From owner-svn-src-user@freebsd.org  Tue Dec  6 19:19:20 2016
Return-Path: <owner-svn-src-user@freebsd.org>
Delivered-To: svn-src-user@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 758F9C6A92A
 for <svn-src-user@mailman.ysv.freebsd.org>;
 Tue,  6 Dec 2016 19:19:20 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 43DC3DA4;
 Tue,  6 Dec 2016 19:19:20 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uB6JJJxF029848;
 Tue, 6 Dec 2016 19:19:19 GMT (envelope-from glebius@FreeBSD.org)
Received: (from glebius@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id uB6JJIfl029833;
 Tue, 6 Dec 2016 19:19:18 GMT (envelope-from glebius@FreeBSD.org)
Message-Id: <201612061919.uB6JJIfl029833@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: glebius set sender to
 glebius@FreeBSD.org using -f
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Tue, 6 Dec 2016 19:19:18 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-user@freebsd.org
Subject: svn commit: r309651 - in user/cperciva/freebsd-update-build/patches:
 10.1-RELEASE 10.2-RELEASE 10.3-RELEASE 11.0-RELEASE 9.3-RELEASE
X-SVN-Group: user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-user@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "SVN commit messages for the experimental &quot; user&quot;
 src tree" <svn-src-user.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-user/>
List-Post: <mailto:svn-src-user@freebsd.org>
List-Help: <mailto:svn-src-user-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Dec 2016 19:19:20 -0000

Author: glebius
Date: Tue Dec  6 19:19:17 2016
New Revision: 309651
URL: https://svnweb.freebsd.org/changeset/base/309651

Log:
  Publish SA-16:36, SA-16:37, SA-16:38.

Added:
  user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:36.telnetd
  user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:37.libc
  user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:38.bhyve
  user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:36.telnetd
  user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:37.libc
  user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:38.bhyve
  user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:36.telnetd
  user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:37.libc
  user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:38.bhyve
  user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:36.telnetd
  user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:37.libc
  user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:38.bhyve
  user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:36.telnetd
  user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:37.libc

Added: user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:36.telnetd
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:36.telnetd	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,26 @@
+--- contrib/telnet/telnetd/sys_term.c.orig
++++ contrib/telnet/telnetd/sys_term.c
+@@ -1159,7 +1159,7 @@
+ 		 */
+ 		argv = (char **)malloc(sizeof(*argv) * 12);
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		*argv++ = (char *)10;
+ 		*argv = (char *)0;
+ 	}
+@@ -1170,11 +1170,12 @@
+ 		*argv = (char *)((long)(*argv) + 10);
+ 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		argv++;
+ 		cpp = &argv[(long)argv[-1] - 10];
+ 	}
+-	*cpp++ = strdup(val);
++	if ((*cpp++ = strdup(val)) == NULL)
++		fatal(net, "failure allocating argument space");
+ 	*cpp = 0;
+ 	return(argv);
+ }

Added: user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:37.libc
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:37.libc	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,75 @@
+--- lib/libc/net/linkaddr.c.orig
++++ lib/libc/net/linkaddr.c
+@@ -35,6 +35,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/socket.h>
++#include <net/if.h>
+ #include <net/if_dl.h>
+ #include <string.h>
+ 
+@@ -122,31 +123,47 @@
+ link_ntoa(const struct sockaddr_dl *sdl)
+ {
+ 	static char obuf[64];
+-	char *out = obuf;
+-	int i;
+-	u_char *in = (u_char *)LLADDR(sdl);
+-	u_char *inlim = in + sdl->sdl_alen;
+-	int firsttime = 1;
++	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
++	char *out;
++	const char *in, *inlim;
++	int namelen, i, rem;
+ 
+-	if (sdl->sdl_nlen) {
+-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
+-		out += sdl->sdl_nlen;
+-		if (sdl->sdl_alen)
++	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
++
++	out = obuf;
++	rem = sizeof(obuf);
++	if (namelen > 0) {
++		bcopy(sdl->sdl_data, out, namelen);
++		out += namelen;
++		rem -= namelen;
++		if (sdl->sdl_alen > 0) {
+ 			*out++ = ':';
++			rem--;
++		}
+ 	}
+-	while (in < inlim) {
+-		if (firsttime)
+-			firsttime = 0;
+-		else
++
++	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
++	inlim = in + sdl->sdl_alen;
++
++	while (in < inlim && rem > 1) {
++		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
+ 			*out++ = '.';
++			rem--;
++		}
+ 		i = *in++;
+ 		if (i > 0xf) {
+-			out[1] = hexlist[i & 0xf];
++			if (rem < 3)
++				break;
++			*out++ = hexlist[i & 0xf];
+ 			i >>= 4;
+-			out[0] = hexlist[i];
+-			out += 2;
+-		} else
+ 			*out++ = hexlist[i];
++			rem -= 2;
++		} else {
++			if (rem < 2)
++				break;
++			*out++ = hexlist[i];
++			rem++;
++		}
+ 	}
+ 	*out = 0;
+ 	return (obuf);

