 @@ -1,14 +1,14 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.25 2010/07/22 03:19:02 christos Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.25.14.1 2017/08/19 04:13:51 snj Exp $	*/
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
  * Copyright (c) 1994 Adam Glass
  * Copyright (c) 1993, 1994 Christopher G. Demetriou
  * All rights reserved.
+ *
  * originally from kern/exec_ecoff.c
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -25,27 +25,27 @@
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.25 2010/07/22 03:19:02 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.25.14.1 2017/08/19 04:13:51 snj Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/proc.h>
 #include <sys/malloc.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
 #include <sys/mount.h>
 #include <sys/exec.h>
 #include <sys/exec_coff.h>
 #include <sys/resourcevar.h>
 @@ -444,38 +444,44 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 			 sh.s_size, sh.s_scnptr)); */
 		error = vn_rdwr(UIO_READ, epp->ep_vp, tbuf,
 				len, sh.s_scnptr,
 				UIO_SYSSPACE, IO_NODELOCKED, l->l_cred,
 				&resid, NULL);
 		if (error) {
 			DPRINTF(("shlib section read error %d\n", error));
 			free(tbuf, M_TEMP);
 			return ENOEXEC;
+		}
 		bufp = tbuf;
 		while (len) {
 			if (len < sizeof(struct coff_slhdr)) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
+			}
 			slhdr = (struct coff_slhdr *)bufp;
 			if (slhdr->path_index > LONG_MAX / sizeof(long) ||
 			    slhdr->entry_len > LONG_MAX / sizeof(long)) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
+			}
 			path_index = slhdr->path_index * sizeof(long);
 			entry_len = slhdr->entry_len * sizeof(long);
-			if (entry_len > len) {
+			if (entry_len < sizeof(struct coff_slhdr) ||
 			    entry_len > len ||
 			    strnlen(slhdr->sl_name, entry_len) == entry_len) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
+			}
 			/* DPRINTF(("path_index: %d entry_len: %d name: %s\n",
 				 path_index, entry_len, slhdr->sl_name)); */
 			error = coff_load_shlib(l, slhdr->sl_name, epp);
 			if (error) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
+			}
 			bufp += entry_len;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $	*/
+/*	$NetBSD: ibcs2_ioctl.c,v 1.45.36.1 2017/08/19 04:13:51 snj Exp $	*/
 /*
  * Copyright (c) 1994, 1995 Scott Bartram
  * All rights reserved.
+ *
  * based on compat/sunos/sun_ioctl.c
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. The name of the author may not be used to endorse or promote products
 @@ -17,27 +17,27 @@
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.36.1 2017/08/19 04:13:51 snj Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/namei.h>
 #include <sys/dirent.h>
 #include <sys/proc.h>
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/filedesc.h>
 #include <sys/ioctl.h>
 #include <sys/kernel.h>
 #include <sys/mbuf.h>
 #include <sys/mman.h>
 @@ -392,28 +392,30 @@ ibcs2_sys_ioctl(struct lwp *l, const str
 		error = EBADF;
 		goto out;
+	}
 	ctl = fp->f_ops->fo_ioctl;
 	switch ((unsigned long)SCARG(uap, cmd)) {
 	case IBCS2_TCGETA:
 	case IBCS2_XCGETA:
 	case IBCS2_OXCGETA:
 		if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
 			goto out;
 		memset(&sts, 0, sizeof(sts));
 		btios2stios(&bts, &sts);
 		if (SCARG(uap, cmd) == IBCS2_TCGETA) {
