Merge remote-tracking branch 'origin/next' into install-raid

src/patches/dnsmasq-2.70-Add-support-to-read-ISC-DHCP-lease-file.patch

@@ -0,0 +1,365 @@
+diff --git a/Makefile b/Makefile
+index 292c8bd..5e0cdbe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -69,7 +69,7 @@ objs = cache.o rfc1035.o util.o option.o forward.o network.o \
+        dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
+        helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
+        dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \
+-       domain.o dnssec.o blockdata.o
++       domain.o dnssec.o blockdata.o isc.o
+ 
+ hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
+        dns-protocol.h radv-protocol.h ip6addr.h
+diff --git a/src/cache.c b/src/cache.c
+index 5cec918..1f5657f 100644
+--- a/src/cache.c
++++ b/src/cache.c
+@@ -17,7 +17,7 @@
+ #include "dnsmasq.h"
+ 
+ static struct crec *cache_head = NULL, *cache_tail = NULL, **hash_table = NULL;
+-#ifdef HAVE_DHCP
++#if (defined HAVE_DHCP) || (defined HAVE_ISC_READER)
+ static struct crec *dhcp_spare = NULL;
+ #endif
+ static struct crec *new_chain = NULL;
+@@ -222,6 +222,9 @@ static void cache_free(struct crec *crecp)
+       crecp->flags &= ~F_BIGNAME;
+     }
+ 
++  if (crecp->flags & F_DHCP)
++    free(crecp->name.namep);
++
+ #ifdef HAVE_DNSSEC
+   cache_blockdata_free(crecp);
+ #endif
+@@ -1110,7 +1113,7 @@ void cache_reload(void)
+       total_size = read_hostsfile(ah->fname, ah->index, total_size, (struct crec **)daemon->packet, revhashsz);
+ } 
+ 
+-#ifdef HAVE_DHCP
++#if (defined HAVE_DHCP) || (defined HAVE_ISC_READER)
+ struct in_addr a_record_from_hosts(char *name, time_t now)
+ {
+   struct crec *crecp = NULL;
+@@ -1188,7 +1191,7 @@ void cache_add_dhcp_entry(char *host_name, int prot,
+       addrlen = sizeof(struct in6_addr);
+     }
+ #endif
+-  
++
+   inet_ntop(prot, host_address, daemon->addrbuff, ADDRSTRLEN);
+   
+   while ((crec = cache_find_by_name(crec, host_name, 0, flags | F_CNAME)))
+@@ -1253,7 +1256,11 @@ void cache_add_dhcp_entry(char *host_name, int prot,
+       else
+ 	crec->ttd = ttd;
+       crec->addr.addr = *host_address;
++#ifdef HAVE_ISC_READER
++      crec->name.namep = strdup(host_name);
++#else
+       crec->name.namep = host_name;
++#endif
+       crec->uid = next_uid();
+       cache_hash(crec);
+ 
+diff --git a/src/dnsmasq.c b/src/dnsmasq.c
+index 1c96a0e..156ac9a 100644
+--- a/src/dnsmasq.c
++++ b/src/dnsmasq.c
+@@ -934,6 +934,11 @@ int main (int argc, char **argv)
+ 
+ 	  poll_resolv(0, daemon->last_resolv != 0, now); 	  
+ 	  daemon->last_resolv = now;
++
++#ifdef HAVE_ISC_READER
++	  if (daemon->lease_file && !daemon->dhcp)
++	    load_dhcp(now);
++#endif
+ 	}
+       
+       if (FD_ISSET(piperead, &rset))
+diff --git a/src/dnsmasq.h b/src/dnsmasq.h
+index 3032546..a40b2a9 100644
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -1447,3 +1447,8 @@ void slaac_add_addrs(struct dhcp_lease *lease, time_t now, int force);
+ time_t periodic_slaac(time_t now, struct dhcp_lease *leases);
+ void slaac_ping_reply(struct in6_addr *sender, unsigned char *packet, char *interface, struct dhcp_lease *leases);
+ #endif
++
++/* isc.c */
++#ifdef HAVE_ISC_READER
++void load_dhcp(time_t now);
++#endif
+diff --git a/src/isc.c b/src/isc.c
+new file mode 100644
+index 0000000..5106442
+--- /dev/null
++++ b/src/isc.c
+@@ -0,0 +1,251 @@
++/* dnsmasq is Copyright (c) 2014 John Volpe, Simon Kelley and
++     Michael Tremer
++
++  This program is free software; you can redistribute it and/or modify
++  it under the terms of the GNU General Public License as published by
++  the Free Software Foundation; version 2 dated June, 1991, or
++  (at your option) version 3 dated 29 June, 2007.
++
++  This program is distributed in the hope that it will be useful,
++  but WITHOUT ANY WARRANTY; without even the implied warranty of
++  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++  GNU General Public License for more details.
