code:
Author: Anton Gladky <gladk@debian.org>
LastChanged: Tue, 26 Feb 2013 20:40:25 +0100
BugDebian: http://bugs.debian.org/700914
Description: This patch was created by oCert according to
  http://www.ocert.org/advisories/ocert-2008-014.html
 and can be downloaded from
  http://www.ocert.org/analysis/2008-014/wordnet.patch
 Unfortunately the original patch had a problem which
 caused 'wordnet test -synsn' to fail.  The critical
 part of the patch was removed from the whole patch
 set and is moved to 51_overflows_memcpy.patch which
 uses memcpy instead of the formerly used strcpy.

--- a/lib/binsrch.c
+++ b/lib/binsrch.c
@@ -28,7 +28,7 @@ char *read_index(long offset, FILE *fp)
     char *linep;

     linep = line;
-    line[0] = '0';
+    line[0] = '\0';

     fseek( fp, offset, SEEK_SET );
     fgets(linep, LINE_LEN, fp);
@@ -58,6 +58,8 @@ char *bin_search(char *searchkey, FILE *
         last_bin_search_offset = ftell( fp );
 	fgets(linep, LINE_LEN, fp);
 	length = (int)(strchr(linep, ' ') - linep);
+	if (length > (sizeof(key) - 1))
+            return(NULL);
 	strncpy(key, linep, length);
 	key[length] = '\0';
 	if(strcmp(key, searchkey) < 0) {
@@ -110,6 +112,8 @@ static int bin_search_key(char *searchke
 	line[length++] =  c;
     if (getc(fp) == EOF) {	/* only 1 line in file */
 	length = (int)(strchr(linep, ' ') - linep);
+	if (length > (sizeof(key) - 1))
+            return(0);
 	strncpy(key, linep, length);
 	key[length] = '\0';
 	if(strcmp(key, searchkey) > 0) {
@@ -132,6 +136,8 @@ static int bin_search_key(char *searchke
 	if (fgets(linep, LINE_LEN, fp) != NULL) {
   	    offset2 = ftell(fp); /* offset at start of next line */
 	    length = (int)(strchr(linep, ' ') - linep);
+	    if (length > (sizeof(key) - 1))
+                return(0);
 	    strncpy(key, linep, length);
 	    key[length] = '\0';
 	    if(strcmp(key, searchkey) < 0) {	/* further in file */
--- a/lib/morph.c
+++ b/lib/morph.c
@@ -51,21 +51,21 @@ static struct {
     char *str;
     int strlen;
 } prepositions[NUMPREPS] = {
-    "to", 2,
-    "at", 2,
-    "of", 2,
-    "on", 2,
-    "off", 3,
-    "in", 2,
-    "out", 3,
-    "up", 2,
-    "down", 4,
-    "from", 4,
-    "with", 4,
-    "into", 4,
-    "for", 3,
-    "about", 5,
-    "between", 7,
+    { "to", 2 },
+    { "at", 2 },
+    { "of", 2 },
+    { "on", 2 },
+    { "off", 3 },
+    { "in", 2 },
+    { "out", 3 },
+    { "up", 2 },
+    { "down", 4 },
+    { "from", 4 },
+    { "with", 4 },
+    { "into", 4 },
+    { "for", 3 },
+    { "about", 5 },
+    { "between", 7 }
 };

 static FILE *exc_fps[NUMPARTS + 1];
@@ -144,18 +144,19 @@ static int do_init(void)
     } else
 	sprintf(searchdir, DEFAULTPATH);
 #else
-    if ((env = getenv("WNSEARCHDIR")) != NULL)
-	strcpy(searchdir, env);
-    else if ((env = getenv("WNHOME")) != NULL)
-	sprintf(searchdir, "%s%s", env, DICTDIR);
-    else
+    if ((env = getenv("WNSEARCHDIR")) != NULL) {
+	snprintf(searchdir, sizeof(searchdir), "%s", env);
+    } else if ((env = getenv("WNHOME")) != NULL) {
+	snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR);
+    } else {
 	strcpy(searchdir, DEFAULTPATH);
+    }
 #endif

     for (i = 1; i <= NUMPARTS; i++) {
-	sprintf(fname, EXCFILE, searchdir, partnames[i]);
+	snprintf(fname, sizeof(fname), EXCFILE, searchdir, partnames[i]);
 	if ((exc_fps[i] = fopen(fname, "r")) == NULL) {
-	    sprintf(msgbuf,
+	    snprintf(msgbuf, sizeof(msgbuf),
 		    "WordNet library error: Can't open exception file(%s)\n\n",
 		    fname);
 	    display_message(msgbuf);
@@ -178,13 +179,16 @@ char *morphstr(char *origstr, int pos)
     int prep;
     char *end_idx1, *end_idx2;
     char *append;
-
+
     if (pos == SATELLITE)
 	pos = ADJ;

     /* First time through for this string */

     if (origstr != NULL) {
+        if (strlen(origstr) > WORDBUF - 1)
+            return(NULL);
+
 	/* Assume string hasn't had spaces substitued with '_' */
 	strtolower(strsubst(strcpy(str, origstr), ' ', '_'));
 	searchstr[0] = '\0';
@@ -232,7 +236,7 @@ char *morphstr(char *origstr, int pos)
 		if (end_idx < 0) return(NULL);		/* shouldn't do this */
 		strncpy(word, str + st_idx, end_idx - st_idx);
 		word[end_idx - st_idx] = '\0';
-		if(tmp = morphword(word, pos))
+		if ((tmp = morphword(word, pos)) != NULL)
 		    strcat(searchstr,tmp);
 		else
 		    strcat(searchstr,word);
@@ -240,7 +244,7 @@ char *morphstr(char *origstr, int pos)
 		st_idx = end_idx + 1;
 	    }

-	    if(tmp = morphword(strcpy(word, str + st_idx), pos))
+	    if ((tmp = morphword(strcpy(word, str + st_idx), pos)) != NULL)
 		strcat(searchstr,tmp);
 	    else
 		strcat(searchstr,word);
@@ -270,16 +274,15 @@ char *morphword(char *word, int pos)
 {
     int offset, cnt;
     int i;
-    static char retval[WORDBUF];
-    char *tmp, tmpbuf[WORDBUF], *end;
-
-    sprintf(retval,"");
-    sprintf(tmpbuf, "");
-    end = "";
-
+    static char retval[WORDBUF] = "";
+    char *tmp, tmpbuf[WORDBUF] = "", *end = "";
+
     if(word == NULL)
 	return(NULL);

+    if (strlen(word) > WORDBUF - 1)
+        return(NULL);
+
     /* first look for word on exception list */

     if((tmp = exc_lookup(word, pos)) != NULL)
@@ -335,7 +338,10 @@ static char *wordbase(char *word, int en
 {
     char *pt1;
     static char copy[WORDBUF];
-
+
+    if (strlen(word) > WORDBUF - 1)
+        return(NULL);
+
     strcpy(copy, word);
     if(strend(copy,sufx[ender])) {
 	pt1=strchr(copy,'\0');
@@ -368,13 +374,14 @@ static char *exc_lookup(char *word, int
 {
     static char line[WORDBUF], *beglp, *endlp;
     char *excline;
-    int found = 0;

     if (exc_fps[pos] == NULL)
 	return(NULL);

     /* first time through load line from exception file */
     if(word != NULL){
+        if (strlen(word) > WORDBUF - 1)
+           return(NULL);
 	if ((excline = bin_search(word, exc_fps[pos])) != NULL) {
 	    strcpy(line, excline);
 	    endlp = strchr(line,' ');
@@ -403,6 +410,9 @@ static char *morphprep(char *s)
     char word[WORDBUF], end[WORDBUF];
     static char retval[WORDBUF];

+    if (strlen(s) > WORDBUF - 1)
+        return (NULL);
+
     /* Assume that the verb is the first word in the phrase.  Strip it
        off, check for validity, then try various morphs with the
        rest of the phrase tacked on, trying to find a match. */
@@ -410,7 +420,7 @@ static char *morphprep(char *s)
     rest = strchr(s, '_');
     last = strrchr(s, '_');
     if (rest != last) {		/* more than 2 words */
-	if (lastwd = morphword(last + 1, NOUN)) {
+	if ((lastwd = morphword(last + 1, NOUN)) != NULL) {
 	    strncpy(end, rest, last - rest + 1);
 	    end[last-rest+1] = '\0';
 	    strcat(end, lastwd);
--- a/lib/search.c
+++ b/lib/search.c
@@ -13,6 +13,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+#include <limits.h>

 #include "wn.h"

@@ -119,33 +120,22 @@ IndexPtr parse_index(long offset, int db
     if ( !line )
       line = read_index( offset, indexfps[dbase] );

-    idx = (IndexPtr)malloc(sizeof(Index));
+    idx = (IndexPtr)calloc(1, sizeof(Index));
     assert(idx);

     /* set offset of entry in index file */
     idx->idxoffset = offset;

-    idx->wd='\0';
-    idx->pos='\0';
-    idx->off_cnt=0;
-    idx->tagged_cnt = 0;
-    idx->sense_cnt=0;
-    idx->offset='\0';
-    idx->ptruse_cnt=0;
-    idx->ptruse='\0';
-
     /* get the word */
     ptrtok=strtok(line," \n");

-    idx->wd = malloc(strlen(ptrtok) + 1);
+    idx->wd = strdup(ptrtok);
     assert(idx->wd);
-    strcpy(idx->wd, ptrtok);

     /* get the part of speech */
     ptrtok=strtok(NULL," \n");
-    idx->pos = malloc(strlen(ptrtok) + 1);
+    idx->pos = strdup(ptrtok);
     assert(idx->pos);
-    strcpy(idx->pos, ptrtok);

     /* get the collins count */
     ptrtok=strtok(NULL," \n");
@@ -154,7 +144,12 @@ IndexPtr parse_index(long offset, int db
     /* get the number of pointers types */
     ptrtok=strtok(NULL," \n");
     idx->ptruse_cnt = atoi(ptrtok);
-
+
+    if (idx->ptruse_cnt < 0 || (unsigned int)idx->ptruse_cnt > UINT_MAX/sizeof(int)) {
+        free_index(idx);
+        return(NULL);
+    }
+
     if (idx->ptruse_cnt) {
 	idx->ptruse = (int *) malloc(idx->ptruse_cnt * (sizeof(int)));
 	assert(idx->ptruse);
@@ -173,9 +168,14 @@ IndexPtr parse_index(long offset, int db
     /* get the number of senses that are tagged */
     ptrtok=strtok(NULL," \n");
     idx->tagged_cnt = atoi(ptrtok);
-
+
+    if (idx->off_cnt < 0 || (unsigned long)idx->off_cnt > ULONG_MAX/sizeof(long)) {
+        free_index(idx);
+        return(NULL);
+    }
+
     /* make space for the offsets */
-    idx->offset = (long *) malloc(idx->off_cnt * (sizeof(long)));
+    idx->offset = (unsigned long *) malloc(idx->off_cnt * sizeof(long));
     assert(idx->offset);

     /* get the offsets */
@@ -197,15 +197,21 @@ IndexPtr getindex(char *searchstr, int d
     char strings[MAX_FORMS][WORDBUF]; /* vector of search strings */
     static IndexPtr offsets[MAX_FORMS];
     static int offset;
-
+
     /* This works like strrok(): if passed with a non-null string,
        prepare vector of search strings and offsets.  If string
        is null, look at current list of offsets and return next
        one, or NULL if no more alternatives for this word. */

     if (searchstr != NULL) {
+        /* Bail out if the input is too long for us to handle */
+        if (strlen(searchstr) > (WORDBUF - 1)) {
+            strcpy(msgbuf, "WordNet library error: search term is too long\n");
+                   display_message(msgbuf);
+            return(NULL);
+        }

-	offset = 0;
+    	offset = 0;
 	strtolower(searchstr);
 	for (i = 0; i < MAX_FORMS; i++) {
 	    strcpy(strings[i], searchstr);
@@ -229,11 +235,11 @@ IndexPtr getindex(char *searchstr, int d
 	/* Get offset of first entry.  Then eliminate duplicates
 	   and get offsets of unique strings. */

-	if (strings[0][0] != NULL)
+	if (strings[0] != NULL)
 	    offsets[0] = index_lookup(strings[0], dbase);

 	for (i = 1; i < MAX_FORMS; i++)
-	    if ((strings[i][0]) != NULL && (strcmp(strings[0], strings[i])))
+	    if (strings[i] != NULL && (strcmp(strings[0], strings[i])))
 		offsets[i] = index_lookup(strings[i], dbase);
     }

@@ -272,7 +278,7 @@ SynsetPtr read_synset(int dbase, long bo
 SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
 {
     static char line[LINEBUF];
-    char tbuf[SMLINEBUF];
+    char tbuf[SMLINEBUF] = "";
     char *ptrtok;
     char *tmpptr;
     int foundpert = 0;
@@ -286,33 +292,11 @@ SynsetPtr parse_synset(FILE *fp, int dba
     if ((tmpptr = fgets(line, LINEBUF, fp)) == NULL)
 	return(NULL);

