Added patches for the CAN-2004-0010, CAN-2004-0177 and CAN-2004-0178 vulnerabilities.

7 files changed, 281 insertions, 2 deletions

diff --git a/sys-kernel/xfs-sources/ChangeLog b/sys-kernel/xfs-sources/ChangeLog
index 6b7d5016c775..0ad37ebe181e 100644
--- a/sys-kernel/xfs-sources/ChangeLog
+++ b/sys-kernel/xfs-sources/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for sys-kernel/xfs-sources
 # Copyright 1999-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xfs-sources/ChangeLog,v 1.44 2004/04/15 18:16:06 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xfs-sources/ChangeLog,v 1.45 2004/04/17 15:31:51 plasmaroo Exp $
+
+*xfs-sources-2.4.24-r5 (17 Apr 2004)
+
+  17 Apr 2004; <plasmaroo@gentoo.org> +files/xfs-sources.CAN-2004-0010.patch,
+  +files/xfs-sources.CAN-2004-0177.patch,
+  +files/xfs-sources.CAN-2004-0178.patch, +xfs-sources-2.4.24-r5.ebuild:
+  Added patches for the CAN-2004-0010, CAN-2004-0177 and CAN-2004-0178
+  vulnerabilities.
 
 *xfs-sources-2.4.24-r4 (15 Apr 2004)
 
diff --git a/sys-kernel/xfs-sources/Manifest b/sys-kernel/xfs-sources/Manifest
index 912bfeaa8ea8..d284a849aa11 100644
--- a/sys-kernel/xfs-sources/Manifest
+++ b/sys-kernel/xfs-sources/Manifest
@@ -1,4 +1,4 @@
-MD5 4ce9a306a27ecc603c5df768aa84f8a8 ChangeLog 10995
+MD5 750dab28e5a77b29822ff9a613bfcaeb ChangeLog 11317
 MD5 f02e213426423fa9c483eb893ab9e0e0 xfs-sources-2.4.20-r4.ebuild 2322
 MD5 c4f209d9bc759c47d15b5b056131cd35 xfs-sources-2.4.24.ebuild 1065
 MD5 f0a9e84650d3661de4d2f6078920a808 xfs-sources-2.4.24-r3.ebuild 1152
@@ -9,6 +9,7 @@ MD5 6131bc0df38cdb946967ceea9c8ffd0e xfs-sources-2.4.23-r1.ebuild 1257
 MD5 362ccecfa0cb07471317a27e762e7250 xfs-sources-2.4.19-r3.ebuild 2339
 MD5 4980429952168194a39b7656d909137a xfs-sources-2.4.20-r2.ebuild 2202
 MD5 7a1c98a028bb42e5e4cf1f24f4a41e46 xfs-sources-2.4.24-r2.ebuild 1137
+MD5 7a7d4dd718fc32296b852bbb80ec6aed xfs-sources-2.4.24-r5.ebuild 1538
 MD5 ccb24e8a4128475f97bf020f5b0a952a xfs-sources-2.4.20-r1.ebuild 2193
 MD5 6934c1007e4f6c56f2fa58ed7deef21e xfs-sources-2.4.24-r4.ebuild 1256
 MD5 bc1840b22fbca3216cc2d10679c534d7 xfs-sources-2.4.24-r1.ebuild 1073
@@ -18,10 +19,12 @@ MD5 53da61155df6e5a6d0c8f57f0195e78a files/digest-xfs-sources-2.4.24-r3 144
 MD5 6c7dc3e61cee85185b45bc82e2982351 files/digest-xfs-sources-2.4.20-r2 142
 MD5 df40eece807d039cba79f477e80ebda2 files/xfs-sources-2.4.19.rtc_fix.patch 4974
 MD5 174438d215b70cad5ffb00ca8123c062 files/xfs-sources-2.4.24.munmap.patch 837
+MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/xfs-sources.CAN-2004-0177.patch 384
 MD5 f296f6804e8a1b632ff0939c10c66ea5 files/digest-xfs-sources-2.4.23-r1 141
 MD5 bb367b087129027dd816740e61f0e675 files/digest-xfs-sources-2.4.20-r1 142
 MD5 77f3799264c87379da9f7f2b23f20684 files/digest-xfs-sources-2.4.19-r3 142
 MD5 e77a93fdf26f06cf3ea5080b27211725 files/xfs-sources.CAN-2003-0985.patch 414
+MD5 147fec50180ad91b6260fc7201dcb90f files/xfs-sources.CAN-2004-0010.patch 6050
 MD5 a61e57d5483a06f20da339d91f98fbb8 files/xfs-sources-2.4.20.rtc_fix.patch 6769
 MD5 d53055aeb748e8680c3232c405c5ec89 files/digest-xfs-sources-2.4.24 141
 MD5 a728d28dca69f5ae16aab56cd2fc6110 files/digest-xfs-sources-2.4.20 139
@@ -31,7 +34,9 @@ MD5 21f3a4f186017d925067335e24db36a1 files/xfs-sources.CAN-2004-0109.patch 1877
 MD5 3afd3962750ab6706f9a9878a94cfd8d files/xfs-sources-2.4.20-gcc33.patch 10849
 MD5 e2e2b545b6fcdcecf49e33798efa5b84 files/xfs-sources-2.4.22.rtc_fix.patch 7073
