@@ -2675,14 +2650,13 @@ smtpdata(m, mci, e, ctladdr, xstart)
 		(void) sleep(2);
 	}

-	(*e->e_putbody)(mci, e, NULL);
+	if (!(*e->e_putbody)(mci, e, NULL))
+		goto writeerr;

 	/*
 	**  Cleanup after sending message.
 	*/

-	if (DataTimeout != NULL)
-		sm_clrevent(DataTimeout);

 #if PIPELINING
 	}
@@ -2722,7 +2696,9 @@ smtpdata(m, mci, e, ctladdr, xstart)
 	}

 	/* terminate the message */
-	(void) sm_io_fprintf(mci->mci_out, SM_TIME_DEFAULT, ".%s", m->m_eol);
+	if (sm_io_fprintf(mci->mci_out, SM_TIME_DEFAULT, ".%s", m->m_eol) ==
+								SM_IO_EOF)
+		goto writeerr;
 	if (TrafficLogFile != NULL)
 		(void) sm_io_fprintf(TrafficLogFile, SM_TIME_DEFAULT,
 				     "%05d >>> .\n", (int) CurrentPid);
@@ -2773,51 +2749,27 @@ smtpdata(m, mci, e, ctladdr, xstart)
 			  shortenstring(SmtpReplyBuffer, 403));
 	}
 	return rstat;
-}

-static void
-datatimeout(ignore)
-	int ignore;
-{
-	int save_errno = errno;
+  writeerr:
+	mci->mci_errno = errno;
+	mci->mci_state = MCIS_ERROR;
+	mci_setstat(mci, EX_TEMPFAIL, "4.4.2", NULL);

 	/*
-	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
-	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
-	**	DOING.
+	**  If putbody() couldn't finish due to a timeout,
+	**  rewind it here in the timeout handler.  See
+	**  comments at the end of putbody() for reasoning.
 	*/

-	if (DataProgress)
-	{
-		time_t timeout;
+	if (e->e_dfp != NULL)
+		(void) bfrewind(e->e_dfp);

-		/* check back again later */
-		if (tTd(18, 101))
-		{
-			/* simulate a DATA timeout */
-			timeout = 1;
-		}
-		else
-			timeout = DATA_PROGRESS_TIMEOUT;
-
-		/* reset the timeout */
-		DataTimeout = sm_sigsafe_setevent(timeout, datatimeout, 0);
-		DataProgress = false;
-	}
-	else
-	{
-		/* event is done */
-		DataTimeout = NULL;
-	}
-
-	/* if no progress was made or problem resetting event, die now */
-	if (DataTimeout == NULL)
-	{
-		errno = ETIMEDOUT;
-		longjmp(CtxDataTimeout, 1);
-	}
-	errno = save_errno;
+	errno = mci->mci_errno;
+	syserr("451 4.4.1 timeout writing message to %s", CurHostName);
+	smtpquit(m, mci, e);
+	return EX_TEMPFAIL;
 }
+
 /*
 **  SMTPGETSTAT -- get status code from DATA in LMTP
 **
@@ -456,6 +456,8 @@ xalloc(sz)
 {
 	register char *p;

+	SM_REQUIRE(sz >= 0);
+
 	/* some systems can't handle size zero mallocs */
 	if (sz <= 0)
 		sz = 1;
@@ -970,18 +972,18 @@ fixcrlf(line, stripnl)
 **		mci -- the mailer connection information.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		output of l to mci->mci_out.
 */

-void
+bool
 putline(l, mci)
 	register char *l;
 	register MCI *mci;
 {
-	putxline(l, strlen(l), mci, PXLF_MAPFROM);
+	return putxline(l, strlen(l), mci, PXLF_MAPFROM);
 }
 /*
 **  PUTXLINE -- putline with flags bits.
@@ -1000,13 +1002,13 @@ putline(l, mci)
 **		    PXLF_NOADDEOL -- don't add an EOL if one wasn't present.
 **
 **	Returns:
-**		none
+**		true iff line was written successfully
 **
 **	Side Effects:
 **		output of l to mci->mci_out.
 */

-void
+bool
 putxline(l, len, mci, pxflags)
 	register char *l;
 	size_t len;
@@ -1058,11 +1060,6 @@ putxline(l, len, mci, pxflags)
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       '.') == SM_IO_EOF)
 					dead = true;
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 				if (TrafficLogFile != NULL)
 					(void) sm_io_putc(TrafficLogFile,
 							  SM_TIME_DEFAULT, '.');
@@ -1075,11 +1072,6 @@ putxline(l, len, mci, pxflags)
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       '>') == SM_IO_EOF)
 					dead = true;
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 				if (TrafficLogFile != NULL)
 					(void) sm_io_putc(TrafficLogFile,
 							  SM_TIME_DEFAULT,
@@ -1091,16 +1083,11 @@ putxline(l, len, mci, pxflags)
 			while (l < q)
 			{
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
-					       (unsigned char) *l++) == SM_IO_EOF)
+				       (unsigned char) *l++) == SM_IO_EOF)
 				{
 					dead = true;
 					break;
 				}
-				else
-				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
-				}
 			}
 			if (dead)
 				break;
@@ -1116,11 +1103,6 @@ putxline(l, len, mci, pxflags)
 				dead = true;
 				break;
 			}
-			else
-			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
-			}
 			if (TrafficLogFile != NULL)
 			{
 				for (l = l_base; l < q; l++)
@@ -1144,11 +1126,9 @@ putxline(l, len, mci, pxflags)
 		{
 			if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT, '.') ==
 			    SM_IO_EOF)
-				break;
-			else
 			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
+				dead = true;
+				break;
 			}
 			if (TrafficLogFile != NULL)
 				(void) sm_io_putc(TrafficLogFile,
@@ -1161,11 +1141,9 @@ putxline(l, len, mci, pxflags)
 		{
 			if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT, '>') ==
 			    SM_IO_EOF)
-				break;
-			else
 			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
+				dead = true;
+				break;
 			}
 			if (TrafficLogFile != NULL)
 				(void) sm_io_putc(TrafficLogFile,
@@ -1183,11 +1161,6 @@ putxline(l, len, mci, pxflags)
 				dead = true;
 				break;
 			}
-			else
-			{
-				/* record progress for DATA timeout */
-				DataProgress = true;
-			}
 		}
 		if (dead)
 			break;
@@ -1198,11 +1171,9 @@ putxline(l, len, mci, pxflags)
 		if ((!bitset(PXLF_NOADDEOL, pxflags) || !noeol) &&
 		    sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
 				mci->mci_mailer->m_eol) == SM_IO_EOF)
-			break;
-		else
 		{
-			/* record progress for DATA timeout */
-			DataProgress = true;
+			dead = true;
+			break;
 		}
 		if (l < end && *l == '\n')
 		{
@@ -1211,11 +1182,9 @@ putxline(l, len, mci, pxflags)
 			{
 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
 					       ' ') == SM_IO_EOF)
-					break;
-				else
 				{
-					/* record progress for DATA timeout */
-					DataProgress = true;
+					dead = true;
+					break;
 				}

 				if (TrafficLogFile != NULL)
@@ -1224,10 +1193,10 @@ putxline(l, len, mci, pxflags)
 			}
 		}

-		/* record progress for DATA timeout */
-		DataProgress = true;
 	} while (l < end);
+	return !dead;
 }
+
 /*
 **  XUNLINK -- unlink a file, doing logging as appropriate.
 **
@@ -2433,6 +2402,7 @@ str2prt(s)
 				*h++ = 'r';
 				break;
 			  default:
+				SM_ASSERT(l >= 2);
 				(void) sm_snprintf(h, l, "%03o",
 					(unsigned int)((unsigned char) c));

