Version bump for the CAN-2004-0109 issue; bug #47881.

9 files changed, 227 insertions, 9 deletions

diff --git a/sys-kernel/uclinux-sources/ChangeLog b/sys-kernel/uclinux-sources/ChangeLog
index d0b83be0f8fc..9d43e1743de9 100644
--- a/sys-kernel/uclinux-sources/ChangeLog
+++ b/sys-kernel/uclinux-sources/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for sys-kernel/uclinux-sources
 # Copyright 2000-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.3 2004/04/12 16:36:23 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.4 2004/04/15 16:51:44 plasmaroo Exp $
+
+*uclinux-sources-2.4.24_p0-r1 (15 Apr 2004)
+
+  15 Apr 2004; <plasmaroo@gentoo.org>
+  +files/uclinux-sources-2.4.24_p0.CAN-2004-0109.patch,
+  +files/uclinux-sources-2.4.24_p0.munmap.patch,
+  +files/uclinux-sources-2.6.5_p0.CAN-2004-0109.patch,
+  +uclinux-sources-2.4.24_p0-r1.ebuild, -uclinux-sources-2.4.24_p0.ebuild,
+  -uclinux-sources-2.6.3_p0.ebuild, +uclinux-sources-2.6.5_p0-r1.ebuild:
+  Version bump for the CAN-2004-0109 issue; bug #47881.
 
