commit: ae11fbf44d552cb1c5eca16a71ebd59c2230f360
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 25 01:42:03 2016 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Fri Mar 25 01:42:03 2016 +0000
URL: https://gitweb.gentoo.org/proj/musl.git/commit/?id=ae11fbf4
sys-apps/busybox: bump to 1.24.2-r99
sys-apps/busybox/Manifest | 9 +-
...1.24.1-r99.ebuild => busybox-1.24.2-r99.ebuild} | 8 +-
.../files/busybox-1.24.1-trylink-ldflags.patch | 32 ++++++
sys-apps/busybox/files/busybox-1.24.1-unzip.patch | 112 ---------------------
.../files/busybox-1.24.2-CVE-2016-2147.patch | 72 +++++++++++++
.../files/busybox-1.24.2-CVE-2016-2148.patch | 55 ++++++++++
.../busybox-1.24.2-ash-recursive-heredocs.patch | 83 +++++++++++++++
7 files changed, 253 insertions(+), 118 deletions(-)
diff --git a/sys-apps/busybox/Manifest b/sys-apps/busybox/Manifest
index b38784f..c2cb732 100644
--- a/sys-apps/busybox/Manifest
+++ b/sys-apps/busybox/Manifest
@@ -1,5 +1,8 @@
AUX busybox-1.19.0-bb.patch 908 SHA256
98f92c2edbcf61d1bacef783ea8b08cce07051b0a4489ed3f4579296846f89f1 SHA512
d4024e531ce7113cf554646608b1ef356e51691e3e21d165621b3690c82b56a319867b90d9daba548b635d9dbd41be5efea63181b7123d4505e529d863a8214c
WHIRLPOOL
b0d6d9b08ad0930e5243c7addc8a6db61505e95ed8e72c64fbfd734cb6ff9e303b3eb8ea6ec4790b2be567783664230cf278eb3e673fa0844c3881cf993f7cb8
-AUX busybox-1.24.1-unzip.patch 3903 SHA256
423e7b2c9dc5614de8038e3938de6f6831e79bbd1889a9a80bef1780a2635ce8 SHA512
c6b33f1b3e8c995a8b47f6c66f068db4068a53293a6d321adb184ce2ffebff4a94c64814d80bfdf5ce103176ed6c892d4d9641f72831833672d87cefed97c472
WHIRLPOOL
8b356fb1a38697da657c0f2e47b726bc738a13d104c4169f8195646a7890f42d47fd0f217ad9943e4432b27d1fc6adad334f9ac4780f3a5ba48b6da977503c0c
+AUX busybox-1.24.1-trylink-ldflags.patch 1179 SHA256
2d57a1e34f3a8a6c4e08a0214ae646f3807ce9d9236d9e9c340ccce0294a6d89 SHA512
9fcd02ad067846db4e4b1fe7fe4b28b9d2088e7ca311f47d103124336e96a19dd0fa6813d7e8d408d4bad70d1856964ef1726f23185ec828f68510477115cd11
WHIRLPOOL
23d46f1027ae2600fe850c3d5f9abc013a4964197e784e6e52147a335871eda80439e54e47824a486620ec40147588a1c6722a58d78db65c7484b8f0d62b164d
+AUX busybox-1.24.2-CVE-2016-2147.patch 3453 SHA256
7cedbcfe2744a7efc1d811372932bc8ef610b8bbdfe34d28ba5a0b5d582b885d SHA512
1268f11089ab5bc4d296995ff8216a8f2f6fbb644d20f04502f92fcadd1cafade43eb6e613fe4b9ab7e475e2bcc3b85ae8196d78c4d56a62db2ce0f3564ba644
WHIRLPOOL
38c30e4256e18cb2f366c5d5b35cd8b268fd0375a94616c38b43ef283df1c7772ec28f61fb4d181e5448ddc04bdc8ab3a0fdc8dd4f97ccd82bfa38cdfd190c0e
+AUX busybox-1.24.2-CVE-2016-2148.patch 1956 SHA256