++  
++  You should have received a copy of the GNU General Public License
++  along with this program.  If not, see <http://www.gnu.org/licenses/>.
++
++  Code in this file is based on contributions by John Volpe and
++  Simon Kelley. Updated for recent versions of dnsmasq by
++  Michael Tremer.
++*/
++
++#include "dnsmasq.h"
++
++#ifdef HAVE_ISC_READER
++#define MAXTOK 50
++
++struct isc_dhcp_lease {
++	char* name;
++	char* fqdn;
++	time_t expires;
++	struct in_addr addr;
++	struct isc_dhcp_lease* next;
++};
++
++static struct isc_dhcp_lease* dhcp_lease_new(const char* hostname) {
++	struct isc_dhcp_lease* lease = whine_malloc(sizeof(*lease));
++
++	lease->name = strdup(hostname);
++	if (daemon->domain_suffix) {
++		asprintf(&lease->fqdn, "%s.%s", hostname, daemon->domain_suffix);
++	}
++	lease->expires = 0;
++	lease->next = NULL;
++
++	return lease;
++}
++
++static void dhcp_lease_free(struct isc_dhcp_lease* lease) {
++	if (!lease)
++		return;
++
++	if (lease->name)
++		free(lease->name);
++	if (lease->fqdn)
++		free(lease->fqdn);
++	free(lease);
++}
++
++static int next_token(char* token, int buffsize, FILE* fp) {
++	int c, count = 0;
++	char* cp = token;
++
++	while ((c = getc(fp)) != EOF) {
++		if (c == '#') {
++			do {
++				c = getc(fp);
++			} while (c != '\n' && c != EOF);
++		}
++
++		if (c == ' ' || c == '\t' || c == '\n' || c == ';') {
++			if (count)
++				break;
++		} else if ((c != '"') && (count < buffsize - 1)) {
++			*cp++ = c;
++			count++;
++		}
++	}
++
++	*cp = 0;
++	return count ? 1 : 0;
++}
++
++static long get_utc_offset() {
++	time_t t = time(NULL);
++	struct tm* time_struct = localtime(&t);
++
++	return time_struct->tm_gmtoff;
++}
++
++static time_t parse_lease_time(const char* token_date, const char* token_time) {
++	time_t time = (time_t)(-1);
++	struct tm lease_time;
++
++	if (sscanf(token_date, "%d/%d/%d", &lease_time.tm_year, &lease_time.tm_mon, &lease_time.tm_mday) == 3) {
++		lease_time.tm_year -= 1900;
++		lease_time.tm_mon -= 1;
++
++		if (sscanf(token_time, "%d:%d:%d", &lease_time.tm_hour, &lease_time.tm_min, &lease_time.tm_sec) == 3) {
++			time = mktime(&lease_time) + get_utc_offset();
++		}
++	}
++
++	return time;
++}
++
++static struct isc_dhcp_lease* find_lease(const char* hostname, struct isc_dhcp_lease* leases) {
++	struct isc_dhcp_lease* lease = leases;
++
++	while (lease) {
++		if (strcmp(hostname, lease->name) == 0) {
++			return lease;
++		}
++		lease = lease->next;
++	}
++
++	return NULL;
++}
++
++static off_t lease_file_size = (off_t)0;
++static ino_t lease_file_inode = (ino_t)0;
++
++void load_dhcp(time_t now) {
++	struct isc_dhcp_lease* leases = NULL;
++
++	struct stat statbuf;
++	if (stat(daemon->lease_file, &statbuf) == -1) {
++		return;
++	}
++
++	/* Do nothing if the lease file has not changed. */
++	if ((statbuf.st_size <= lease_file_size) && (statbuf.st_ino == lease_file_inode))
++		return;
++
++	lease_file_size = statbuf.st_size;
++	lease_file_inode = statbuf.st_ino;
++
++	FILE* fp = fopen(daemon->lease_file, "r");
++	if (!fp) {
++		my_syslog(LOG_ERR, _("failed to load %s:%s"), daemon->lease_file, strerror(errno));
++		return;
++	}
++
++	my_syslog(LOG_INFO, _("reading %s"), daemon->lease_file);
++
++	char* hostname = daemon->namebuff;
++	struct in_addr host_address;
++	time_t time_starts = -1;
++	time_t time_ends = -1;
++	int nomem;
++
++	char token[MAXTOK];
++	while ((next_token(token, MAXTOK, fp))) {
++		if (strcmp(token, "lease") == 0) {
++			hostname[0] = '\0';
++
++			if (next_token(token, MAXTOK, fp) && ((host_address.s_addr = inet_addr(token)) != (in_addr_t)-1)) {
++				if (next_token(token, MAXTOK, fp) && *token == '{') {
++					while (next_token(token, MAXTOK, fp) && *token != '}') {
++						if ((strcmp(token, "client-hostname") == 0) || (strcmp(token, "hostname") == 0)) {
++							if (next_token(hostname, MAXDNAME, fp)) {
++								if (!canonicalise(hostname, &nomem)) {
++									*hostname = 0;
++									my_syslog(LOG_ERR, _("bad name in %s"), daemon->lease_file);
++								}
++							}
++						} else if ((strcmp(token, "starts") == 0) || (strcmp(token, "ends") == 0)) {
++							char token_date[MAXTOK];
++							char token_time[MAXTOK];
++
++							int is_starts = strcmp(token, "starts") == 0;
++
++							// Throw away the weekday and parse the date.
