Git-Url:
http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-0.8.git;a=commitdiff;h=56c56500bed2ca1b43b33978c3f49f47fca3d99b
commit 56c56500bed2ca1b43b33978c3f49f47fca3d99b
Author: Miklos Vajna <[EMAIL PROTECTED]>
Date: Wed Jun 18 16:20:55 2008 +0200
kernel-2.6.24-4kalgan3-i686
- update to patchlevel '.7'
- add CVE-2008-1673.patch
diff --git a/source/base/kernel/CVE-2008-1669.patch
b/source/base/kernel/CVE-2008-1669.patch
deleted file mode 100644
index 9939aa3..0000000
--- a/source/base/kernel/CVE-2008-1669.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-diff --git a/fs/locks.c b/fs/locks.c
-index 592faad..5c4a178 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -1749,6 +1749,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp,
unsigned int cmd,
- struct file_lock *file_lock = locks_alloc_lock();
- struct flock flock;
- struct inode *inode;
-+ struct file *f;
- int error;
-
- if (file_lock == NULL)
-@@ -1821,7 +1822,15 @@ again:
- * Attempt to detect a close/fcntl race and recover by
- * releasing the lock that was just acquired.
- */
-- if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
-+ /*
-+ * we need that spin_lock here - it prevents reordering between
-+ * update of inode->i_flock and check for it done in close().
-+ * rcu_read_lock() wouldn't do.
-+ */
-+ spin_lock(¤t->files->file_lock);
-+ f = fcheck(fd);
-+ spin_unlock(¤t->files->file_lock);
-+ if (!error && f != filp && flock.l_type != F_UNLCK) {
- flock.l_type = F_UNLCK;
- goto again;
- }
-@@ -1877,6 +1886,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp,
unsigned int cmd,
- struct file_lock *file_lock = locks_alloc_lock();
- struct flock64 flock;
- struct inode *inode;
-+ struct file *f;
- int error;
-
- if (file_lock == NULL)
-@@ -1949,7 +1959,10 @@ again:
- * Attempt to detect a close/fcntl race and recover by
- * releasing the lock that was just acquired.
- */
-- if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
-+ spin_lock(¤t->files->file_lock);
-+ f = fcheck(fd);
-+ spin_unlock(¤t->files->file_lock);
-+ if (!error && f != filp && flock.l_type != F_UNLCK) {
- flock.l_type = F_UNLCK;
- goto again;
- }
diff --git a/source/base/kernel/CVE-2008-1673.patch
b/source/base/kernel/CVE-2008-1673.patch
new file mode 100644
index 0000000..6a7d653
--- /dev/null
+++ b/source/base/kernel/CVE-2008-1673.patch
@@ -0,0 +1,107 @@
+From ddb2c43594f22843e9f3153da151deaba1a834c5 Mon Sep 17 00:00:00 2001
+From: Chris Wright <[EMAIL PROTECTED]>
+Date: Wed, 4 Jun 2008 09:16:33 -0700
+Subject: [PATCH] asn1: additional sanity checking during BER decoding
+
+- Don't trust a length which is greater than the working buffer.
+ An invalid length could cause overflow when calculating buffer size
+ for decoding oid.
+
+- An oid length of zero is invalid and allows for an off-by-one error when
+ decoding oid because the first subid actually encodes first 2 subids.
+
+- A primitive encoding may not have an indefinite length.
+
+Thanks to Wei Wang from McAfee for report.
+
+Cc: Steven French <[EMAIL PROTECTED]>
+Cc: [EMAIL PROTECTED]
+Acked-by: Patrick McHardy <[EMAIL PROTECTED]>
+Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
+Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
+---
+ fs/cifs/asn1.c | 14 ++++++++++++++
+ net/ipv4/netfilter/nf_nat_snmp_basic.c | 14 ++++++++++++++
+ 2 files changed, 28 insertions(+), 0 deletions(-)
+
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index cb52cbb..f58e41d 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int
*def, unsigned int *len)
+ }
+ }
+ }
++
++ /* don't trust len bigger than ctx buffer */
++ if (*len > ctx->end - ctx->pointer)
++ return 0;
++
+ return 1;
+ }
+
+@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
+ if (!asn1_length_decode(ctx, &def, &len))
+ return 0;
+
++ /* primitive shall be definite, indefinite shall be constructed */
++ if (*con == ASN1_PRI && !def)
++ return 0;
++
+ if (def)
+ *eoc = ctx->pointer + len;
+ else
+@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
+ unsigned long *optr;
+
+ size = eoc - ctx->pointer + 1;
++
++ /* first subid actually encodes first two subids */
++ if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++ return 0;
++
+ *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+ if (*oid == NULL)
+ return 0;
+diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c
b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+index 5daefad..7750c97 100644
+--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
++++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+@@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx
*ctx,
+ }
+ }
+ }
++
++ /* don't trust len bigger than ctx buffer */
++ if (*len > ctx->end - ctx->pointer)
++ return 0;
++
+ return 1;
+ }
+
+@@ -250,6 +255,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx
*ctx,
+ if (!asn1_length_decode(ctx, &def, &len))
+ return 0;
+
++ /* primitive shall be definite, indefinite shall be constructed */
++ if (*con == ASN1_PRI && !def)
++ return 0;
++
+ if (def)
+ *eoc = ctx->pointer + len;
+ else
+@@ -434,6 +443,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
+ unsigned long *optr;
+
+ size = eoc - ctx->pointer + 1;
++
++ /* first subid actually encodes first two subids */
++ if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++ return 0;
++
+ *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+ if (*oid == NULL) {
+ if (net_ratelimit())
+--
+1.5.5
+
diff --git a/source/base/kernel/FrugalBuild b/source/base/kernel/FrugalBuild
index 634c6a6..6cb76f6 100644
--- a/source/base/kernel/FrugalBuild
+++ b/source/base/kernel/FrugalBuild
@@ -1,7 +1,7 @@
# Compiling Time: 14.33 SBU
# Maintainer: VMiklos <[EMAIL PROTECTED]>
-_F_kernel_patches=(CVE-2008-1669.patch)
+_F_kernel_patches=(CVE-2008-1673.patch)
Finclude kernel
# you can safely bump this.
-pkgrel=4kalgan2
+pkgrel=4kalgan3
diff --git a/source/include/kernel-version.sh b/source/include/kernel-version.sh
index 7203f36..e808fff 100644
--- a/source/include/kernel-version.sh
+++ b/source/include/kernel-version.sh
@@ -18,4 +18,4 @@
# don't touch these two!
_F_kernelver_ver=2.6.24
_F_kernelver_rel=3
-_F_kernelver_stable=6
+_F_kernelver_stable=7
diff --git a/source/network/madwifi/FrugalBuild
b/source/network/madwifi/FrugalBuild
index 53b65bd..cbf09a9 100644
--- a/source/network/madwifi/FrugalBuild
+++ b/source/network/madwifi/FrugalBuild
@@ -3,7 +3,7 @@
pkgname=madwifi
pkgver=0.9.4
-pkgrel=2
+pkgrel=3kalgan1
pkgdesc="Madwifi drivers for Atheros wireless chipsets"
url="http://madwifi.sourceforge.net/";
Finclude kernel-module
_______________________________________________
Frugalware-git mailing list
[email protected]
http://frugalware.org/mailman/listinfo/frugalware-git