Added: user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:38.bhyve
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.1-RELEASE/43-SA-16:38.bhyve	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,19 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -263,12 +263,14 @@
+ 	/* XXX VM_MMAP_SPARSE not implemented yet */
+ 	assert(ctx->vms == VM_MMAP_ALL);
+ 
+-	if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++	if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++	    gaddr + len <= ctx->lowmem)
+ 		return ((void *)(ctx->lowmem_addr + gaddr));
+ 
+ 	if (gaddr >= 4*GB) {
+ 		gaddr -= 4*GB;
+-		if (gaddr < ctx->highmem && gaddr + len <= ctx->highmem)
++		if (gaddr < ctx->highmem && len <= ctx->highmem &&
++		    gaddr + len <= ctx->highmem)
+ 			return ((void *)(ctx->highmem_addr + gaddr));
+ 	}
+ 

Added: user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:36.telnetd
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:36.telnetd	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,26 @@
+--- contrib/telnet/telnetd/sys_term.c.orig
++++ contrib/telnet/telnetd/sys_term.c
+@@ -1159,7 +1159,7 @@
+ 		 */
+ 		argv = (char **)malloc(sizeof(*argv) * 12);
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		*argv++ = (char *)10;
+ 		*argv = (char *)0;
+ 	}
+@@ -1170,11 +1170,12 @@
+ 		*argv = (char *)((long)(*argv) + 10);
+ 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		argv++;
+ 		cpp = &argv[(long)argv[-1] - 10];
+ 	}
+-	*cpp++ = strdup(val);
++	if ((*cpp++ = strdup(val)) == NULL)
++		fatal(net, "failure allocating argument space");
+ 	*cpp = 0;
+ 	return(argv);
+ }

Added: user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:37.libc
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:37.libc	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,75 @@
+--- lib/libc/net/linkaddr.c.orig
++++ lib/libc/net/linkaddr.c
+@@ -35,6 +35,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/socket.h>
++#include <net/if.h>
+ #include <net/if_dl.h>
+ #include <string.h>
+ 
+@@ -122,31 +123,47 @@
+ link_ntoa(const struct sockaddr_dl *sdl)
+ {
+ 	static char obuf[64];
+-	char *out = obuf;
+-	int i;
+-	u_char *in = (u_char *)LLADDR(sdl);
+-	u_char *inlim = in + sdl->sdl_alen;
+-	int firsttime = 1;
++	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
++	char *out;
++	const char *in, *inlim;
++	int namelen, i, rem;
+ 
+-	if (sdl->sdl_nlen) {
+-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
+-		out += sdl->sdl_nlen;
+-		if (sdl->sdl_alen)
++	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
++
++	out = obuf;
++	rem = sizeof(obuf);
++	if (namelen > 0) {
++		bcopy(sdl->sdl_data, out, namelen);
++		out += namelen;
++		rem -= namelen;
++		if (sdl->sdl_alen > 0) {
+ 			*out++ = ':';
++			rem--;
++		}
+ 	}
+-	while (in < inlim) {
+-		if (firsttime)
+-			firsttime = 0;
+-		else
++
++	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
++	inlim = in + sdl->sdl_alen;
++
++	while (in < inlim && rem > 1) {
++		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
+ 			*out++ = '.';
++			rem--;
++		}
+ 		i = *in++;
+ 		if (i > 0xf) {
+-			out[1] = hexlist[i & 0xf];
++			if (rem < 3)
++				break;
++			*out++ = hexlist[i & 0xf];
+ 			i >>= 4;
+-			out[0] = hexlist[i];
+-			out += 2;
+-		} else
+ 			*out++ = hexlist[i];
++			rem -= 2;
++		} else {
++			if (rem < 2)
++				break;
++			*out++ = hexlist[i];
++			rem++;
++		}
+ 	}
+ 	*out = 0;
+ 	return (obuf);