@@ -1216,6 +1216,8 @@ bgp_attr_print(const struct bgp_attr *attr, const u_char *pptr, int len)
                            tptr = pptr + len;
                            break;
 			}
+                        if (advance < 0) /* infinite loop protection */
+                            break;
 			tptr += advance;
 		}
 		break;
@@ -1646,9 +1648,10 @@ bgp_update_print(const u_char *dat, int length)
 		while (dat + length > p) {
 			char buf[MAXHOSTNAMELEN + 100];
 			i = decode_prefix4(p, buf, sizeof(buf));
-			if (i == -1)
+			if (i == -1) {
 				printf("\n\t    (illegal prefix length)");
-			else if (i == -2)
+				break;
+			} else if (i == -2)
 				goto trunc;
 			else {
 				printf("\n\t    %s", buf);
@@ -1508,6 +1508,9 @@ static int isis_print (const u_int8_t *p, u_int length)
               tlv_type,
               tlv_len);

+        if (tlv_len == 0) /* something is malformed */
+            break;
+
        /* now check if we have a decoder otherwise do a hexdump at the end*/
 	switch (tlv_type) {
 	case TLV_AREA_ADDR:
@@ -1538,7 +1541,7 @@ static int isis_print (const u_int8_t *p, u_int length)
 	    break;

        case TLV_ISNEIGH_VARLEN:
-            if (!TTEST2(*tptr, 1))
+            if (!TTEST2(*tptr, 1) || tmp < 3) /* min. TLV length */
 		goto trunctlv;
 	    lan_alen = *tptr++; /* LAN adress length */
            tmp --;
@@ -326,6 +326,9 @@ ldp_print(register const u_char *pptr, register u_int len) {
               EXTRACT_32BITS(&ldp_msg_header->id),
               LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore");

+        if (msg_len == 0) /* infinite loop protection */
+            break;
+
        msg_tptr=tptr+sizeof(struct ldp_msg_header);
        msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */

@@ -875,10 +875,17 @@ rsvp_print(register const u_char *pptr, register u_int len) {
            switch(rsvp_obj_ctype) {
            case RSVP_CTYPE_IPV4:
                while(obj_tlen >= 4 ) {
-                    printf("\n\t    Subobject Type: %s",
+                    printf("\n\t    Subobject Type: %s, length %u",
                           tok2str(rsvp_obj_xro_values,
                                   "Unknown %u",
-                                   RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)));                
+                                   RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)),
+                           *(obj_tptr+1));                
+
+                    if (*(obj_tptr+1) == 0) { /* prevent infinite loops */
+                        printf("\n\t      ERROR: zero length ERO subtype");
+                        break;
+                    }
+
                    switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) {
                    case RSVP_OBJ_XRO_IPV4:
                        printf(", %s, %s/%u, Flags: [%s]",
@@ -386,6 +386,21 @@ For more information about these matters, see the files named COPYING.\n"),
    usage (1);
 }

+static char **tv;
+static int tv_alloc;
+static int tv_used;
+
+static int
+findtempname (char *tempname)
+{
+  int i;
+
+  for (i = 0; i < tv_used; i++)
+    if (strcmp (tv[i], tempname) == 0)
+	return (1);
+  return (0);
+}
+
 /* Return a name for temporary file COUNT. */

 static char *
@@ -393,11 +408,12 @@ maketempname (count)
     int count;
 {
  static char *tempbase = NULL;
+  char *tempname;
  char tempsuffix[10];
+  int fd;

  if (!tempbase)
    {
-      int fd;
      tempbase = concat (tempdir, "txidxXXXXXX");

      fd = mkstemp (tempbase);
@@ -406,7 +422,52 @@ maketempname (count)
    }

  sprintf (tempsuffix, ".%d", count);
-  return concat (tempbase, tempsuffix);
+  tempname = concat (tempbase, tempsuffix);
+  /*
+   * The open logic becomes a bit convoluted. If open(2) fails due to EEXIST,
+   * it's likely because somebody attempted to race us, or because we have
+   * already created this file.
+   */
+  fd = open (tempname, O_CREAT|O_EXCL|O_WRONLY, 0600);
+  if (fd == -1)
+    {
+	/*
+	 * If errno is not EEXIST, then open failed for some other reason, so
+	 * we should terminate. If errno == EEXIST AND we didn't create this
+	 * file, terminate. Otherwise, it's safe to say that errno == EEXIST
+	 * because we already created it, in this event, we can just return.
+	 */
+	if (errno != EEXIST ||
+	  (errno == EEXIST && findtempname (tempname) == 0))
+	  pfatal_with_name (tempname);
+	return (tempname);
+    }
+  else if (fd > 0)
+    {
+	close (fd);
+    }
+  if (tv == NULL)
+    {
+	tv_alloc = 16;
+	tv = calloc (tv_alloc, sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "calloc failed\n");
+	    exit (1);
+	  }
+    }
+  else if (tv_used == tv_alloc)
+    {
+	tv_alloc += 4;
+	tv = realloc (tv, tv_alloc * sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "realloc failed");
+	    exit (1);
+	  }
+    }
+  tv[tv_used++] = strdup (tempname);
+  return tempname;
 }


@@ -151,7 +151,7 @@ the base port number used in probes (default is 33434).
 Traceroute hopes that nothing is listening on UDP ports
 .I base
 to
-.I base + nhops * nprobes - 1
+.I base + nhops - 1
 at the destination host (so an ICMP PORT_UNREACHABLE message will
 be returned to terminate the route tracing).  If something is
 listening on a port in the default range, this option can be used
@@ -94,10 +94,17 @@ static mysig_t sshpam_oldsig;
 static void 
 sshpam_sigchld_handler(int sig)
 {
+	signal(SIGCHLD, SIG_DFL);
 	if (cleanup_ctxt == NULL)
 		return;	/* handler called after PAM cleanup, shouldn't happen */
-	if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0) == -1)
-		return;	/* couldn't wait for process */
+	if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
+	     <= 0) {
+		/* PAM thread has not exitted, privsep slave must have */
+		kill(cleanup_ctxt->pam_thread, SIGTERM);
+		if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
+		    <= 0)
+			return; /* could not wait */
+	}
 	if (WIFSIGNALED(sshpam_thread_status) &&
 	    WTERMSIG(sshpam_thread_status) == SIGTERM)
 		return;	/* terminated by pthread_cancel */
@@ -49,6 +49,7 @@ typedef struct KbdintDevice KbdintDevice;

 struct Authctxt {
 	int		 success;
+	int		 authenticated;	/* authenticated and alarms cancelled */
 	int		 postponed;	/* authentication needs another step */
 	int		 valid;		/* user exists and is allowed to login */
 	int		 attempt;
@@ -27,6 +27,24 @@ RCSID("$OpenBSD: deattack.c,v 1.19 2003/09/18 08:49:45 markus Exp $");
 #include "xmalloc.h"
 #include "deattack.h"

+/*
+ * CRC attack detection has a worst-case behaviour that is O(N^3) over
+ * the number of identical blocks in a packet. This behaviour can be 
+ * exploited to create a limited denial of service attack. 
+ * 
+ * However, because we are dealing with encrypted data, identical
+ * blocks should only occur every 2^35 maximally-sized packets or so. 
+ * Consequently, we can detect this DoS by looking for identical blocks
+ * in a packet.
+ *
+ * The parameter below determines how many identical blocks we will
+ * accept in a single packet, trading off between attack detection and
+ * likelihood of terminating a legitimate connection. A value of 32 
+ * corresponds to an average of 2^40 messages before an attack is
+ * misdetected
+ */
+#define MAX_IDENTICAL	32
+
 /* SSH Constants */
 #define SSH_MAXBLOCKS	(32 * 1024)
 #define SSH_BLOCKSIZE	(8)
@@ -87,7 +105,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	static u_int16_t *h = (u_int16_t *) NULL;
 	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
 	u_int32_t i, j;
-	u_int32_t l;
+	u_int32_t l, same;
 	u_char *c;
 	u_char *d;