0d42e12334ff14616ce9dc22f02f15c8f3df3ef3334c9ef81abd29d21b5ac687 SHA512
0ffdfa24d5943a15d924fdd42b5d410c0a215d0cad1753caf6c6aba7d0e5be7a883b561a683a4ac8b906e96b1839f4e6f235501c1467afe50508284f51e42c0c
WHIRLPOOL
6a37440abe63b75815b41d2bb4ddc8de1a557bca3a7a17802b7443079fd7418260d81231900f697cab4b4fbbd892be37dc9d97df6880e342db07fa5792f556bb
+AUX busybox-1.24.2-ash-recursive-heredocs.patch 2442 SHA256
2e4b028036b6e983f04f51a2cfb5e61a6e71e4143e5342c54b96bc2296e5d45c SHA512
24cd081d29fd013b9e1893ceb6f3fb8e240e46f69c1d225eed4c71ab5b630e064a15d158f37a2a1ad3f00dafa972af84fe79bd32917b4f126d557839b3288b02
WHIRLPOOL
d9108189f20b0326f3095d420aab74dae4bad00381781558f4d6360c62aa9021b01194b773be13625dd7ab97732ea737685e330f19046527792f0f278f761e26
AUX ginit.c 3097 SHA256
fd6a4715d3dd10f6db479020433da3997d397658301335c847fb779129238b8c SHA512
8bf70f13db0fbeecedf9a9f862c5391c0d8b7aa3ddd2ec85cda9b360c3117a01e32b01017b8c30197f587e521ba360ff70d1caf8d0f69d5c3a27f37ecc252e7c
WHIRLPOOL
a1ec3ccc296033d88a9504b693c7d249d0bd11b1d75e3f59a62137c5e4b4c914fe2b8971c86dbca2cc8ccc0d86f3f8c2c45bb44cec85a3628c44f091476baa92
AUX klogd.confd 218 SHA256
737b78745964e110da2fd3357c6d5fb80ccacf979039b8d40c03cf1cb969e5f3 SHA512
3348d5376b368b28d1431692a93868cd4550be12ad729340c5f78da35a5bd295e7613d70ce8ccde5029ad6d87a41c2f24155180f3570de8a9174dd63dece143f
WHIRLPOOL
ea28c1d926e36fba0ab69de8ddfd2503889b7cfa3a4ada347a9d22d9894fe30be068c0ed55f899b952e62b8de3cb69e1a4209f7864787988ded28ede10c7445a
AUX klogd.initd 255 SHA256
ee9213bdb5f5b9ec7691f414349c0e5db3ec8ea91353c63121dd90d8d7f3b4e3 SHA512
a4cd9e53f2e4383765d66cd063f628b8358bc7696d21a1b450e7bd89e5a6fb323138d48c729d6a5b40ac3eb511bceaec37eb4806ba4348c715c8d7fa894567f4
WHIRLPOOL
26e600b2a09f45c6e5a3eac9c1b73dc7a969ae28a9c624fe8a1e9696757bfa6c809b13b6544e0e48e94f6d864b06bd0d9bee6cf785829782b1ede17477ab5943
@@ -17,6 +20,6 @@ AUX syslogd.confd 234 SHA256
65166088cb173582200b8c0d3bc6ea339b5929dbafa816780bf
AUX syslogd.initd 277 SHA256
47fac609c382b4fb6feaef6b86c12d0f46464370a7fed713fa9a1d70d7c9871f SHA512
3700355b3473c034d8e368a68aa4b44059d6d056ab59987e4e914dda72d02d7c9e4c13799211fd865d885b360a43094e18e80741713f78dfe6162a9a68e768cf
WHIRLPOOL
fcbea7f7a0e5e8f4cd91bf6203abc5559ce4d380a932d6c70ec8aee2ead8e76209e54557007f23f668019dee5404e1cd5ec48a3df75f0d5613b31e7ac896b61f
AUX watchdog.confd 232 SHA256
786d9497ad55c29d6fff231709e71ecad94f2ee1de3b45b461deb29c3eba1c63 SHA512
8fd7121075535195f3e5d43ec773713c883fb7865cd5e5927b3b20c2605c50acb81d50461bd1a246c1282006ce74b11932ac1cec67ddc2be15da2f9aa8674232
WHIRLPOOL