-    synptr = (SynsetPtr)malloc(sizeof(Synset));
+    synptr = (SynsetPtr)calloc(1, sizeof(Synset));
     assert(synptr);
-
-    synptr->hereiam = 0;
+
     synptr->sstype = DONT_KNOW;
-    synptr->fnum = 0;
-    synptr->pos = '\0';
-    synptr->wcount = 0;
-    synptr->words = '\0';
-    synptr->whichword = 0;
-    synptr->ptrcount = 0;
-    synptr->ptrtyp = '\0';
-    synptr->ptroff = '\0';
-    synptr->ppos = '\0';
-    synptr->pto = '\0';
-    synptr->pfrm = '\0';
-    synptr->fcount = 0;
-    synptr->frmid = '\0';
-    synptr->frmto = '\0';
-    synptr->defn = '\0';
-    synptr->key = 0;
-    synptr->nextss = NULL;
-    synptr->nextform = NULL;
     synptr->searchtype = -1;
-    synptr->ptrlist = NULL;
-    synptr->headword = NULL;
-    synptr->headsense = 0;

     ptrtok = line;

@@ -322,7 +306,7 @@ SynsetPtr parse_synset(FILE *fp, int dba

     /* sanity check - make sure starting file offset matches first field */
     if (synptr->hereiam != loc) {
-	sprintf(msgbuf, "WordNet library error: no synset at location %d\n",
+	sprintf(msgbuf, "WordNet library error: no synset at location %ld\n",
 		loc);
 	display_message(msgbuf);
 	free(synptr);
@@ -335,16 +319,20 @@ SynsetPtr parse_synset(FILE *fp, int dba

     /* looking at POS */
     ptrtok = strtok(NULL, " \n");
-    synptr->pos = malloc(strlen(ptrtok) + 1);
+    synptr->pos = strdup(ptrtok);
     assert(synptr->pos);
-    strcpy(synptr->pos, ptrtok);
     if (getsstype(synptr->pos) == SATELLITE)
 	synptr->sstype = INDIRECT_ANT;

     /* looking at numwords */
     ptrtok = strtok(NULL, " \n");
     synptr->wcount = strtol(ptrtok, NULL, 16);
-
+
+    if (synptr->wcount < 0 || (unsigned int)synptr->wcount > UINT_MAX/sizeof(char *)) {
+        free_syns(synptr);
+        return(NULL);
+    }
+
     synptr->words = (char **)malloc(synptr->wcount  * sizeof(char *));
     assert(synptr->words);
     synptr->wnsns = (int *)malloc(synptr->wcount * sizeof(int));
@@ -354,9 +342,8 @@ SynsetPtr parse_synset(FILE *fp, int dba

     for (i = 0; i < synptr->wcount; i++) {
 	ptrtok = strtok(NULL, " \n");
-	synptr->words[i] = malloc(strlen(ptrtok) + 1);
+	synptr->words[i] = strdup(ptrtok);
 	assert(synptr->words[i]);
-	strcpy(synptr->words[i], ptrtok);

 	/* is this the word we're looking for? */

@@ -371,6 +358,12 @@ SynsetPtr parse_synset(FILE *fp, int dba
     ptrtok = strtok(NULL," \n");
     synptr->ptrcount = atoi(ptrtok);

+    /* Should we check for long here as well? */
+    if (synptr->ptrcount < 0 || (unsigned int)synptr->ptrcount > UINT_MAX/sizeof(int)) {
+        free_syns(synptr);
+        return(NULL);
+    }
+
     if (synptr->ptrcount) {

 	/* alloc storage for the pointers */
@@ -455,21 +448,23 @@ SynsetPtr parse_synset(FILE *fp, int dba
     ptrtok = strtok(NULL," \n");
     if (ptrtok) {
 	ptrtok = strtok(NULL," \n");
-	sprintf(tbuf, "");
 	while (ptrtok != NULL) {
+	    if (strlen(ptrtok) + strlen(tbuf) + 1 + 1 > sizeof(tbuf)) {
+                free_syns(synptr);
+                return(NULL);
+	    }
 	    strcat(tbuf,ptrtok);
 	    ptrtok = strtok(NULL, " \n");
 	    if(ptrtok)
 		strcat(tbuf," ");
 	}
-	assert((1 + strlen(tbuf)) < sizeof(tbuf));
-	synptr->defn = malloc(strlen(tbuf) + 4);
+	synptr->defn = malloc(strlen(tbuf) + 3);
 	assert(synptr->defn);
 	sprintf(synptr->defn,"(%s)",tbuf);
     }

     if (keyindexfp) { 		/* we have unique keys */
-	sprintf(tmpbuf, "%c:%8.8d", partchars[dbase], synptr->hereiam);
+	sprintf(tmpbuf, "%c:%8.8ld", partchars[dbase], synptr->hereiam);
 	synptr->key = GetKeyForOffset(tmpbuf);
     }

@@ -635,7 +630,7 @@ static void traceptrs(SynsetPtr synptr,

 	    if ((ptrtyp == PERTPTR || ptrtyp == PPLPTR) &&
 		synptr->pto[i] != 0) {
-		sprintf(tbuf, " (Sense %d)\n",
+		snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n",
 			cursyn->wnsns[synptr->pto[i] - 1]);
 		printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
 			    SKIP_ANTS, PRINT_MARKER);
@@ -656,7 +651,7 @@ static void traceptrs(SynsetPtr synptr,
 		    traceptrs(cursyn, HYPERPTR, getpos(cursyn->pos), 0);
 		}
 	    } else if (ptrtyp == ANTPTR && dbase != ADJ && synptr->pto[i] != 0) {
-		sprintf(tbuf, " (Sense %d)\n",
+		snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n",
 			cursyn->wnsns[synptr->pto[i] - 1]);
 		printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
 			    SKIP_ANTS, PRINT_MARKER);
@@ -817,7 +812,7 @@ static void tracenomins(SynsetPtr synptr

 	    cursyn = read_synset(synptr->ppos[i], synptr->ptroff[i], "");

-	    sprintf(tbuf, "#%d\n",
+	    snprintf(tbuf, sizeof(tbuf), "#%d\n",
 		    cursyn->wnsns[synptr->pto[i] - 1]);
 	    printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
 			SKIP_ANTS, SKIP_MARKER);
@@ -989,12 +984,12 @@ void getexample(char *offset, char *wd)
     char sentbuf[512];

     if (vsentfilefp != NULL) {
-	if (line = bin_search(offset, vsentfilefp)) {
+	if ((line = bin_search(offset, vsentfilefp)) != NULL) {
 	    while(*line != ' ')
 		line++;

 	    printbuffer("          EX: ");
-	    sprintf(sentbuf, line, wd);
+	    snprintf(sentbuf, sizeof(sentbuf), line, wd);
 	    printbuffer(sentbuf);
 	}
     }
@@ -1011,7 +1006,7 @@ int findexample(SynsetPtr synptr)
     if (vidxfilefp != NULL) {
 	wdnum = synptr->whichword - 1;

-	sprintf(tbuf,"%s%%%-1.1d:%-2.2d:%-2.2d::",
+	snprintf(tbuf, sizeof(tbuf), "%s%%%-1.1d:%-2.2d:%-2.2d::",
 		synptr->words[wdnum],
 		getpos(synptr->pos),
 		synptr->fnum,
@@ -1124,7 +1119,7 @@ static void freq_word(IndexPtr index)
 	if (cnt >= 17 && cnt <= 32) familiar = 6;
 	if (cnt > 32 ) familiar = 7;

-	sprintf(tmpbuf,
+	snprintf(tmpbuf, sizeof(tmpbuf),
 		"\n%s used as %s is %s (polysemy count = %d)\n",
 		index->wd, a_an[getpos(index->pos)], freqcats[familiar], cnt);
 	printbuffer(tmpbuf);
@@ -1147,6 +1142,9 @@ void wngrep (char *word_passed, int pos)
    }
    rewind(inputfile);

+   if (strlen(word_passed) + 1 > sizeof(word))
+       return;
+
    strcpy (word, word_passed);
    ToLowerCase(word);		/* map to lower case for index file search */
    strsubst (word, ' ', '_');	/* replace spaces with underscores */
@@ -1169,7 +1167,7 @@ void wngrep (char *word_passed, int pos)
             ((line[loc + wordlen] == '-') || (line[loc + wordlen] == '_')))
          ) {
             strsubst (line, '_', ' ');
-            sprintf (tmpbuf, "%s\n", line);
+            snprintf (tmpbuf, sizeof(tmpbuf), "%s\n", line);
             printbuffer (tmpbuf);
             break;
          }
@@ -1683,9 +1681,8 @@ SynsetPtr traceptrs_ds(SynsetPtr synptr,
 		cursyn = read_synset(synptr->ppos[i],
 				      synptr->ptroff[i],
 				      "");
-		synptr->headword = malloc(strlen(cursyn->words[0]) + 1);
+		synptr->headword = strdup(cursyn->words[0]);
 		assert(synptr->headword);
-		strcpy(synptr->headword, cursyn->words[0]);
 		synptr->headsense = cursyn->lexid[0];
 		free_synset(cursyn);
 		break;
@@ -2013,7 +2010,7 @@ static int getsearchsense(SynsetPtr synp
     strsubst(strcpy(wdbuf, synptr->words[whichword - 1]), ' ', '_');
     strtolower(wdbuf);

-    if (idx = index_lookup(wdbuf, getpos(synptr->pos))) {
+    if ((idx = index_lookup(wdbuf, getpos(synptr->pos))) != NULL) {
 	for (i = 0; i < idx->off_cnt; i++)
 	    if (idx->offset[i] == synptr->hereiam) {
 		free_index(idx);
@@ -2037,7 +2034,7 @@ static void printsynset(char *head, Syns
        by flags */

     if (offsetflag)		/* print synset offset */
-	sprintf(tbuf + strlen(tbuf),"{%8.8d} ", synptr->hereiam);
+	sprintf(tbuf + strlen(tbuf),"{%8.8ld} ", synptr->hereiam);
     if (fileinfoflag) {		/* print lexicographer file information */
 	sprintf(tbuf + strlen(tbuf), "<%s> ", lexfiles[synptr->fnum]);
 	prlexid = 1;		/* print lexicographer id after word */
@@ -2072,7 +2069,7 @@ static void printantsynset(SynsetPtr syn
     tbuf[0] = '\0';

     if (offsetflag)
-	sprintf(tbuf,"{%8.8d} ", synptr->hereiam);
+	sprintf(tbuf,"{%8.8ld} ", synptr->hereiam);
     if (fileinfoflag) {
 	sprintf(tbuf + strlen(tbuf),"<%s> ", lexfiles[synptr->fnum]);
 	prlexid = 1;
--- a/lib/wnutil.c
+++ b/lib/wnutil.c
@@ -48,7 +48,7 @@ int wninit(void)
     char *env;

     if (!done) {
-	if (env = getenv("WNDBVERSION")) {
+	if ((env = getenv("WNDBVERSION")) != NULL) {
 	    wnrelease = strdup(env);	/* set release */
 	    assert(wnrelease);
 	}
@@ -70,7 +70,7 @@ int re_wninit(void)

     closefps();

-    if (env = getenv("WNDBVERSION")) {
+    if ((env = getenv("WNDBVERSION")) != NULL) {
 	wnrelease = strdup(env);	/* set release */
 	assert(wnrelease);
     }
@@ -149,25 +149,25 @@ static int do_init(void)
 	sprintf(searchdir, DEFAULTPATH);
 #else
     if ((env = getenv("WNSEARCHDIR")) != NULL)
-	strcpy(searchdir, env);
+	snprintf(searchdir, sizeof(searchdir), "%s", env);
     else if ((env = getenv("WNHOME")) != NULL)
-	sprintf(searchdir, "%s%s", env, DICTDIR);
+	snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR);
     else
 	strcpy(searchdir, DEFAULTPATH);
 #endif

     for (i = 1; i < NUMPARTS + 1; i++) {
-	sprintf(tmpbuf, DATAFILE, searchdir, partnames[i]);
+	snprintf(tmpbuf, sizeof(tmpbuf), DATAFILE, searchdir, partnames[i]);
 	if((datafps[i] = fopen(tmpbuf, "r")) == NULL) {
-	    sprintf(msgbuf,
+	    snprintf(msgbuf, sizeof(msgbuf),
 		    "WordNet library error: Can't open datafile(%s)\n",
 		    tmpbuf);
 	    display_message(msgbuf);
 	    openerr = -1;
 	}
-	sprintf(tmpbuf, INDEXFILE, searchdir, partnames[i]);
+	snprintf(tmpbuf, sizeof(tmpbuf), INDEXFILE, searchdir, partnames[i]);
 	if((indexfps[i] = fopen(tmpbuf, "r")) == NULL) {
-	    sprintf(msgbuf,
+	    snprintf(msgbuf, sizeof(msgbuf),
 		    "WordNet library error: Can't open indexfile(%s)\n",
 		    tmpbuf);
 	    display_message(msgbuf);
@@ -178,35 +178,35 @@ static int do_init(void)
     /* This file isn't used by the library and doesn't have to
        be present.  No error is reported if the open fails. */

-    sprintf(tmpbuf, SENSEIDXFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), SENSEIDXFILE, searchdir);
     sensefp = fopen(tmpbuf, "r");

     /* If this file isn't present, the runtime code will skip printint out
        the number of times each sense was tagged. */

-    sprintf(tmpbuf, CNTLISTFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), CNTLISTFILE, searchdir);
     cntlistfp = fopen(tmpbuf, "r");