Added: user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:38.bhyve
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.2-RELEASE/26-SA-16:38.bhyve	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,19 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -263,12 +263,14 @@
+ 	/* XXX VM_MMAP_SPARSE not implemented yet */
+ 	assert(ctx->vms == VM_MMAP_ALL);
+ 
+-	if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++	if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++	    gaddr + len <= ctx->lowmem)
+ 		return ((void *)(ctx->lowmem_addr + gaddr));
+ 
+ 	if (gaddr >= 4*GB) {
+ 		gaddr -= 4*GB;
+-		if (gaddr < ctx->highmem && gaddr + len <= ctx->highmem)
++		if (gaddr < ctx->highmem && len <= ctx->highmem &&
++		    gaddr + len <= ctx->highmem)
+ 			return ((void *)(ctx->highmem_addr + gaddr));
+ 	}
+ 

Added: user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:36.telnetd
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:36.telnetd	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,26 @@
+--- contrib/telnet/telnetd/sys_term.c.orig
++++ contrib/telnet/telnetd/sys_term.c
+@@ -1159,7 +1159,7 @@
+ 		 */
+ 		argv = (char **)malloc(sizeof(*argv) * 12);
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		*argv++ = (char *)10;
+ 		*argv = (char *)0;
+ 	}
+@@ -1170,11 +1170,12 @@
+ 		*argv = (char *)((long)(*argv) + 10);
+ 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		argv++;
+ 		cpp = &argv[(long)argv[-1] - 10];
+ 	}
+-	*cpp++ = strdup(val);
++	if ((*cpp++ = strdup(val)) == NULL)
++		fatal(net, "failure allocating argument space");
+ 	*cpp = 0;
+ 	return(argv);
+ }

Added: user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:37.libc
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:37.libc	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,75 @@
+--- lib/libc/net/linkaddr.c.orig
++++ lib/libc/net/linkaddr.c
+@@ -35,6 +35,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/socket.h>
++#include <net/if.h>
+ #include <net/if_dl.h>
+ #include <string.h>
+ 
+@@ -122,31 +123,47 @@
+ link_ntoa(const struct sockaddr_dl *sdl)
+ {
+ 	static char obuf[64];
+-	char *out = obuf;
+-	int i;
+-	u_char *in = (u_char *)LLADDR(sdl);
+-	u_char *inlim = in + sdl->sdl_alen;
+-	int firsttime = 1;
++	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
++	char *out;
++	const char *in, *inlim;
++	int namelen, i, rem;
+ 
+-	if (sdl->sdl_nlen) {
+-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
+-		out += sdl->sdl_nlen;
+-		if (sdl->sdl_alen)
++	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
++
++	out = obuf;
++	rem = sizeof(obuf);
++	if (namelen > 0) {
++		bcopy(sdl->sdl_data, out, namelen);
++		out += namelen;
++		rem -= namelen;
++		if (sdl->sdl_alen > 0) {
+ 			*out++ = ':';
++			rem--;
++		}
+ 	}
+-	while (in < inlim) {
+-		if (firsttime)
+-			firsttime = 0;
+-		else
++
++	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
++	inlim = in + sdl->sdl_alen;
++
++	while (in < inlim && rem > 1) {
++		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
+ 			*out++ = '.';
++			rem--;
++		}
+ 		i = *in++;
+ 		if (i > 0xf) {
+-			out[1] = hexlist[i & 0xf];
++			if (rem < 3)
++				break;
++			*out++ = hexlist[i & 0xf];
+ 			i >>= 4;
+-			out[0] = hexlist[i];
+-			out += 2;
+-		} else
+ 			*out++ = hexlist[i];
++			rem -= 2;
++		} else {
++			if (rem < 2)
++				break;
++			*out++ = hexlist[i];
++			rem++;
++		}
+ 	}
+ 	*out = 0;
+ 	return (obuf);