++							if (next_token(token, MAXTOK, fp) && next_token(token_date, MAXTOK, fp) && next_token(token_time, MAXTOK, fp)) {
++								time_t time = parse_lease_time(token_date, token_time);
++
++								if (is_starts)
++									time_starts = time;
++								else
++									time_ends = time;
++							}
++						}
++					}
++
++					if (!*hostname)
++						continue;
++
++					if ((time_starts == -1) || (time_ends == -1))
++						continue;
++
++					if (difftime(now, time_ends) > 0)
++						continue;
++
++					char* dot = strchr(hostname, '.');
++					if (dot) {
++						if (!daemon->domain_suffix || hostname_isequal(dot + 1, daemon->domain_suffix)) {
++							my_syslog(LOG_WARNING,
++								_("Ignoring DHCP lease for %s because it has an illegal domain part"),
++								hostname);
++							continue;
++						}
++						*dot = 0;
++					}
++
++					// Search for an existing lease in the list
++					// with the given host name and update the data
++					// if needed.
++					struct isc_dhcp_lease* lease = find_lease(hostname, leases);
++
++					// If no lease already exists, we create a new one
++					// and append it to the list.
++					if (!lease) {
++						lease = dhcp_lease_new(hostname);
++
++						lease->next = leases;
++						leases = lease;
++					}
++
++					// Only update more recent leases.
++					if (lease->expires > time_ends)
++						continue;
++
++					lease->addr = host_address;
++					lease->expires = time_ends;
++				}
++			}
++		}
++	}
++
++	fclose(fp);
++
++	// Drop all entries.
++	cache_unhash_dhcp();
++
++	while (leases) {
++		struct isc_dhcp_lease *lease = leases;
++		leases = lease->next;
++
++		if (lease->fqdn) {
++			cache_add_dhcp_entry(lease->fqdn, AF_INET, (struct all_addr*)&lease->addr.s_addr, lease->expires);
++		}
++
++		if (lease->name) {
++			cache_add_dhcp_entry(lease->name, AF_INET, (struct all_addr*)&lease->addr.s_addr, lease->expires);
++		}
++
++		// Cleanup
++		dhcp_lease_free(lease);
++	}
++}
++
++#endif
+diff --git a/src/option.c b/src/option.c
+index daa728f..d16c982 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -1642,7 +1642,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+ 	ret_err(_("bad MX target"));
+       break;
+ 
+-#ifdef HAVE_DHCP      
++#if (defined HAVE_DHCP) || (defined HAVE_ISC_READER)
+     case 'l':  /* --dhcp-leasefile */
+       daemon->lease_file = opt_string_alloc(arg);
+       break;

src/patches/dnsmasq-2.71-support-nettle-3.0.patch

@@ -0,0 +1,65 @@
+From cdb755c5f16a6768c3e8b1f345fe15fc9244228d Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 18 Jun 2014 20:52:53 +0100
+Subject: [PATCH] Fix FTBFS with Nettle-3.0.