8ea0f6b759198c978f10bf0b2b00cc73343e72401a05edf257b9c5e1032e8a619328aaa02936b5b5a717a021baa84b5653b8c9826e14e5c07c7b7af98f878767
AUX watchdog.initd 229 SHA256
b9dd1284af20bf43198807c8d17829fc12e0c39ca3b6f4f7f766c5cd6b581997 SHA512
fddd3dfa9ab4fe324c7d4c683a60062ceb068b7648e21950758af8993606db6fd92bbcf3326f56c4b5b488e61ae50b8620cf94645600734ba43ed3cfc3be3070
WHIRLPOOL
d18af9faa3dbec43928933a9a1e5f525a4cd72eab7441dab0d3185e7336848f8694d807d9a43feb4a39af51ba1e2350d3ccd93f0d3c0ad58bac321c42a5f3af6
-DIST busybox-1.24.1.tar.bz2 2068803 SHA256
37d03132cc078937360b392170b7a1d0e5b322eee9f57c0b82292a8b1f0afe3d SHA512
3afc757ebaae61ae13c2c69097ee734717434f9e658eb77093a8b7b49af3326cbca2d723483ff84a1da99544b822fd2b47d9a97c68f09962e11754e5daf124ca
WHIRLPOOL
5e827d08d737caac832e7e5923da624094ff27ee2edbb46dadc339e95edba65378a8fa3db412682724476a2092eee41a804f8f36c2eec0b9f883f5ba855f3ad0
-EBUILD busybox-1.24.1-r99.ebuild 8806 SHA256
78cb413fffb1bf9b9da50ed3373672b07fea7ac40ced778e52710f0a1f365834 SHA512
6d8b480c5dcc9c45cb0d3572799962eba8d024e94dbf97d593ff7e8cd17fa878fb729ed243bcd4382e75e80c911991f116c0ba987e1700651bfe4a09e1cc2434
WHIRLPOOL
6840d74b1150bb75209144e9062d52be49c9b46d8f5f45e69ce8996d3f2e867ae1eda9f4c470d7641bf4066c883b7589ae0414843aebd1ceca900fa2286e364c
+DIST busybox-1.24.2.tar.bz2 2066822 SHA256
e71ef53ec656f31c42633918d301405d40dea1d97eca12f272217ae4a971c855 SHA512
4d20fb68ee440be2855231c7fd5f3cb9dd9bfcc1a688f0b59cd3f7a55c8819e9cc44bd15f91500713571f2a84e5e44adc0fa8ae0ae3ebf63961dfc9e1c9ef8e0
WHIRLPOOL
2d89e3fded8d61567873acdb1e1e21888a4447e19c1b893543bbe82de52e8e3cf091adb10f34aa155da573994d89ae42f40ecce65ec0d32a641d103c8d8ce053
+EBUILD busybox-1.24.2-r99.ebuild 9061 SHA256
c551563a5830166f5419a894f92ce6a61f33c05e28e78e8e878133a197f1f3a2 SHA512
ce99e75d6b0bfca61c5a43479c86ec870153df066a5729cc58e5ac38386684ec87c0355ef1ec790c4dcd319475b54f60a93cdde0cf5f2b55738e6578a1a13310
WHIRLPOOL
a68cceb73b6d24e6b17df54284f42ff41c61e9e9c7f8b0a777edb7cb71f7570ff62d64b15c0e7640d999e123e612e6f94dcb5384ff904b39d398a4c26d2b542d
MISC metadata.xml 872 SHA256
1cf483a8d55e8cbe20edb30261276d71e0ba0a1b06d73621f849496d1f6c4a17 SHA512
c0b3f8b9348553d8a4db25c1c51ef5a82bcd14a09251568c0709b392e2dea9bc35dced96377d11a32ad53ba09052603781caebf754428debf7acb0aaedafbf07
WHIRLPOOL
91b126a39ecd6937e6058814b88043e9fbbf7b434854e25a4e4a7ad8e666de37978b8bac0c8dca0255096a42af9afed412bb5bbccdffaf03ba75c2fd2e4b3428
diff --git a/sys-apps/busybox/busybox-1.24.1-r99.ebuild
b/sys-apps/busybox/busybox-1.24.2-r99.ebuild
similarity index 95%
rename from sys-apps/busybox/busybox-1.24.1-r99.ebuild
