2.4.11

 ipc

diff -u --recursive --new-file v2.4.10/linux/ipc/sem.c linux/ipc/sem.c
--- v2.4.10/linux/ipc/sem.c   Mon Feb 19 10:18:18 2001
+++ linux/ipc/sem.c   Sun Sep 30 12:26:42 2001
@@ -53,6 +53,8 @@
  *
  * SMP-threaded, sysctl's added
  * (c) 1999 Manfred Spraul <manfreds@colorfullife.com>
+ * Enforced range limit on SEM_UNDO
+ * (c) 2001 Red Hat Inc <alan@redhat.com>
  */
 
 #include <linux/config.h>
@@ -256,8 +258,19 @@
       curr->sempid = (curr->sempid << 16) | pid;
       curr->semval += sem_op;
       if (sop->sem_flg & SEM_UNDO)
-         un->semadj[sop->sem_num] -= sem_op;
-
+      {
+         int undo = un->semadj[sop->sem_num] - sem_op;
+         /*
+           *   Exceeding the undo range is an error.
+          */
+         if (undo < (-SEMAEM - 1) || undo > SEMAEM)
+         {
+            /* Don't undo the undo */
+            sop->sem_flg &= ~SEM_UNDO;
+            goto out_of_range;
+         }
+         un->semadj[sop->sem_num] = undo;
+      }
       if (curr->semval < 0)
          goto would_block;
       if (curr->semval > SEMVMX)