components/developer/cvs/patches/01-CVE-2017-12836.patch

   1 Fix is taken from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810
   2
   3 --- cvs-1.12.13/src/rsh-client.c.~1~    2005-10-02 19:17:21.000000000 +0000
   4 +++ cvs-1.12.13/src/rsh-client.c        2017-08-21 22:02:48.504540428 +0000
   5 @@ -53,8 +53,9 @@
   6      char *cvs_server = (root->cvs_server != NULL
   7                         ? root->cvs_server : getenv ("CVS_SERVER"));
   8      int i = 0;
   9 -    /* This needs to fit "rsh", "-b", "-l", "USER", "host",
  10 -       "cmd (w/ args)", and NULL.  We leave some room to grow. */
  11 +    /* This needs to fit "rsh", "-b", "-l", "USER",
  12 +       "--", "host", "cmd (w/ args)", and NULL.
  13 +       We leave some room to grow. */
  14      char *rsh_argv[10];
  15
  16      if (!cvs_rsh)
  17 @@ -97,6 +98,9 @@
  18         rsh_argv[i++] = root->username;
  19      }
  20
  21 +    /* Only non-option arguments from here. (CVE-2017-12836) */
  22 +    rsh_argv[i++] = "--";
  23 +
  24      rsh_argv[i++] = root->hostname;
  25      rsh_argv[i++] = cvs_server;
  26      rsh_argv[i++] = "server";
  27 @@ -171,6 +175,8 @@
  28             *p++ = root->username;
  29         }
  30
  31 +       *p++ = "--";
  32 +
  33         *p++ = root->hostname;
  34         *p++ = command;
  35         *p++ = NULL;