rename to sys-apps/busybox/busybox-1.24.2-r99.ebuild
index 7cde8fa..176d709 100644
--- a/sys-apps/busybox/busybox-1.24.1-r99.ebuild
+++ b/sys-apps/busybox/busybox-1.24.2-r99.ebuild
@@ -16,7 +16,7 @@ if [[ ${PV} == "9999" ]] ; then
else
MY_P=${PN}-${PV/_/-}
SRC_URI="http://www.busybox.net/downloads/${MY_P}.tar.bz2";
- KEYWORDS="amd64 arm ~mips ppc x86"
+ KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64
~s390 ~sh ~sparc ~x86 ~amd64-linux ~arm-linux ~x86-linux"
fi
LICENSE="GPL-2" # GPL-2 only
@@ -67,7 +67,10 @@ src_prepare() {
# patches go here!
epatch "${FILESDIR}"/${PN}-1.19.0-bb.patch
- epatch "${FILESDIR}"/${P}-*.patch
+ epatch "${FILESDIR}"/busybox-1.24.1-trylink-ldflags.patch
+ epatch "${FILESDIR}"/busybox-1.24.2-ash-recursive-heredocs.patch
+ epatch "${FILESDIR}"/busybox-1.24.2-CVE-2016-2147.patch
+ epatch "${FILESDIR}"/busybox-1.24.2-CVE-2016-2148.patch
cp "${FILESDIR}"/ginit.c init/ || die
# flag cleanup
@@ -115,7 +118,6 @@ src_configure() {
busybox_config_option n BUILD_LIBBUSYBOX
busybox_config_option n FEATURE_CLEAN_UP
busybox_config_option n MONOTONIC_SYSCALL
- busybox_config_option n START_STOP_DAEMON
busybox_config_option n USE_PORTABLE_CODE
busybox_config_option n WERROR
diff --git a/sys-apps/busybox/files/busybox-1.24.1-trylink-ldflags.patch
b/sys-apps/busybox/files/busybox-1.24.1-trylink-ldflags.patch
new file mode 100644
index 0000000..9d61ceb
--- /dev/null
+++ b/sys-apps/busybox/files/busybox-1.24.1-trylink-ldflags.patch
@@ -0,0 +1,32 @@
+From 77e2bde6a50f0f6b9b3c9983c86e661a9872b5f6 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <[email protected]>
+Date: Tue, 1 Dec 2015 11:25:10 -0500
+Subject: [PATCH] trylink: include LDFLAGS when checking linkage
+
+The user might be including options in their LDFLAGS (like -fuse-ld=gold)
+that change the behavior of the linker and thus change the results of the
+flag tests. Make sure we include the user's LDFLAGS when running these
+tests so we filter out flags that will fail when used later on.
+
+URL: https://bugs.gentoo.org/499712
+Signed-off-by: Mike Frysinger <[email protected]>
+---
+ scripts/trylink | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/trylink b/scripts/trylink
+index 6e1187e..3c431ed 100755
+--- a/scripts/trylink
++++ b/scripts/trylink
+@@ -54,7 +54,7 @@ check_cc() {
+ # "eval" may be needed if CFLAGS can contain
+ # '... -D"BB_VER=KBUILD_STR(1.N.M)" ...'
+ # and we need shell to process quotes!
+- $CC $CFLAGS $1 "$tempname".c -o "$tempname" >/dev/null 2>&1
++ $CC $CFLAGS $LDFLAGS $1 "$tempname".c -o "$tempname" >/dev/null 2>&1
+ r=$?
