1 files changed, 85 insertions, 0 deletions
diff --git a/sys-kernel/rsbac-dev-sources/files/rsbac-dev-sources-2.6.7-70681-binfmt.patch b/sys-kernel/rsbac-dev-sources/files/rsbac-dev-sources-2.6.7-70681-binfmt.patch
new file mode 100644
index 000000000000..c0f90a5dfbd8
--- /dev/null
+++ b/sys-kernel/rsbac-dev-sources/files/rsbac-dev-sources-2.6.7-70681-binfmt.patch
@@ -0,0 +1,85 @@
+diff -X /usr/src/dontdiff -urNp linux-2.6.7-gentoo-r16/fs/binfmt_elf.c linux-dsd/fs/binfmt_elf.c
+--- linux-2.6.7-gentoo-r16/fs/binfmt_elf.c	2004-06-16 06:19:22.000000000 +0100
++++ linux-dsd/fs/binfmt_elf.c	2004-11-24 16:24:00.301979976 +0000
+@@ -332,9 +332,12 @@ static unsigned long load_elf_interp(str
+ 		goto out;
+ 
+ 	retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
+-	error = retval;
+-	if (retval < 0)
++	error = -EIO;
++	if (retval != size) {
++		if (retval < 0)
++			error = retval;	
+ 		goto out_close;
++	}
+ 
+ 	eppnt = elf_phdata;
+ 	for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
+@@ -520,8 +523,11 @@ static int load_elf_binary(struct linux_
+ 		goto out;
+ 
+ 	retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
+-	if (retval < 0)
++	if (retval != size) {
++		if (retval < 0)
++			retval = -EIO;
+ 		goto out_free_ph;
++	}
+ 
+ 	files = current->files;		/* Refcounted so ok */
+ 	retval = unshare_files();
+@@ -558,7 +564,8 @@ static int load_elf_binary(struct linux_
+ 			 */
+ 
+ 			retval = -ENOMEM;
+-			if (elf_ppnt->p_filesz > PATH_MAX)
++			if (elf_ppnt->p_filesz > PATH_MAX || 
++			    elf_ppnt->p_filesz == 0)
+ 				goto out_free_file;
+ 			elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ 							   GFP_KERNEL);
+@@ -568,8 +575,16 @@ static int load_elf_binary(struct linux_
+ 			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
+ 					   elf_interpreter,
+ 					   elf_ppnt->p_filesz);
+-			if (retval < 0)
++			if (retval != elf_ppnt->p_filesz) {
++				if (retval >= 0)
++					retval = -EIO;
+ 				goto out_free_interp;
++			}
++			/* make sure path is NULL terminated */
++			retval = -EINVAL;
++			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++				goto out_free_interp;
++
+ 			/* If the program interpreter is one of these two,
+ 			 * then assume an iBCS2 image. Otherwise assume
+ 			 * a native linux image.
+@@ -604,8 +619,11 @@ static int load_elf_binary(struct linux_
+ 			if (IS_ERR(interpreter))
+ 				goto out_free_interp;
+ 			retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+-			if (retval < 0)
++			if (retval != BINPRM_BUF_SIZE) {
++				if (retval >= 0)
++					retval = -EIO;
+ 				goto out_free_dentry;
++			}
+ 
+ 			/* Get the exec headers */
+ 			interp_ex = *((struct exec *) bprm->buf);
+@@ -757,8 +775,10 @@ static int load_elf_binary(struct linux_
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
+-		if (BAD_ADDR(error))
+-			continue;
++		if (BAD_ADDR(error)) {
++			send_sig(SIGKILL, current, 0);
++			goto out_free_dentry;
++		}
+ 
+ 		if (!load_addr_set) {
+ 			load_addr_set = 1;