@@ -133,7 +151,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	if (IV)
 		h[HASH(IV) & (n - 1)] = HASH_IV;

-	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
+	for (c = buf, same = j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
 		for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
 		    i = (i + 1) & (n - 1)) {
 			if (h[i] == HASH_IV) {
@@ -144,6 +162,8 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 						break;
 				}
 			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
+				if (++same > MAX_IDENTICAL)
+					return (DEATTACK_DOS_DETECTED);
 				if (check_crc(c, buf, len, IV))
 					return (DEATTACK_DETECTED);
 				else
@@ -25,6 +25,7 @@
 /* Return codes */
 #define DEATTACK_OK		0
 #define DEATTACK_DETECTED	1
+#define DEATTACK_DOS_DETECTED	2

 int	 detect_attack(u_char *, u_int32_t, u_char[8]);
 #endif
@@ -511,6 +511,11 @@ struct winsize {
 # undef HAVE_UPDWTMPX
 #endif

+#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \
+    defined(SYSLOG_R_SAFE_IN_SIGHAND)
+# define DO_LOG_SAFE_IN_SIGHAND
+#endif
+
 #if !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY)
 # define memmove(s1, s2, n) bcopy((s2), (s1), (n))
 #endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
@@ -127,6 +127,20 @@ error(const char *fmt,...)
 	va_end(args);
 }

+void
+sigdie(const char *fmt,...)
+{
+	va_list args;
+
+#ifdef DO_LOG_SAFE_IN_SIGHAND
+	va_start(args, fmt);
+	do_log(SYSLOG_LEVEL_FATAL, fmt, args);
+	va_end(args);
+#endif
+	_exit(1);
+}
+
+
 /* Log this message (information that usually should go to the log). */

 void
@@ -64,6 +64,7 @@ LogLevel log_level_number(char *);

 void     fatal(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     error(const char *, ...) __attribute__((format(printf, 1, 2)));
+void     sigdie(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     logit(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     verbose(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     debug(const char *, ...) __attribute__((format(printf, 1, 2)));
@@ -940,9 +940,16 @@ packet_read_poll1(void)
 	 * (C)1998 CORE-SDI, Buenos Aires Argentina
 	 * Ariel Futoransky(futo@core-sdi.com)
 	 */
-	if (!receive_context.plaintext &&
-	    detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED)
-		packet_disconnect("crc32 compensation attack: network attack detected");
+	if (!receive_context.plaintext) {
+		switch (detect_attack(buffer_ptr(&input), padded_len, NULL)) {
+		case DEATTACK_DETECTED:
+			packet_disconnect("crc32 compensation attack: "
+			    "network attack detected");
+		case DEATTACK_DOS_DETECTED:
+			packet_disconnect("deattack denial of "
+			    "service detected");
+		}
+	}

 	/* Decrypt data to incoming_packet. */
 	buffer_clear(&incoming_packet);
@@ -2266,7 +2266,7 @@ do_cleanup(Authctxt *authctxt)
 		return;
 	called = 1;

-	if (authctxt == NULL)
+	if (authctxt == NULL || !authctxt->authenticated)
 		return;
 #ifdef KRB5
 	if (options.kerberos_ticket_cleanup &&
@@ -36,4 +36,4 @@
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
 #   EscapeChar ~
-#   VersionAddendum FreeBSD-20040419
+#   VersionAddendum FreeBSD-20060930
@@ -719,7 +719,7 @@ Note that this option applies to protocol version 2 only.
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20040419 .
+.Dq FreeBSD-20060930 .
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1
@@ -314,7 +314,7 @@ grace_alarm_handler(int sig)
 		kill(pmonitor->m_pid, SIGALRM);

 	/* Log error and exit. */
-	fatal("Timeout before authentication for %s", get_remote_ipaddr());
+	sigdie("Timeout before authentication for %s", get_remote_ipaddr());
 }

 /*
@@ -1509,6 +1509,8 @@ main(int ac, char **av)
 	}

 authenticated:
+	authctxt->authenticated = 1;
+
 	/*
 	 * In privilege separation, we fork another child and prepare
 	 * file descriptor passing.
@@ -14,7 +14,7 @@
 # Note that some of FreeBSD's defaults differ from OpenBSD's, and
 # FreeBSD has a few additional options.

-#VersionAddendum FreeBSD-20040419
+#VersionAddendum FreeBSD-20060930

 #Port 22
 #Protocol 2
@@ -660,7 +660,7 @@ The default is
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20040419 .
+.Dq FreeBSD-20060930 .
 .It Cm X11DisplayOffset
 Specifies the first display number available for
 .Nm sshd Ns 's
@@ -5,7 +5,7 @@

 #define SSH_VERSION             (ssh_version_get())
 #define SSH_VERSION_BASE        "OpenSSH_3.8.1p1"
-#define SSH_VERSION_ADDENDUM    "FreeBSD-20040419"
+#define SSH_VERSION_ADDENDUM    "FreeBSD-20060930"

 const char *ssh_version_get(void);
 void ssh_version_set_addendum(const char *add);
@@ -628,6 +628,9 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 		ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
 		return 0;
 	} else if(ret == -1) return -1;
+
+	ret = 0;
+
 	/* SEQUENCE, SET and "OTHER" are left in encoded form */
 	if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
 		/* Clear context cache for type OTHER because the auto clear when
@@ -70,6 +70,10 @@
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
 	
+#ifndef OPENSSL_DH_MAX_MODULUS_BITS
+# define OPENSSL_DH_MAX_MODULUS_BITS	10000
+#endif
+
 #define DH_FLAG_CACHE_MONT_P	0x01

 #ifdef  __cplusplus
@@ -200,6 +204,7 @@ void ERR_load_DH_strings(void);
 /* Reason codes. */
 #define DH_R_BAD_GENERATOR				 101
 #define DH_R_NO_PRIVATE_VALUE				 100
+#define DH_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -78,6 +78,7 @@ static ERR_STRING_DATA DH_str_functs[]=
 static ERR_STRING_DATA DH_str_reasons[]=
 	{
 {DH_R_BAD_GENERATOR                      ,"bad generator"},
+{DH_R_MODULUS_TOO_LARGE                  ,"modulus too large"},
 {DH_R_NO_PRIVATE_VALUE                   ,"no private value"},
 {0,NULL}
 	};
@@ -164,6 +164,12 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
 	BIGNUM *tmp;
 	int ret= -1;

+	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+		{
+		DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	ctx = BN_CTX_new();
 	if (ctx == NULL) goto err;
 	BN_CTX_start(ctx);
@@ -79,6 +79,10 @@
 # include <openssl/dh.h>
 #endif

+#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
+# define OPENSSL_DSA_MAX_MODULUS_BITS	10000
+#endif
+
 #define DSA_FLAG_CACHE_MONT_P	0x01

 #if defined(OPENSSL_FIPS)
@@ -245,8 +249,10 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_SIG_CB					 114

 /* Reason codes. */
+#define DSA_R_BAD_Q_VALUE				 102
 #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 100
 #define DSA_R_MISSING_PARAMETERS			 101
+#define DSA_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -85,8 +85,10 @@ static ERR_STRING_DATA DSA_str_functs[]=

 static ERR_STRING_DATA DSA_str_reasons[]=
 	{
+{DSA_R_BAD_Q_VALUE                       ,"bad q value"},
 {DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
 {DSA_R_MISSING_PARAMETERS                ,"missing parameters"},
+{DSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {0,NULL}
 	};

