10.3/releng-p6.diff

Index: UPDATING
===================================================================
--- UPDATING	(版本 301301)
+++ UPDATING	(版本 303304)
@@ -16,6 +16,14 @@
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20160725	p6	FreeBSD-SA-16:25.bspatch
+			FreeBSD-EN-16:09.freebsd-update
+
+	Fix bspatch heap overflow vulnerability. [SA-16:25]
+
+	Fix freebsd-update(8) support of FreeBSD 11.0 release
+	distribution. [EN-16:09]
+
 20160604	p5	FreeBSD-SA-16:24.ntp
 
 	Fix multiple vulnerabilities of ntp.
Index: sys/conf/newvers.sh
===================================================================
--- sys/conf/newvers.sh	(版本 301301)
+++ sys/conf/newvers.sh	(版本 303304)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.3"
-BRANCH="RELEASE-p5"
+BRANCH="RELEASE-p6"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
Index: usr.bin/bsdiff/bspatch/bspatch.c
===================================================================
--- usr.bin/bsdiff/bspatch/bspatch.c	(版本 301301)
+++ usr.bin/bsdiff/bspatch/bspatch.c	(版本 303304)
@@ -155,6 +155,10 @@
 		};
 
 		/* Sanity-check */
+		if ((ctrl[0] < 0) || (ctrl[1] < 0))
+			errx(1,"Corrupt patch\n");
+
+		/* Sanity-check */
 		if(newpos+ctrl[0]>newsize)
 			errx(1,"Corrupt patch\n");
 
Index: usr.sbin/freebsd-update/freebsd-update.sh
===================================================================
--- usr.sbin/freebsd-update/freebsd-update.sh	(版本 301301)
+++ usr.sbin/freebsd-update/freebsd-update.sh	(版本 303304)
@@ -1250,7 +1250,7 @@
 
 	# Check that the first four fields make sense.
 	if gunzip -c < files/$1.gz |
-	    grep -qvE "^[a-z]+\|[0-9a-z]+\|${P}+\|[fdL-]\|"; then
+	    grep -qvE "^[a-z]+\|[0-9a-z-]+\|${P}+\|[fdL-]\|"; then
 		fetch_metadata_bogus ""
 		return 1
 	fi