+ rm -f "$tempname" "$tempname".c "$tempname".o
+ return $r
+--
+2.6.2
+
diff --git a/sys-apps/busybox/files/busybox-1.24.1-unzip.patch
b/sys-apps/busybox/files/busybox-1.24.1-unzip.patch
deleted file mode 100644
index 722b5fb..0000000
--- a/sys-apps/busybox/files/busybox-1.24.1-unzip.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-https://bugs.gentoo.org/564246
-
-From 1de25a6e87e0e627aa34298105a3d17c60a1f44e Mon Sep 17 00:00:00 2001
-From: Denys Vlasenko <[email protected]>
-Date: Mon, 26 Oct 2015 19:33:05 +0100
-Subject: [PATCH] unzip: test for bad archive SEGVing
-
-function old new delta
-huft_build 1296 1300 +4
-
-Signed-off-by: Denys Vlasenko <[email protected]>
----
- archival/libarchive/decompress_gunzip.c | 11 +++++++----
- testsuite/unzip.tests | 23 ++++++++++++++++++++++-
- 2 files changed, 29 insertions(+), 5 deletions(-)
-
-diff --git a/archival/libarchive/decompress_gunzip.c
b/archival/libarchive/decompress_gunzip.c
-index 7b6f459..30bf451 100644
---- a/archival/libarchive/decompress_gunzip.c
-+++ b/archival/libarchive/decompress_gunzip.c
-@@ -305,11 +305,12 @@ static int huft_build(const unsigned *b, const unsigned
n,
- unsigned i; /* counter, current code */
- unsigned j; /* counter */
- int k; /* number of bits in current code */
-- unsigned *p; /* pointer into c[], b[], or v[] */
-+ const unsigned *p; /* pointer into c[], b[], or v[] */
- huft_t *q; /* points to current table */
- huft_t r; /* table entry for structure assignment */
- huft_t *u[BMAX]; /* table stack */
- unsigned v[N_MAX]; /* values in order of bit length */
-+ unsigned v_end;
- int ws[BMAX + 1]; /* bits decoded stack */
- int w; /* bits decoded */
- unsigned x[BMAX + 1]; /* bit offsets, then code stack */
-@@ -324,7 +325,7 @@ static int huft_build(const unsigned *b, const unsigned n,
-
- /* Generate counts for each bit length */
- memset(c, 0, sizeof(c));
-- p = (unsigned *) b; /* cast allows us to reuse p for pointing to b */
-+ p = b;
- i = n;
- do {
- c[*p]++; /* assume all entries <= BMAX */
-@@ -365,12 +366,14 @@ static int huft_build(const unsigned *b, const unsigned
n,
- }
-
- /* Make a table of values in order of bit lengths */
-- p = (unsigned *) b;
-+ p = b;
- i = 0;
-+ v_end = 0;
- do {
- j = *p++;
- if (j != 0) {
- v[x[j]++] = i;
-+ v_end = x[j];
- }
- } while (++i < n);
-
-@@ -432,7 +435,7 @@ static int huft_build(const unsigned *b, const unsigned n,
-
- /* set up table entry in r */
- r.b = (unsigned char) (k - w);
-- if (p >= v + n) {
-+ if (p >= v + v_end) { // Was "if (p >= v + n)" but v[]
can be shorter!