@@ -245,6 +245,18 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 		return -1;
 		}

+	if (BN_num_bits(dsa->q) != 160)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);
+		return -1;
+		}
+
+	if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	BN_init(&u1);
 	BN_init(&u2);
 	BN_init(&t1);
@@ -27,9 +27,9 @@
 */
 #define OPENSSL_VERSION_NUMBER	0x0090705FL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7e-fips 25 Oct 2004"
+#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7e-fips-p1 25 Oct 2004"
 #else
-#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7e 25 Oct 2004"
+#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7e-p1 25 Oct 2004"
 #endif
 #define OPENSSL_VERSION_PTEXT	" part of " OPENSSL_VERSION_TEXT

@@ -155,6 +155,17 @@ struct rsa_st
 	BN_BLINDING *blinding;
 	};

+#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+# define OPENSSL_RSA_MAX_MODULUS_BITS	16400
+#endif
+
+#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+# define OPENSSL_RSA_SMALL_MODULUS_BITS	4112
+#endif
+#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS
+# define OPENSSL_RSA_MAX_PUBEXP_BITS	72 /* exponent limit enforced for "large" modulus only */
+#endif
+
 #define RSA_3	0x3L
 #define RSA_F4	0x10001L

@@ -348,6 +359,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_INVALID_MESSAGE_LENGTH			 131
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q			 126
 #define RSA_R_KEY_SIZE_TOO_SMALL			 120
+#define RSA_R_MODULUS_TOO_LARGE				 105
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING			 113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q			 127
 #define RSA_R_OAEP_DECODING_ERROR			 121
@@ -105,6 +105,28 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	if ((ctx=BN_CTX_new()) == NULL) goto err;
@@ -505,6 +527,28 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	ctx=BN_CTX_new();
@@ -116,6 +116,7 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
 {RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
 {RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
+{RSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
 {RSA_R_N_DOES_NOT_EQUAL_P_Q              ,"n does not equal p q"},
 {RSA_R_OAEP_DECODING_ERROR               ,"oaep decoding error"},
@@ -185,6 +185,23 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
 		sig=d2i_X509_SIG(NULL,&p,(long)i);

 		if (sig == NULL) goto err;
+
+		/* Excess data can be used to create forgeries */
+		if(p != s+i)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
+		/* Parameters to the signature algorithm can also be used to
+		   create forgeries */
+		if(sig->algor->parameter
+		   && sig->algor->parameter->type != V_ASN1_NULL)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
 		sigtype=OBJ_obj2nid(sig->algor->algorithm);


@@ -268,9 +268,6 @@ int ssl23_get_client_hello(SSL *s)
 	int n=0,j;
 	int type=0;
 	int v[2];
-#ifndef OPENSSL_NO_RSA
-	int use_sslv2_strong=0;
-#endif

 	if (s->state ==	SSL23_ST_SR_CLNT_HELLO_A)
 		{
@@ -519,9 +516,7 @@ int ssl23_get_client_hello(SSL *s)
 			}

 		s->state=SSL2_ST_GET_CLIENT_HELLO_A;
-		if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||
-			use_sslv2_strong ||
-			(s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3))
+		if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)
 			s->s2->ssl2_rollback=0;
 		else
 			/* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0
@@ -538,7 +538,8 @@ static int get_server_hello(SSL *s)
 		CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
 		}

-	if (s->session->peer != s->session->sess_cert->peer_key->x509)
+	if (s->session->sess_cert == NULL 
+      || s->session->peer != s->session->sess_cert->peer_key->x509)
 		/* can't happen */
 		{
 		ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
@@ -1733,7 +1733,7 @@ static int ssl3_get_client_key_exchange(SSL *s)

                if (kssl_ctx->client_princ)
                        {
-                        int len = strlen(kssl_ctx->client_princ);
+                        size_t len = strlen(kssl_ctx->client_princ);
                        if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
                                {
                                s->session->krb5_client_princ_len = len;
@@ -1167,7 +1167,7 @@ char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
 		c=sk_SSL_CIPHER_value(sk,i);
 		for (cp=c->name; *cp; )
 			{
-			if (len-- == 0)
+			if (len-- <= 0)
 				{
 				*p='\0';
 				return(buf);
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# $FreeBSD$
-#
-
-# PROVIDE: bsnmpd
-# REQUIRE: NETWORKING syslogd
-# KEYWORD: nojail
-
-. /etc/rc.subr
-
-name="bsnmpd"
-rcvar=`set_rcvar`
-command="/usr/sbin/${name}"
-pidfile="/var/run/snmpd.pid"
-
-load_rc_config $name
-run_rc_command "$1"
@@ -5,8 +5,9 @@
 #

 # PROVIDE: named
-# REQUIRE: SERVERS
+# REQUIRE: SERVERS cleanvar
 # BEFORE:  DAEMON
+# KEYWORD: shutdown

 . /etc/rc.subr

@@ -14,6 +15,7 @@ name="named"
 rcvar=`set_rcvar`
 start_precmd="named_precmd"
 start_postcmd="make_symlinks"
+stop_postcmd="named_poststop"
 required_dirs="$named_chrootdir"	# if it is set, it must exist
 extra_commands="reload"

@@ -48,6 +50,10 @@ chroot_autoupdate()
 		else
 			ln -s ${named_chrootdir}/etc/namedb /etc/namedb
 		fi
+	else
+		# Make sure it points to the right place.
+		ln -shf ${named_chrootdir}/etc/namedb /etc/namedb
+
 	fi

 	# Mount a devfs in the chroot directory if needed
@@ -77,6 +83,13 @@ make_symlinks()
 	ln -fs "${named_chrootdir}${pidfile}" ${pidfile}
 }

+named_poststop()
+{
+	if [ -n "${named_chrootdir}"  -a -c ${named_chrootdir}/dev/null ]; then
+		umount ${named_chrootdir}/dev 2>/dev/null || true
+	fi
+}
+
 named_precmd()
 {
 	local confgen_chroot
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# $FreeBSD$
-#
-
-# PROVIDE: powerd
-# REQUIRE: DAEMON
-# BEFORE: LOGIN
-# KEYWORD: nojail
-
-. /etc/rc.subr
-
-name="powerd"
-rcvar=`set_rcvar`
-command="/usr/sbin/powerd"
-
-load_rc_config $name
-run_rc_command "$1"
@@ -1,67 +0,0 @@
-# $FreeBSD$
-#
-# Example configuration file for bsnmpd(1).
-#
-
-#
-# Set some common variables
-#
-host := foo.bar.com
-location := "Room 200"
-contact := "[email protected]"
-system := 1	# FreeBSD
-traphost := noc.bar.com
-trapport := 162
-
-# Change this!
-read := "public"
-write := "geheim"
-trap := "mytrap"
-
-#
-# Configuration
-#
-%snmpd
-begemotSnmpdDebugDumpPdus	= 2
-begemotSnmpdDebugSyslogPri	= 7
-
-begemotSnmpdCommunityString.0.1	= $(read)
-begemotSnmpdCommunityString.0.2	= $(write)
-begemotSnmpdCommunityDisable	= 1
-
-# open standard SNMP ports
-begemotSnmpdPortStatus.[$(host)].161 = 1
-begemotSnmpdPortStatus.127.0.0.1.161 = 1
-
-# open a unix domain socket
-begemotSnmpdLocalPortStatus."/var/run/snmpd.sock" = 1
-begemotSnmpdLocalPortType."/var/run/snmpd.sock" = 4
-
-# send traps to the traphost
-begemotTrapSinkStatus.[$(traphost)].$(trapport) = 4
-begemotTrapSinkVersion.[$(traphost)].$(trapport) = 2
-begemotTrapSinkComm.[$(traphost)].$(trapport) = $(trap)
-
-sysContact	= $(contact)
-sysLocation	= $(location)
-sysObjectId 	= 1.3.6.1.4.1.12325.1.1.2.1.$(system)
-
-snmpEnableAuthenTraps = 2
-
-#
-# Load MIB-2 module
-#
-begemotSnmpdModulePath."mibII"	= "/usr/lib/snmp_mibII.so"
-
-#
-# Netgraph module
-#
-#begemotSnmpdModulePath."netgraph" = "/usr/lib/snmp_netgraph.so"
-#
-#%netgraph
-#begemotNgControlNodeName = "snmpd"
-
-#
-# pf(4) module
-#
-#begemotSnmpdModulePath."pf"	= "/usr/lib/snmp_pf.so"
@@ -830,8 +830,11 @@ local void treat_file(iname)
    }