+
+---
+ CHANGELOG    |    3 +++
+ src/dnssec.c |   18 ++++++++++++------
+ 2 files changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/src/dnssec.c b/src/dnssec.c
+index 2ffb75d..69bfc29 100644
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -28,6 +28,12 @@
+ #include <nettle/nettle-meta.h>
+ #include <nettle/bignum.h>
+ 
++/* Nettle-3.0 moved to a new API for DSA. We use a name that's defined in the new API
++   to detect Nettle-3, and invoke the backwards compatibility mode. */
++#ifdef dsa_params_init
++#include <nettle/dsa-compat.h>
++#endif
++
+ 
+ #define SERIAL_UNDEF  -100
+ #define SERIAL_EQ        0
+@@ -121,8 +127,8 @@ static int hash_init(const struct nettle_hash *hash, void **ctxp, unsigned char
+   return 1;
+ }
+   
+-static int rsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
+-		      unsigned char *digest, int algo)
++static int dnsmasq_rsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
++			      unsigned char *digest, int algo)
+ {
+   unsigned char *p;
+   size_t exp_len;
+@@ -173,8 +179,8 @@ static int rsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned
+   return 0;
+ }  
+ 
+-static int dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
+-		      unsigned char *digest, int algo)
++static int dnsmasq_dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
++			      unsigned char *digest, int algo)
+ {
+   unsigned char *p;
+   unsigned int t;
+@@ -293,10 +299,10 @@ static int verify(struct blockdata *key_data, unsigned int key_len, unsigned cha
+   switch (algo)
+     {
+     case 1: case 5: case 7: case 8: case 10:
+-      return rsa_verify(key_data, key_len, sig, sig_len, digest, algo);
++      return dnsmasq_rsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+       
+     case 3: case 6: 
+-      return dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
++      return dnsmasq_dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+  
+ #ifndef NO_NETTLE_ECC   
+     case 13: case 14:
+-- 
+1.7.10.4
+

src/patches/dnsmasq-2.71-use-nettle-with-minigmp.patch

@@ -0,0 +1,88 @@
+From 063efb330a3f341c2548e2cf1f67f83e49cd6395 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Tue, 17 Jun 2014 19:49:31 +0100
+Subject: [PATCH] Build config: add -DNO_GMP for use with nettle/mini-gmp
+
+---
+ Makefile        |    2 +-
+ bld/pkg-wrapper |    9 +++++++--
+ src/config.h    |    7 +++++++
+ src/dnssec.c    |    3 ++-
+ 4 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index c58b50b..17eeb27 100644
+--- a/Makefile
++++ b/Makefile
+@@ -61,7 +61,7 @@ lua_cflags =    `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CON
+ lua_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_LUASCRIPT $(PKG_CONFIG) --libs lua5.1` 
+ nettle_cflags = `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --cflags nettle hogweed`
+ nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --libs nettle hogweed`
+-gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG) --copy -lgmp`
++gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
+ sunos_libs =    `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi`
+ version =     -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
+ 
+diff --git a/bld/pkg-wrapper b/bld/pkg-wrapper
+index 9f9332d..0ddb678 100755
+--- a/bld/pkg-wrapper
++++ b/bld/pkg-wrapper
+@@ -11,9 +11,14 @@ in=`cat`
+ 
+ if grep "^\#[[:space:]]*define[[:space:]]*$search" config.h >/dev/null 2>&1 || \
+     echo $in | grep $search >/dev/null 2>&1; then
+-
++# Nasty, nasty, in --copy, arg 2 is another config to search for, use with NO_GMP
+     if [ $op = "--copy" ]; then
+-	pkg="$*"
++	if grep "^\#[[:space:]]*define[[:space:]]*$pkg" config.h >/dev/null 2>&1 || \
++            echo $in | grep $pkg >/dev/null 2>&1; then
++	    pkg=""
++	else 
++	    pkg="$*"
++	fi
+     elif grep "^\#[[:space:]]*define[[:space:]]*${search}_STATIC" config.h >/dev/null 2>&1 || \
+ 	      echo $in | grep ${search}_STATIC >/dev/null 2>&1; then
+ 	pkg=`$pkg  --static $op $*`
+diff --git a/src/config.h b/src/config.h
+index 2155544..ee6d218 100644
+--- a/src/config.h
++++ b/src/config.h
+@@ -105,6 +105,8 @@ HAVE_AUTH
+    define this to include the facility to act as an authoritative DNS
+    server for one or more zones.
+ 
++HAVE_DNSSEC
++   include DNSSEC validator.
+ 
+ NO_IPV6
+ NO_TFTP
+@@ -118,6 +120,11 @@ NO_AUTH
+    which are enabled  by default in the distributed source tree. Building dnsmasq
+    with something like "make COPTS=-DNO_SCRIPT" will do the trick.
+ 
++NO_NETTLE_ECC
++   Don't include the ECDSA cypher in DNSSEC validation. Needed for older Nettle versions.
++NO_GMP
++   Don't use and link against libgmp, Useful if nettle is built with --enable-mini-gmp.
