Import of pkgsrc-2015Q3

sysutils/xentools45/patches/patch-XSA137

@@ -0,0 +1,175 @@
+$NetBSD: patch-XSA137,v 1.1 2015/08/23 17:02:58 spz Exp $
+
+patch for CVE-2015-3259 aka XSA-137 from:
+http://xenbits.xen.org/xsa/xsa137.patch
+
+--- libxl/xl_cmdimpl.c.orig	2015-06-22 13:41:35.000000000 +0000
++++ libxl/xl_cmdimpl.c
+@@ -151,7 +151,7 @@ struct domain_create {
+     int console_autoconnect;
+     int checkpointed_stream;
+     const char *config_file;
+-    const char *extra_config; /* extra config string */
++    char *extra_config; /* extra config string */
+     const char *restore_file;
+     int migrate_fd; /* -1 means none */
+     char **migration_domname_r; /* from malloc */
+@@ -4570,11 +4570,25 @@ int main_vm_list(int argc, char **argv)
+     return 0;
+ }
+ 
++static void string_realloc_append(char **accumulate, const char *more)
++{
++    /* Appends more to accumulate.  Accumulate is either NULL, or
++     * points (always) to a malloc'd nul-terminated string. */
++
++    size_t oldlen = *accumulate ? strlen(*accumulate) : 0;
++    size_t morelen = strlen(more) + 1/*nul*/;
++    if (oldlen > SSIZE_MAX || morelen > SSIZE_MAX - oldlen) {
++        fprintf(stderr,"Additional config data far too large\n");
++        exit(-ERROR_FAIL);
++    }
++
++    *accumulate = xrealloc(*accumulate, oldlen + morelen);
++    memcpy(*accumulate + oldlen, more, morelen);
++}
++
+ int main_create(int argc, char **argv)
+ {
+     const char *filename = NULL;
+-    char *p;
+-    char extra_config[1024];
+     struct domain_create dom_info;
+     int paused = 0, debug = 0, daemonize = 1, console_autoconnect = 0,
+         quiet = 0, monitor = 1, vnc = 0, vncautopass = 0;
+@@ -4589,6 +4603,8 @@ int main_create(int argc, char **argv)
+         {0, 0, 0, 0}
+     };
+ 
++    dom_info.extra_config = NULL;
++
+     if (argv[1] && argv[1][0] != '-' && !strchr(argv[1], '=')) {
+         filename = argv[1];
+         argc--; argv++;
+@@ -4628,20 +4644,21 @@ int main_create(int argc, char **argv)
+         break;
+     }
+ 
+-    extra_config[0] = '\0';
+-    for (p = extra_config; optind < argc; optind++) {
++    memset(&dom_info, 0, sizeof(dom_info));
++
++    for (; optind < argc; optind++) {
+         if (strchr(argv[optind], '=') != NULL) {
+-            p += snprintf(p, sizeof(extra_config) - (p - extra_config),
+-                "%s\n", argv[optind]);
++            string_realloc_append(&dom_info.extra_config, argv[optind]);
++            string_realloc_append(&dom_info.extra_config, "\n");
+         } else if (!filename) {
+             filename = argv[optind];
+         } else {
+             help("create");
++            free(dom_info.extra_config);
+             return 2;
+         }
+     }
+ 
+-    memset(&dom_info, 0, sizeof(dom_info));
+     dom_info.debug = debug;
+     dom_info.daemonize = daemonize;
+     dom_info.monitor = monitor;
+@@ -4649,16 +4666,18 @@ int main_create(int argc, char **argv)
+     dom_info.dryrun = dryrun_only;
+     dom_info.quiet = quiet;
+     dom_info.config_file = filename;
+-    dom_info.extra_config = extra_config;
+     dom_info.migrate_fd = -1;
+     dom_info.vnc = vnc;
+     dom_info.vncautopass = vncautopass;
+     dom_info.console_autoconnect = console_autoconnect;
+ 
+     rc = create_domain(&dom_info);
+-    if (rc < 0)
++    if (rc < 0) {
++        free(dom_info.extra_config);
+         return -rc;
++    }
+ 
++    free(dom_info.extra_config);
+     return 0;
+ }
+ 
+@@ -4666,8 +4685,7 @@ int main_config_update(int argc, char **
+ {
+     uint32_t domid;
+     const char *filename = NULL;
+-    char *p;
+-    char extra_config[1024];
++    char *extra_config = NULL;
+     void *config_data = 0;
+     int config_len = 0;
+     libxl_domain_config d_config;
+@@ -4705,15 +4723,15 @@ int main_config_update(int argc, char **
+         break;
+     }
+ 
+-    extra_config[0] = '\0';
+-    for (p = extra_config; optind < argc; optind++) {
++    for (; optind < argc; optind++) {
+         if (strchr(argv[optind], '=') != NULL) {
+-            p += snprintf(p, sizeof(extra_config) - (p - extra_config),
+-                "%s\n", argv[optind]);
++            string_realloc_append(&extra_config, argv[optind]);
++            string_realloc_append(&extra_config, "\n");
+         } else if (!filename) {
+             filename = argv[optind];
+         } else {
+             help("create");
++            free(extra_config);
+             return 2;
+         }
+     }
+@@ -4722,7 +4740,8 @@ int main_config_update(int argc, char **
+         rc = libxl_read_file_contents(ctx, filename,
+                                       &config_data, &config_len);
+         if (rc) { fprintf(stderr, "Failed to read config file: %s: %s\n",
+-                           filename, strerror(errno)); return ERROR_FAIL; }
++                           filename, strerror(errno));
++                  free(extra_config); return ERROR_FAIL; }
+         if (strlen(extra_config)) {
+             if (config_len > INT_MAX - (strlen(extra_config) + 2 + 1)) {
+                 fprintf(stderr, "Failed to attach extra configration\n");
+@@ -4763,7 +4782,7 @@ int main_config_update(int argc, char **
+     libxl_domain_config_dispose(&d_config);
+ 
+     free(config_data);
+-
++    free(extra_config);
+     return 0;
+ }
+ 
+@@ -7020,7 +7039,7 @@ int main_cpupoolcreate(int argc, char **
+ {
+     const char *filename = NULL, *config_src=NULL;
+     const char *p;
+-    char extra_config[1024];
++    char *extra_config = NULL;
+     int opt;
+     static struct option opts[] = {
+         {"defconfig", 1, 0, 'f'},
+@@ -7054,13 +7073,10 @@ int main_cpupoolcreate(int argc, char **
+         break;
+     }
+ 
+-    memset(extra_config, 0, sizeof(extra_config));
+     while (optind < argc) {
+         if ((p = strchr(argv[optind], '='))) {
+-            if (strlen(extra_config) + 1 + strlen(argv[optind]) < sizeof(extra_config)) {
+-                strcat(extra_config, "\n");
+-                strcat(extra_config, argv[optind]);
+-            }
++            string_realloc_append(&extra_config, "\n");
++            string_realloc_append(&extra_config, argv[optind]);
+         } else if (!filename) {
+             filename = argv[optind];
+         } else {