Attachment 20405 Details for Bug 54773

[patch] Patch for the new vulnerabilities

cvs-krahmer-esser-issues-fix.patch (text/plain), 6.11 KB, created by Sebastian Krahmer on 2004-05-28 17:38:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-05-28 17:38:22 UTC

Size: 6.11 KB

patch

obsolete

>diff -Nur cvs-1.12.7.orig/src/commit.c cvs-1.12.7/src/commit.c
>--- cvs-1.12.7.orig/src/commit.c	Mon Apr  5 17:36:08 2004
>+++ cvs-1.12.7/src/commit.c	Thu May 27 13:45:36 2004
>@@ -484,6 +484,11 @@
> 	   operate on, and only work with those files in the future.
> 	   This saves time--we don't want to search the file system
> 	   of the working directory twice.  */
>+	if (find_args.argc > (0x7fffffff / sizeof (char **)))
>+	{
>+	    find_args.argc = 0;
>+	    return 0;
>+	}
> 	find_args.argv = (char **) xmalloc (find_args.argc * sizeof (char **));
> 	find_args.argc = 0;
> 	walklist (find_args.ulist, copy_ulist, &find_args);
>diff -Nur cvs-1.12.7.orig/src/filesubr.c cvs-1.12.7/src/filesubr.c
>--- cvs-1.12.7.orig/src/filesubr.c	Mon Apr  5 17:36:09 2004
>+++ cvs-1.12.7/src/filesubr.c	Thu May 27 13:42:56 2004
>@@ -924,6 +924,12 @@
> expand_wild (int argc, char **argv, int *pargc, char ***pargv)
> {
>     int i;
>+    if (argc > (0x7fffffff / sizeof (char *))) {
>+	*pargc = 0;
>+	*pargv = NULL;
>+	error (0, 0, "expand_wild: too many arguments");
>+	return;
>+    }
>     *pargc = argc;
>     *pargv = (char **) xmalloc (argc * sizeof (char *));
>     for (i = 0; i < argc; ++i)
>diff -Nur cvs-1.12.7.orig/src/history.c cvs-1.12.7/src/history.c
>--- cvs-1.12.7.orig/src/history.c	Mon Mar 22 18:26:45 2004
>+++ cvs-1.12.7/src/history.c	Thu May 27 13:38:40 2004
>@@ -412,8 +412,11 @@
> 		working = 1;
> 		break;
> 	    case 'X':			/* Undocumented debugging flag */
>+#ifdef DEBUG
> 		histfile = optarg;
>+#endif
> 		break;
>+
> 	    case 'D':			/* Since specified date */
> 		if (*since_rev || *since_tag || *backto)
> 		{
>@@ -898,6 +901,11 @@
> {
>     if (user_count == user_max)
>     {
>+	if (user_max + USER_INCREMENT > (0x7FFFFFFF / sizeof (char *)))
>+	{
>+	    error (0, 0, "save_user: too many users");
>+	    return;
>+	}
> 	user_max += USER_INCREMENT;
> 	user_list = (char **) xrealloc ((char *) user_list,
> 					(int) user_max * sizeof (char *));
>@@ -925,6 +933,11 @@
> 
>     if (file_count == file_max)
>     {
>+	if (file_max + FILE_INCREMENT > (0x7FFFFFFF / sizeof (*fl)))
>+	{
>+	    error (0, 0, "save_file: too many files");
>+	    return;
>+	}
> 	file_max += FILE_INCREMENT;
> 	file_list = (struct file_list_str *) xrealloc ((char *) file_list,
> 						   file_max * sizeof (*fl));
>@@ -965,6 +978,11 @@
> {
>     if (mod_count == mod_max)
>     {
>+	if (mod_max + MODULE_INCREMENT > (0x7FFFFFFF / sizeof (char *)))
>+	{
>+	    error (0, 0, "save_module: too many modules");
>+	    return;
>+	}
> 	mod_max += MODULE_INCREMENT;
> 	mod_list = (char **) xrealloc ((char *) mod_list,
> 				       mod_max * sizeof (char *));
>diff -Nur cvs-1.12.7.orig/src/server.c cvs-1.12.7/src/server.c
>--- cvs-1.12.7.orig/src/server.c	Tue Apr  6 22:17:55 2004
>+++ cvs-1.12.7/src/server.c	Wed May 26 12:49:22 2004
>@@ -886,7 +886,7 @@
>     int i;
>     char *p;
> 
>-    if (lim < 0)
>+    if (lim < 0 || lim > 10000)
> 	return;
>     p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10);
>     if (p == NULL)
>@@ -1936,6 +1936,9 @@
>     {
> 	char *cp;
> 
>+	if (!data[0])
>+	    goto error;
>+