     /* This file doesn't have to be present.  No error is reported if the
        open fails. */

-    sprintf(tmpbuf, KEYIDXFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), KEYIDXFILE, searchdir);
     keyindexfp = fopen(tmpbuf, "r");

-    sprintf(tmpbuf, REVKEYIDXFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), REVKEYIDXFILE, searchdir);
     revkeyindexfp = fopen(tmpbuf, "r");

-    sprintf(tmpbuf, VRBSENTFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), VRBSENTFILE, searchdir);
     if ((vsentfilefp = fopen(tmpbuf, "r")) == NULL) {
-	sprintf(msgbuf,
+	snprintf(msgbuf, sizeof(msgbuf),
 "WordNet library warning: Can't open verb example sentence file(%s)\n",
 		tmpbuf);
 	display_message(msgbuf);
     }

-    sprintf(tmpbuf, VRBIDXFILE, searchdir);
+    snprintf(tmpbuf, sizeof(tmpbuf), VRBIDXFILE, searchdir);
     if ((vidxfilefp = fopen(tmpbuf, "r")) == NULL) {
-	sprintf(msgbuf,
+	snprintf(msgbuf, sizeof(msgbuf),
 "WordNet library warning: Can't open verb example sentence index file(%s)\n",
 		tmpbuf);
 	display_message(msgbuf);
--- a/src/wn.c
+++ b/src/wn.c
@@ -131,7 +131,7 @@ static void printusage(), printlicense()
        printsearches(char *, int, unsigned long);
 static int error_message(char *);

-main(int argc,char *argv[])
+int main(int argc,char *argv[])
 {
     display_message = error_message;

@@ -228,14 +228,14 @@ static int do_search(char *searchword, i
 	printf("\n%s of %s %s\n%s",
 	       label, partnames[pos], searchword, outbuf);

-    if (morphword = morphstr(searchword, pos))
+    if ((morphword = morphstr(searchword, pos)) != NULL)
 	do {
 	    outbuf = findtheinfo(morphword, pos, search, whichsense);
 	    totsenses += wnresults.printcnt;
 	    if (strlen(outbuf) > 0)
 		printf("\n%s of %s %s\n%s",
 		       label, partnames[pos], morphword, outbuf);
-	} while (morphword = morphstr(NULL, pos));
+	} while ((morphword = morphstr(NULL, pos)) != NULL);

     return(totsenses);
 }


code:
This patch was created by oCert according to
 http://www.ocert.org/advisories/ocert-2008-014.html
Unfortunately the original patch contained a bug which was
later fixed by the issuer of the patch Rob Holland <rob@ocert.org>
This part was now separated in this file.

--- a/lib/search.c
+++ b/lib/search.c
@@ -1568,7 +1568,8 @@ char *findtheinfo(char *searchstr, int d
 			bufstart[0] = '\n';
 			bufstart++;
 		    }
-		    strncpy(bufstart, tmpbuf, strlen(tmpbuf));
+                   /* Avoid writing a trailing \0 after the string */
+                   memcpy(bufstart, tmpbuf, strlen(tmpbuf));
 		    bufstart = searchbuffer + strlen(searchbuffer);
 		}
 	    }

license: mit


code:
Fix CVE-2017-13082:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13082
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

Patch copied from upstream:
https://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch

From cf4cab804c7afd5c45505528a8d16e46163243a2 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Date: Fri, 14 Jul 2017 15:15:35 +0200
Subject: [PATCH 1/8] hostapd: Avoid key reinstallation in FT handshake

Do not reinstall TK to the driver during Reassociation Response frame
processing if the first attempt of setting the TK succeeded. This avoids
issues related to clearing the TX/RX PN that could result in reusing
same PN values for transmitted frames (e.g., due to CCM nonce reuse and
also hitting replay protection on the receiver) and accepting replayed
frames on RX side.

This issue was introduced by the commit
0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in
authenticator') which allowed wpa_ft_install_ptk() to be called multiple
times with the same PTK. While the second configuration attempt is
needed with some drivers, it must be done only if the first attempt
failed.

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
---
 src/ap/ieee802_11.c  | 16 +++++++++++++---
 src/ap/wpa_auth.c    | 11 +++++++++++
 src/ap/wpa_auth.h    |  3 ++-
 src/ap/wpa_auth_ft.c | 10 ++++++++++
 src/ap/wpa_auth_i.h  |  1 +
 5 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 4e04169..333035f 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -1841,6 +1841,7 @@ static int add_associated_sta(struct hostapd_data *hapd,
 {
 	struct ieee80211_ht_capabilities ht_cap;
 	struct ieee80211_vht_capabilities vht_cap;
+	int set = 1;

 	/*
 	 * Remove the STA entry to ensure the STA PS state gets cleared and
@@ -1848,9 +1849,18 @@ static int add_associated_sta(struct hostapd_data *hapd,
 	 * FT-over-the-DS, where a station re-associates back to the same AP but
 	 * skips the authentication flow, or if working with a driver that
 	 * does not support full AP client state.
+	 *
+	 * Skip this if the STA has already completed FT reassociation and the
+	 * TK has been configured since the TX/RX PN must not be reset to 0 for
+	 * the same key.
 	 */
-	if (!sta->added_unassoc)
+	if (!sta->added_unassoc &&
+	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
+	     !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) {
 		hostapd_drv_sta_remove(hapd, sta->addr);
+		wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
+		set = 0;
+	}

 #ifdef CONFIG_IEEE80211N
 	if (sta->flags & WLAN_STA_HT)
@@ -1873,11 +1883,11 @@ static int add_associated_sta(struct hostapd_data *hapd,
 			    sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
 			    sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
 			    sta->vht_opmode, sta->p2p_ie ? 1 : 0,
-			    sta->added_unassoc)) {
+			    set)) {
 		hostapd_logger(hapd, sta->addr,
 			       HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
 			       "Could not %s STA to kernel driver",
-			       sta->added_unassoc ? "set" : "add");
+			       set ? "set" : "add");

 		if (sta->added_unassoc) {
 			hostapd_drv_sta_remove(hapd, sta->addr);
diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 3587086..707971d 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -1745,6 +1745,9 @@ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event)
 #else /* CONFIG_IEEE80211R */
 		break;
 #endif /* CONFIG_IEEE80211R */
+	case WPA_DRV_STA_REMOVED:
+		sm->tk_already_set = FALSE;
+		return 0;
 	}

 #ifdef CONFIG_IEEE80211R
@@ -3250,6 +3253,14 @@ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
 }

+int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
+{
+	if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
+		return 0;
+	return sm->tk_already_set;
+}
+
+
 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
 			     struct rsn_pmksa_cache_entry *entry)
 {
diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
index 0de8d97..97461b0 100644
--- a/src/ap/wpa_auth.h
+++ b/src/ap/wpa_auth.h
@@ -267,7 +267,7 @@ void wpa_receive(struct wpa_authenticator *wpa_auth,
 		 u8 *data, size_t data_len);
 enum wpa_event {
 	WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH,
-	WPA_REAUTH_EAPOL, WPA_ASSOC_FT
+	WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED
 };
 void wpa_remove_ptk(struct wpa_state_machine *sm);
 int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event);
@@ -280,6 +280,7 @@ int wpa_auth_pairwise_set(struct wpa_state_machine *sm);
 int wpa_auth_get_pairwise(struct wpa_state_machine *sm);
 int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm);
 int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm);
+int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm);
 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
 			     struct rsn_pmksa_cache_entry *entry);
 struct rsn_pmksa_cache_entry *
diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index 42242a5..e63b99a 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -780,6 +780,14 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)
 		return;
 	}

+	if (sm->tk_already_set) {
+		/* Must avoid TK reconfiguration to prevent clearing of TX/RX
+		 * PN in the driver */
+		wpa_printf(MSG_DEBUG,
+			   "FT: Do not re-install same PTK to the driver");
+		return;
+	}
+
 	/* FIX: add STA entry to kernel/driver here? The set_key will fail
 	 * most likely without this.. At the moment, STA entry is added only
 	 * after association has been completed. This function will be called
@@ -792,6 +800,7 @@ void wpa_ft_install_ptk(struct wpa_state_machine *sm)

 	/* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
 	sm->pairwise_set = TRUE;
+	sm->tk_already_set = TRUE;
 }

@@ -898,6 +907,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm,

 	sm->pairwise = pairwise;
 	sm->PTK_valid = TRUE;
+	sm->tk_already_set = FALSE;
 	wpa_ft_install_ptk(sm);

 	buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
index 72b7eb3..7fd8f05 100644
--- a/src/ap/wpa_auth_i.h
+++ b/src/ap/wpa_auth_i.h
@@ -65,6 +65,7 @@ struct wpa_state_machine {
 	struct wpa_ptk PTK;
 	Boolean PTK_valid;
 	Boolean pairwise_set;
+	Boolean tk_already_set;
 	int keycount;
 	Boolean Pair;
 	struct wpa_key_replay_counter {
--
2.7.4


code:
Fix CVE-2018-14526:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14526
https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt

Patch downloaded from upstream:

https://w1.fi/security/2018-1/rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch

From 3e34cfdff6b192fe337c6fb3f487f73e96582961 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Date: Sun, 15 Jul 2018 01:25:53 +0200
Subject: [PATCH] WPA: Ignore unauthenticated encrypted EAPOL-Key data

Ignore unauthenticated encrypted EAPOL-Key data in supplicant
processing. When using WPA2, these are frames that have the Encrypted
flag set, but not the MIC flag.

When using WPA2, EAPOL-Key frames that had the Encrypted flag set but
not the MIC flag, had their data field decrypted without first verifying
the MIC. In case the data field was encrypted using RC4 (i.e., when
negotiating TKIP as the pairwise cipher), this meant that
unauthenticated but decrypted data would then be processed. An adversary
could abuse this as a decryption oracle to recover sensitive information
in the data field of EAPOL-Key messages (e.g., the group key).
(CVE-2018-14526)

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
---
 src/rsn_supp/wpa.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff -upr wpa_supplicant-2.6.orig/src/rsn_supp/wpa.c wpa_supplicant-2.6/src/rsn_supp/wpa.c
--- wpa_supplicant-2.6.orig/src/rsn_supp/wpa.c	2016-10-02 21:51:11.000000000 +0300
+++ wpa_supplicant-2.6/src/rsn_supp/wpa.c	2018-08-08 16:55:11.506831029 +0300
@@ -2016,6 +2016,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, c

 	if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
 	    (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
+		/*
+		 * Only decrypt the Key Data field if the frame's authenticity
+		 * was verified. When using AES-SIV (FILS), the MIC flag is not
+		 * set, so this check should only be performed if mic_len != 0
+		 * which is the case in this code branch.
+		 */
+		if (!(key_info & WPA_KEY_INFO_MIC)) {
+			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+				"WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
+			goto out;
+		}
 		if (wpa_supplicant_decrypt_key_data(sm, key, ver, key_data,
 						    &key_data_len))
 			goto out;


code:
Fix CVE-2017-{13078,13079,13080,13081,13087,13088}:

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13078
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13079
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13081
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13087
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13088

These two patches are copied from upstream:
https://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
https://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch

From 927f891007c402fefd1ff384645b3f07597c3ede Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Date: Wed, 12 Jul 2017 16:03:24 +0200
Subject: [PATCH 2/8] Prevent reinstallation of an already in-use group key

Track the current GTK and IGTK that is in use and when receiving a
(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do
not install the given key if it is already in use. This prevents an
attacker from trying to trick the client into resetting or lowering the
sequence counter associated to the group key.