++
+ LEASEFILE
+ CONFFILE
+ RESOLVFILE
+diff --git a/src/dnssec.c b/src/dnssec.c
+index 44d626b..2ffb75d 100644
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -26,7 +26,8 @@
+ #  include <nettle/ecc-curve.h>
+ #endif
+ #include <nettle/nettle-meta.h>
+-#include <gmp.h>
++#include <nettle/bignum.h>
++
+ 
+ #define SERIAL_UNDEF  -100
+ #define SERIAL_EQ        0
+-- 
+1.7.10.4
+

src/patches/lzo-2.06-CVE-2014-4607.patch

@@ -0,0 +1,245 @@
+diff --git a/minilzo/minilzo.c b/minilzo/minilzo.c
+index 34ce0f0..ecfdf66 100644
+--- a/minilzo/minilzo.c
++++ b/minilzo/minilzo.c
+@@ -3547,6 +3547,8 @@ DO_COMPRESS      ( const lzo_bytep in , lzo_uint  in_len,
+ #undef TEST_LBO
+ #undef NEED_IP
+ #undef NEED_OP
++#undef TEST_IV
++#undef TEST_OV
+ #undef HAVE_TEST_IP
+ #undef HAVE_TEST_OP
+ #undef HAVE_NEED_IP
+@@ -3561,6 +3563,7 @@ DO_COMPRESS      ( const lzo_bytep in , lzo_uint  in_len,
+ #  if (LZO_TEST_OVERRUN_INPUT >= 2)
+ #    define NEED_IP(x) \
+             if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x))  goto input_overrun
++#    define TEST_IV(x)          if ((x) > (lzo_uint)0 - (511)) goto input_overrun
+ #  endif
+ #endif
+ 
+@@ -3572,6 +3575,7 @@ DO_COMPRESS      ( const lzo_bytep in , lzo_uint  in_len,
+ #    undef TEST_OP
+ #    define NEED_OP(x) \
+             if ((lzo_uint)(op_end - op) < (lzo_uint)(x))  goto output_overrun
++#    define TEST_OV(x)          if ((x) > (lzo_uint)0 - (511)) goto output_overrun
+ #  endif
+ #endif
+ 
+@@ -3602,11 +3606,13 @@ DO_COMPRESS      ( const lzo_bytep in , lzo_uint  in_len,
+ #  define HAVE_NEED_IP 1
+ #else
+ #  define NEED_IP(x)            ((void) 0)
++#  define TEST_IV(x)            ((void) 0)
+ #endif
+ #if defined(NEED_OP)
+ #  define HAVE_NEED_OP 1
+ #else
+ #  define NEED_OP(x)            ((void) 0)
++#  define TEST_OV(x)            ((void) 0)
+ #endif
+ 
+ #if defined(HAVE_TEST_IP) || defined(HAVE_NEED_IP)
+@@ -3687,6 +3693,7 @@ DO_DECOMPRESS  ( const lzo_bytep in , lzo_uint  in_len,
+             {
+                 t += 255;
+                 ip++;
++                TEST_IV(t);
+                 NEED_IP(1);
+             }
+             t += 15 + *ip++;
+@@ -3835,6 +3842,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 31 + *ip++;
+@@ -3879,6 +3887,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 7 + *ip++;
+@@ -4073,6 +4082,8 @@ lookbehind_overrun:
+ #undef TEST_LBO
+ #undef NEED_IP
+ #undef NEED_OP
++#undef TEST_IV
++#undef TEST_OV
+ #undef HAVE_TEST_IP
+ #undef HAVE_TEST_OP
+ #undef HAVE_NEED_IP
+@@ -4087,6 +4098,7 @@ lookbehind_overrun:
+ #  if (LZO_TEST_OVERRUN_INPUT >= 2)
+ #    define NEED_IP(x) \
+             if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x))  goto input_overrun
++#    define TEST_IV(x)          if ((x) > (lzo_uint)0 - (511)) goto input_overrun
+ #  endif
+ #endif
+ 
+@@ -4098,6 +4110,7 @@ lookbehind_overrun:
+ #    undef TEST_OP
+ #    define NEED_OP(x) \
+             if ((lzo_uint)(op_end - op) < (lzo_uint)(x))  goto output_overrun
++#    define TEST_OV(x)          if ((x) > (lzo_uint)0 - (511)) goto output_overrun
+ #  endif
+ #endif
+ 
+@@ -4128,11 +4141,13 @@ lookbehind_overrun:
+ #  define HAVE_NEED_IP 1
+ #else
+ #  define NEED_IP(x)            ((void) 0)
++#  define TEST_IV(x)            ((void) 0)
+ #endif
+ #if defined(NEED_OP)
+ #  define HAVE_NEED_OP 1
+ #else
+ #  define NEED_OP(x)            ((void) 0)
++#  define TEST_OV(x)            ((void) 0)
+ #endif
+ 