    close(ifd);
-    if (!to_stdout && close(ofd)) {
-	write_error();
+    if (!to_stdout) {
+        /* Copy modes, times, ownership, and remove the input file */
+        copy_stat(&istat);
+        if (close(ofd))
+	    write_error();
    }
    if (method == -1) {
 	if (!to_stdout) unlink (ofname);
@@ -851,10 +854,6 @@ local void treat_file(iname)
 	}
 	fprintf(stderr, "\n");
    }
-    /* Copy modes, times, ownership, and remove the input file */
-    if (!to_stdout) {
-	copy_stat(&istat);
-    }
 }

 /* ========================================================================
@@ -1258,6 +1257,7 @@ local int get_method(in)
 		/* Copy the base name. Keep a directory prefix intact. */
                char *p = basename(ofname);
                char *base = p;
+		char *base2;
 		for (;;) {
 		    *p = (char)get_char();
 		    if (*p++ == '\0') break;
@@ -1265,6 +1265,8 @@ local int get_method(in)
 			error("corrupted input -- file name too large");
 		    }
 		}
+		base2 = basename (base);
+		strcpy(base, base2);
                /* If necessary, adapt the name to local OS conventions: */
                if (!list) {
                   MAKE_LEGAL_NAME(base);
@@ -1637,12 +1639,12 @@ local void copy_stat(ifstat)
    reset_times(ofname, ifstat);
 #endif
    /* Copy the protection modes */
-    if (chmod(ofname, ifstat->st_mode & 07777)) {
+    if (fchmod(ofd, ifstat->st_mode & 07777)) {
 	WARN((stderr, "%s: ", progname));
 	if (!quiet) perror(ofname);
    }
 #ifndef NO_CHOWN
-    chown(ofname, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
+    (void) fchown(ofd, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
 #endif
    remove_ofname = 0;
    /* It's now safe to remove the input file: */
@@ -202,6 +202,8 @@ extern int test;           /* check .z file integrity */
 extern int to_stdout;      /* output to stdout (-c) */
 extern int save_orig_name; /* set if original name must be saved */

+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
+
 #define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
 #define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))

@@ -316,7 +316,7 @@ int *m;                 /* maximum lookup bits, returns actual */
  {
    *t = (struct huft *)NULL;
    *m = 0;
-    return 0;
+    return 2;
  }


@@ -148,13 +148,17 @@ local void make_table(nchar, bitlen, tablebits, table)
    unsigned i, k, len, ch, jutbits, avail, nextcode, mask;

    for (i = 1; i <= 16; i++) count[i] = 0;
-    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;
+    for (i = 0; i < (unsigned)nchar; i++) {
+        if (bitlen[i] > 16)
+        error("Bad table (case a)\n");
+        else count[bitlen[i]]++;
+    }

    start[1] = 0;
    for (i = 1; i <= 16; i++)
 	start[i + 1] = start[i] + (count[i] << (16 - i));
-    if ((start[17] & 0xffff) != 0)
-	error("Bad table\n");
+    if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */
+	error("Bad table (case b)\n");

    jutbits = 16 - tablebits;
    for (i = 1; i <= (unsigned)tablebits; i++) {
@@ -168,15 +172,15 @@ local void make_table(nchar, bitlen, tablebits, table)

    i = start[tablebits + 1] >> jutbits;
    if (i != 0) {
-	k = 1 << tablebits;
-	while (i != k) table[i++] = 0;
+	k = MIN(1 << tablebits, DIST_BUFSIZE);
+	while (i < k) table[i++] = 0;
    }

    avail = nchar;
    mask = (unsigned) 1 << (15 - tablebits);
    for (ch = 0; ch < (unsigned)nchar; ch++) {
 	if ((len = bitlen[ch]) == 0) continue;
-	nextcode = start[len] + weight[len];
+	nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE);
 	if (len <= (unsigned)tablebits) {
 	    for (i = start[len]; i < nextcode; i++) table[i] = ch;
 	} else {
@@ -217,7 +221,7 @@ local void read_pt_len(nn, nbit, i_special)
 	for (i = 0; i < 256; i++) pt_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NPT)) {
 	    c = bitbuf >> (BITBUFSIZ - 3);
 	    if (c == 7) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
@@ -227,7 +231,7 @@ local void read_pt_len(nn, nbit, i_special)
 	    pt_len[i++] = c;
 	    if (i == i_special) {
 		c = getbits(2);
-		while (--c >= 0) pt_len[i++] = 0;
+		while (--c >= 0 && i < NPT) pt_len[i++] = 0;
 	    }
 	}
 	while (i < nn) pt_len[i++] = 0;
@@ -247,7 +251,7 @@ local void read_c_len()
 	for (i = 0; i < 4096; i++) c_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NC)) {
 	    c = pt_table[bitbuf >> (BITBUFSIZ - 8)];
 	    if (c >= NT) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
@@ -255,14 +259,14 @@ local void read_c_len()
 		    if (bitbuf & mask) c = right[c];
 		    else               c = left [c];
 		    mask >>= 1;
-		} while (c >= NT);
+		} while (c >= NT && (mask || c != left[c]));
 	    }
 	    fillbuf((int) pt_len[c]);
 	    if (c <= 2) {
 		if      (c == 0) c = 1;
 		else if (c == 1) c = getbits(4) + 3;
 		else             c = getbits(CBIT) + 20;
-		while (--c >= 0) c_len[i++] = 0;
+		while (--c >= 0 && i < NC) c_len[i++] = 0;
 	    } else c_len[i++] = c - 2;
 	}
 	while (i < NC) c_len[i++] = 0;
@@ -291,7 +295,7 @@ local unsigned decode_c()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NC);
+	} while (j >= NC && (mask || j != left[j]));
    }
    fillbuf((int) c_len[j]);
    return j;
@@ -308,7 +312,7 @@ local unsigned decode_p()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NP);
+	} while (j >= NP && (mask || j != left[j]));
    }
    fillbuf((int) pt_len[j]);
    if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));
@@ -355,7 +359,7 @@ local unsigned decode(count, buffer)
    while (--j >= 0) {
 	buffer[r] = buffer[i];
 	i = (i + 1) & (DICSIZ - 1);
-	if (++r == count) return r;
+	if (++r >= count) return r;
    }
    for ( ; ; ) {
 	c = decode_c();
@@ -365,14 +369,14 @@ local unsigned decode(count, buffer)
 	}
 	if (c <= UCHAR_MAX) {
 	    buffer[r] = c;
-	    if (++r == count) return r;
+	    if (++r >= count) return r;
 	} else {
 	    j = c - (UCHAR_MAX + 1 - THRESHOLD);
 	    i = (r - decode_p() - 1) & (DICSIZ - 1);
 	    while (--j >= 0) {
 		buffer[r] = buffer[i];
 		i = (i + 1) & (DICSIZ - 1);
-		if (++r == count) return r;
+		if (++r >= count) return r;
 	    }
 	}
    }
@@ -12,7 +12,6 @@ static char rcsid[] = "$FreeBSD$";
 #include "gzip.h"
 #include "crypt.h"