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
---
 src/common/wpa_common.h |  11 +++++
 src/rsn_supp/wpa.c      | 116 ++++++++++++++++++++++++++++++------------------
 src/rsn_supp/wpa_i.h    |   4 ++
 3 files changed, 87 insertions(+), 44 deletions(-)

diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index af1d0f0..d200285 100644
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -217,6 +217,17 @@ struct wpa_ptk {
 	size_t tk_len;
 };

+struct wpa_gtk {
+	u8 gtk[WPA_GTK_MAX_LEN];
+	size_t gtk_len;
+};
+
+#ifdef CONFIG_IEEE80211W
+struct wpa_igtk {
+	u8 igtk[WPA_IGTK_MAX_LEN];
+	size_t igtk_len;
+};
+#endif /* CONFIG_IEEE80211W */

 /* WPA IE version 1
  * 00-50-f2:1 (OUI:OUI type)
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 3c47879..95bd7be 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -714,6 +714,15 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 	const u8 *_gtk = gd->gtk;
 	u8 gtk_buf[32];

+	/* Detect possible key reinstallation */
+	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
+	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
+		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
+			gd->keyidx, gd->tx, gd->gtk_len);
+		return 0;
+	}
+
 	wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 		"WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
@@ -748,6 +757,9 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 	}
 	os_memset(gtk_buf, 0, sizeof(gtk_buf));

+	sm->gtk.gtk_len = gd->gtk_len;
+	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
+
 	return 0;
 }

@@ -854,6 +866,48 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
 }

+#ifdef CONFIG_IEEE80211W
+static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
+				       const struct wpa_igtk_kde *igtk)
+{
+	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
+	u16 keyidx = WPA_GET_LE16(igtk->keyid);
+
+	/* Detect possible key reinstallation */
+	if (sm->igtk.igtk_len == len &&
+	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
+		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
+			keyidx);
+		return  0;
+	}
+
+	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+		"WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
+		keyidx, MAC2STR(igtk->pn));
+	wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
+	if (keyidx > 4095) {
+		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+			"WPA: Invalid IGTK KeyID %d", keyidx);
+		return -1;
+	}
+	if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
+			   broadcast_ether_addr,
+			   keyidx, 0, igtk->pn, sizeof(igtk->pn),
+			   igtk->igtk, len) < 0) {
+		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+			"WPA: Failed to configure IGTK to the driver");
+		return -1;
+	}
+
+	sm->igtk.igtk_len = len;
+	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
+
+	return 0;
+}
+#endif /* CONFIG_IEEE80211W */
+
+
 static int ieee80211w_set_keys(struct wpa_sm *sm,
 			       struct wpa_eapol_ie_parse *ie)
 {
@@ -864,30 +918,14 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
 	if (ie->igtk) {
 		size_t len;
 		const struct wpa_igtk_kde *igtk;
-		u16 keyidx;
+
 		len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 		if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
 			return -1;
+
 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
-		keyidx = WPA_GET_LE16(igtk->keyid);
-		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
-			"pn %02x%02x%02x%02x%02x%02x",
-			keyidx, MAC2STR(igtk->pn));
-		wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
-				igtk->igtk, len);
-		if (keyidx > 4095) {
-			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
-				"WPA: Invalid IGTK KeyID %d", keyidx);
-			return -1;
-		}
-		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
-				   broadcast_ether_addr,
-				   keyidx, 0, igtk->pn, sizeof(igtk->pn),
-				   igtk->igtk, len) < 0) {
-			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
-				"WPA: Failed to configure IGTK to the driver");
+		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 			return -1;
-		}
 	}

 	return 0;
@@ -2307,7 +2345,7 @@ void wpa_sm_deinit(struct wpa_sm *sm)
  */
 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
 {
-	int clear_ptk = 1;
+	int clear_keys = 1;

 	if (sm == NULL)
 		return;
@@ -2333,11 +2371,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
 		/* Prepare for the next transition */
 		wpa_ft_prepare_auth_request(sm, NULL);

-		clear_ptk = 0;
+		clear_keys = 0;
 	}
 #endif /* CONFIG_IEEE80211R */

-	if (clear_ptk) {
+	if (clear_keys) {
 		/*
 		 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
 		 * this is not part of a Fast BSS Transition.
@@ -2347,6 +2385,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
 		os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 		sm->tptk_set = 0;
 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
+		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
+#ifdef CONFIG_IEEE80211W
+		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
+#endif /* CONFIG_IEEE80211W */
 	}

 #ifdef CONFIG_TDLS
@@ -2877,6 +2919,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
 	os_memset(sm->pmk, 0, sizeof(sm->pmk));
 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
+	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
+#ifdef CONFIG_IEEE80211W
+	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
+#endif /* CONFIG_IEEE80211W */
 #ifdef CONFIG_IEEE80211R
 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
 	os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
@@ -2949,29 +2995,11 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
 		os_memset(&gd, 0, sizeof(gd));
 #ifdef CONFIG_IEEE80211W
 	} else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
-		struct wpa_igtk_kde igd;
-		u16 keyidx;
-
-		os_memset(&igd, 0, sizeof(igd));
-		keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
-		os_memcpy(igd.keyid, buf + 2, 2);
-		os_memcpy(igd.pn, buf + 4, 6);
-
-		keyidx = WPA_GET_LE16(igd.keyid);
-		os_memcpy(igd.igtk, buf + 10, keylen);
-
-		wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
-				igd.igtk, keylen);
-		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
-				   broadcast_ether_addr,
-				   keyidx, 0, igd.pn, sizeof(igd.pn),
-				   igd.igtk, keylen) < 0) {
-			wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
-				   "WNM mode");
-			os_memset(&igd, 0, sizeof(igd));
+		const struct wpa_igtk_kde *igtk;
+
+		igtk = (const struct wpa_igtk_kde *) (buf + 2);
+		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
 			return -1;
-		}
-		os_memset(&igd, 0, sizeof(igd));
 #endif /* CONFIG_IEEE80211W */
 	} else {
 		wpa_printf(MSG_DEBUG, "Unknown element id");
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index f653ba6..afc9e37 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -31,6 +31,10 @@ struct wpa_sm {
 	u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
 	int rx_replay_counter_set;
 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
+	struct wpa_gtk gtk;
+#ifdef CONFIG_IEEE80211W
+	struct wpa_igtk igtk;
+#endif /* CONFIG_IEEE80211W */

 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */

--
2.7.4

From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sun, 1 Oct 2017 12:12:24 +0300
Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
 Mode cases

This extends the protection to track last configured GTK/IGTK value
separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
corner case where these two different mechanisms may get used when the
GTK/IGTK has changed and tracking a single value is not sufficient to
detect a possible key reconfiguration.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/rsn_supp/wpa.c   | 53 +++++++++++++++++++++++++++++++++++++---------------
 src/rsn_supp/wpa_i.h |  2 ++
 2 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 95bd7be..7a2c68d 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -709,14 +709,17 @@ struct wpa_gtk_data {

 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 				      const struct wpa_gtk_data *gd,
-				      const u8 *key_rsc)
+				      const u8 *key_rsc, int wnm_sleep)
 {
 	const u8 *_gtk = gd->gtk;
 	u8 gtk_buf[32];

 	/* Detect possible key reinstallation */
-	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
-	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
+	if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
+	     os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
+	    (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
+	     os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
+		       sm->gtk_wnm_sleep.gtk_len) == 0)) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
 			gd->keyidx, gd->tx, gd->gtk_len);
@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 	}
 	os_memset(gtk_buf, 0, sizeof(gtk_buf));

-	sm->gtk.gtk_len = gd->gtk_len;
-	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
+	if (wnm_sleep) {
+		sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
+		os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
+			  sm->gtk_wnm_sleep.gtk_len);
+	} else {
+		sm->gtk.gtk_len = gd->gtk_len;
+		os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
+	}

 	return 0;
 }
@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
 	    (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
 					       gtk_len, gtk_len,
 					       &gd.key_rsc_len, &gd.alg) ||
-	     wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
+	     wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"RSN: Failed to install GTK");
 		os_memset(&gd, 0, sizeof(gd));
@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,

 #ifdef CONFIG_IEEE80211W
 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
-				       const struct wpa_igtk_kde *igtk)
+				       const struct wpa_igtk_kde *igtk,
+				       int wnm_sleep)
 {
 	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 	u16 keyidx = WPA_GET_LE16(igtk->keyid);

 	/* Detect possible key reinstallation */
-	if (sm->igtk.igtk_len == len &&
-	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
+	if ((sm->igtk.igtk_len == len &&
+	     os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
+	    (sm->igtk_wnm_sleep.igtk_len == len &&
+	     os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
+		       sm->igtk_wnm_sleep.igtk_len) == 0)) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
 			keyidx);
@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
 		return -1;
 	}

-	sm->igtk.igtk_len = len;
-	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
+	if (wnm_sleep) {
+		sm->igtk_wnm_sleep.igtk_len = len;
+		os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
+			  sm->igtk_wnm_sleep.igtk_len);
+	} else {
+		sm->igtk.igtk_len = len;
+		os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
+	}

 	return 0;
 }
@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
 			return -1;

 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
-		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
+		if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
 			return -1;
 	}

@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
 	if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
 		key_rsc = null_rsc;

-	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
+	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
 	    wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
 		goto failed;
 	os_memset(&gd, 0, sizeof(gd));
@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
 		sm->tptk_set = 0;
 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
+		os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 #ifdef CONFIG_IEEE80211W
 		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
+		os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 #endif /* CONFIG_IEEE80211W */
 	}

@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
+	os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 #ifdef CONFIG_IEEE80211W
 	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
+	os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 #endif /* CONFIG_IEEE80211W */
 #ifdef CONFIG_IEEE80211R
 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)

 		wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
 				gd.gtk, gd.gtk_len);
-		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
+		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
 			os_memset(&gd, 0, sizeof(gd));
 			wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
 				   "WNM mode");
@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
 		const struct wpa_igtk_kde *igtk;

 		igtk = (const struct wpa_igtk_kde *) (buf + 2);
-		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
+		if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
 			return -1;
 #endif /* CONFIG_IEEE80211W */
 	} else {
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index afc9e37..9a54631 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -32,8 +32,10 @@ struct wpa_sm {
 	int rx_replay_counter_set;
 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
 	struct wpa_gtk gtk;
+	struct wpa_gtk gtk_wnm_sleep;
 #ifdef CONFIG_IEEE80211W
 	struct wpa_igtk igtk;
+	struct wpa_igtk igtk_wnm_sleep;
 #endif /* CONFIG_IEEE80211W */

 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
--
2.7.4


code:
Fix a nonce re-use bug:

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

Patch copied from upstream:

https://w1.fi/security/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch

From 12fac09b437a1dc8a0f253e265934a8aaf4d2f8b Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sun, 1 Oct 2017 12:32:57 +0300
Subject: [PATCH 5/8] Fix PTK rekeying to generate a new ANonce

The Authenticator state machine path for PTK rekeying ended up bypassing
the AUTHENTICATION2 state where a new ANonce is generated when going
directly to the PTKSTART state since there is no need to try to
determine the PMK again in such a case. This is far from ideal since the
new PTK would depend on a new nonce only from the supplicant.

Fix this by generating a new ANonce when moving to the PTKSTART state
for the purpose of starting new 4-way handshake to rekey PTK.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/ap/wpa_auth.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 707971d..bf10cc1 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -1901,6 +1901,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2)
 }

+static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
+{
+	if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
+		wpa_printf(MSG_ERROR,
+			   "WPA: Failed to get random data for ANonce");
+		sm->Disconnect = TRUE;
+		return -1;
+	}
+	wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
+		    WPA_NONCE_LEN);
+	sm->TimeoutCtr = 0;
+	return 0;
+}
+
+
 SM_STATE(WPA_PTK, INITPMK)
 {
 	u8 msk[2 * PMK_LEN];
@@ -2458,9 +2473,12 @@ SM_STEP(WPA_PTK)
 		SM_ENTER(WPA_PTK, AUTHENTICATION);
 	else if (sm->ReAuthenticationRequest)
 		SM_ENTER(WPA_PTK, AUTHENTICATION2);
-	else if (sm->PTKRequest)
-		SM_ENTER(WPA_PTK, PTKSTART);
-	else switch (sm->wpa_ptk_state) {
+	else if (sm->PTKRequest) {
+		if (wpa_auth_sm_ptk_update(sm) < 0)
+			SM_ENTER(WPA_PTK, DISCONNECTED);
+		else
+			SM_ENTER(WPA_PTK, PTKSTART);
+	} else switch (sm->wpa_ptk_state) {
 	case WPA_PTK_INITIALIZE:
 		break;
 	case WPA_PTK_DISCONNECT:
--
2.7.4


code:
Don't install a zeroed encryption key:

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

Patch copied from upstream:
https://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch

From 8f82bc94e8697a9d47fa8774dfdaaede1084912c Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Date: Fri, 29 Sep 2017 04:22:51 +0200
Subject: [PATCH 4/8] Prevent installation of an all-zero TK

Properly track whether a PTK has already been installed to the driver
and the TK part cleared from memory. This prevents an attacker from
trying to trick the client into installing an all-zero TK.

This fixes the earlier fix in commit
ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the
driver in EAPOL-Key 3/4 retry case') which did not take into account
possibility of an extra message 1/4 showing up between retries of
message 3/4.

Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
---
 src/common/wpa_common.h | 1 +
 src/rsn_supp/wpa.c      | 5 ++---
 src/rsn_supp/wpa_i.h    | 1 -
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index d200285..1021ccb 100644
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -215,6 +215,7 @@ struct wpa_ptk {
 	size_t kck_len;
 	size_t kek_len;
 	size_t tk_len;
+	int installed; /* 1 if key has already been installed to driver */
 };

 struct wpa_gtk {
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 7a2c68d..0550a41 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -510,7 +510,6 @@ static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
 		os_memset(buf, 0, sizeof(buf));
 	}
 	sm->tptk_set = 1;
-	sm->tk_to_set = 1;

 	kde = sm->assoc_wpa_ie;
 	kde_len = sm->assoc_wpa_ie_len;
@@ -615,7 +614,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
 	enum wpa_alg alg;
 	const u8 *key_rsc;

-	if (!sm->tk_to_set) {
+	if (sm->ptk.installed) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Do not re-install same PTK to the driver");
 		return 0;
@@ -659,7 +658,7 @@ static int wpa_supplicant_install_ptk(struct wpa_sm *sm,

 	/* TK is not needed anymore in supplicant */
 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
-	sm->tk_to_set = 0;
+	sm->ptk.installed = 1;

 	if (sm->wpa_ptk_rekey) {
 		eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index 9a54631..41f371f 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -24,7 +24,6 @@ struct wpa_sm {
 	struct wpa_ptk ptk, tptk;
 	int ptk_set, tptk_set;
 	unsigned int msg_3_of_4_ok:1;
-	unsigned int tk_to_set:1;
 	u8 snonce[WPA_NONCE_LEN];
 	u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
 	int renew_snonce;
--
2.7.4


code:
These three patches are follow-ups to the bug fixes for the 'KRACK' key
re-installation attacks on Wi-Fi's WPA2 security protocol. See upstream
security announcement for more information:

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

These three patches copied from upstream:

https://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
https://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
https://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch

From 6c4bed4f47d1960ec04981a9d50e5076aea5223d Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 22 Sep 2017 11:03:15 +0300
Subject: [PATCH 6/8] TDLS: Reject TPK-TK reconfiguration

Do not try to reconfigure the same TPK-TK to the driver after it has
been successfully configured. This is an explicit check to avoid issues
related to resetting the TX/RX packet number. There was already a check
for this for TPK M2 (retries of that message are ignored completely), so
that behavior does not get modified.