+ #if defined(HAVE_TEST_IP) || defined(HAVE_NEED_IP)
+@@ -4213,6 +4228,7 @@ DO_DECOMPRESS  ( const lzo_bytep in , lzo_uint  in_len,
+             {
+                 t += 255;
+                 ip++;
++                TEST_IV(t);
+                 NEED_IP(1);
+             }
+             t += 15 + *ip++;
+@@ -4361,6 +4377,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 31 + *ip++;
+@@ -4405,6 +4422,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 7 + *ip++;
+diff --git a/src/lzo1_d.ch b/src/lzo1_d.ch
+index 40a5bfd..c442d9c 100644
+--- a/src/lzo1_d.ch
++++ b/src/lzo1_d.ch
+@@ -76,6 +76,8 @@
+ #undef TEST_LBO
+ #undef NEED_IP
+ #undef NEED_OP
++#undef TEST_IV
++#undef TEST_OV
+ #undef HAVE_TEST_IP
+ #undef HAVE_TEST_OP
+ #undef HAVE_NEED_IP
+@@ -91,6 +93,7 @@
+ #  if (LZO_TEST_OVERRUN_INPUT >= 2)
+ #    define NEED_IP(x) \
+             if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x))  goto input_overrun
++#    define TEST_IV(x)          if ((x) > (lzo_uint)0 - (511)) goto input_overrun
+ #  endif
+ #endif
+ 
+@@ -102,6 +105,7 @@
+ #    undef TEST_OP              /* don't need both of the tests here */
+ #    define NEED_OP(x) \
+             if ((lzo_uint)(op_end - op) < (lzo_uint)(x))  goto output_overrun
++#    define TEST_OV(x)          if ((x) > (lzo_uint)0 - (511)) goto output_overrun
+ #  endif
+ #endif
+ 
+@@ -135,11 +139,13 @@
+ #  define HAVE_NEED_IP 1
+ #else
+ #  define NEED_IP(x)            ((void) 0)
++#  define TEST_IV(x)            ((void) 0)
+ #endif
+ #if defined(NEED_OP)
+ #  define HAVE_NEED_OP 1
+ #else
+ #  define NEED_OP(x)            ((void) 0)
++#  define TEST_OV(x)            ((void) 0)
+ #endif
+ 
+ 
+diff --git a/src/lzo1b_d.ch b/src/lzo1b_d.ch
+index fe5f361..36b4b6b 100644
+--- a/src/lzo1b_d.ch
++++ b/src/lzo1b_d.ch
+@@ -187,6 +187,7 @@ match:
+                 {
+                     t += 255;
+                     ip++;
++                    TEST_OV(t);
+                     NEED_IP(1);
+                 }
+                 t += (M4_MIN_LEN - M3_MIN_LEN) + *ip++;
+diff --git a/src/lzo1f_d.ch b/src/lzo1f_d.ch
+index 9e942f5..0c2199e 100644
+--- a/src/lzo1f_d.ch
++++ b/src/lzo1f_d.ch
+@@ -84,6 +84,7 @@ DO_DECOMPRESS  ( const lzo_bytep in , lzo_uint  in_len,
+             {
+                 t += 255;
+                 ip++;
++                TEST_IV(t);
+                 NEED_IP(1);
+             }
+             t += 31 + *ip++;
+@@ -138,6 +139,7 @@ match:
+                         {
+                             t += 255;
+                             ip++;
++                            TEST_OV(t);
+                             NEED_IP(1);
+                         }
+                         t += 31 + *ip++;
+diff --git a/src/lzo1x_d.ch b/src/lzo1x_d.ch
+index 49cf326..c804cc7 100644
+--- a/src/lzo1x_d.ch
++++ b/src/lzo1x_d.ch
+@@ -120,6 +120,7 @@ DO_DECOMPRESS  ( const lzo_bytep in , lzo_uint  in_len,
+             {
+                 t += 255;
+                 ip++;
++                TEST_IV(t);
+                 NEED_IP(1);
+             }
+             t += 15 + *ip++;
+@@ -273,6 +274,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 31 + *ip++;
+@@ -317,6 +319,7 @@ match:
+                     {
+                         t += 255;
+                         ip++;
++                        TEST_OV(t);
+                         NEED_IP(1);
+                     }
+                     t += 7 + *ip++;
+diff --git a/src/lzo2a_d.ch b/src/lzo2a_d.ch
+index 48e51ca..954f07e 100644