 MD5 739cbda7c5acadb95758e2f4d8194699 files/digest-xfs-sources-2.4.20-r5 142
+MD5 ac42024b6e6ee1e2165914db4b22a61c files/xfs-sources.CAN-2004-0178.patch 424
 MD5 739cbda7c5acadb95758e2f4d8194699 files/digest-xfs-sources-2.4.20-r4 142
+MD5 53da61155df6e5a6d0c8f57f0195e78a files/digest-xfs-sources-2.4.24-r5 144
 MD5 739cbda7c5acadb95758e2f4d8194699 files/digest-xfs-sources-2.4.20-r3 142
 MD5 53da61155df6e5a6d0c8f57f0195e78a files/digest-xfs-sources-2.4.24-r4 144
 MD5 e637c6fa41097ea2c4693d0766f2e1c5 files/do_brk_fix.patch 242
diff --git a/sys-kernel/xfs-sources/files/digest-xfs-sources-2.4.24-r5 b/sys-kernel/xfs-sources/files/digest-xfs-sources-2.4.24-r5
new file mode 100644
index 000000000000..981a129bcbef
--- /dev/null
+++ b/sys-kernel/xfs-sources/files/digest-xfs-sources-2.4.24-r5
@@ -0,0 +1,2 @@
+MD5 1e055c42921b2396a559d84df4c3d9aa linux-2.4.24.tar.bz2 29837818
+MD5 572ff310d39ce7fd20568bf27299ded8 xfs-sources-2.4.24-r3.patch.bz2 1718289
diff --git a/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0010.patch b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0010.patch
new file mode 100644
index 000000000000..6b4b1cefa49e
--- /dev/null
+++ b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0010.patch
@@ -0,0 +1,200 @@
+diff -urN linux-2.4.25-pre6/fs/ncpfs/dir.c linux-2.4.25-pre7/fs/ncpfs/dir.c
+--- linux-2.4.25-pre6/fs/ncpfs/dir.c	2002-11-28 15:53:15.000000000 -0800
++++ linux-2.4.25-pre7/fs/ncpfs/dir.c	2004-01-23 10:53:26.000000000 -0800
+@@ -266,8 +266,8 @@
+ 	struct ncp_server *server;
+ 	struct inode *dir = dentry->d_parent->d_inode;
+ 	struct ncp_entry_info finfo;
+-	int res, val = 0, len = dentry->d_name.len + 1;
+-	__u8 __name[len];
++	int res, val = 0, len;
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+ 	if (!dentry->d_inode || !dir)
+ 		goto finished;
+@@ -291,14 +291,15 @@
+ 		dentry->d_parent->d_name.name, dentry->d_name.name,
+ 		NCP_GET_AGE(dentry));
+ 
++	len = sizeof(__name);
+ 	if (ncp_is_server_root(dir)) {
+ 		res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, 1);
++						dentry->d_name.len, 1);
+ 		if (!res)
+ 			res = ncp_lookup_volume(server, __name, &(finfo.i));
+ 	} else {
+ 		res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, !ncp_preserve_case(dir));
++						dentry->d_name.len, !ncp_preserve_case(dir));
+ 		if (!res)
+ 			res = ncp_obtain_info(server, dir, __name, &(finfo.i));
+ 	}
+@@ -548,9 +549,9 @@
+ 	int valid = 0;
+ 	int hashed = 0;
+ 	ino_t ino = 0;
+-	__u8 __name[256];
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+-	qname.len = 256;
++	qname.len = sizeof(__name);
+ 	if (ncp_vol2io(NCP_SERVER(inode), __name, &qname.len,
+ 			entry->i.entryName, entry->i.nameLen,
+ 			!ncp_preserve_entry_case(inode, entry->i.NSCreator)))
+@@ -705,16 +706,19 @@
+ {
+ 	struct ncp_server* server = NCP_SBP(sb);
+ 	struct nw_info_struct i;
+-	int result, len = strlen(server->m.mounted_vol) + 1;
+-	__u8 __name[len];
++	int result;
+ 
+ 	if (ncp_single_volume(server)) {
++		int len;
+ 		struct dentry* dent;
++		__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+-		result = -ENOENT;
+-		if (ncp_io2vol(server, __name, &len, server->m.mounted_vol,
+-								len-1, 1))
++		len = sizeof(__name);
++		result = ncp_io2vol(server, __name, &len, server->m.mounted_vol,
++				    strlen(server->m.mounted_vol), 1);
++		if (result)
+ 			goto out;
++		result = -ENOENT;
+ 		if (ncp_lookup_volume(server, __name, &i)) {