For TPK M3, the TPK-TK could have been reconfigured, but that was
followed by immediate teardown of the link due to an issue in updating
the STA entry. Furthermore, for TDLS with any real security (i.e.,
ignoring open/WEP), the TPK message exchange is protected on the AP path
and simple replay attacks are not feasible.

As an additional corner case, make sure the local nonce gets updated if
the peer uses a very unlikely "random nonce" of all zeros.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/rsn_supp/tdls.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
index e424168..9eb9738 100644
--- a/src/rsn_supp/tdls.c
+++ b/src/rsn_supp/tdls.c
@@ -112,6 +112,7 @@ struct wpa_tdls_peer {
 		u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
 	} tpk;
 	int tpk_set;
+	int tk_set; /* TPK-TK configured to the driver */
 	int tpk_success;
 	int tpk_in_progress;

@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 	u8 rsc[6];
 	enum wpa_alg alg;

+	if (peer->tk_set) {
+		/*
+		 * This same TPK-TK has already been configured to the driver
+		 * and this new configuration attempt (likely due to an
+		 * unexpected retransmitted frame) would result in clearing
+		 * the TX/RX sequence number which can break security, so must
+		 * not allow that to happen.
+		 */
+		wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
+			   " has already been configured to the driver - do not reconfigure",
+			   MAC2STR(peer->addr));
+		return -1;
+	}
+
 	os_memset(rsc, 0, 6);

 	switch (peer->cipher) {
@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 		return -1;
 	}

+	wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
+		   MAC2STR(peer->addr));
 	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
 			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
 		wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
 			   "driver");
 		return -1;
 	}
+	peer->tk_set = 1;
 	return 0;
 }

@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 	peer->cipher = 0;
 	peer->qos_info = 0;
 	peer->wmm_capable = 0;
-	peer->tpk_set = peer->tpk_success = 0;
+	peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
 	peer->chan_switch_enabled = 0;
 	os_memset(&peer->tpk, 0, sizeof(peer->tpk));
 	os_memset(peer->inonce, 0, WPA_NONCE_LEN);
@@ -1159,6 +1177,7 @@ skip_rsnie:
 		wpa_tdls_peer_free(sm, peer);
 		return -1;
 	}
+	peer->tk_set = 0; /* A new nonce results in a new TK */
 	wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
 		    peer->inonce, WPA_NONCE_LEN);
 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
 }

+static int tdls_nonce_set(const u8 *nonce)
+{
+	int i;
+
+	for (i = 0; i < WPA_NONCE_LEN; i++) {
+		if (nonce[i])
+			return 1;
+	}
+
+	return 0;
+}
+
+
 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
 				   const u8 *buf, size_t len)
 {
@@ -2004,7 +2036,8 @@ skip_rsn:
 	peer->rsnie_i_len = kde.rsn_ie_len;
 	peer->cipher = cipher;

-	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
+	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
+	    !tdls_nonce_set(peer->inonce)) {
 		/*
 		 * There is no point in updating the RNonce for every obtained
 		 * TPK M1 frame (e.g., retransmission due to timeout) with the
@@ -2020,6 +2053,7 @@ skip_rsn:
 				"TDLS: Failed to get random data for responder nonce");
 			goto error;
 		}
+		peer->tk_set = 0; /* A new nonce results in a new TK */
 	}

 #if 0
--
2.7.4

From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 22 Sep 2017 11:25:02 +0300
Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending
 request

Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
Mode Response if WNM-Sleep Mode has not been used') started ignoring the
response when no WNM-Sleep Mode Request had been used during the
association. This can be made tighter by clearing the used flag when
successfully processing a response. This adds an additional layer of
protection against unexpected retransmissions of the response frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 wpa_supplicant/wnm_sta.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 1b3409c..67a07ff 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,

 	if (!wpa_s->wnmsleep_used) {
 		wpa_printf(MSG_DEBUG,
-			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
+			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
 		return;
 	}

@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
 		return;
 	}

+	wpa_s->wnmsleep_used = 0;
+
 	if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
 	    wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
 		wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
--
2.7.4

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

Patch copied from upstream:

https://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch

From b372ab0b7daea719749194dc554b26e6367603f2 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 22 Sep 2017 12:06:37 +0300
Subject: [PATCH 8/8] FT: Do not allow multiple Reassociation Response frames

The driver is expected to not report a second association event without
the station having explicitly request a new association. As such, this
case should not be reachable. However, since reconfiguring the same
pairwise or group keys to the driver could result in nonce reuse issues,
be extra careful here and do an additional state check to avoid this
even if the local driver ends up somehow accepting an unexpected
Reassociation Response frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/rsn_supp/wpa.c    | 3 +++
 src/rsn_supp/wpa_ft.c | 8 ++++++++
 src/rsn_supp/wpa_i.h  | 1 +
 3 files changed, 12 insertions(+)

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index 0550a41..2a53c6f 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -2440,6 +2440,9 @@ void wpa_sm_notify_disassoc(struct wpa_sm *sm)
 #ifdef CONFIG_TDLS
 	wpa_tdls_disassoc(sm);
 #endif /* CONFIG_TDLS */
+#ifdef CONFIG_IEEE80211R
+	sm->ft_reassoc_completed = 0;
+#endif /* CONFIG_IEEE80211R */

 	/* Keys are not needed in the WPA state machine anymore */
 	wpa_sm_drop_sa(sm);
diff --git a/src/rsn_supp/wpa_ft.c b/src/rsn_supp/wpa_ft.c
index 205793e..d45bb45 100644
--- a/src/rsn_supp/wpa_ft.c
+++ b/src/rsn_supp/wpa_ft.c
@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
 	u16 capab;

 	sm->ft_completed = 0;
+	sm->ft_reassoc_completed = 0;

 	buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
 		2 + sm->r0kh_id_len + ric_ies_len + 100;
@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
 		return -1;
 	}

+	if (sm->ft_reassoc_completed) {
+		wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
+		return 0;
+	}
+
 	if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
 		wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
 		return -1;
@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct wpa_sm *sm, const u8 *ies,
 		return -1;
 	}

+	sm->ft_reassoc_completed = 1;
+
 	if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
 		return -1;

diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
index 41f371f..56f88dc 100644
--- a/src/rsn_supp/wpa_i.h
+++ b/src/rsn_supp/wpa_i.h
@@ -128,6 +128,7 @@ struct wpa_sm {
 	size_t r0kh_id_len;
 	u8 r1kh_id[FT_R1KH_ID_LEN];
 	int ft_completed;
+	int ft_reassoc_completed;
 	int over_the_ds_in_progress;
 	u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
 	int set_ptk_after_assoc;
--
2.7.4


code:
This fixes the wxplot2d plotting issue found at
https://github.com/andrejv/wxmaxima/issues/973.

From 5a0693c97ceaa4935b908f1e478126896952f399 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gunter=20K=C3=B6nigsmann?= <gunter@peterpall.de>
Date: Mon, 19 Feb 2018 05:37:35 +0100
Subject: [PATCH] Seems I accidentally made wxMaxima to default to parameters
 for old gnuplots. Resolves #973

---
 data/wxmathml.lisp.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/wxmathml.lisp.in b/data/wxmathml.lisp.in
index a32e3fc3..4e19acaf 100644
--- a/data/wxmathml.lisp.in
+++ b/data/wxmathml.lisp.in
@@ -43,7 +43,7 @@
 (defvar $wxsubscripts t
   "Recognize TeX-style subscripts")
 (defvar $wxplot_pngcairo nil "Use gnuplot's pngcairo terminal for new plots?")
-(defmvar $wxplot_old_gnuplot t)
+(defmvar $wxplot_old_gnuplot nil)

 (defun $wxstatusbar (status)
   (format t "<statusbar>~a</statusbar>~%" status))


code:
From <https://git.busybox.net/buildroot/tree/package/x265/0003-arm-asm-primitives.patch?id=57d4a27eaf1a9e59d767c321e7b7500c5060a2ac>.
This fixes build errors like:

  cd /tmp/guix-build-x265-2.8.drv-0/x265_2.8/build/encoder && /gnu/store/cd5q2pni1d95fs3cdabbclyh9hqhw2nq-gcc-5.5.0/bin/c++  -DEXPORT_C_API=1 -DHAVE_ARMV6=1 -DHAVE_INT_TYPES_H=1 -DHAVE_NEON -DHIGH_BIT_DEPTH=0 -DX265_ARCH_ARM=1 -DX265_DEPTH=8 -DX265_NS=x265 -D__STDC_LIMIT_MACROS=1 -I/tmp/guix-build-x265-2.8.drv-0/x265_2.8/source/. -I/tmp/guix-build-x265-2.8.drv-0/x265_2.8/source/common -I/tmp/guix-build-x265-2.8.drv-0/x265_2.8/source/encoder -I/tmp/guix-build-x265-2.8.drv-0/x265_2.8/build  -O2 -g -DNDEBUG   -Wall -Wextra -Wshadow -std=gnu++98 -fPIC -mcpu=native -mfloat-abi=hard -mfpu=neon -marm -fPIC -Wno-array-bounds -ffast-math -fno-exceptions -Wno-uninitialized -o CMakeFiles/encoder.dir/search.cpp.o -c /tmp/guix-build-x265-2.8.drv-0/x265_2.8/source/encoder/search.cpp
  /tmp/guix-build-x265-2.8.drv-0/x265_2.8/source/common/arm/asm-primitives.cpp:437:38: error: incompatible types in assignment of ?void(const pixel*, intptr_t, int16_t*, intptr_t) {aka void(const unsigned char*, int, short int*, int)}? to ?void (* [2])(const pixel*, intptr_t, int16_t*, intptr_t) {aka void (* [2])(const unsigned char*, int, short int*, int)}?
	   p.pu[LUMA_64x48].convert_p2s = PFX(filterPixelToShort_64x48_neon);
					^

Downloaded from upstream bug report:
https://bitbucket.org/multicoreware/x265/issues/406

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>

--- ./source/common/arm/asm-primitives.cpp.orig	2018-05-21 02:33:10.000000000 -0600
+++ ./source/common/arm/asm-primitives.cpp	2018-05-28 20:38:37.302378303 -0600
@@ -48,77 +48,77 @@ void setupAssemblyPrimitives(EncoderPrim
         p.ssim_4x4x2_core = PFX(ssim_4x4x2_core_neon);

