Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs security patch (bug #65877).

6 files changed, 118 insertions, 8 deletions

diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r12 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r13
index 49ba6c313556..49ba6c313556 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r12
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r13
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r9 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r10
index 0d04b5cf57f2..0d04b5cf57f2 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r9
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r10
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.15-r2 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.15-r3
index 3bdaa8aa52a4..3bdaa8aa52a4 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.15-r2
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.15-r3
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r16 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r17
index 1fcc6f96f959..1fcc6f96f959 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r16
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r17
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.binfmt_elf.patch b/sys-kernel/wolk-sources/files/wolk-sources.binfmt_elf.patch
index bce026adf312..a8ce8124db86 100644
--- a/sys-kernel/wolk-sources/files/wolk-sources.binfmt_elf.patch
+++ b/sys-kernel/wolk-sources/files/wolk-sources.binfmt_elf.patch
@@ -1,6 +1,6 @@
-diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt_elf.c
---- linux-2.4.27-gentoo-r2/fs/binfmt_elf.c	2004-11-10 20:43:18.000000000 +0000
-+++ linux-2.4.27-gentoo-r3/fs/binfmt_elf.c	2004-11-10 20:33:40.000000000 +0000
+diff -ur linux-2.4.27-gentoo-r3/fs/binfmt_elf.c linux-2.4.27-gentoo-r4/fs/binfmt_elf.c
+--- linux-2.4.27-gentoo-r3/fs/binfmt_elf.c	2004-11-20 14:00:14.547133232 +0000
++++ linux-2.4.27-gentoo-r4/fs/binfmt_elf.c	2004-11-20 13:59:42.415018056 +0000
 @@ -308,9 +308,12 @@
  		goto out;
  
@@ -29,7 +29,17 @@ diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt
  		
  	files = current->files;		/* Refcounted so ok */
  	retval = unshare_files();
-@@ -734,8 +740,14 @@
+@@ -724,7 +730,8 @@
+ 			 */
+ 
+ 			retval = -ENOMEM;
+-			if (elf_ppnt->p_filesz > PATH_MAX)
++			if (elf_ppnt->p_filesz > PATH_MAX || 
++			    elf_ppnt->p_filesz == 0)
+ 				goto out_free_file;
+ 			elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ 							   GFP_KERNEL);
+@@ -734,8 +741,16 @@
  			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
  					   elf_interpreter,
  					   elf_ppnt->p_filesz);
@@ -40,12 +50,14 @@ diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt
  				goto out_free_interp;
 +			}
 +			/* make sure path is NULL terminated */
-+			elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++			retval = -EINVAL;
++			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++				goto out_free_interp;
 +
  			/* If the program interpreter is one of these two,
  			 * then assume an iBCS2 image. Otherwise assume
  			 * a native linux image.
-@@ -754,8 +766,11 @@
+@@ -754,8 +769,11 @@
  			if (IS_ERR(interpreter))
  				goto out_free_interp;
  			retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -58,7 +70,7 @@ diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt
  
  			/* Get the exec headers */
  			interp_ex = *((struct exec *) bprm->buf);
-@@ -967,7 +982,10 @@
+@@ -967,7 +985,10 @@
  #endif
  
  			if (BAD_ADDR(error))
@@ -70,7 +82,7 @@ diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt
  
  			/* PaX: mirror at a randomized base */
  			down_write(&current->mm->mmap_sem);
-@@ -1008,7 +1026,10 @@
+@@ -1008,7 +1029,10 @@
  		{
  			error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
  			if (BAD_ADDR(error))
@@ -82,3 +94,4 @@ diff -ur linux-2.4.27-gentoo-r2/fs/binfmt_elf.c linux-2.4.27-gentoo-r3/fs/binfmt
  		}
  
  		if (!load_addr_set) {
+Only in linux-2.4.27-gentoo-r4/fs: binfmt_elf.c.orig
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.smbfs.patch b/sys-kernel/wolk-sources/files/wolk-sources.smbfs.patch
new file mode 100644
index 000000000000..63c5ba30403f
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources.smbfs.patch
@@ -0,0 +1,97 @@
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c	2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c	2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+ 	data_len = WVAL(buf, 1);
+ 
+ 	/* we can NOT simply trust the data_len given by the server ... */
+-	if (data_len > server->packet_size - (buf+3 - server->packet)) {
+-		printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-		       "%d > %d - (%p - %p)\n",
+-		       data_len, server->packet_size, buf+3, server->packet);
++	if (data_len > count ||
++		(buf+3 - server->packet) + data_len > server->packet_size) {
++		printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++		       "%d > %d || (%p - %p) + %d > %d\n",
++		       data_len, count,
++		       buf+3, server->packet, data_len, server->packet_size);
+ 		result = -EIO;
+ 		goto out;
+ 	}
+@@ -1378,10 +1380,12 @@
+ 	buf = smb_base(server->packet) + data_off;
+ 
+ 	/* we can NOT simply trust the info given by the server ... */
+-	if (data_len > server->packet_size - (buf - server->packet)) {
+-		printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-		       "%d > %d - (%p - %p)\n",
+-		       data_len, server->packet_size, buf, server->packet);
++	if (data_len > count ||
++		(buf - server->packet) + data_len > server->packet_size) {
++		printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++		       "%d > %d || (%p - %p) + %d > %d\n",
++		       data_len, count,
++		       buf, server->packet, data_len, server->packet_size);
+ 		result = -EIO;
+ 		goto out;
+ 	}
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c	2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c	2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+ 					parm_disp, parm_offset, parm_count,
+ 					data_disp, data_offset, data_count);
+ 				*parm  = base + parm_offset;
++				if (*parm - inbuf + parm_tot > server->packet_size)
++					goto out_bad_parm;
+ 				*data  = base + data_offset;
++				if (*data - inbuf + data_tot > server->packet_size)
++					goto out_bad_data;
+ 				goto success;
+ 			}
+ 
+@@ -591,6 +595,8 @@
+ 			rcv_buf = smb_vmalloc(buf_len);
+ 			if (!rcv_buf)
+ 				goto out_no_mem;
++			memset(rcv_buf, 0, buf_len);
++			
+ 			*parm = rcv_buf;
+ 			*data = rcv_buf + total_p;
+ 		} else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+ 
+ 		if (parm_disp + parm_count > total_p)
+ 			goto out_bad_parm;
++		if (parm_offset + parm_count > server->packet_size)	
++			goto out_bad_parm;
+ 		if (data_disp + data_count > total_d)
+ 			goto out_bad_data;
++		if (data_offset + data_count > server->packet_size)	
++			goto out_bad_data;
+ 		memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+ 		memcpy(*data + data_disp, base + data_offset, data_count);
+ 
+@@ -610,8 +620,11 @@
+ 		 * Check whether we've received all of the data. Note that
+ 		 * we use the packet totals -- total lengths might shrink!
+ 		 */
+-		if (data_len >= data_tot && parm_len >= parm_tot)
++		if (data_len >= data_tot && parm_len >= parm_tot) {
++			data_len = data_tot;
++			parm_len = parm_tot;
+ 			break;
++		}
+ 	}
+ 
+ 	/*
+@@ -625,6 +638,9 @@
+ 		server->packet = rcv_buf;
+ 		rcv_buf = inbuf;
+ 	} else {
++		if (parm_len + data_len > buf_len)
++			goto out_data_grew;
++
+ 		PARANOIA("copying data, old size=%d, new size=%u\n",
+ 			 server->packet_size, buf_len);
+ 		memcpy(inbuf, rcv_buf, parm_len + data_len);