 			memset(&st, 0, sizeof(st));
 			stios2stio(&sts, &st);
 			error = copyout(&st, SCARG(uap, data), sizeof(st));
 			if (error)
 				DPRINTF(("ibcs2_ioctl(%d): copyout failed ",
 				     p->p_pid));
 		} else
 			error = copyout(&sts, SCARG(uap, data), sizeof(sts));
 		break;
 	case IBCS2_TCSETA:
 	case IBCS2_TCSETAW:
 	case IBCS2_TCSETAF:
 		if ((error = copyin(SCARG(uap, data), &st, sizeof(st))) != 0) {
 @@ -549,23 +551,24 @@ ibcs2_sys_gtty(struct lwp *l, const stru
+	}
 	if ((fp->f_flag & (FREAD|FWRITE)) == 0) {
 		DPRINTF(("ibcs2_sys_gtty(%d): bad fp flag ", curproc->p_pid));
 		error = EBADF;
 		goto out;
+	}
 	error = (*fp->f_ops->fo_ioctl)(fp, TIOCGETP, (void *)&tb);
 	if (error)
 		goto out;
 	fd_putfile(SCARG(uap, fd));
 	memset(&itb, 0, sizeof(itb));
 	itb.sg_ispeed = tb.sg_ispeed;
 	itb.sg_ospeed = tb.sg_ospeed;
 	itb.sg_erase = tb.sg_erase;
 	itb.sg_kill = tb.sg_kill;
 	itb.sg_flags = tb.sg_flags & ~(IBCS2_GHUPCL|IBCS2_GXTABS);
 	return copyout((void *)&itb, SCARG(uap, tb), sizeof(itb));
 out:
 	fd_putfile(SCARG(uap, fd));
 	return error;
+}

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $	*/
+/*	$NetBSD: ibcs2_stat.c,v 1.47.18.1 2017/08/19 04:13:51 snj Exp $	*/
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. The name of the author may not be used to endorse or promote products
 @@ -17,27 +17,27 @@
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47.18.1 2017/08/19 04:13:51 snj Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/namei.h>
 #include <sys/proc.h>
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/filedesc.h>
 #include <sys/ioctl.h>
 #include <sys/kernel.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
 #include <sys/syscallargs.h>
 @@ -137,31 +137,33 @@ ibcs2_sys_statfs(struct lwp *l, const st
 		syscallarg(int) fstype;
 	} */
 	struct mount *mp;
 	struct statvfs *sp;
 	int error;
 	struct vnode *vp;
 	error = namei_simple_user(SCARG(uap, path),
 				NSM_FOLLOW_TRYEMULROOT, &vp);
 	if (error != 0)
 		return (error);
 	mp = vp->v_mount;
 	sp = &mp->mnt_stat;
 	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+	error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
 out:
 	vrele(vp);
 	return (error);
+}
 int
 ibcs2_sys_fstatfs(struct lwp *l, const struct ibcs2_sys_fstatfs_args *uap, register_t *retval)
+{
 	/* {
 		syscallarg(int) fd;
 		syscallarg(struct ibcs2_statfs *) buf;
 		syscallarg(int) len;
 		syscallarg(int) fstype;
 	} */
 	file_t *fp;
 	struct mount *mp;
 @@ -190,32 +192,34 @@ ibcs2_sys_statvfs(struct lwp *l, const s
 		syscallarg(struct ibcs2_statvfs *) buf;
 	} */
 	struct mount *mp;
 	struct statvfs *sp;
 	int error;
 	struct vnode *vp;
 	error = namei_simple_user(SCARG(uap, path),
 				NSM_FOLLOW_TRYEMULROOT, &vp);
 	if (error != 0)
 		return (error);
 	mp = vp->v_mount;
 	sp = &mp->mnt_stat;
 	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statvfs(sp, (void *)SCARG(uap, buf),
+	error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
-			   sizeof(struct ibcs2_statvfs));
+	    sizeof(struct ibcs2_statvfs));
 out:
 	vrele(vp);
 	return error;
+}
 int
 ibcs2_sys_fstatvfs(struct lwp *l, const struct ibcs2_sys_fstatvfs_args *uap, register_t *retval)
+{
 	/* {
 		syscallarg(int) fd;
 		syscallarg(struct ibcs2_statvfs *) buf;
 	} */
 	file_t *fp;
 	struct mount *mp;
 	struct statvfs *sp;
 	int error;