-#define MIN(a,b) ((a) <= (b) ? (a) : (b))
 /* The arguments must not have side effects. */

 #define MAX_BITLEN 25
@@ -132,7 +131,7 @@ local void read_tree()
 	/* Remember where the literals of this length start in literal[] : */
 	lit_base[len] = base;
 	/* And read the literals: */
-	for (n = leaves[len]; n > 0; n--) {
+	for (n = leaves[len]; n > 0 && base < LITERALS; n--) {
 	    literal[base++] = (uch)get_byte();
 	}
    }
@@ -168,7 +167,7 @@ local void build_tree()
    prefixp = &prefix_len[1<<peek_bits];
    for (len = 1; len <= peek_bits; len++) {
 	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
-	while (prefixes--) *--prefixp = (uch)len;
+	while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;
    }
    /* The length of all other codes is unknown: */
    while (prefixp > prefix_len) *--prefixp = 0;
@@ -1170,7 +1170,7 @@ LibAliasIn(struct libalias *la, char *ptr, int maxpacketsize)

 	if (la->packetAliasMode & PKT_ALIAS_REVERSE) {
 		la->packetAliasMode &= ~PKT_ALIAS_REVERSE;
-		iresult = LibAliasOut(la, ptr, maxpacketsize);
+		iresult = PacketAliasOut(ptr, maxpacketsize);
 		la->packetAliasMode |= PKT_ALIAS_REVERSE;
 		return (iresult);
 	}
@@ -1264,7 +1264,7 @@ LibAliasOutTry(struct libalias *la, char *ptr,	/* valid IP packet */

 	if (la->packetAliasMode & PKT_ALIAS_REVERSE) {
 		la->packetAliasMode &= ~PKT_ALIAS_REVERSE;
-		iresult = LibAliasIn(la, ptr, maxpacketsize);
+		iresult = PacketAliasIn(ptr, maxpacketsize);
 		la->packetAliasMode |= PKT_ALIAS_REVERSE;
 		return (iresult);
 	}
@@ -15,7 +15,6 @@ SRCS=	rpoll.c
 INCS=	rpoll.h
 MAN=	rpoll.3

-CLEANFILES= rpoll.3
 rpoll.3: rpoll.man
 	cat ${.ALLSRC} > ${.TARGET}

@@ -8,8 +8,7 @@ _snmp_atm= snmp_atm

 SUBDIR=	${_snmp_atm} \
 	snmp_mibII \
-	snmp_netgraph \
-	snmp_pf
+	snmp_netgraph

