bspatch: add sanity checks on sizes

[emaste]

Summary

Note that on i386 this introduces a new 2GB limit, but this is not a concern in practice. Also avoid allocating an extra byte in the old and new file content buffers.

Based on the "NON-CRYPTANALYTIC ATTACKS AGAINST FREEBSD UPDATE COMPONENTS" gist.

[emaste]

usr.bin/bsdiff/bspatch/bspatch.c

76–77 ↗

(On Diff #19599)

On i386 ssize_t is 4 bytes, so would truncate from offtin / lseek.

123 ↗

(On Diff #19599)

SSIZE_MAX introduces a 2G limit, but we already had an implicit 2G limit for proper operation based on the previous newsize type.

155 ↗

(On Diff #19599)

Same 2G argument as above.

[emaste]

rebase after rS304807

[cem]

Changes seem fine to me. This code is really ugly, though.

usr.bin/bsdiff/bspatch/bspatch.c

175 ↗

(On Diff #19679)

The gist checks for newsize <= 0. Is zero a valid newsize?

[emaste]

usr.bin/bsdiff/bspatch/bspatch.c

175 ↗

(On Diff #19679)

Yes, a zero byte output file is legitimate.

head/usr.bin/bsdiff/bspatch/bspatch.c

 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd March 8, 2015
+.Dd April 18, 2015
 .Dt SDT 9
 .Os
 .Sh NAME
 .Nm SDT
 .Nd a DTrace framework for adding statically-defined tracing probes
 .Sh SYNOPSIS
 .In sys/param.h
 .In sys/queue.h

 .Pp
 The
 .Fn SDT_PROBE*
 macros are used to create
 .Nm
 trace points.
 They are meant to be added to executable code and can be used to instrument the
 code in which they are called.
+.Sh PROVIDERS
+A number of kernel DTrace providers are available.
+In general, these providers define stable interfaces and should be treated as
+such: existing D scripts may be broken if a probe is renamed or its arguments
+are modified.
+However, it is often useful to define ad-hoc
+.Nm
+probes for debugging a subsystem or driver.
+Similarly, a developer may wish to provide a group of
+.Nm
+probes without committing to their future stability.
+Such probes should be added to the
+.Ql sdt
+provider instead of defining a new provider.
 .Sh EXAMPLES
+The DTrace providers available on the current system can be listed with
+.Bd -literal -offset indent
+dtrace -l | sed 1d | awk '{print $2}' | sort -u
+.Ed
+.Pp
+A detailed list of the probes offered by a given provider can be obtained by
+specifying the provider using the
+.Fl P
+flag.
+For example, to view the probes and argument types for the
+.Ql sched
+provider, run
+.Bd -literal -offset indent
+dtrace -lv -P sched
+.Ed
+.Pp
 The following probe definition will create a DTrace probe called
 .Ql icmp:::receive-unreachable ,
 which would hypothetically be triggered when the kernel receives an ICMP packet
 of type Destination Unreachable:
 .Bd -literal -offset indent
 SDT_PROVIDER_DECLARE(icmp);
 
 SDT_PROBE_DEFINE1(icmp, , , receive__unreachable,