+ 			PPRINTK("ncp_conn_logged_in: %s not found\n",
+ 				server->m.mounted_vol);
+@@ -745,8 +749,8 @@
+ 	struct ncp_server *server = NCP_SERVER(dir);
+ 	struct inode *inode = NULL;
+ 	struct ncp_entry_info finfo;
+-	int error, res, len = dentry->d_name.len + 1;
+-	__u8 __name[len];
++	int error, res, len;
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+ 	error = -EIO;
+ 	if (!ncp_conn_valid(server))
+@@ -755,14 +759,15 @@
+ 	PPRINTK("ncp_lookup: server lookup for %s/%s\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name);
+ 
++	len = sizeof(__name);
+ 	if (ncp_is_server_root(dir)) {
+ 		res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, 1);
++				 dentry->d_name.len, 1);
+ 		if (!res)
+ 			res = ncp_lookup_volume(server, __name, &(finfo.i));
+ 	} else {
+ 		res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, !ncp_preserve_case(dir));
++				 dentry->d_name.len, !ncp_preserve_case(dir));
+ 		if (!res)
+ 			res = ncp_obtain_info(server, dir, __name, &(finfo.i));
+ 	}
+@@ -825,9 +830,9 @@
+ {
+ 	struct ncp_server *server = NCP_SERVER(dir);
+ 	struct ncp_entry_info finfo;
+-	int error, result, len = dentry->d_name.len + 1;
++	int error, result, len;
+ 	int opmode;
+-	__u8 __name[len];
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 	
+ 	PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name, mode);
+@@ -836,8 +841,9 @@
+ 		goto out;
+ 
+ 	ncp_age_dentry(server, dentry);
++	len = sizeof(__name);
+ 	error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, !ncp_preserve_case(dir));
++			   dentry->d_name.len, !ncp_preserve_case(dir));
+ 	if (error)
+ 		goto out;
+ 
+@@ -880,8 +886,8 @@
+ {
+ 	struct ncp_entry_info finfo;
+ 	struct ncp_server *server = NCP_SERVER(dir);
+-	int error, len = dentry->d_name.len + 1;
+-	__u8 __name[len];
++	int error, len;
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+ 	DPRINTK("ncp_mkdir: making %s/%s\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name);
+@@ -890,8 +896,9 @@
+ 		goto out;
+ 
+ 	ncp_age_dentry(server, dentry);
++	len = sizeof(__name);
+ 	error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, !ncp_preserve_case(dir));
++			   dentry->d_name.len, !ncp_preserve_case(dir));
+ 	if (error)
+ 		goto out;
+ 
+@@ -909,8 +916,8 @@
+ static int ncp_rmdir(struct inode *dir, struct dentry *dentry)
+ {
+ 	struct ncp_server *server = NCP_SERVER(dir);
+-	int error, result, len = dentry->d_name.len + 1;
+-	__u8 __name[len];
++	int error, result, len;
++	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
+ 	DPRINTK("ncp_rmdir: removing %s/%s\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name);
+@@ -923,8 +930,9 @@
+ 	if (!d_unhashed(dentry))
+ 		goto out;
+ 
++	len = sizeof(__name);
+ 	error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+-						len-1, !ncp_preserve_case(dir));
++			   dentry->d_name.len, !ncp_preserve_case(dir));
+ 	if (error)
+ 		goto out;
+ 
+@@ -1022,9 +1030,8 @@
+ {
+ 	struct ncp_server *server = NCP_SERVER(old_dir);
+ 	int error;
+-	int old_len = old_dentry->d_name.len + 1;
+-	int new_len = new_dentry->d_name.len + 1;
+-	__u8 __old_name[old_len], __new_name[new_len];
++	int old_len, new_len;
++	__u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
+ 
+ 	DPRINTK("ncp_rename: %s/%s to %s/%s\n",
+ 		old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
+@@ -1037,15 +1044,17 @@
+ 	ncp_age_dentry(server, old_dentry);