 INCS=	snmpmod.h
 INCSDIR= ${INCLUDEDIR}/bsnmp
@@ -1,15 +0,0 @@
-# $FreeBSD$
-# 
-# Author: Philip Paeps <[email protected]>
-
-CONTRIB=${.CURDIR}/../../../../contrib/bsnmp
-
-MOD=	pf
-SRCS=	pf_snmp.c
-WARNS?=	6
-
-XSYM=	begemotPf
-DEFS=	${MOD}_tree.def
-BMIBS=	BEGEMOT-PF-MIB.txt
-
-.include <bsd.lib.mk>
@@ -1,195 +0,0 @@
-#
-# Copyright (c) 2005 Philip Paeps <philip@FreeBSD.org>
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 1. Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer.
-# 2. Redistributions in binary form must reproduce the above copyright
-#    notice, this list of conditions and the following disclaimer in the
-#    documentation and/or other materials provided with the distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-# SUCH DAMAGE.
-#
-# $FreeBSD$
-#
-
-(1 internet
-  (4 private
-    (1 enterprises
-      (12325 fokus
-        (1 begemot
-          (200 begemotPf
-            (1 begemotPfObjects
-              (1 pfStatus
-                (1 pfStatusRunning INTEGER pf_status GET)
-                (2 pfStatusRuntime TIMETICKS pf_status GET)
-                (3 pfStatusDebug INTEGER pf_status GET)
-                (4 pfStatusHostId OCTETSTRING pf_status GET)
-              )
-              (2 pfCounter
-                (1 pfCounterMatch COUNTER64 pf_counter GET)
-                (2 pfCounterBadOffset COUNTER64 pf_counter GET)
-                (3 pfCounterFragment COUNTER64 pf_counter GET)
-                (4 pfCounterShort COUNTER64 pf_counter GET)
-                (5 pfCounterNormalize COUNTER64 pf_counter GET)
-                (6 pfCounterMemDrop COUNTER64 pf_counter GET)
-              )
-              (3 pfStateTable
-                (1 pfStateTableCount UNSIGNED32 pf_statetable GET)
-                (2 pfStateTableSearches COUNTER64 pf_statetable GET)
-                (3 pfStateTableInserts COUNTER64 pf_statetable GET)
-                (4 pfStateTableRemovals COUNTER64 pf_statetable GET)
-              )
-              (4 pfSrcNodes
-                (1 pfSrcNodesCount UNSIGNED32 pf_srcnodes GET)
-                (2 pfSrcNodesSearches COUNTER64 pf_srcnodes GET)
-                (3 pfSrcNodesInserts COUNTER64 pf_srcnodes GET)
-                (4 pfSrcNodesRemovals COUNTER64 pf_srcnodes GET)
-              )
-              (5 pfLimits
-                (1 pfLimitsStates UNSIGNED32 pf_limits GET)
-                (2 pfLimitsSrcNodes UNSIGNED32 pf_limits GET)
-                (3 pfLimitsFrags UNSIGNED32 pf_limits GET)
-              )
-              (6 pfTimeouts
-                (1 pfTimeoutsTcpFirst INTEGER32 pf_timeouts GET)
-                (2 pfTimeoutsTcpOpening INTEGER32 pf_timeouts GET)
-                (3 pfTimeoutsTcpEstablished INTEGER32 pf_timeouts GET)
-                (4 pfTimeoutsTcpClosing INTEGER32 pf_timeouts GET)
-                (5 pfTimeoutsTcpFinWait INTEGER32 pf_timeouts GET)
-                (6 pfTimeoutsTcpClosed INTEGER32 pf_timeouts GET)
-                (7 pfTimeoutsUdpFirst INTEGER32 pf_timeouts GET)
-                (8 pfTimeoutsUdpSingle INTEGER32 pf_timeouts GET)
-                (9 pfTimeoutsUdpMultiple INTEGER32 pf_timeouts GET)
-                (10 pfTimeoutsIcmpFirst INTEGER32 pf_timeouts GET)
-                (11 pfTimeoutsIcmpError INTEGER32 pf_timeouts GET)
-                (12 pfTimeoutsOtherFirst INTEGER32 pf_timeouts GET)
-                (13 pfTimeoutsOtherSingle INTEGER32 pf_timeouts GET)
-                (14 pfTimeoutsOtherMultiple INTEGER32 pf_timeouts GET)
-                (15 pfTimeoutsFragment INTEGER32 pf_timeouts GET)
-                (16 pfTimeoutsInterval INTEGER32 pf_timeouts GET)
-                (17 pfTimeoutsAdaptiveStart INTEGER32 pf_timeouts GET)
-                (18 pfTimeoutsAdaptiveEnd INTEGER32 pf_timeouts GET)
-                (19 pfTimeoutsSrcNode INTEGER32 pf_timeouts GET)
-              )
-              (7 pfLogInterface
-                (1 pfLogInterfaceName OCTETSTRING pf_logif GET)
-                (2 pfLogInterfaceIp4BytesIn COUNTER64 pf_logif GET)
-                (3 pfLogInterfaceIp4BytesOut COUNTER64 pf_logif GET)
-                (4 pfLogInterfaceIp4PktsInPass COUNTER64 pf_logif GET)
-                (5 pfLogInterfaceIp4PktsInDrop COUNTER64 pf_logif GET)
-                (6 pfLogInterfaceIp4PktsOutPass COUNTER64 pf_logif GET)
-                (7 pfLogInterfaceIp4PktsOutDrop COUNTER64 pf_logif GET)
-                (8 pfLogInterfaceIp6BytesIn COUNTER64 pf_logif GET)
-                (9 pfLogInterfaceIp6BytesOut COUNTER64 pf_logif GET)
-                (10 pfLogInterfaceIp6PktsInPass COUNTER64 pf_logif GET)
-                (11 pfLogInterfaceIp6PktsInDrop COUNTER64 pf_logif GET)
-                (12 pfLogInterfaceIp6PktsOutPass COUNTER64 pf_logif GET)
-                (13 pfLogInterfaceIp6PktsOutDrop COUNTER64 pf_logif GET)
-              )
-              (8 pfInterfaces
-                (1 pfInterfacesIfNumber INTEGER32 pf_interfaces GET)
-                (2 pfInterfacesIfTable
-                  (1 pfInterfacesIfEntry : INTEGER32 pf_iftable
-                    (1 pfInterfacesIfIndex INTEGER32)
-                    (2 pfInterfacesIfDescr OCTETSTRING GET)
-                    (3 pfInterfacesIfType INTEGER GET)
-		    (4 pfInterfacesIfTZero TIMETICKS GET)
-                    (5 pfInterfacesIfRefsState UNSIGNED32 GET)
-                    (6 pfInterfacesIfRefsRule UNSIGNED32 GET)
-                    (7 pfInterfacesIf4BytesInPass COUNTER64 GET)
-                    (8 pfInterfacesIf4BytesInBlock COUNTER64 GET)
-                    (9 pfInterfacesIf4BytesOutPass COUNTER64 GET)
-                    (10 pfInterfacesIf4BytesOutBlock COUNTER64 GET)
-                    (11 pfInterfacesIf4PktsInPass COUNTER64 GET)
-                    (12 pfInterfacesIf4PktsInBlock COUNTER64 GET)
-                    (13 pfInterfacesIf4PktsOutPass COUNTER64 GET)
-                    (14 pfInterfacesIf4PktsOutBlock COUNTER64 GET)
-                    (15 pfInterfacesIf6BytesInPass COUNTER64 GET)
-                    (16 pfInterfacesIf6BytesInBlock COUNTER64 GET)
-                    (17 pfInterfacesIf6BytesOutPass COUNTER64 GET)
-                    (18 pfInterfacesIf6BytesOutBlock COUNTER64 GET)
-                    (19 pfInterfacesIf6PktsInPass COUNTER64 GET)
-                    (20 pfInterfacesIf6PktsInBlock COUNTER64 GET)
-                    (21 pfInterfacesIf6PktsOutPass COUNTER64 GET)
-                    (22 pfInterfacesIf6PktsOutBlock COUNTER64 GET)
-                  )
-                )
-              )
-	      (9 pfTables
-	        (1 pfTablesTblNumber INTEGER32 pf_tables GET)
-		(2 pfTablesTblTable
-		  (1 pfTablesTblEntry : INTEGER32 pf_tbltable
-		    (1 pfTablesTblIndex INTEGER32)
-		    (2 pfTablesTblDescr OCTETSTRING GET)
-		    (3 pfTablesTblCount INTEGER32 GET)
-		    (4 pfTablesTblTZero TIMETICKS GET)
-		    (5 pfTablesTblRefsAnchor INTEGER32 GET)
-		    (6 pfTablesTblRefsRule INTEGER32 GET)