Added: user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:38.bhyve
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/10.3-RELEASE/13-SA-16:38.bhyve	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,24 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -426,13 +426,18 @@
+ {
+ 
+ 	if (ctx->lowmem > 0) {
+-		if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++		if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++		    gaddr + len <= ctx->lowmem)
+ 			return (ctx->baseaddr + gaddr);
+ 	}
+ 
+ 	if (ctx->highmem > 0) {
+-		if (gaddr >= 4*GB && gaddr + len <= 4*GB + ctx->highmem)
+-			return (ctx->baseaddr + gaddr);
++                if (gaddr >= 4*GB) {
++			if (gaddr < 4*GB + ctx->highmem &&
++			    len <= ctx->highmem &&
++			    gaddr + len <= 4*GB + ctx->highmem)
++				return (ctx->baseaddr + gaddr);
++		}
+ 	}
+ 
+ 	return (NULL);

Added: user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:36.telnetd
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:36.telnetd	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,26 @@
+--- contrib/telnet/telnetd/sys_term.c.orig
++++ contrib/telnet/telnetd/sys_term.c
+@@ -1159,7 +1159,7 @@
+ 		 */
+ 		argv = (char **)malloc(sizeof(*argv) * 12);
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		*argv++ = (char *)10;
+ 		*argv = (char *)0;
+ 	}
+@@ -1170,11 +1170,12 @@
+ 		*argv = (char *)((long)(*argv) + 10);
+ 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		argv++;
+ 		cpp = &argv[(long)argv[-1] - 10];
+ 	}
+-	*cpp++ = strdup(val);
++	if ((*cpp++ = strdup(val)) == NULL)
++		fatal(net, "failure allocating argument space");
+ 	*cpp = 0;
+ 	return(argv);
+ }

Added: user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:37.libc
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:37.libc	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,75 @@
+--- lib/libc/net/linkaddr.c.orig
++++ lib/libc/net/linkaddr.c
+@@ -35,6 +35,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/socket.h>
++#include <net/if.h>
+ #include <net/if_dl.h>
+ #include <string.h>
+ 
+@@ -122,31 +123,47 @@
+ link_ntoa(const struct sockaddr_dl *sdl)
+ {
+ 	static char obuf[64];
+-	char *out = obuf;
+-	int i;
+-	u_char *in = (u_char *)LLADDR(sdl);
+-	u_char *inlim = in + sdl->sdl_alen;
+-	int firsttime = 1;
++	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
++	char *out;
++	const char *in, *inlim;
++	int namelen, i, rem;
+ 
+-	if (sdl->sdl_nlen) {
+-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
+-		out += sdl->sdl_nlen;
+-		if (sdl->sdl_alen)
++	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
++
++	out = obuf;
++	rem = sizeof(obuf);
++	if (namelen > 0) {
++		bcopy(sdl->sdl_data, out, namelen);
++		out += namelen;
++		rem -= namelen;
++		if (sdl->sdl_alen > 0) {
+ 			*out++ = ':';
++			rem--;
++		}
+ 	}
+-	while (in < inlim) {
+-		if (firsttime)
+-			firsttime = 0;
+-		else
++
++	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
++	inlim = in + sdl->sdl_alen;
++
++	while (in < inlim && rem > 1) {
++		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
+ 			*out++ = '.';
++			rem--;
++		}
+ 		i = *in++;
+ 		if (i > 0xf) {
+-			out[1] = hexlist[i & 0xf];
++			if (rem < 3)
++				break;
++			*out++ = hexlist[i & 0xf];
+ 			i >>= 4;
+-			out[0] = hexlist[i];
+-			out += 2;
+-		} else
+ 			*out++ = hexlist[i];
++			rem -= 2;
++		} else {
++			if (rem < 2)
++				break;
++			*out++ = hexlist[i];
++			rem++;
++		}
+ 	}
+ 	*out = 0;
+ 	return (obuf);