         // addAvg
-         p.pu[LUMA_4x4].addAvg   = PFX(addAvg_4x4_neon);
-         p.pu[LUMA_4x8].addAvg   = PFX(addAvg_4x8_neon);
-         p.pu[LUMA_4x16].addAvg  = PFX(addAvg_4x16_neon);
-         p.pu[LUMA_8x4].addAvg   = PFX(addAvg_8x4_neon);
-         p.pu[LUMA_8x8].addAvg   = PFX(addAvg_8x8_neon);
-         p.pu[LUMA_8x16].addAvg  = PFX(addAvg_8x16_neon);
-         p.pu[LUMA_8x32].addAvg  = PFX(addAvg_8x32_neon);
-         p.pu[LUMA_12x16].addAvg = PFX(addAvg_12x16_neon);
-         p.pu[LUMA_16x4].addAvg  = PFX(addAvg_16x4_neon);
-         p.pu[LUMA_16x8].addAvg  = PFX(addAvg_16x8_neon);
-         p.pu[LUMA_16x12].addAvg = PFX(addAvg_16x12_neon);
-         p.pu[LUMA_16x16].addAvg = PFX(addAvg_16x16_neon);
-         p.pu[LUMA_16x32].addAvg = PFX(addAvg_16x32_neon);
-         p.pu[LUMA_16x64].addAvg = PFX(addAvg_16x64_neon);
-         p.pu[LUMA_24x32].addAvg = PFX(addAvg_24x32_neon);
-         p.pu[LUMA_32x8].addAvg  = PFX(addAvg_32x8_neon);
-         p.pu[LUMA_32x16].addAvg = PFX(addAvg_32x16_neon);
-         p.pu[LUMA_32x24].addAvg = PFX(addAvg_32x24_neon);
-         p.pu[LUMA_32x32].addAvg = PFX(addAvg_32x32_neon);
-         p.pu[LUMA_32x64].addAvg = PFX(addAvg_32x64_neon);
-         p.pu[LUMA_48x64].addAvg = PFX(addAvg_48x64_neon);
-         p.pu[LUMA_64x16].addAvg = PFX(addAvg_64x16_neon);
-         p.pu[LUMA_64x32].addAvg = PFX(addAvg_64x32_neon);
-         p.pu[LUMA_64x48].addAvg = PFX(addAvg_64x48_neon);
-         p.pu[LUMA_64x64].addAvg = PFX(addAvg_64x64_neon);
+         p.pu[LUMA_4x4].addAvg[ALIGNED]   = PFX(addAvg_4x4_neon);
+         p.pu[LUMA_4x8].addAvg[ALIGNED]   = PFX(addAvg_4x8_neon);
+         p.pu[LUMA_4x16].addAvg[ALIGNED]  = PFX(addAvg_4x16_neon);
+         p.pu[LUMA_8x4].addAvg[ALIGNED]   = PFX(addAvg_8x4_neon);
+         p.pu[LUMA_8x8].addAvg[ALIGNED]   = PFX(addAvg_8x8_neon);
+         p.pu[LUMA_8x16].addAvg[ALIGNED]  = PFX(addAvg_8x16_neon);
+         p.pu[LUMA_8x32].addAvg[ALIGNED]  = PFX(addAvg_8x32_neon);
+         p.pu[LUMA_12x16].addAvg[ALIGNED] = PFX(addAvg_12x16_neon);
+         p.pu[LUMA_16x4].addAvg[ALIGNED]  = PFX(addAvg_16x4_neon);
+         p.pu[LUMA_16x8].addAvg[ALIGNED]  = PFX(addAvg_16x8_neon);
+         p.pu[LUMA_16x12].addAvg[ALIGNED] = PFX(addAvg_16x12_neon);
+         p.pu[LUMA_16x16].addAvg[ALIGNED] = PFX(addAvg_16x16_neon);
+         p.pu[LUMA_16x32].addAvg[ALIGNED] = PFX(addAvg_16x32_neon);
+         p.pu[LUMA_16x64].addAvg[ALIGNED] = PFX(addAvg_16x64_neon);
+         p.pu[LUMA_24x32].addAvg[ALIGNED] = PFX(addAvg_24x32_neon);
+         p.pu[LUMA_32x8].addAvg[ALIGNED]  = PFX(addAvg_32x8_neon);
+         p.pu[LUMA_32x16].addAvg[ALIGNED] = PFX(addAvg_32x16_neon);
+         p.pu[LUMA_32x24].addAvg[ALIGNED] = PFX(addAvg_32x24_neon);
+         p.pu[LUMA_32x32].addAvg[ALIGNED] = PFX(addAvg_32x32_neon);
+         p.pu[LUMA_32x64].addAvg[ALIGNED] = PFX(addAvg_32x64_neon);
+         p.pu[LUMA_48x64].addAvg[ALIGNED] = PFX(addAvg_48x64_neon);
+         p.pu[LUMA_64x16].addAvg[ALIGNED] = PFX(addAvg_64x16_neon);
+         p.pu[LUMA_64x32].addAvg[ALIGNED] = PFX(addAvg_64x32_neon);
+         p.pu[LUMA_64x48].addAvg[ALIGNED] = PFX(addAvg_64x48_neon);
+         p.pu[LUMA_64x64].addAvg[ALIGNED] = PFX(addAvg_64x64_neon);

         // chroma addAvg
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x2].addAvg   = PFX(addAvg_4x2_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x4].addAvg   = PFX(addAvg_4x4_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x8].addAvg   = PFX(addAvg_4x8_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x16].addAvg  = PFX(addAvg_4x16_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_6x8].addAvg   = PFX(addAvg_6x8_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x2].addAvg   = PFX(addAvg_8x2_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x4].addAvg   = PFX(addAvg_8x4_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x6].addAvg   = PFX(addAvg_8x6_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x8].addAvg   = PFX(addAvg_8x8_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x16].addAvg  = PFX(addAvg_8x16_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x32].addAvg  = PFX(addAvg_8x32_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_12x16].addAvg = PFX(addAvg_12x16_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x4].addAvg  = PFX(addAvg_16x4_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x8].addAvg  = PFX(addAvg_16x8_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x12].addAvg = PFX(addAvg_16x12_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x16].addAvg = PFX(addAvg_16x16_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x32].addAvg = PFX(addAvg_16x32_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_24x32].addAvg = PFX(addAvg_24x32_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x8].addAvg  = PFX(addAvg_32x8_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x16].addAvg = PFX(addAvg_32x16_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x24].addAvg = PFX(addAvg_32x24_neon);
-        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x32].addAvg = PFX(addAvg_32x32_neon);
-
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x8].addAvg   = PFX(addAvg_4x8_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x16].addAvg  = PFX(addAvg_4x16_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x32].addAvg  = PFX(addAvg_4x32_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_6x16].addAvg  = PFX(addAvg_6x16_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x4].addAvg   = PFX(addAvg_8x4_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x8].addAvg   = PFX(addAvg_8x8_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x12].addAvg  = PFX(addAvg_8x12_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x16].addAvg  = PFX(addAvg_8x16_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x32].addAvg  = PFX(addAvg_8x32_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x64].addAvg  = PFX(addAvg_8x64_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_12x32].addAvg = PFX(addAvg_12x32_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x8].addAvg  = PFX(addAvg_16x8_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x16].addAvg = PFX(addAvg_16x16_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x24].addAvg = PFX(addAvg_16x24_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x32].addAvg = PFX(addAvg_16x32_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x64].addAvg = PFX(addAvg_16x64_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_24x64].addAvg = PFX(addAvg_24x64_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x16].addAvg = PFX(addAvg_32x16_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x32].addAvg = PFX(addAvg_32x32_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x48].addAvg = PFX(addAvg_32x48_neon);
-        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x64].addAvg = PFX(addAvg_32x64_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x2].addAvg[ALIGNED]   = PFX(addAvg_4x2_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x4].addAvg[ALIGNED]   = PFX(addAvg_4x4_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x8].addAvg[ALIGNED]   = PFX(addAvg_4x8_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_4x16].addAvg[ALIGNED]  = PFX(addAvg_4x16_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_6x8].addAvg[ALIGNED]   = PFX(addAvg_6x8_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x2].addAvg[ALIGNED]   = PFX(addAvg_8x2_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x4].addAvg[ALIGNED]   = PFX(addAvg_8x4_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x6].addAvg[ALIGNED]   = PFX(addAvg_8x6_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x8].addAvg[ALIGNED]   = PFX(addAvg_8x8_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x16].addAvg[ALIGNED]  = PFX(addAvg_8x16_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_8x32].addAvg[ALIGNED]  = PFX(addAvg_8x32_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_12x16].addAvg[ALIGNED] = PFX(addAvg_12x16_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x4].addAvg[ALIGNED]  = PFX(addAvg_16x4_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x8].addAvg[ALIGNED]  = PFX(addAvg_16x8_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x12].addAvg[ALIGNED] = PFX(addAvg_16x12_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x16].addAvg[ALIGNED] = PFX(addAvg_16x16_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_16x32].addAvg[ALIGNED] = PFX(addAvg_16x32_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_24x32].addAvg[ALIGNED] = PFX(addAvg_24x32_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x8].addAvg[ALIGNED]  = PFX(addAvg_32x8_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x16].addAvg[ALIGNED] = PFX(addAvg_32x16_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x24].addAvg[ALIGNED] = PFX(addAvg_32x24_neon);
+        p.chroma[X265_CSP_I420].pu[CHROMA_420_32x32].addAvg[ALIGNED] = PFX(addAvg_32x32_neon);
+
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x8].addAvg[ALIGNED]   = PFX(addAvg_4x8_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x16].addAvg[ALIGNED]  = PFX(addAvg_4x16_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_4x32].addAvg[ALIGNED]  = PFX(addAvg_4x32_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_6x16].addAvg[ALIGNED]  = PFX(addAvg_6x16_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x4].addAvg[ALIGNED]   = PFX(addAvg_8x4_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x8].addAvg[ALIGNED]   = PFX(addAvg_8x8_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x12].addAvg[ALIGNED]  = PFX(addAvg_8x12_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x16].addAvg[ALIGNED]  = PFX(addAvg_8x16_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x32].addAvg[ALIGNED]  = PFX(addAvg_8x32_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_8x64].addAvg[ALIGNED]  = PFX(addAvg_8x64_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_12x32].addAvg[ALIGNED] = PFX(addAvg_12x32_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x8].addAvg[ALIGNED]  = PFX(addAvg_16x8_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x16].addAvg[ALIGNED] = PFX(addAvg_16x16_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x24].addAvg[ALIGNED] = PFX(addAvg_16x24_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x32].addAvg[ALIGNED] = PFX(addAvg_16x32_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_16x64].addAvg[ALIGNED] = PFX(addAvg_16x64_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_24x64].addAvg[ALIGNED] = PFX(addAvg_24x64_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x16].addAvg[ALIGNED] = PFX(addAvg_32x16_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x32].addAvg[ALIGNED] = PFX(addAvg_32x32_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x48].addAvg[ALIGNED] = PFX(addAvg_32x48_neon);
+        p.chroma[X265_CSP_I422].pu[CHROMA_422_32x64].addAvg[ALIGNED] = PFX(addAvg_32x64_neon);

         // quant
          p.quant = PFX(quant_neon);
@@ -402,7 +402,7 @@ void setupAssemblyPrimitives(EncoderPrim
         p.scale2D_64to32  = PFX(scale2D_64to32_neon);

         // scale1D_128to64
-        p.scale1D_128to64 = PFX(scale1D_128to64_neon);
+        p.scale1D_128to64[ALIGNED] = PFX(scale1D_128to64_neon);

         // copy_count
         p.cu[BLOCK_4x4].copy_cnt     = PFX(copy_cnt_4_neon);
@@ -411,37 +411,37 @@ void setupAssemblyPrimitives(EncoderPrim
         p.cu[BLOCK_32x32].copy_cnt   = PFX(copy_cnt_32_neon);

         // filterPixelToShort
-        p.pu[LUMA_4x4].convert_p2s   = PFX(filterPixelToShort_4x4_neon);
-        p.pu[LUMA_4x8].convert_p2s   = PFX(filterPixelToShort_4x8_neon);
-        p.pu[LUMA_4x16].convert_p2s  = PFX(filterPixelToShort_4x16_neon);
-        p.pu[LUMA_8x4].convert_p2s   = PFX(filterPixelToShort_8x4_neon);
-        p.pu[LUMA_8x8].convert_p2s   = PFX(filterPixelToShort_8x8_neon);
-        p.pu[LUMA_8x16].convert_p2s  = PFX(filterPixelToShort_8x16_neon);
-        p.pu[LUMA_8x32].convert_p2s  = PFX(filterPixelToShort_8x32_neon);
-        p.pu[LUMA_12x16].convert_p2s = PFX(filterPixelToShort_12x16_neon);
-        p.pu[LUMA_16x4].convert_p2s  = PFX(filterPixelToShort_16x4_neon);
-        p.pu[LUMA_16x8].convert_p2s  = PFX(filterPixelToShort_16x8_neon);
-        p.pu[LUMA_16x12].convert_p2s = PFX(filterPixelToShort_16x12_neon);
-        p.pu[LUMA_16x16].convert_p2s = PFX(filterPixelToShort_16x16_neon);
-        p.pu[LUMA_16x32].convert_p2s = PFX(filterPixelToShort_16x32_neon);
-        p.pu[LUMA_16x64].convert_p2s = PFX(filterPixelToShort_16x64_neon);
-        p.pu[LUMA_24x32].convert_p2s = PFX(filterPixelToShort_24x32_neon);
-        p.pu[LUMA_32x8].convert_p2s  = PFX(filterPixelToShort_32x8_neon);
-        p.pu[LUMA_32x16].convert_p2s = PFX(filterPixelToShort_32x16_neon);
-        p.pu[LUMA_32x24].convert_p2s = PFX(filterPixelToShort_32x24_neon);
-        p.pu[LUMA_32x32].convert_p2s = PFX(filterPixelToShort_32x32_neon);
-        p.pu[LUMA_32x64].convert_p2s = PFX(filterPixelToShort_32x64_neon);
-        p.pu[LUMA_48x64].convert_p2s = PFX(filterPixelToShort_48x64_neon);
-        p.pu[LUMA_64x16].convert_p2s = PFX(filterPixelToShort_64x16_neon);
-        p.pu[LUMA_64x32].convert_p2s = PFX(filterPixelToShort_64x32_neon);
-        p.pu[LUMA_64x48].convert_p2s = PFX(filterPixelToShort_64x48_neon);
-        p.pu[LUMA_64x64].convert_p2s = PFX(filterPixelToShort_64x64_neon);
+        p.pu[LUMA_4x4].convert_p2s[ALIGNED]   = PFX(filterPixelToShort_4x4_neon);
+        p.pu[LUMA_4x8].convert_p2s[ALIGNED]   = PFX(filterPixelToShort_4x8_neon);
+        p.pu[LUMA_4x16].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_4x16_neon);
+        p.pu[LUMA_8x4].convert_p2s[ALIGNED]   = PFX(filterPixelToShort_8x4_neon);
+        p.pu[LUMA_8x8].convert_p2s[ALIGNED]   = PFX(filterPixelToShort_8x8_neon);
+        p.pu[LUMA_8x16].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_8x16_neon);
+        p.pu[LUMA_8x32].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_8x32_neon);
+        p.pu[LUMA_12x16].convert_p2s[ALIGNED] = PFX(filterPixelToShort_12x16_neon);
+        p.pu[LUMA_16x4].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_16x4_neon);
+        p.pu[LUMA_16x8].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_16x8_neon);
+        p.pu[LUMA_16x12].convert_p2s[ALIGNED] = PFX(filterPixelToShort_16x12_neon);
+        p.pu[LUMA_16x16].convert_p2s[ALIGNED] = PFX(filterPixelToShort_16x16_neon);
+        p.pu[LUMA_16x32].convert_p2s[ALIGNED] = PFX(filterPixelToShort_16x32_neon);
+        p.pu[LUMA_16x64].convert_p2s[ALIGNED] = PFX(filterPixelToShort_16x64_neon);
+        p.pu[LUMA_24x32].convert_p2s[ALIGNED] = PFX(filterPixelToShort_24x32_neon);
+        p.pu[LUMA_32x8].convert_p2s[ALIGNED]  = PFX(filterPixelToShort_32x8_neon);
+        p.pu[LUMA_32x16].convert_p2s[ALIGNED] = PFX(filterPixelToShort_32x16_neon);
+        p.pu[LUMA_32x24].convert_p2s[ALIGNED] = PFX(filterPixelToShort_32x24_neon);
+        p.pu[LUMA_32x32].convert_p2s[ALIGNED] = PFX(filterPixelToShort_32x32_neon);
+        p.pu[LUMA_32x64].convert_p2s[ALIGNED] = PFX(filterPixelToShort_32x64_neon);
+        p.pu[LUMA_48x64].convert_p2s[ALIGNED] = PFX(filterPixelToShort_48x64_neon);
+        p.pu[LUMA_64x16].convert_p2s[ALIGNED] = PFX(filterPixelToShort_64x16_neon);
+        p.pu[LUMA_64x32].convert_p2s[ALIGNED] = PFX(filterPixelToShort_64x32_neon);
+        p.pu[LUMA_64x48].convert_p2s[ALIGNED] = PFX(filterPixelToShort_64x48_neon);
+        p.pu[LUMA_64x64].convert_p2s[ALIGNED] = PFX(filterPixelToShort_64x64_neon);

