cvs: patch against CVE-2012-0804 (heap overflow)

pkgs/applications/version-management/cvs/CVE-2012-0804.patch

@@ -0,0 +1,16 @@
+diff --git a/src/client.c b/src/client.c
+index 751406b..b45d89c 100644
+--- a/src/client.c
++++ b/src/client.c
+@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, struct buffer **to_server_p,
+          * code.
+          */
+ 	read_line_via (from_server, to_server, &read_buf);
+-	sscanf (read_buf, "%s %d", write_buf, &codenum);
++	count = sscanf (read_buf, "%*s %d", &codenum);
+
+-	if ((codenum / 100) != 2)
++	if (count != 1 || (codenum / 100) != 2)
+ 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
+ 		   root->proxy_hostname, proxy_port_number);
+ 	free (read_buf);

pkgs/applications/version-management/cvs/default.nix

@@ -8,7 +8,10 @@ stdenv.mkDerivation {
     sha256 = "0pjir8cwn0087mxszzbsi1gyfc6373vif96cw4q3m1x6p49kd1bq";
   };
 
-  patches = [ ./getcwd-chroot.patch ];
+  patches = [
+    ./getcwd-chroot.patch
+    ./CVE-2012-0804.patch
+  ];
 
   hardeningDisable = [ "fortify" "format" ];