Index: usr.bin/bsdiff/bspatch/bspatch.c
===================================================================
--- usr.bin/bsdiff/bspatch/bspatch.c
+++ usr.bin/bsdiff/bspatch/bspatch.c
@@ -27,11 +27,13 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <sys/capsicum.h>
 #include <bzlib.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <err.h>
+#include <errno.h>
 #include <unistd.h>
 #include <fcntl.h>
 
@@ -69,8 +71,9 @@
 {
 	FILE * f, * cpf, * dpf, * epf;
 	BZFILE * cpfbz2, * dpfbz2, * epfbz2;
+	cap_rights_t rights;
 	int cbz2err, dbz2err, ebz2err;
-	int fd;
+	int newfd, oldfd;
 	ssize_t oldsize,newsize;
 	ssize_t bzctrllen,bzdatalen;
 	u_char header[32],buf[8];
@@ -119,38 +122,63 @@
 	if((bzctrllen<0) || (bzdatalen<0) || (newsize<0))
 		errx(1,"Corrupt patch\n");
 
-	/* Close patch file and re-open it via libbzip2 at the right places */
+	/* Close patch file and re-open it for libbzip2. */
 	if (fclose(f))
 		err(1, "fclose(%s)", argv[3]);
 	if ((cpf = fopen(argv[3], "rb")) == NULL)
 		err(1, "fopen(%s)", argv[3]);
+	if ((dpf = fopen(argv[3], "rb")) == NULL)
+		err(1, "fopen(%s)", argv[3]);
+	if ((epf = fopen(argv[3], "rb")) == NULL)
+		err(1, "fopen(%s)", argv[3]);
+
+	oldfd = open(argv[1], O_RDONLY|O_BINARY, 0);
+	if (oldfd < 0)
+		err(1, "%s", argv[1]);
+	newfd = open(argv[2], O_CREAT|O_TRUNC|O_WRONLY|O_BINARY, 0666);
+	if (newfd < 0)
+		err(1, "%s", argv[2]);
+
+	/* Limit rights to read and seek on input files, write on output. */
+	cap_rights_init(&rights, CAP_READ, CAP_SEEK);
+	if (cap_rights_limit(oldfd, &rights) < 0 && errno != ENOSYS)
+		err(1, "unable to limit rights for old file");
+	if ((cap_rights_limit(fileno(cpf), &rights) < 0 && errno != ENOSYS) ||
+	    (cap_rights_limit(fileno(dpf), &rights) < 0 && errno != ENOSYS) ||
+	    (cap_rights_limit(fileno(epf), &rights) < 0 && errno != ENOSYS))
+		err(1, "unable to limit rights for patch file");
+	cap_rights_init(&rights, CAP_WRITE);
+	if (cap_rights_limit(newfd, &rights) < 0 && errno != ENOSYS)
+		err(1, "unable to limit rights for new file");
+	if (cap_enter() < 0 && errno != ENOSYS)
+		err(1, "unable to enter capability mode");
+
+	/* Seek to the three blocks for libbzip2. */
 	if (fseeko(cpf, 32, SEEK_SET))
 		err(1, "fseeko(%s, %lld)", argv[3],
 		    (long long)32);
 	if ((cpfbz2 = BZ2_bzReadOpen(&cbz2err, cpf, 0, 0, NULL, 0)) == NULL)
 		errx(1, "BZ2_bzReadOpen, bz2err = %d", cbz2err);
-	if ((dpf = fopen(argv[3], "rb")) == NULL)
-		err(1, "fopen(%s)", argv[3]);
 	if (fseeko(dpf, 32 + bzctrllen, SEEK_SET))
 		err(1, "fseeko(%s, %lld)", argv[3],
 		    (long long)(32 + bzctrllen));
 	if ((dpfbz2 = BZ2_bzReadOpen(&dbz2err, dpf, 0, 0, NULL, 0)) == NULL)
 		errx(1, "BZ2_bzReadOpen, bz2err = %d", dbz2err);
-	if ((epf = fopen(argv[3], "rb")) == NULL)
-		err(1, "fopen(%s)", argv[3]);
 	if (fseeko(epf, 32 + bzctrllen + bzdatalen, SEEK_SET))
 		err(1, "fseeko(%s, %lld)", argv[3],
 		    (long long)(32 + bzctrllen + bzdatalen));
 	if ((epfbz2 = BZ2_bzReadOpen(&ebz2err, epf, 0, 0, NULL, 0)) == NULL)
 		errx(1, "BZ2_bzReadOpen, bz2err = %d", ebz2err);
 
-	if(((fd=open(argv[1],O_RDONLY|O_BINARY,0))<0) ||
-		((oldsize=lseek(fd,0,SEEK_END))==-1) ||
-		((old=malloc(oldsize+1))==NULL) ||
-		(lseek(fd,0,SEEK_SET)!=0) ||
-		(read(fd,old,oldsize)!=oldsize) ||
-		(close(fd)==-1)) err(1,"%s",argv[1]);
-	if((new=malloc(newsize+1))==NULL) err(1,NULL);
+	if (((oldsize = lseek(oldfd, 0, SEEK_END)) == -1) ||
+	    ((old = malloc(oldsize + 1)) == NULL) ||
+	    (lseek(oldfd, 0, SEEK_SET) != 0) ||
+	    (read(oldfd, old, oldsize) != oldsize) ||
+	    (close(oldfd) == -1))
+		err(1, "%s", argv[1]);
+
+	if ((new = malloc(newsize + 1)) == NULL)
+		err(1, NULL);
 
 	oldpos=0;newpos=0;
 	while(newpos<newsize) {
@@ -164,10 +192,6 @@
 		}
 
 		/* Sanity-check */
-		if ((ctrl[0] < 0) || (ctrl[1] < 0))
-			errx(1,"Corrupt patch\n");
-
-		/* Sanity-check */
 		if(newpos+ctrl[0]>newsize)
 			errx(1,"Corrupt patch\n");
 
@@ -209,9 +233,8 @@
 		err(1, "fclose(%s)", argv[3]);
 
 	/* Write the new file */
-	if(((fd=open(argv[2],O_CREAT|O_TRUNC|O_WRONLY|O_BINARY,0666))<0) ||
-		(write(fd,new,newsize)!=newsize) || (close(fd)==-1))
-		err(1,"%s",argv[2]);
+	if ((write(newfd, new, newsize) != newsize) || (close(newfd)==-1))
+		err(1, "%s", argv[2]);
 
 	free(new);
 	free(old);