         // Block_fill
-        p.cu[BLOCK_4x4].blockfill_s   = PFX(blockfill_s_4x4_neon);
-        p.cu[BLOCK_8x8].blockfill_s   = PFX(blockfill_s_8x8_neon);
-        p.cu[BLOCK_16x16].blockfill_s = PFX(blockfill_s_16x16_neon);
-        p.cu[BLOCK_32x32].blockfill_s = PFX(blockfill_s_32x32_neon);
+        p.cu[BLOCK_4x4].blockfill_s[ALIGNED]   = PFX(blockfill_s_4x4_neon);
+        p.cu[BLOCK_8x8].blockfill_s[ALIGNED]   = PFX(blockfill_s_8x8_neon);
+        p.cu[BLOCK_16x16].blockfill_s[ALIGNED] = PFX(blockfill_s_16x16_neon);
+        p.cu[BLOCK_32x32].blockfill_s[ALIGNED] = PFX(blockfill_s_32x32_neon);

         // Blockcopy_ss
         p.cu[BLOCK_4x4].copy_ss   = PFX(blockcopy_ss_4x4_neon);
@@ -495,21 +495,21 @@ void setupAssemblyPrimitives(EncoderPrim
         p.chroma[X265_CSP_I422].cu[BLOCK_422_32x64].copy_sp = PFX(blockcopy_sp_32x64_neon);

         // pixel_add_ps
-        p.cu[BLOCK_4x4].add_ps   = PFX(pixel_add_ps_4x4_neon);
-        p.cu[BLOCK_8x8].add_ps   = PFX(pixel_add_ps_8x8_neon);
-        p.cu[BLOCK_16x16].add_ps = PFX(pixel_add_ps_16x16_neon);
-        p.cu[BLOCK_32x32].add_ps = PFX(pixel_add_ps_32x32_neon);
-        p.cu[BLOCK_64x64].add_ps = PFX(pixel_add_ps_64x64_neon);
+        p.cu[BLOCK_4x4].add_ps[ALIGNED]   = PFX(pixel_add_ps_4x4_neon);
+        p.cu[BLOCK_8x8].add_ps[ALIGNED]   = PFX(pixel_add_ps_8x8_neon);
+        p.cu[BLOCK_16x16].add_ps[ALIGNED] = PFX(pixel_add_ps_16x16_neon);
+        p.cu[BLOCK_32x32].add_ps[ALIGNED] = PFX(pixel_add_ps_32x32_neon);
+        p.cu[BLOCK_64x64].add_ps[ALIGNED] = PFX(pixel_add_ps_64x64_neon);

         // chroma add_ps
-        p.chroma[X265_CSP_I420].cu[BLOCK_420_4x4].add_ps   = PFX(pixel_add_ps_4x4_neon);
-        p.chroma[X265_CSP_I420].cu[BLOCK_420_8x8].add_ps   = PFX(pixel_add_ps_8x8_neon);
-        p.chroma[X265_CSP_I420].cu[BLOCK_420_16x16].add_ps = PFX(pixel_add_ps_16x16_neon);
-        p.chroma[X265_CSP_I420].cu[BLOCK_420_32x32].add_ps = PFX(pixel_add_ps_32x32_neon);
-        p.chroma[X265_CSP_I422].cu[BLOCK_422_4x8].add_ps   = PFX(pixel_add_ps_4x8_neon);
-        p.chroma[X265_CSP_I422].cu[BLOCK_422_8x16].add_ps  = PFX(pixel_add_ps_8x16_neon);
-        p.chroma[X265_CSP_I422].cu[BLOCK_422_16x32].add_ps = PFX(pixel_add_ps_16x32_neon);
-        p.chroma[X265_CSP_I422].cu[BLOCK_422_32x64].add_ps = PFX(pixel_add_ps_32x64_neon);
+        p.chroma[X265_CSP_I420].cu[BLOCK_420_4x4].add_ps[ALIGNED]   = PFX(pixel_add_ps_4x4_neon);
+        p.chroma[X265_CSP_I420].cu[BLOCK_420_8x8].add_ps[ALIGNED]   = PFX(pixel_add_ps_8x8_neon);
+        p.chroma[X265_CSP_I420].cu[BLOCK_420_16x16].add_ps[ALIGNED] = PFX(pixel_add_ps_16x16_neon);
+        p.chroma[X265_CSP_I420].cu[BLOCK_420_32x32].add_ps[ALIGNED] = PFX(pixel_add_ps_32x32_neon);
+        p.chroma[X265_CSP_I422].cu[BLOCK_422_4x8].add_ps[ALIGNED]   = PFX(pixel_add_ps_4x8_neon);
+        p.chroma[X265_CSP_I422].cu[BLOCK_422_8x16].add_ps[ALIGNED]  = PFX(pixel_add_ps_8x16_neon);
+        p.chroma[X265_CSP_I422].cu[BLOCK_422_16x32].add_ps[ALIGNED] = PFX(pixel_add_ps_16x32_neon);
+        p.chroma[X265_CSP_I422].cu[BLOCK_422_32x64].add_ps[ALIGNED] = PFX(pixel_add_ps_32x64_neon);

         // cpy2Dto1D_shr
         p.cu[BLOCK_4x4].cpy2Dto1D_shr   = PFX(cpy2Dto1D_shr_4x4_neon);
@@ -518,10 +518,10 @@ void setupAssemblyPrimitives(EncoderPrim
         p.cu[BLOCK_32x32].cpy2Dto1D_shr = PFX(cpy2Dto1D_shr_32x32_neon);

         // ssd_s
-        p.cu[BLOCK_4x4].ssd_s   = PFX(pixel_ssd_s_4x4_neon);
-        p.cu[BLOCK_8x8].ssd_s   = PFX(pixel_ssd_s_8x8_neon);
-        p.cu[BLOCK_16x16].ssd_s = PFX(pixel_ssd_s_16x16_neon);
-        p.cu[BLOCK_32x32].ssd_s = PFX(pixel_ssd_s_32x32_neon);
+        p.cu[BLOCK_4x4].ssd_s[ALIGNED]   = PFX(pixel_ssd_s_4x4_neon);
+        p.cu[BLOCK_8x8].ssd_s[ALIGNED]   = PFX(pixel_ssd_s_8x8_neon);
+        p.cu[BLOCK_16x16].ssd_s[ALIGNED] = PFX(pixel_ssd_s_16x16_neon);
+        p.cu[BLOCK_32x32].ssd_s[ALIGNED] = PFX(pixel_ssd_s_32x32_neon);

         // sse_ss
         p.cu[BLOCK_4x4].sse_ss   = PFX(pixel_sse_ss_4x4_neon);
@@ -548,10 +548,10 @@ void setupAssemblyPrimitives(EncoderPrim
         p.chroma[X265_CSP_I422].cu[BLOCK_422_32x64].sub_ps = PFX(pixel_sub_ps_32x64_neon);

         // calc_Residual
-        p.cu[BLOCK_4x4].calcresidual   = PFX(getResidual4_neon);
-        p.cu[BLOCK_8x8].calcresidual   = PFX(getResidual8_neon);
-        p.cu[BLOCK_16x16].calcresidual = PFX(getResidual16_neon);
-        p.cu[BLOCK_32x32].calcresidual = PFX(getResidual32_neon);
+        p.cu[BLOCK_4x4].calcresidual[ALIGNED]   = PFX(getResidual4_neon);
+        p.cu[BLOCK_8x8].calcresidual[ALIGNED]   = PFX(getResidual8_neon);
+        p.cu[BLOCK_16x16].calcresidual[ALIGNED] = PFX(getResidual16_neon);
+        p.cu[BLOCK_32x32].calcresidual[ALIGNED] = PFX(getResidual32_neon);

         // sse_pp
         p.cu[BLOCK_4x4].sse_pp   = PFX(pixel_sse_pp_4x4_neon);
@@ -722,31 +722,31 @@ void setupAssemblyPrimitives(EncoderPrim
         p.pu[LUMA_64x64].sad_x4 = PFX(sad_x4_64x64_neon);

         // pixel_avg_pp
-        p.pu[LUMA_4x4].pixelavg_pp   = PFX(pixel_avg_pp_4x4_neon);
-        p.pu[LUMA_4x8].pixelavg_pp   = PFX(pixel_avg_pp_4x8_neon);
-        p.pu[LUMA_4x16].pixelavg_pp  = PFX(pixel_avg_pp_4x16_neon);
-        p.pu[LUMA_8x4].pixelavg_pp   = PFX(pixel_avg_pp_8x4_neon);
-        p.pu[LUMA_8x8].pixelavg_pp   = PFX(pixel_avg_pp_8x8_neon);
-        p.pu[LUMA_8x16].pixelavg_pp  = PFX(pixel_avg_pp_8x16_neon);
-        p.pu[LUMA_8x32].pixelavg_pp  = PFX(pixel_avg_pp_8x32_neon);
-        p.pu[LUMA_12x16].pixelavg_pp = PFX(pixel_avg_pp_12x16_neon);
-        p.pu[LUMA_16x4].pixelavg_pp  = PFX(pixel_avg_pp_16x4_neon);
-        p.pu[LUMA_16x8].pixelavg_pp  = PFX(pixel_avg_pp_16x8_neon);
-        p.pu[LUMA_16x12].pixelavg_pp = PFX(pixel_avg_pp_16x12_neon);
-        p.pu[LUMA_16x16].pixelavg_pp = PFX(pixel_avg_pp_16x16_neon);
-        p.pu[LUMA_16x32].pixelavg_pp = PFX(pixel_avg_pp_16x32_neon);
-        p.pu[LUMA_16x64].pixelavg_pp = PFX(pixel_avg_pp_16x64_neon);
-        p.pu[LUMA_24x32].pixelavg_pp = PFX(pixel_avg_pp_24x32_neon);
-        p.pu[LUMA_32x8].pixelavg_pp  = PFX(pixel_avg_pp_32x8_neon);
-        p.pu[LUMA_32x16].pixelavg_pp = PFX(pixel_avg_pp_32x16_neon);
-        p.pu[LUMA_32x24].pixelavg_pp = PFX(pixel_avg_pp_32x24_neon);
-        p.pu[LUMA_32x32].pixelavg_pp = PFX(pixel_avg_pp_32x32_neon);
-        p.pu[LUMA_32x64].pixelavg_pp = PFX(pixel_avg_pp_32x64_neon);
-        p.pu[LUMA_48x64].pixelavg_pp = PFX(pixel_avg_pp_48x64_neon);
-        p.pu[LUMA_64x16].pixelavg_pp = PFX(pixel_avg_pp_64x16_neon);
-        p.pu[LUMA_64x32].pixelavg_pp = PFX(pixel_avg_pp_64x32_neon);
-        p.pu[LUMA_64x48].pixelavg_pp = PFX(pixel_avg_pp_64x48_neon);
-        p.pu[LUMA_64x64].pixelavg_pp = PFX(pixel_avg_pp_64x64_neon);
+        p.pu[LUMA_4x4].pixelavg_pp[ALIGNED]   = PFX(pixel_avg_pp_4x4_neon);
+        p.pu[LUMA_4x8].pixelavg_pp[ALIGNED]   = PFX(pixel_avg_pp_4x8_neon);
+        p.pu[LUMA_4x16].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_4x16_neon);
+        p.pu[LUMA_8x4].pixelavg_pp[ALIGNED]   = PFX(pixel_avg_pp_8x4_neon);
+        p.pu[LUMA_8x8].pixelavg_pp[ALIGNED]   = PFX(pixel_avg_pp_8x8_neon);
+        p.pu[LUMA_8x16].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_8x16_neon);
+        p.pu[LUMA_8x32].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_8x32_neon);
+        p.pu[LUMA_12x16].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_12x16_neon);
+        p.pu[LUMA_16x4].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_16x4_neon);
+        p.pu[LUMA_16x8].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_16x8_neon);
+        p.pu[LUMA_16x12].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_16x12_neon);
+        p.pu[LUMA_16x16].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_16x16_neon);
+        p.pu[LUMA_16x32].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_16x32_neon);
+        p.pu[LUMA_16x64].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_16x64_neon);
+        p.pu[LUMA_24x32].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_24x32_neon);
+        p.pu[LUMA_32x8].pixelavg_pp[ALIGNED]  = PFX(pixel_avg_pp_32x8_neon);
+        p.pu[LUMA_32x16].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_32x16_neon);
+        p.pu[LUMA_32x24].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_32x24_neon);
+        p.pu[LUMA_32x32].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_32x32_neon);
+        p.pu[LUMA_32x64].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_32x64_neon);
+        p.pu[LUMA_48x64].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_48x64_neon);
+        p.pu[LUMA_64x16].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_64x16_neon);
+        p.pu[LUMA_64x32].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_64x32_neon);
+        p.pu[LUMA_64x48].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_64x48_neon);
+        p.pu[LUMA_64x64].pixelavg_pp[ALIGNED] = PFX(pixel_avg_pp_64x64_neon);