-		    (7 pfTablesTblEvalMatch COUNTER64 GET)
-		    (8 pfTablesTblEvalNoMatch COUNTER64 GET)
-		    (9 pfTablesTblBytesInPass COUNTER64 GET)
-		    (10 pfTablesTblBytesInBlock COUNTER64 GET)
-		    (11 pfTablesTblBytesInXPass COUNTER64 GET)
-		    (12 pfTablesTblBytesOutPass COUNTER64 GET)
-		    (13 pfTablesTblBytesOutBlock COUNTER64 GET)
-		    (14 pfTablesTblBytesOutXPass COUNTER64 GET)
-		    (15 pfTablesTblPktsInPass COUNTER64 GET)
-		    (16 pfTablesTblPktsInBlock COUNTER64 GET)
-		    (17 pfTablesTblPktsInXPass COUNTER64 GET)
-		    (18 pfTablesTblPktsOutPass COUNTER64 GET)
-		    (19 pfTablesTblPktsOutBlock COUNTER64 GET)
-		    (20 pfTablesTblPktsOutXPass COUNTER64 GET)
-		  )
-		)
-		(3 pfTablesAddrTable
-		  (1 pfTablesAddrEntry : INTEGER32 pf_tbladdr
-		    (1 pfTablesAddrIndex INTEGER32)
-		    (2 pfTablesAddrNet IPADDRESS GET)
-		    (3 pfTablesAddrMask INTEGER32 GET)
-		    (4 pfTablesAddrTZero TIMETICKS GET)
-		    (5 pfTablesAddrBytesInPass COUNTER64 GET)
-		    (6 pfTablesAddrBytesInBlock COUNTER64 GET)
-		    (7 pfTablesAddrBytesOutPass COUNTER64 GET)
-		    (8 pfTablesAddrBytesOutBlock COUNTER64 GET)
-		    (9 pfTablesAddrPktsInPass COUNTER64 GET)
-		    (10 pfTablesAddrPktsInBlock COUNTER64 GET)
-		    (11 pfTablesAddrPktsOutPass COUNTER64 GET)
-		    (12 pfTablesAddrPktsOutBlock COUNTER64 GET)
-		  )
-		)
-	      )
-	      (10 pfAltq
-	        (1 pfAltqQueueNumber INTEGER32 pf_altq GET)
-		(2 pfAltqQueueTable
-		  (1 pfAltqQueueEntry : INTEGER32 pf_altqq
-		    (1 pfAltqQueueIndex INTEGER32)
-		    (2 pfAltqQueueDescr OCTETSTRING GET)
-		    (3 pfAltqQueueParent OCTETSTRING GET)
-		    (4 pfAltqQueueScheduler INTEGER GET)
-		    (5 pfAltqQueueBandwidth UNSIGNED32 GET)
-		    (6 pfAltqQueuePriority INTEGER32 GET)
-		    (7 pfAltqQueueLimit INTEGER32 GET)
-		  )
-		)
-	      )
-            )
-          )
-        )
-      )
-    )
-  )
-)
@@ -1,4 +0,0 @@
-# $FreeBSD$
-
-MDSRCS+= bcmp.S bcopy.S bzero.S memcmp.S memcpy.S memmove.S memset.S \
-	strcat.S strcmp.S strcpy.S
@@ -1,24 +0,0 @@
-#include <machine/asm.h>
-__FBSDID("$FreeBSD$");
-
-#if 0
-	RCSID("$NetBSD: bcmp.S,v 1.1 2001/06/19 00:25:04 fvdl Exp $")
-#endif
-
-ENTRY(bcmp)
-	cld				/* set compare direction forward */
-
-	movq	%rdx,%rcx		/* compare by words */
-	shrq	$3,%rcx
-	repe
-	cmpsq
-	jne	L1
-
-	movq	%rdx,%rcx		/* compare remainder by bytes */
-	andq	$7,%rcx
-	repe
-	cmpsb
-L1:
-	setne	%al
-	movsbl	%al,%eax
-	ret
@@ -1,88 +0,0 @@
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * This code is derived from locore.s.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <machine/asm.h>
-__FBSDID("$FreeBSD$");
-
-#if 0
-	RCSID("$NetBSD: bcopy.S,v 1.2 2003/08/07 16:42:36 agc Exp $")
-#endif
-
-	/*
-	 * (ov)bcopy (src,dst,cnt)
-	 *  ws@tools.de     (Wolfgang Solfrank, TooLs GmbH) +49-228-985800
-	 */
-
-#ifdef MEMCOPY
-ENTRY(memcpy)
-#else
-#ifdef MEMMOVE
-ENTRY(memmove)
-#else
-ENTRY(bcopy)
-#endif
-#endif
-#if defined(MEMCOPY) || defined(MEMMOVE)
-	movq	%rdi,%rax	/* return dst */
-#else
-	xchgq	%rdi,%rsi
-#endif
-	movq	%rdx,%rcx
-	movq	%rdi,%r8
-	subq	%rsi,%r8
-	cmpq	%rcx,%r8	/* overlapping? */
-	jb	1f
-	cld			/* nope, copy forwards. */
-	shrq	$3,%rcx		/* copy by words */
-	rep
-	movsq
-	movq	%rdx,%rcx
-	andq	$7,%rcx		/* any bytes left? */
-	rep
-	movsb
-	ret
-1:
-	addq	%rcx,%rdi	/* copy backwards. */
-	addq	%rcx,%rsi
-	std
-	andq	$7,%rcx		/* any fractional bytes? */
-	decq	%rdi
-	decq	%rsi
-	rep
-	movsb
-	movq	%rdx,%rcx	/* copy remainder by words */
-	shrq	$3,%rcx
-	subq	$7,%rsi
-	subq	$7,%rdi
-	rep
-	movsq
-	cld
-	ret
@@ -1,43 +0,0 @@
-/*
- * Written by J.T. Conklin <jtc@NetBSD.org>.
- * Public domain.
- * Adapted for NetBSD/x86_64 by Frank van der Linden <fvdl@wasabisystems.com>
- */
-
-#include <machine/asm.h>
-__FBSDID("$FreeBSD$");
-
-#if 0
-	RCSID("$NetBSD: bzero.S,v 1.2 2003/07/26 19:24:38 salo Exp $")
-#endif
-
-ENTRY(bzero)
-	cld				/* set fill direction forward */
-	xorq	%rax,%rax		/* set fill data to 0 */
-
-	/*
-	 * if the string is too short, it's really not worth the overhead
-	 * of aligning to word boundries, etc.  So we jump to a plain
-	 * unaligned set.
-	 */
-	cmpq	$16,%rsi
-	jb	L1
-
-	movq	%rdi,%rcx		/* compute misalignment */
-	negq	%rcx
-	andq	$7,%rcx
-	subq	%rcx,%rsi
-	rep				/* zero until word aligned */
-	stosb
-
-	movq	%rsi,%rcx		/* zero by words */
-	shrq	$3,%rcx
-	andq	$7,%rsi
-	rep
-	stosq
-
-L1:	movq	%rsi,%rcx		/* zero remainder by bytes */
-	rep
-	stosb
-
-	ret
@@ -1,41 +0,0 @@
-/*
- * Written by J.T. Conklin <jtc@NetBSD.org>.
- * Public domain.
- * Adapted for NetBSD/x86_64 by Frank van der Linden <fvdl@wasabisystems.com>
- */
-
-#include <machine/asm.h>
-__FBSDID("$FreeBSD$");
-
-#if 0
-	RCSID("$NetBSD: memcmp.S,v 1.2 2003/07/26 19:24:39 salo Exp $")
-#endif
-
-ENTRY(memcmp)
-	cld				/* set compare direction forward */
-	movq	%rdx,%rcx		/* compare by longs */
-	shrq	$3,%rcx
-	repe
-	cmpsq
-	jne	L5			/* do we match so far? */
-
-	movq	%rdx,%rcx		/* compare remainder by bytes */
-	andq	$7,%rcx
-	repe
-	cmpsb
-	jne	L6			/* do we match? */
-
-	xorl	%eax,%eax		/* we match, return zero	*/
-	ret
-
-L5:	movl	$8,%ecx			/* We know that one of the next	*/
-	subq	%rcx,%rdi		/* eight pairs of bytes do not	*/
-	subq	%rcx,%rsi		/* match.			*/
-	repe
-	cmpsb
-L6:	xorl	%eax,%eax		/* Perform unsigned comparison	*/
-	movb	-1(%rdi),%al
-	xorl	%edx,%edx
-	movb	-1(%rsi),%dl
-	subl    %edx,%eax
-	ret
@@ -1,5 +0,0 @@
-/*	$NetBSD: memcpy.S,v 1.1 2001/06/19 00:25:05 fvdl Exp $	*/
-/*	$FreeBSD$ */
-
-#define MEMCOPY
-#include "bcopy.S"
@@ -1,5 +0,0 @@
-/*	$NetBSD: memmove.S,v 1.1 2001/06/19 00:25:05 fvdl Exp $	*/
-/*	$FreeBSD$ */
-
-#define MEMMOVE
-#include "bcopy.S"
@@ -1,60 +0,0 @@
-/*
- * Written by J.T. Conklin <jtc@NetBSD.org>.
- * Public domain.
- * Adapted for NetBSD/x86_64 by Frank van der Linden <fvdl@wasabisystems.com>
- */
-
-#include <machine/asm.h>
-__FBSDID("$FreeBSD$");
-
-#if 0
-	RCSID("$NetBSD: memset.S,v 1.3 2004/02/26 20:50:06 drochner Exp $")
-#endif
-
-ENTRY(memset)
-	movq	%rsi,%rax
-	andq	$0xff,%rax
-	movq	%rdx,%rcx
-	movq	%rdi,%r11
-
-	cld				/* set fill direction forward */
-
-	/*
-	 * if the string is too short, it's really not worth the overhead
-	 * of aligning to word boundries, etc.  So we jump to a plain
-	 * unaligned set.
-	 */
-	cmpq	$0x0f,%rcx
-	jle	L1
-
-	movb	%al,%ah			/* copy char to all bytes in word */
-	movl	%eax,%edx
-	sall	$16,%eax
-	orl	%edx,%eax
-
-	movl	%eax,%edx
-	salq	$32,%rax
-	orq	%rdx,%rax
-
-	movq	%rdi,%rdx		/* compute misalignment */
-	negq	%rdx
-	andq	$7,%rdx
-	movq	%rcx,%r8
-	subq	%rdx,%r8
-
-	movq	%rdx,%rcx		/* set until word aligned */
-	rep
-	stosb
-
-	movq	%r8,%rcx
-	shrq	$3,%rcx			/* set by words */
-	rep
-	stosq
-
-	movq	%r8,%rcx		/* set remainder by bytes */
-	andq	$7,%rcx
-L1:	rep
-	stosb
-	movq	%r11,%rax
-
-	ret
@@ -55,7 +55,7 @@ HIDENAME(cerror):
 	pushq	%rax
 	call	PIC_PLT(CNAME(__error))
 	popq	%rcx
-	movq	%rcx,(%rax)
+	movl	%ecx,(%rax)
 	movq	$-1,%rax
 	movq	$-1,%rdx
 	ret