Pull up following revision(s) (requested by lukem in ticket #1180):
	usr.bin/ftp/version.h: revision 1.85
Version 20141026
Ignore special characters unless they're from the command line.
Fixes CVE-2014-8517
Ticket 1180.
Pull up following revision(s) (requested by riastradh in ticket #1117):
	sys/dev/rasops/rasops.c: revision 1.72
	sys/dev/vme/if_ie_vme.c: revision 1.31
	sys/dev/qbus/if_qe.c: revision 1.73
	sys/altq/altq_jobs.c: revision 1.7
	sys/net/if_gre.c: revision 1.160
	sys/dev/ic/oosiop.c: revision 1.14
- Fix error branches in altq_jobs.c to avoid leaks, noted by maxv@.
- Fix leaks in oosiop_alloc_cb error branches, noted by maxv@.
  While here, avoid a sketchy pointer cast that probably falls afoul of
  strict aliasing rules. Compile-tested only, with hppa.
- Don't leak f on failurein rasops.c.  Noted by maxv@.
  Compile-tested only, with zaurus.
- Avoid leak in error branch in if_qe.c, noted by maxv@, compile-tested for
  vax.
- Sizeof struct ievme, not sizeof size_t in if_ie_vme.c.
  Noted by maxv@, compile-tested for sparc.
- Don't leak in gre_clone_create error branch.
  Noted by maxv@, compile-tested for amd64.
Pull up following revision(s) (requested by riastradh in ticket #1118):
	sys/kern/kern_rndq.c: revision 1.27
	sys/kern/kern_rndpool.c: revision 1.7
buf is not guaranteed to be aligned; don't *(uint32_t *) it in kern_rndq.c.
done is not guaranteed to be aligned; don't *(uint32_t *) it in kern_rndpool.c.
Ticket 1117-1118 and 1139.
Pull up following revision(s) (requested by tsutsui in ticket #1139):
	sys/arch/sun3/dev/fd.c: revision 1.78
	sys/arch/sparc/dev/fd.c: revision 1.155
	sys/arch/sparc64/dev/fdc.c: revision 1.42
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
I'm not sure why this 18 year old bug didn't cause problem before
(at least my old 5.99.23 kernel worked), but probably it's triggered
by new gcc 4.8 which might do more aggressive memory allocation.
The problem is found by Nobuyoshi Sato on trying eject(1) against fd(4).
Should be pulled up to netbsd-7.
Sync with sparc/dev/fd.c:1.155.
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
I'm not sure why this 18 year old bug didn't cause problem before
(at least my old 5.99.23 kernel worked), but probably it's triggered
by new gcc 4.8 which might do more aggressive memory allocation.
The problem is found by Nobuyoshi Sato on trying eject(1) against fd(4).
Should be pulled up to netbsd-7.
Sync with sparc/dev/fd.c rev 1.155.
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
Note sun3 still uses gcc 4.5.4 but also panicked by this old bug,
so probably this problem was triggered by not gcc 4.8 but struct disk
changes (struct disk_geom was added in <sys/disk.h> rev 1.58),
which increased sizeof(struct fd_softc) from 248 bytes to 296 bytes.
(i.e. now struct fd_softc could be allocated in a different pool block,
 probably near the wrong pointer of the struct disklabel)
Anyway, this fix should be pullued up to netbsd-7.
(probably I'm the only user of floppy on sun3 though)
Pull up following revision(s) (requested by christos in ticket #1169):
	crypto/external/bsd/openssh/dist/auth.c: revision 1.9
for consistency use options.use_dns when getting the canonical hostname.
[we do the same below for hosts.allow and deny] reported by rudolf.
Ticket 1169.
Pull up following revision(s) (requested by christos in ticket #1174):
	sys/netinet/tcp_output.c: revision 1.178
Avoid stack overflow when SACK and TCP_SIGNATURE are both present. Thanks
to Jonathan Looney for pointing this out.
Ticket 1174.