         // planecopy
         p.planecopy_cp = PFX(pixel_planecopy_cp_neon);


code:
Revert this upstream commit which breaks a test case in "notmuch":

https://git.xapian.org/?p=xapian;a=commitdiff;h=5489fb2f838c0f0b0a593b4c17df282a93a1fe5a

See the notmuch FAQ entry:

https://notmuchmail.org/faq/#index12h2

This should be fixed for later releases.

diff --git a/backends/glass/glass_postlist.cc b/xapian-core/backends/glass/glass_postlist.cc
index 80e578b85..a47f14a68 100644
--- a/backends/glass/glass_postlist.cc
+++ b/backends/glass/glass_postlist.cc
@@ -759,7 +759,7 @@ GlassPostList::open_nearby_postlist(const std::string & term_,
     (void)need_pos;
     if (term_.empty())
 	RETURN(NULL);
-    if (!this_db.get() || this_db->postlist_table.is_modified())
+    if (!this_db.get() || this_db->postlist_table.is_writable())
 	RETURN(NULL);
     RETURN(new GlassPostList(this_db, term_, cursor->clone()));
 }


code:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0149
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924
---
 demo.c      |  2 +-
 editor.c    | 12 ++++++------
 file.c      |  2 +-
 highscore.c |  6 +++---
 misc.c      |  2 +-
 preview.c   |  2 +-
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/demo.c b/demo.c
index 9084e70..f4fc2cd 100644
--- a/demo.c
+++ b/demo.c
@@ -154,7 +154,7 @@ static void DoBlocks(display, window)

     /* Construct the demo level filename */
     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
-        sprintf(levelPath, "%s/demo.data", str);
+        snprintf(levelPath, sizeof(levelPath),"%s/demo.data", str);
     else
         sprintf(levelPath, "%s/demo.data", LEVEL_INSTALL_DIR);

diff --git a/editor.c b/editor.c
index f2bb9ed..66d0679 100644
--- a/editor.c
+++ b/editor.c
@@ -213,7 +213,7 @@ static void DoLoadLevel(display, window)

     /* Construct the Edit level filename */
     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
-        sprintf(levelPath, "%s/editor.data", str);
+        snprintf(levelPath,sizeof(levelPath)-1, "%s/editor.data", str);
     else
         sprintf(levelPath, "%s/editor.data", LEVEL_INSTALL_DIR);

@@ -958,8 +958,8 @@ static void LoadALevel(display)
     if ((num > 0) && (num <= MAX_NUM_LEVELS))
     {
 	    /* Construct the Edit level filename */
-   	 	if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
-        	sprintf(levelPath, "%s/level%02ld.data", str2, (u_long) num);
+        if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
+            snprintf(levelPath, sizeof(levelPath)-1,"%s/level%02ld.data", str2, (u_long) num);
     	else
         	sprintf(levelPath, "%s/level%02ld.data",
 				LEVEL_INSTALL_DIR, (u_long) num);
@@ -1017,9 +1017,9 @@ static void SaveALevel(display)
     num = atoi(str);
     if ((num > 0) && (num <= MAX_NUM_LEVELS))
     {
-	    /* Construct the Edit level filename */
-   	 	if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
-        	sprintf(levelPath, "%s/level%02ld.data", str2, (u_long) num);
+        /* Construct the Edit level filename */
+        if ((str2 = getenv("XBOING_LEVELS_DIR")) != NULL)
+            snprintf(levelPath, sizeof(levelPath)-1,"%s/level%02ld.data", str2, (u_long) num);
     	else
         	sprintf(levelPath, "%s/level%02ld.data",
 				LEVEL_INSTALL_DIR, (u_long) num);
diff --git a/file.c b/file.c
index 4c043cd..99a0854 100644
--- a/file.c
+++ b/file.c
@@ -139,7 +139,7 @@ void SetupStage(display, window)

     /* Construct the level filename */
     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
-        sprintf(levelPath, "%s/level%02ld.data", str, newLevel);
+        snprintf(levelPath,sizeof(levelPath), "%s/level%02ld.data", str, newLevel);
     else
         sprintf(levelPath, "%s/level%02ld.data", LEVEL_INSTALL_DIR, newLevel);

diff --git a/highscore.c b/highscore.c
index f0db3e9..792273e 100644
--- a/highscore.c
+++ b/highscore.c
@@ -1023,7 +1023,7 @@ int ReadHighScoreTable(type)
 	{
 		/* Use the environment variable if it exists */
 		if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
-			strcpy(filename, str);
+            strncpy(filename, str, sizeof(filename)-1);
 		else
 			strcpy(filename, HIGH_SCORE_FILE);
 	}
@@ -1095,7 +1095,7 @@ int WriteHighScoreTable(type)
 	{
 		/* Use the environment variable if it exists */
 		if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
-			strcpy(filename, str);
+            strncpy(filename, str, sizeof(filename)-1);
 		else
 			strcpy(filename, HIGH_SCORE_FILE);
 	}
@@ -1218,7 +1218,7 @@ static int LockUnlock(cmd)

 	/* Use the environment variable if it exists */
 	if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
-		strcpy(filename, str);
+        strncpy(filename, str, sizeof(filename)-1);
 	else
 		strcpy(filename, HIGH_SCORE_FILE);

diff --git a/misc.c b/misc.c
index f3ab37e..7f3ddce 100644
--- a/misc.c
+++ b/misc.c
@@ -427,7 +427,7 @@ char *GetHomeDir()
      */

     if ((ptr = getenv("HOME")) != NULL)
-        (void) strcpy(dest, ptr);
+        (void) strncpy(dest, ptr,sizeof(dest)-1);
     else
     {
         /* HOME variable is not present so get USER var */
diff --git a/preview.c b/preview.c
index 41c1187..687f566 100644
--- a/preview.c
+++ b/preview.c
@@ -139,7 +139,7 @@ static void DoLoadLevel(display, window)

     /* Construct the Preview level filename */
     if ((str = getenv("XBOING_LEVELS_DIR")) != NULL)
-        sprintf(levelPath, "%s/level%02d.data", str, lnum);
+        snprintf(levelPath, sizeof(levelPath)-1, "%s/level%02d.data", str, lnum);
     else
         sprintf(levelPath, "%s/level%02d.data", LEVEL_INSTALL_DIR, lnum);

--
2.15.1


code:
Removes references to mibstore.h and miInitializeBackingStore, which
have been removed from xorg-server.  Zack Rusin <zackr@vmware.com>
wrote: "It was a noop for at least 5 years and it has been removed."
See: http://patches.openembedded.org/patch/46133/

--- xf86-video-ark-0.7.5/src/ark_driver.c.~1~	2012-07-17 00:51:36.000000000 -0400
+++ xf86-video-ark-0.7.5/src/ark_driver.c	2014-12-19 00:23:13.028931734 -0500
@@ -39,7 +39,6 @@
 #include "compiler.h"
 #include "mipointer.h"
 #include "micmap.h"
-#include "mibstore.h"
 #include "fb.h"
 #include "ark.h"

@@ -538,7 +537,6 @@

 	fbPictureInit (pScreen, 0, 0);

-	miInitializeBackingStore(pScreen);
 	xf86SetBackingStore(pScreen);

 	if (!pARK->NoAccel) {


code:
Allow builds with glibc 2.20.
Based on a patch by Peter Hutterer <peter.hutterer@who-t.net>.
See <https://raw.githubusercontent.com/openembedded/oe-core/master/meta/recipes-graphics/xorg-driver/xf86-input-synaptics/always_include_xorg_server.h.patch>.

--- xf86-video-geode-2.11.16/src/lx_memory.c.~1~	2014-07-16 16:59:37.000000000 -0400
+++ xf86-video-geode-2.11.16/src/lx_memory.c	2014-12-19 00:38:11.753388268 -0500
@@ -23,6 +23,8 @@
  * software without specific prior written permission.
  */

+#include <xorg-server.h>
+
 #include "xf86.h"
 #include "geode.h"
 #include "cim/cim_regs.h"


code:
Removes references to mibstore.h and miInitializeBackingStore, which
have been removed from xorg-server.  Zack Rusin <zackr@vmware.com>
wrote: "It was a noop for at least 5 years and it has been removed."
See: http://patches.openembedded.org/patch/46133/

--- xf86-video-i128-1.3.6/src/i128_driver.c.~1~	2012-07-17 01:21:15.000000000 -0400
+++ xf86-video-i128-1.3.6/src/i128_driver.c	2014-12-19 00:47:16.140087736 -0500
@@ -51,7 +51,6 @@
 #include "mipointer.h"

 /* All drivers implementing backing store need this */
-#include "mibstore.h"
 #include "micmap.h"

 #include "xf86DDC.h"
@@ -1557,7 +1556,6 @@
         return FALSE;
     }

-    miInitializeBackingStore(pScreen);
     xf86SetBackingStore(pScreen);
     xf86SetSilkenMouse(pScreen);


code:
Fix test compilation with exa.h in configure when using glibc 2.20.
Inspired by a patch by Peter Hutterer <peter.hutterer@who-t.net>.
See <https://raw.githubusercontent.com/openembedded/oe-core/master/meta/recipes-graphics/xorg-driver/xf86-input-synaptics/always_include_xorg_server.h.patch>.

--- xf86-video-mach64-6.9.4/configure.~1~	2012-12-20 01:16:10.000000000 -0500
+++ xf86-video-mach64-6.9.4/configure	2014-12-19 02:48:18.040097554 -0500
@@ -18370,7 +18370,9 @@

         SAVE_CPPFLAGS="$CPPFLAGS"
         CPPFLAGS="$CPPFLAGS $XORG_CFLAGS"
-        ac_fn_c_check_header_mongrel "$LINENO" "exa.h" "ac_cv_header_exa_h" "$ac_includes_default"
+        ac_fn_c_check_header_mongrel "$LINENO" "exa.h" "ac_cv_header_exa_h" "$ac_includes_default
+#include <xorg-server.h>
+"
 if test "x$ac_cv_header_exa_h" = xyes; then :
   have_exa_h="yes"
 else


code:
Fix build against xorg-server >= 1.20.

Patch taken from upstream:
https://cgit.freedesktop.org/xorg/driver/xf86-video-savage/commit/?id=0ece556daa8a88771b669d8104396abd9166d2d0

diff --git a/src/savage_driver.c b/src/savage_driver.c
index 58a294d..3cda923 100644
--- a/src/savage_driver.c
+++ b/src/savage_driver.c
@@ -2034,8 +2034,6 @@ static Bool SavagePreInit(ScrnInfoPtr pScrn, int flags)
     xf86DrvMsg(pScrn->scrnIndex, X_PROBED, "Detected current MCLK value of %1.3f MHz\n",
 	       mclk / 1000.0);

-    pScrn->maxHValue = 2048 << 3;	/* 11 bits of h_total 8-pixel units */
-    pScrn->maxVValue = 2048;		/* 11 bits of v_total */
     pScrn->virtualX = pScrn->display->virtualX;
     pScrn->virtualY = pScrn->display->virtualY;

@@ -3637,6 +3635,14 @@ static ModeStatus SavageValidMode(SCRN_ARG_TYPE arg, DisplayModePtr pMode,
        (pMode->VDisplay > psav->PanelY)))
 	    return MODE_PANEL;

+    /* 11 bits of h_total 8-pixel units */
+    if (pMode->HTotal > (2048 << 3))
+	return MODE_BAD_HVALUE;
+
+    /* 11 bits of v_total */
+    if (pMode->VTotal > 2048)
+	return MODE_BAD_VVALUE;
+
     if (psav->UseBIOS) {
 	refresh = SavageGetRefresh(pMode);
         return (SavageMatchBiosMode(pScrn,pMode->HDisplay,