   12 Apr 2004; Daniel Ahlberg <aliz@gentoo.org>
   uclinux-sources-2.4.24_p0.ebuild, uclinux-sources-2.6.3_p0.ebuild:
diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.24_p0 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.24_p0-r1
index 1f752820c61e..1f752820c61e 100644
--- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.24_p0
+++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.24_p0-r1
diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.3_p0 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.3_p0
deleted file mode 100644
index 83e3fc201787..000000000000
--- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.3_p0
+++ /dev/null
@@ -1,2 +0,0 @@
-MD5 6063a7e424355ec52e0cb559fb99034d linux-2.6.3.tar.bz2 34271622
-MD5 ca2ecc5b6f59b9315e529458bda486a7 linux-2.6.3-uc0.patch.gz 61091
diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.5_p0-r1 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.5_p0-r1
new file mode 100644
index 000000000000..d1c9ca4e12cf
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.5_p0-r1
@@ -0,0 +1,2 @@
+MD5 9a76bf64c1151369b250f967d83077aa linux-2.6.5.tar.bz2 34684611
+MD5 7e55c2a8f83460c8b7917abeb67a97c8 linux-2.6.5-uc0.patch.gz 61905
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.CAN-2004-0109.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.CAN-2004-0109.patch
new file mode 100644
index 000000000000..d02b51c57fc6
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.CAN-2004-0109.patch
@@ -0,0 +1,87 @@
+--- linux/fs/isofs/rock.c.orig
++++ linux/fs/isofs/rock.c
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/pagemap.h>
+ #include <linux/smp_lock.h>
++#include <asm/page.h>
+ 
+ #include "rock.h"
+ 
+@@ -419,7 +420,7 @@
+   return 0;
+ }
+ 
+-static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr)
++static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
+ {
+ 	int slen;
+ 	int rootflag;
+@@ -431,16 +432,25 @@
+ 		rootflag = 0;
+ 		switch (slp->flags & ~1) {
+ 		case 0:
++			if (slp->len > plimit - rpnt)
++				return NULL;
+ 			memcpy(rpnt, slp->text, slp->len);
+ 			rpnt+=slp->len;
+ 			break;
++		case 2:
++			if (rpnt >= plimit)
++				return NULL;
++			*rpnt++='.';
++			break;
+ 		case 4:
++			if (2 > plimit - rpnt)
++				return NULL;
+ 			*rpnt++='.';
+-			/* fallthru */
+-		case 2:
+ 			*rpnt++='.';
+ 			break;
+ 		case 8:
++			if (rpnt >= plimit)
++				return NULL;
+ 			rootflag = 1;
+ 			*rpnt++='/';
+ 			break;
+@@ -457,17 +467,23 @@
+ 			 * If there is another SL record, and this component
+ 			 * record isn't continued, then add a slash.
+ 			 */
+-			if ((!rootflag) && (rr->u.SL.flags & 1) && !(oldslp->flags & 1))
++			if ((!rootflag) && (rr->u.SL.flags & 1) &&
++			    !(oldslp->flags & 1)) {
++				if (rpnt >= plimit)
++					return NULL;
+ 				*rpnt++='/';
++			}
+ 			break;
+ 		}
+ 
+ 		/*
+ 		 * If this component record isn't continued, then append a '/'.
+ 		 */
+-		if (!rootflag && !(oldslp->flags & 1))
++		if (!rootflag && !(oldslp->flags & 1)) {
++			if (rpnt >= plimit)
++				return NULL;
+ 			*rpnt++='/';
+-
++		}
+ 	}
+ return rpnt;
+ }
+@@ -548,7 +564,10 @@
+ 			CHECK_SP(goto out);
+ 			break;
+ 		case SIG('S', 'L'):
+-			rpnt = get_symlink_chunk(rpnt, rr);
++			rpnt = get_symlink_chunk(rpnt, rr,
++						 link + (PAGE_SIZE - 1));
++			if (rpnt == NULL)
++				goto out;
+ 			break;
+ 		case SIG('C', 'E'):
+ 			/* This tells is if there is a continuation record */
+
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.munmap.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.munmap.patch
new file mode 100644
index 000000000000..e120b35b7adb
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.24_p0.munmap.patch
@@ -0,0 +1,27 @@
+diff -ur linux-2.4.25-rc3/mm/mremap.c linux-2.4.25-rc4/mm/mremap.c
+--- linux-2.4.25-rc3/mm/mremap.c	2004-02-18 13:56:01.000000000 +0000
++++ linux-2.4.25-rc4/mm/mremap.c	2004-02-18 13:49:08.000000000 +0000
+@@ -258,16 +258,20 @@
+ 		if ((addr <= new_addr) && (addr+old_len) > new_addr)
+ 			goto out;
+ 
+-		do_munmap(current->mm, new_addr, new_len);
++		ret = do_munmap(current->mm, new_addr, new_len);
++		if (ret && new_len)
++			goto out;
+ 	}
+ 
+ 	/*
+ 	 * Always allow a shrinking remap: that just unmaps
+ 	 * the unnecessary pages..
+ 	 */
+-	ret = addr;
+ 	if (old_len >= new_len) {
+-		do_munmap(current->mm, addr+new_len, old_len - new_len);
++		ret = do_munmap(current->mm, addr+new_len, old_len - new_len);
++		if (ret && old_len != new_len)
++			goto out;
++		ret = addr;
+ 		if (!(flags & MREMAP_FIXED) || (new_addr == addr))
+ 			goto out;
+ 	}
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.5_p0.CAN-2004-0109.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.5_p0.CAN-2004-0109.patch
new file mode 100644
index 000000000000..d7726c2e5aaf
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.5_p0.CAN-2004-0109.patch
@@ -0,0 +1,88 @@
+--- linux/fs/isofs/rock.c.orig
++++ linux/fs/isofs/rock.c
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/pagemap.h>
+ #include <linux/smp_lock.h>
+ #include <linux/buffer_head.h>
++#include <asm/page.h>
+ 
+ #include "rock.h"
+@@ -419,7 +420,7 @@ int parse_rock_ridge_inode_internal(stru
+   return 0;
+ }
+ 
+-static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr)
++static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
+ {
+ 	int slen;
+ 	int rootflag;
+@@ -431,16 +432,25 @@ static char *get_symlink_chunk(char *rpn
+ 		rootflag = 0;
+ 		switch (slp->flags & ~1) {
+ 		case 0:
++			if (slp->len > plimit - rpnt)
++				return NULL;
+ 			memcpy(rpnt, slp->text, slp->len);
+ 			rpnt+=slp->len;
+ 			break;
++		case 2:
++			if (rpnt >= plimit)
++				return NULL;
++			*rpnt++='.';
++			break;
+ 		case 4:
++			if (2 > plimit - rpnt)
++				return NULL;
+ 			*rpnt++='.';
+-			/* fallthru */
+-		case 2:
+ 			*rpnt++='.';
+ 			break;
+ 		case 8:
++			if (rpnt >= plimit)
++				return NULL;
+ 			rootflag = 1;
+ 			*rpnt++='/';
+ 			break;
+@@ -457,17 +467,23 @@ static char *get_symlink_chunk(char *rpn
+ 			 * If there is another SL record, and this component
+ 			 * record isn't continued, then add a slash.
+ 			 */
+-			if ((!rootflag) && (rr->u.SL.flags & 1) && !(oldslp->flags & 1))
++			if ((!rootflag) && (rr->u.SL.flags & 1) &&
++			    !(oldslp->flags & 1)) {
++				if (rpnt >= plimit)
++					return NULL;
+ 				*rpnt++='/';
++			}
+ 			break;
+ 		}
+ 
+ 		/*
+ 		 * If this component record isn't continued, then append a '/'.
+ 		 */
+-		if (!rootflag && !(oldslp->flags & 1))
++		if (!rootflag && !(oldslp->flags & 1)) {
++			if (rpnt >= plimit)
++				return NULL;
+ 			*rpnt++='/';
+-
++		}
+ 	}
+ return rpnt;
+ }
+@@ -548,7 +564,10 @@ static int rock_ridge_symlink_readpage(s
+ 			CHECK_SP(goto out);
+ 			break;
+ 		case SIG('S', 'L'):
+-			rpnt = get_symlink_chunk(rpnt, rr);
++			rpnt = get_symlink_chunk(rpnt, rr,
++						 link + (PAGE_SIZE - 1));
++			if (rpnt == NULL)
++				goto out;
+ 			break;
+ 		case SIG('C', 'E'):
+ 			/* This tells is if there is a continuation record */
+
+
diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0-r1.ebuild
index 9a9c52fd598f..127d1f613e7d 100644
--- a/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0.ebuild
+++ b/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0.ebuild,v 1.2 2004/04/12 16:36:23 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.24_p0-r1.ebuild,v 1.1 2004/04/15 16:51:44 plasmaroo Exp $
 