- r.e = 99; /* out of values--invalid code */
- } else if (*p < s) {
- r.e = (unsigned char) (*p < 256 ? 16 : 15);
/* 256 is EOB code */
-diff --git a/testsuite/unzip.tests b/testsuite/unzip.tests
-index 8677a03..ca0a458 100755
---- a/testsuite/unzip.tests
-+++ b/testsuite/unzip.tests
-@@ -7,7 +7,7 @@
-
- . ./testing.sh
-
--# testing "test name" "options" "expected result" "file input" "stdin"
-+# testing "test name" "commands" "expected result" "file input" "stdin"
- # file input will be file called "input"
- # test can create a file "actual" instead of writing to stdout
-
-@@ -30,6 +30,27 @@ testing "unzip (subdir only)" "unzip -q foo.zip foo/ &&
test -d foo && test ! -f
- rmdir foo
- rm foo.zip
-
-+# File containing some damaged encrypted stream
-+testing "unzip (bad archive)" "uudecode; unzip bad.zip 2>&1; echo \$?" \
-+"Archive: bad.zip
-+ inflating: ]3j½r«IK-%Ix
-+unzip: inflate error
-+1
-+" \
-+"" "\
-+begin-base64 644 bad.zip
-+UEsDBBQAAgkIAAAAIQA5AAAANwAAADwAAAAQAAcAXTNqwr1ywqtJGxJLLSVJ
-+eCkBD0AdKBk8JzQsIj01JC0/ORJQSwMEFAECCAAAAAAhADoAAAAPAAAANgAA
-+AAwAAQASw73Ct1DCokohPXQiNjoUNTUiHRwgLT4WHlBLAQIQABQAAggIAAAA
-+oQA5AAAANwAAADwAAAAQQAcADAAAACwAMgCAAAAAAABdM2rCvXLCq0kbEkst
-+JUl4KQEPQB0oGSY4Cz4QNgEnJSYIPVBLAQIAABQAAggAAAAAIQAqAAAADwAA
-+BDYAAAAMAAEADQAAADIADQAAAEEAAAASw73Ct1DKokohPXQiNzA+FAI1HCcW
-+NzITNFBLBQUKAC4JAA04Cw0EOhZQSwUGAQAABAIAAgCZAAAAeQAAAAIALhM=
-+====
-+"
-+
-+rm *
-+
- # Clean up scratch directory.
-
- cd ..
---
-2.6.2
-
diff --git a/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2147.patch
b/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2147.patch
new file mode 100644
index 0000000..2187c9b
--- /dev/null
+++ b/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2147.patch
@@ -0,0 +1,72 @@
+From 3c4de6e36c4d387a648622e7b828a05f2b1b47e6 Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <[email protected]>
+Date: Fri, 26 Feb 2016 15:54:56 +0100
+Subject: [PATCH] udhcpc: fix OPTION_6RD parsing (could overflow its malloced
+ buffer)
+
+Signed-off-by: Denys Vlasenko <[email protected]>
+Signed-off-by: Mike Frysinger <[email protected]>
+(cherry picked from commit 352f79acbd759c14399e39baef21fc4ffe180ac2)
+---
+ networking/udhcp/common.c | 15 +++++++++++++--
+ networking/udhcp/dhcpc.c | 4 ++--
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
+index bc41c8d..680852c 100644
+--- a/networking/udhcp/common.c
++++ b/networking/udhcp/common.c
+@@ -142,7 +142,7 @@ const char dhcp_option_strings[] ALIGN1 =
+ * udhcp_str2optset: to determine how many bytes to allocate.
+ * xmalloc_optname_optval: to estimate string length
+ * from binary option length: (option[LEN] / dhcp_option_lengths[opt_type])
+- * is the number of elements, multiply in by one element's string width
++ * is the number of elements, multiply it by one element's string width
+ * (len_of_option_as_string[opt_type]) and you know how wide string you need.
+ */
+ const uint8_t dhcp_option_lengths[] ALIGN1 = {
+@@ -162,7 +162,18 @@ const uint8_t dhcp_option_lengths[] ALIGN1 = {
+ [OPTION_S32] = 4,
+ /* Just like OPTION_STRING, we use minimum length here */
+ [OPTION_STATIC_ROUTES] = 5,
+- [OPTION_6RD] = 22, /* ignored by udhcp_str2optset */
++ [OPTION_6RD] = 12, /* ignored by udhcp_str2optset */
++ /* The above value was chosen as follows:
++ * len_of_option_as_string[] for this option is >60: it's a string of
the form
++ * "32 128 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 ".
++ * Each additional ipv4 address takes 4 bytes in binary option and
appends
++ * another "255.255.255.255 " 16-byte string. We can set [OPTION_6RD] =
4
++ * but this severely overestimates string length: instead of 16 bytes,
++ * it adds >60 for every 4 bytes in binary option.
++ * We cheat and declare here that option is in units of 12 bytes.
++ * This adds more than 60 bytes for every three ipv4 addresses - more
than enough.
