From c375b2cf5bc56b8ac3351dea89a4e8541e65b6ea Mon Sep 17 00:00:00 2001 From: Fabian Keil Date: Mon, 21 Aug 2017 11:23:15 +0200 Subject: [PATCH] devel/cvs: Import inofficial patch to fix CVE-2017-12836 --- devel/cvs/Makefile | 2 +- devel/cvs/files/patch-src-client.c | 55 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 devel/cvs/files/patch-src-client.c diff --git a/devel/cvs/Makefile b/devel/cvs/Makefile index 24f82936d4ea..dec9fbb2fcd1 100644 --- a/devel/cvs/Makefile +++ b/devel/cvs/Makefile @@ -2,7 +2,7 @@ PORTNAME= cvs PORTVERSION= 1.20120905 -PORTREVISION?= 4 +PORTREVISION?= 5 CATEGORIES= devel MASTER_SITES= LOCAL/eadler diff --git a/devel/cvs/files/patch-src-client.c b/devel/cvs/files/patch-src-client.c new file mode 100644 index 000000000000..80d6af0a0c71 --- /dev/null +++ b/devel/cvs/files/patch-src-client.c @@ -0,0 +1,55 @@ +From 9c448da8bb5f592ddcd2d980d01d81305f920f78 Mon Sep 17 00:00:00 2001 +From: Fabian Keil +Date: Mon, 21 Aug 2017 10:49:05 +0200 +Subject: [PATCH] Add fix for CVE-2017-12836 + +Based on a patch by Thorsten Glaser: +https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10 + +The patched file had to be changed and in the first +chunk the size of rsh_argv has been extended to 16 +to match Debian's upstream version. +--- + cvs/src/client.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git cvs/src/client.c cvs/src/client.c +index c9fe170..09771ce 100644 +--- src/client.c ++++ src/client.c +@@ -4736,9 +4736,10 @@ start_rsh_server (root, to_server, from_server) + char *cvs_rsh; + char *cvs_server = getenv ("CVS_SERVER"); + int i = 0; +- /* This needs to fit "rsh", "-b", "-l", "USER", "host", +- "cmd (w/ args)", and NULL. We leave some room to grow. */ +- char *rsh_argv[10]; ++ /* This needs to fit "rsh", "-b", "-l", "USER", "-p", port, ++ "--", "host", "cvs", "-R", "server", and NULL. ++ We leave some room to grow. */ ++ char *rsh_argv[16]; + + if (root->method == extssh_method) + cvs_rsh = env_cvs_ssh ? env_cvs_ssh : SSH_DFLT; +@@ -4763,6 +4764,9 @@ start_rsh_server (root, to_server, from_server) + rsh_argv[i++] = root->username; + } + ++ /* Only non-option arguments from here. (CVE-2017-12836) */ ++ rsh_argv[i++] = "--"; ++ + rsh_argv[i++] = root->hostname; + rsh_argv[i++] = cvs_server; + rsh_argv[i++] = "server"; +@@ -4841,6 +4845,8 @@ start_rsh_server (root, to_server, from_server) + *p++ = root->username; + } + ++ *p++ = "--"; ++ + *p++ = root->hostname; + *p++ = command; + *p++ = NULL; +-- +2.14.1 + -- 2.14.1