+--- a/src/lzo2a_d.ch
++++ b/src/lzo2a_d.ch
+@@ -131,6 +131,7 @@ DO_DECOMPRESS    ( const lzo_bytep in , lzo_uint  in_len,
+             {
+                 t += 255;
+                 ip++;
++                TEST_OV(t);
+                 NEED_IP(1);
+             }
+             t += *ip++;

src/patches/mitkrb-1.12.1-db2_fix-1.patch

@@ -0,0 +1,175 @@
+Submitted By:            Pierre Labastie <pierre dot labastie at eamil dot fr>
+Date:                    2014-03-04
+Initial Package Version: 1.12.1
+Upstream Status:         In upstream GIT
+Origin:                  Upstream
+Description:             Fixes http://krbdev.mit.edu/rt/Ticket/Display.html?id=7860
+
+--- a/src/plugins/kdb/db2/libdb2/mpool/mpool.c
++++ b/src/plugins/kdb/db2/libdb2/mpool/mpool.c
+@@ -81,9 +81,9 @@ mpool_open(key, fd, pagesize, maxcache)
+ 	/* Allocate and initialize the MPOOL cookie. */
+ 	if ((mp = (MPOOL *)calloc(1, sizeof(MPOOL))) == NULL)
+ 		return (NULL);
+-	CIRCLEQ_INIT(&mp->lqh);
++	TAILQ_INIT(&mp->lqh);
+ 	for (entry = 0; entry < HASHSIZE; ++entry)
+-		CIRCLEQ_INIT(&mp->hqh[entry]);
++		TAILQ_INIT(&mp->hqh[entry]);
+ 	mp->maxcache = maxcache;
+ 	mp->npages = sb.st_size / pagesize;
+ 	mp->pagesize = pagesize;
+@@ -143,8 +143,8 @@ mpool_new(mp, pgnoaddr, flags)
+ 	bp->flags = MPOOL_PINNED | MPOOL_INUSE;
+ 
+ 	head = &mp->hqh[HASHKEY(bp->pgno)];
+-	CIRCLEQ_INSERT_HEAD(head, bp, hq);
+-	CIRCLEQ_INSERT_TAIL(&mp->lqh, bp, q);
++	TAILQ_INSERT_HEAD(head, bp, hq);
++	TAILQ_INSERT_TAIL(&mp->lqh, bp, q);
+ 	return (bp->page);
+ }
+ 
+@@ -168,8 +168,8 @@ mpool_delete(mp, page)
+ 
+ 	/* Remove from the hash and lru queues. */
+ 	head = &mp->hqh[HASHKEY(bp->pgno)];
+-	CIRCLEQ_REMOVE(head, bp, hq);
+-	CIRCLEQ_REMOVE(&mp->lqh, bp, q);
++	TAILQ_REMOVE(head, bp, hq);
++	TAILQ_REMOVE(&mp->lqh, bp, q);
+ 
+ 	free(bp);
+ 	return (RET_SUCCESS);
+@@ -208,10 +208,10 @@ mpool_get(mp, pgno, flags)
+ 		 * of the lru chain.
+ 		 */
+ 		head = &mp->hqh[HASHKEY(bp->pgno)];
+-		CIRCLEQ_REMOVE(head, bp, hq);
+-		CIRCLEQ_INSERT_HEAD(head, bp, hq);
+-		CIRCLEQ_REMOVE(&mp->lqh, bp, q);
+-		CIRCLEQ_INSERT_TAIL(&mp->lqh, bp, q);
++		TAILQ_REMOVE(head, bp, hq);
++		TAILQ_INSERT_HEAD(head, bp, hq);
++		TAILQ_REMOVE(&mp->lqh, bp, q);
++		TAILQ_INSERT_TAIL(&mp->lqh, bp, q);
+ 
+ 		/* Return a pinned page. */
+ 		bp->flags |= MPOOL_PINNED;
+@@ -261,8 +261,8 @@ mpool_get(mp, pgno, flags)
+ 	 * of the lru chain.
+ 	 */
+ 	head = &mp->hqh[HASHKEY(bp->pgno)];
+-	CIRCLEQ_INSERT_HEAD(head, bp, hq);
+-	CIRCLEQ_INSERT_TAIL(&mp->lqh, bp, q);
++	TAILQ_INSERT_HEAD(head, bp, hq);
++	TAILQ_INSERT_TAIL(&mp->lqh, bp, q);
+ 
+ 	/* Run through the user's filter. */
+ 	if (mp->pgin != NULL)
+@@ -311,8 +311,8 @@ mpool_close(mp)
+ 	BKT *bp;
+ 
+ 	/* Free up any space allocated to the lru pages. */
+-	while ((bp = mp->lqh.cqh_first) != (void *)&mp->lqh) {
+-		CIRCLEQ_REMOVE(&mp->lqh, mp->lqh.cqh_first, q);
++	while ((bp = mp->lqh.tqh_first) != NULL) {
++		TAILQ_REMOVE(&mp->lqh, mp->lqh.tqh_first, q);
+ 		free(bp);
+ 	}
+ 
+@@ -332,8 +332,7 @@ mpool_sync(mp)
+ 	BKT *bp;
+ 
+ 	/* Walk the lru chain, flushing any dirty pages to disk. */
+-	for (bp = mp->lqh.cqh_first;
+-	    bp != (void *)&mp->lqh; bp = bp->q.cqe_next)
++	for (bp = mp->lqh.tqh_first; bp != NULL; bp = bp->q.tqe_next)
+ 		if (bp->flags & MPOOL_DIRTY &&
+ 		    mpool_write(mp, bp) == RET_ERROR)
+ 			return (RET_ERROR);
+@@ -363,8 +362,7 @@ mpool_bkt(mp)
+ 	 * off any lists.  If we don't find anything we grow the cache anyway.