++ * (Even 16 instead of 12 should work, but let's be paranoid).
++ */
+ };
+
+
+diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
+index 915f659..2332b57 100644
+--- a/networking/udhcp/dhcpc.c
++++ b/networking/udhcp/dhcpc.c
+@@ -113,7 +113,7 @@ static const uint8_t len_of_option_as_string[] = {
+ [OPTION_IP ] = sizeof("255.255.255.255 "),
+ [OPTION_IP_PAIR ] = sizeof("255.255.255.255 ") * 2,
+ [OPTION_STATIC_ROUTES ] = sizeof("255.255.255.255/32 255.255.255.255
"),
+- [OPTION_6RD ] = sizeof("32 128
ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "),
++ [OPTION_6RD ] = sizeof("132 128
ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "),
+ [OPTION_STRING ] = 1,
+ [OPTION_STRING_HOST ] = 1,
+ #if ENABLE_FEATURE_UDHCP_RFC3397
+@@ -220,7 +220,7 @@ static NOINLINE char *xmalloc_optname_optval(uint8_t
*option, const struct dhcp_
+ type = optflag->flags & OPTION_TYPE_MASK;
+ optlen = dhcp_option_lengths[type];
+ upper_length = len_of_option_as_string[type]
+- * ((unsigned)(len + optlen - 1) / (unsigned)optlen);
++ * ((unsigned)(len + optlen) / (unsigned)optlen);
+
+ dest = ret = xmalloc(upper_length + strlen(opt_name) + 2);
+ dest += sprintf(ret, "%s=", opt_name);
+--
+2.7.4
+
diff --git a/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2148.patch
b/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2148.patch
new file mode 100644
index 0000000..08e08be
--- /dev/null
+++ b/sys-apps/busybox/files/busybox-1.24.2-CVE-2016-2148.patch
@@ -0,0 +1,55 @@
+From 3a76bb5136d05f94ee62e377aa723e63444912c7 Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <[email protected]>
+Date: Thu, 10 Mar 2016 11:47:58 +0100
+Subject: [PATCH] udhcp: fix a SEGV on malformed RFC1035-encoded domain name
+
+Signed-off-by: Denys Vlasenko <[email protected]>
+Signed-off-by: Mike Frysinger <[email protected]>
+(cherry picked from commit d474ffc68290e0a83651c4432eeabfa62cd51e87)
+---
+ networking/udhcp/domain_codec.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/networking/udhcp/domain_codec.c b/networking/udhcp/domain_codec.c
+index c1325d8..8429367 100644
+--- a/networking/udhcp/domain_codec.c
++++ b/networking/udhcp/domain_codec.c
+@@ -63,11 +63,10 @@ char* FAST_FUNC dname_dec(const uint8_t *cstr, int clen,
const char *pre)
+ if (crtpos + *c + 1 > clen) /* label too long?
abort */
+ return NULL;
+ if (dst)
+- memcpy(dst + len, c + 1, *c);
++ /* \3com ---> "com." */
++ ((char*)mempcpy(dst + len, c + 1,
*c))[0] = '.';
+ len += *c + 1;
+ crtpos += *c + 1;
+- if (dst)
+- dst[len - 1] = '.';
+ } else {
+ /* NUL: end of current domain name */
+ if (retpos == 0) {
+@@ -78,7 +77,10 @@ char* FAST_FUNC dname_dec(const uint8_t *cstr, int clen,
const char *pre)
+ crtpos = retpos;
+ retpos = depth = 0;
+ }
+- if (dst)
++ if (dst && len != 0)
++ /* \4host\3com\0\4host and we are at \0:
++ * \3com was converted to "com.",
change dot to space.