 IUSE=""
 
@@ -24,7 +24,7 @@ fi
 
 MY_P=linux-${PV/_p/-uc}
 
-S=${WORKDIR}/${MY_P}
+S=${WORKDIR}/linux-${KV}
 DESCRIPTION="uCLinux kernel patches for CPUs without MMUs"
 SRC_URI="mirror://kernel/v${MMV}/linux-${OKV}.tar.bz2
 	http://www.uclinux.org/pub/uClinux/uClinux-${MMV}.x/${MY_P/linux/${base}}.${patch}.gz"
@@ -43,6 +43,10 @@ src_unpack() {
 	set MY_ARCH=${ARCH}
 	unset ARCH
 	rm ../${MY_P/linux/${base}}.${patch}
+
+	epatch ${FILESDIR}/${P}.munmap.patch || die "Failed to apply munmap patch!"
+	epatch ${FILESDIR}/${P}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!"
+
 	kernel_universal_unpack
 	set ARCH=${MY_ARCH}
 }
diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.6.3_p0.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.6.5_p0-r1.ebuild
index c175a2ace711..fd52afec5957 100644
--- a/sys-kernel/uclinux-sources/uclinux-sources-2.6.3_p0.ebuild
+++ b/sys-kernel/uclinux-sources/uclinux-sources-2.6.5_p0-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.3_p0.ebuild,v 1.2 2004/04/12 16:36:23 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.5_p0-r1.ebuild,v 1.1 2004/04/15 16:51:44 plasmaroo Exp $
 
 IUSE=""
 
@@ -9,10 +9,10 @@ inherit kernel eutils
 OKV="`echo ${PV}|sed -e 's:^\([0-9]\+\.[0-9]\+\.[0-9]\+\).*:\1:'`"
 
 EXTRAVERSION="uc${PV/*_p/}"
-[ ! "${PR}" == "r0" ] && EXTRAVERSION="${EXTRAVERSION}-${PR}"
+[ "${PR}" != "r0" ] && EXTRAVERSION="${EXTRAVERSION}-${PR}"
 KV="${OKV}-${EXTRAVERSION}"
 
-#Get the major & minor kernel version
+# Get the major & minor kernel version
 MMV=`echo $PV | awk -F. '{print $1"."$2}'`
 
 patch="diff"
@@ -24,7 +24,7 @@ fi
 
 MY_P=linux-${PV/_p/-uc}
 
-S=${WORKDIR}/${MY_P}
+S=${WORKDIR}/linux-${KV}
 DESCRIPTION="uCLinux kernel patches for CPUs without MMUs"
 SRC_URI="mirror://kernel/v${MMV}/linux-${OKV}.tar.bz2
 	http://www.uclinux.org/pub/uClinux/uClinux-${MMV}.x/${MY_P/linux/${base}}.${patch}.gz"
@@ -43,6 +43,8 @@ src_unpack() {
 	set MY_ARCH=${ARCH}
 	unset ARCH
 	rm ../${MY_P/linux/${base}}.${patch}
+	epatch ${FILESDIR}/${P}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!"
+
 	kernel_universal_unpack
 	set ARCH=${MY_ARCH}
 }