+ 	ncp_age_dentry(server, new_dentry);
+ 
++	old_len = sizeof(__old_name);
+ 	error = ncp_io2vol(server, __old_name, &old_len,
+-					old_dentry->d_name.name, old_len-1,
+-					!ncp_preserve_case(old_dir));
++			   old_dentry->d_name.name, old_dentry->d_name.len,
++			   !ncp_preserve_case(old_dir));
+ 	if (error)
+ 		goto out;
+ 
++	new_len = sizeof(__new_name);
+ 	error = ncp_io2vol(server, __new_name, &new_len,
+-					new_dentry->d_name.name, new_len-1,
+-					!ncp_preserve_case(new_dir));
++			   new_dentry->d_name.name, new_dentry->d_name.len,
++			   !ncp_preserve_case(new_dir));
+ 	if (error)
+ 		goto out;
+ 
+
diff --git a/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0177.patch b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0177.patch
new file mode 100644
index 000000000000..da6b7e190685
--- /dev/null
+++ b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0177.patch
@@ -0,0 +1,10 @@
+--- linux-2.4.26-pre3/fs/jbd/journal.c	2004-02-18 05:36:31.000000000 -0800
++++ linux-2.4.26-pre4/fs/jbd/journal.c	2004-03-16 09:59:36.000000000 -0800
+@@ -671,6 +671,7 @@
+ 
+ 	bh = getblk(journal->j_dev, blocknr, journal->j_blocksize);
+ 	lock_buffer(bh);
++	memset(bh->b_data, 0, journal->j_blocksize);
+ 	BUFFER_TRACE(bh, "return this buffer");
+ 	return journal_add_journal_head(bh);
+ }
diff --git a/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0178.patch b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0178.patch
new file mode 100644
index 000000000000..19e57268c2fa
--- /dev/null
+++ b/sys-kernel/xfs-sources/files/xfs-sources.CAN-2004-0178.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.26-pre2/drivers/sound/sb_audio.c	2002-02-25 11:38:06.000000000 -0800
++++ linux-2.4.26-pre3/drivers/sound/sb_audio.c	2004-03-13 07:43:23.000000000 -0800
+@@ -879,7 +879,7 @@
+ 			c -= locallen; p += locallen;
+ 		}
+ 		/* used = ( samples * 16 bits size ) */
+-		*used = len << 1;
++		*used =  max_in  > ( max_out << 1) ? (max_out << 1) : max_in;
+ 		/* returned = ( samples * 8 bits size ) */
+ 		*returned = len;
+ 	}
diff --git a/sys-kernel/xfs-sources/xfs-sources-2.4.24-r5.ebuild b/sys-kernel/xfs-sources/xfs-sources-2.4.24-r5.ebuild
new file mode 100644
index 000000000000..8c0d33606c9d
--- /dev/null
+++ b/sys-kernel/xfs-sources/xfs-sources-2.4.24-r5.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xfs-sources/xfs-sources-2.4.24-r5.ebuild,v 1.1 2004/04/17 15:31:51 plasmaroo Exp $
+
+ETYPE="sources"
+
+inherit kernel eutils
+IUSE=""
+OKV="`echo ${PV}|sed -e 's:^\([0-9]\+\.[0-9]\+\.[0-9]\+\).*:\1:'`"
+EXTRAVERSION="-${PN/-*/}-${PR}"
+KV=${OKV}${EXTRAVERSION}
+
+S=${WORKDIR}/linux-${KV}
+
+# Documentation on the patches contained in this kernel will be installed
+# to /usr/share/doc/xfs-sources-${PV}/patches.txt.gz
+
+DESCRIPTION="Full sources for the XFS Specialized Gentoo Linux kernel"
+SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2
+	http://dev.gentoo.org/~scox/kernels/v2.4/xfs-sources-${PV}-r3.patch.bz2"
+
+KEYWORDS="x86 -ppc -sparc"
+SLOT="${KV}"
+
+src_unpack() {
+	unpack ${A}
+	mv linux-${OKV} linux-${KV} || die
+
+	cd linux-${KV}
+
+	bzcat ${DISTDIR}/xfs-sources-${PV}-r3.patch.bz2 | patch -p1 \
+		|| die "Failed to patch kernel"
+
+	cd ${S}
+	epatch ${FILESDIR}/${P}.munmap.patch || die "Failed to apply munmap!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!"
+
+	make mrproper || die "make mrproper failed"
+	kernel_universal_unpack
+}