++ */
+ dst[len - 1] = ' ';
+ }
+
+@@ -228,6 +230,9 @@ int main(int argc, char **argv)
+ int len;
+ uint8_t *encoded;
+
++ uint8_t str[6] = { 0x00, 0x00, 0x02, 0x65, 0x65, 0x00 };
++ printf("NUL:'%s'\n", dname_dec(str, 6, ""));
++
+ #define DNAME_DEC(encoded,pre) dname_dec((uint8_t*)(encoded),
sizeof(encoded), (pre))
+ printf("'%s'\n", DNAME_DEC("\4host\3com\0", "test1:"));
+ printf("test2:'%s'\n", DNAME_DEC("\4host\3com\0\4host\3com\0", ""));
+--
+2.7.4
+
diff --git a/sys-apps/busybox/files/busybox-1.24.2-ash-recursive-heredocs.patch
b/sys-apps/busybox/files/busybox-1.24.2-ash-recursive-heredocs.patch
new file mode 100644
index 0000000..5405eaf
--- /dev/null
+++ b/sys-apps/busybox/files/busybox-1.24.2-ash-recursive-heredocs.patch
@@ -0,0 +1,83 @@
+From 4194c2875310c13ee3ca2bb0e1aea6a2ae67c55a Mon Sep 17 00:00:00 2001
+From: Ron Yorston <[email protected]>
+Date: Thu, 29 Oct 2015 16:44:56 +0000
+Subject: [PATCH] ash: fix error during recursive processing of here document
+
+Save the value of the checkkwd flag to prevent it being clobbered
+during recursion.
+
+Based on commit ec2c84d from git://git.kernel.org/pub/scm/utils/dash/dash.git
+by Herbert Xu.
+
+function old new delta
+readtoken 190 203 +13
+------------------------------------------------------------------------------
+(add/remove: 0/0 grow/shrink: 1/0 up/down: 13/0) Total: 13 bytes
+
+Signed-off-by: Ron Yorston <[email protected]>
+Signed-off-by: Denys Vlasenko <[email protected]>
+Signed-off-by: Mike Frysinger <[email protected]>
+(cherry picked from commit 713f07d906d9171953be0c12e2369869855b6ca6)
+---
+ shell/ash.c | 5 +++--
+ shell/ash_test/ash-heredoc/heredoc3.right | 1 +
+ shell/ash_test/ash-heredoc/heredoc3.tests | 9 +++++++++
+ 3 files changed, 13 insertions(+), 2 deletions(-)
+ create mode 100644 shell/ash_test/ash-heredoc/heredoc3.right
+ create mode 100755 shell/ash_test/ash-heredoc/heredoc3.tests
+
+diff --git a/shell/ash.c b/shell/ash.c
+index 8a1628e..256e933 100644
+--- a/shell/ash.c
++++ b/shell/ash.c
+@@ -11893,6 +11893,7 @@ static int
+ readtoken(void)
+ {
+ int t;
++ int kwd = checkkwd;
+ #if DEBUG
+ smallint alreadyseen = tokpushback;
+ #endif
+@@ -11906,7 +11907,7 @@ readtoken(void)
+ /*
+ * eat newlines
+ */
+- if (checkkwd & CHKNL) {
++ if (kwd & CHKNL) {
+ while (t == TNL) {
+ parseheredoc();
+ t = xxreadtoken();
+@@ -11920,7 +11921,7 @@ readtoken(void)
+ /*
+ * check for keywords
+ */
+- if (checkkwd & CHKKWD) {
++ if (kwd & CHKKWD) {
+ const char *const *pp;
+
+ pp = findkwd(wordtext);
+diff --git a/shell/ash_test/ash-heredoc/heredoc3.right
b/shell/ash_test/ash-heredoc/heredoc3.right
+new file mode 100644
+index 0000000..ce01362
+--- /dev/null
++++ b/shell/ash_test/ash-heredoc/heredoc3.right
+@@ -0,0 +1 @@
++hello
+diff --git a/shell/ash_test/ash-heredoc/heredoc3.tests
b/shell/ash_test/ash-heredoc/heredoc3.tests
+new file mode 100755
+index 0000000..96c227c
+--- /dev/null
++++ b/shell/ash_test/ash-heredoc/heredoc3.tests
+@@ -0,0 +1,9 @@
++echo hello >greeting
++cat <<EOF &&
++$(cat greeting)
++EOF
++{
++ echo $?
++ cat greeting
++} >/dev/null
++rm greeting
+--
+2.7.4
+
