public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cvs: patch against CVE-2012-0804 (heap overflow)

Browse Source
This commit is contained in:
Graham Christensen 2017-01-25 07:23:49 -05:00
parent 87a3ee0c40
commit 04ae7febc8
No known key found for this signature in database
GPG Key ID: 06121D366FE9435C
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkgs/applications/version-management/cvs/CVE-2012-0804.patch Normal file
View File

@ -0,0 +1,16 @@
diff --git a/src/client.c b/src/client.c
index 751406b..b45d89c 100644
--- a/src/client.c
+++ b/src/client.c
@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, struct buffer **to_server_p,
* code.
*/
read_line_via (from_server, to_server, &read_buf);
- sscanf (read_buf, "%s %d", write_buf, &codenum);
+ count = sscanf (read_buf, "%*s %d", &codenum);
- if ((codenum / 100) != 2)
+ if (count != 1 || (codenum / 100) != 2)
error (1, 0, "proxy server %s:%d does not support http tunnelling",
root->proxy_hostname, proxy_port_number);
free (read_buf);

5
pkgs/applications/version-management/cvs/default.nix
View File

@ -8,7 +8,10 @@ stdenv.mkDerivation {
sha256 = "0pjir8cwn0087mxszzbsi1gyfc6373vif96cw4q3m1x6p49kd1bq";
};
patches = [ ./getcwd-chroot.patch ];
patches = [
./getcwd-chroot.patch
./CVE-2012-0804.patch
];
hardeningDisable = [ "fortify" "format" ];