Added: user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:38.bhyve
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/11.0-RELEASE/4-SA-16:38.bhyve	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,24 @@
+--- lib/libvmmapi/vmmapi.c.orig
++++ lib/libvmmapi/vmmapi.c
+@@ -426,13 +426,18 @@
+ {
+ 
+ 	if (ctx->lowmem > 0) {
+-		if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
++		if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
++		    gaddr + len <= ctx->lowmem)
+ 			return (ctx->baseaddr + gaddr);
+ 	}
+ 
+ 	if (ctx->highmem > 0) {
+-		if (gaddr >= 4*GB && gaddr + len <= 4*GB + ctx->highmem)
+-			return (ctx->baseaddr + gaddr);
++                if (gaddr >= 4*GB) {
++			if (gaddr < 4*GB + ctx->highmem &&
++			    len <= ctx->highmem &&
++			    gaddr + len <= 4*GB + ctx->highmem)
++				return (ctx->baseaddr + gaddr);
++		}
+ 	}
+ 
+ 	return (NULL);

Added: user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:36.telnetd
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:36.telnetd	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,26 @@
+--- contrib/telnet/telnetd/sys_term.c.orig
++++ contrib/telnet/telnetd/sys_term.c
+@@ -1159,7 +1159,7 @@
+ 		 */
+ 		argv = (char **)malloc(sizeof(*argv) * 12);
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		*argv++ = (char *)10;
+ 		*argv = (char *)0;
+ 	}
+@@ -1170,11 +1170,12 @@
+ 		*argv = (char *)((long)(*argv) + 10);
+ 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
+ 		if (argv == NULL)
+-			return(NULL);
++			fatal(net, "failure allocating argument space");
+ 		argv++;
+ 		cpp = &argv[(long)argv[-1] - 10];
+ 	}
+-	*cpp++ = strdup(val);
++	if ((*cpp++ = strdup(val)) == NULL)
++		fatal(net, "failure allocating argument space");
+ 	*cpp = 0;
+ 	return(argv);
+ }

Added: user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:37.libc
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ user/cperciva/freebsd-update-build/patches/9.3-RELEASE/51-SA-16:37.libc	Tue Dec  6 19:19:17 2016	(r309651)
@@ -0,0 +1,75 @@
+--- lib/libc/net/linkaddr.c.orig
++++ lib/libc/net/linkaddr.c
+@@ -35,6 +35,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/socket.h>
++#include <net/if.h>
+ #include <net/if_dl.h>
+ #include <string.h>
+ 
+@@ -122,31 +123,47 @@
+ link_ntoa(const struct sockaddr_dl *sdl)
+ {
+ 	static char obuf[64];
+-	char *out = obuf;
+-	int i;
+-	u_char *in = (u_char *)LLADDR(sdl);
+-	u_char *inlim = in + sdl->sdl_alen;
+-	int firsttime = 1;
++	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
++	char *out;
++	const char *in, *inlim;
++	int namelen, i, rem;
+ 
+-	if (sdl->sdl_nlen) {
+-		bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
+-		out += sdl->sdl_nlen;
+-		if (sdl->sdl_alen)
++	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
++
++	out = obuf;
++	rem = sizeof(obuf);
++	if (namelen > 0) {
++		bcopy(sdl->sdl_data, out, namelen);
++		out += namelen;
++		rem -= namelen;
++		if (sdl->sdl_alen > 0) {
+ 			*out++ = ':';
++			rem--;
++		}
+ 	}
+-	while (in < inlim) {
+-		if (firsttime)
+-			firsttime = 0;
+-		else
++
++	in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
++	inlim = in + sdl->sdl_alen;
++
++	while (in < inlim && rem > 1) {
++		if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
+ 			*out++ = '.';
++			rem--;
++		}
+ 		i = *in++;
+ 		if (i > 0xf) {
+-			out[1] = hexlist[i & 0xf];
++			if (rem < 3)
++				break;
++			*out++ = hexlist[i & 0xf];
+ 			i >>= 4;
+-			out[0] = hexlist[i];
+-			out += 2;
+-		} else
+ 			*out++ = hexlist[i];
++			rem -= 2;
++		} else {
++			if (rem < 2)
++				break;
++			*out++ = hexlist[i];
++			rem++;
++		}
+ 	}
+ 	*out = 0;
+ 	return (obuf);