+ 	 * The cache never shrinks.
+ 	 */
+-	for (bp = mp->lqh.cqh_first;
+-	    bp != (void *)&mp->lqh; bp = bp->q.cqe_next)
++	for (bp = mp->lqh.tqh_first; bp != NULL; bp = bp->q.tqe_next)
+ 		if (!(bp->flags & MPOOL_PINNED)) {
+ 			/* Flush if dirty. */
+ 			if (bp->flags & MPOOL_DIRTY &&
+@@ -375,8 +373,8 @@ mpool_bkt(mp)
+ #endif
+ 			/* Remove from the hash and lru queues. */
+ 			head = &mp->hqh[HASHKEY(bp->pgno)];
+-			CIRCLEQ_REMOVE(head, bp, hq);
+-			CIRCLEQ_REMOVE(&mp->lqh, bp, q);
++			TAILQ_REMOVE(head, bp, hq);
++			TAILQ_REMOVE(&mp->lqh, bp, q);
+ #if defined(DEBUG) && !defined(DEBUG_IDX0SPLIT)
+ 			{ void *spage;
+ 				spage = bp->page;
+@@ -450,7 +448,7 @@ mpool_look(mp, pgno)
+ 	BKT *bp;
+ 
+ 	head = &mp->hqh[HASHKEY(pgno)];
+-	for (bp = head->cqh_first; bp != (void *)head; bp = bp->hq.cqe_next)
++	for (bp = head->tqh_first; bp != NULL; bp = bp->hq.tqe_next)
+ 		if ((bp->pgno == pgno) && (bp->flags & MPOOL_INUSE)) {
+ #ifdef STATISTICS
+ 			++mp->cachehit;
+@@ -494,8 +492,7 @@ mpool_stat(mp)
+ 
+ 	sep = "";
+ 	cnt = 0;
+-	for (bp = mp->lqh.cqh_first;
+-	    bp != (void *)&mp->lqh; bp = bp->q.cqe_next) {
++	for (bp = mp->lqh.tqh_first; bp != NULL; bp = bp->q.tqe_next) {
+ 		(void)fprintf(stderr, "%s%d", sep, bp->pgno);
+ 		if (bp->flags & MPOOL_DIRTY)
+ 			(void)fprintf(stderr, "d");
+
+--- a/src/plugins/kdb/db2/libdb2/mpool/mpool.h
++++ b/src/plugins/kdb/db2/libdb2/mpool/mpool.h
+@@ -47,8 +47,8 @@
+ 
+ /* The BKT structures are the elements of the queues. */
+ typedef struct _bkt {
+-	CIRCLEQ_ENTRY(_bkt) hq;		/* hash queue */
+-	CIRCLEQ_ENTRY(_bkt) q;		/* lru queue */
++	TAILQ_ENTRY(_bkt) hq;		/* hash queue */
++	TAILQ_ENTRY(_bkt) q;		/* lru queue */
+ 	void    *page;			/* page */
+ 	db_pgno_t   pgno;			/* page number */
+ 
+@@ -59,9 +59,9 @@ typedef struct _bkt {
+ } BKT;
+ 
+ typedef struct MPOOL {
+-	CIRCLEQ_HEAD(_lqh, _bkt) lqh;	/* lru queue head */
++	TAILQ_HEAD(_lqh, _bkt) lqh;	/* lru queue head */
+ 					/* hash queue array */
+-	CIRCLEQ_HEAD(_hqh, _bkt) hqh[HASHSIZE];
++	TAILQ_HEAD(_hqh, _bkt) hqh[HASHSIZE];
+ 	db_pgno_t	curcache;		/* current number of cached pages */
+ 	db_pgno_t	maxcache;		/* max number of cached pages */
+ 	db_pgno_t	npages;			/* number of pages in the file */
+
+--- a/src/plugins/kdb/db2/libdb2/test/run.test
++++ b/src/plugins/kdb/db2/libdb2/test/run.test
+@@ -71,10 +71,11 @@ main()
+ }
+ 
+ getnwords() {
+-	# Delete blank lines because the db code appears not to
+-	# like empty keys.  On Debian Linux, $DICT appears to contain
+-	# some non-ASCII characters, and "rev" chokes on them.
+-	sed -e '/^$/d' < $DICT | cat -v | sed -e ${1}q
++	# Delete blank lines because the db code appears not to like
++	# empty keys.  Omit lines with non-alphanumeric characters to
++	# avoid shell metacharacters and non-ASCII characters which
++	# could cause 'rev' to choke.
++	LC_ALL=C sed -e '/^$/d' -e '/[^A-Za-z]/d' < $DICT | sed -e ${1}q
+ }
+ 
+ # Take the first hundred entries in the dictionary, and make them