> 	if (strchr (data, '+'))
> 	    goto error;
> 
>@@ -2068,6 +2071,14 @@
>     char *p;
> 
>     if (error_pending()) return;
>+    
>+    if (argument_count >= 10000)
>+    {
>+	if (alloc_pending (80))
>+	    sprintf (pending_error_text, 
>+		     "E Protocol error: too many arguments");
>+	return;
>+    }
> 
>     if (argument_vector_size <= argument_count)
>     {
>@@ -2097,6 +2108,14 @@
>     char *p;
> 
>     if (error_pending()) return;
>+    
>+    if (argument_count <= 1) 
>+    {
>+	if (alloc_pending (80))
>+	    sprintf (pending_error_text,
>+		     "E Protocol error: called argumentx without prior call to argument");
>+	return;
>+    }
> 
>     p = argument_vector[argument_count - 1];
>     p = xrealloc (p, strlen (p) + 1 + strlen (arg) + 1);
>@@ -2423,7 +2442,7 @@
>                     save some code here...  -kff */
> 
>                  /* Chop newline by hand, for strcmp()'s sake. */
>-                 if (linebuf[num_red - 1] == '\n')
>+                 if (num_red > 0 && linebuf[num_red - 1] == '\n')
>                      linebuf[num_red - 1] = '\0';
> 
>                  if (strcmp (linebuf, CVS_Username) == 0)
>@@ -2478,7 +2497,7 @@
> 	 while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
> 	 {
> 	     /* Chop newline by hand, for strcmp()'s sake. */
>-	     if (linebuf[num_red - 1] == '\n')
>+	     if (num_red > 0 && linebuf[num_red - 1] == '\n')
> 		 linebuf[num_red - 1] = '\0';
> 
> 	     if (strcmp (linebuf, CVS_Username) == 0)
>diff -Nur cvs-1.12.7.orig/src/wrapper.c cvs-1.12.7/src/wrapper.c
>--- cvs-1.12.7.orig/src/wrapper.c	Wed Feb 18 05:46:08 2004
>+++ cvs-1.12.7/src/wrapper.c	Wed May 26 12:48:32 2004
>@@ -235,6 +235,30 @@
> #endif /* SERVER_SUPPORT || CLIENT_SUPPORT */
> 
> /*
>+ * Remove fmt str specifier other than %% or %s. And allow
>+ * only max_s %s specifiers
>+ */
>+wrap_clean_fmt_str(char *fmt, int max_s)
>+{
>+    while (*fmt) {
>+	if (fmt[0] == '%' && fmt[1])
>+	{
>+	    if (fmt[1] == '%') 
>+		fmt++;
>+	    else
>+		if (fmt[1] == 's' && max_s > 0)
>+		{
>+		    max_s--;
>+		    fmt++;
>+		} else 
>+		    *fmt = ' ';
>+	}
>+	fmt++;
>+    }
>+    return;
>+}
>+
>+/*
>  * Open a file and read lines, feeding each line to a line parser. Arrange
>  * for keeping a temporary list of wrappers at the end, if the "temp"
>  * argument is set.
>@@ -540,9 +564,8 @@
>     args = xmalloc (strlen (e->tocvsFilter)
> 		    + strlen (fileName)
> 		    + strlen (buf));
>-    /* FIXME: sprintf will blow up if the format string contains items other
>-       than %s, or contains too many %s's.  We should instead be parsing
>-       e->tocvsFilter ourselves and giving a real error.  */
>+
>+    wrap_clean_fmt_str(e->tocvsFilter, 2);
>     sprintf (args, e->tocvsFilter, fileName, buf);
>     run_setup (args);
>     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL|RUN_REALLY );
>@@ -572,9 +595,8 @@
> 
>     args = xmalloc (strlen (e->fromcvsFilter)
> 		    + strlen (fileName));
>-    /* FIXME: sprintf will blow up if the format string contains items other
>-       than %s, or contains too many %s's.  We should instead be parsing
>-       e->fromcvsFilter ourselves and giving a real error.  */
>+
>+    wrap_clean_fmt_str(e->fromcvsFilter, 1);
>     sprintf (args, e->fromcvsFilter, fileName);
>     run_setup (args);
>     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL );

Actions: View | Diff

Attachments on bug 54773: 18913 | 18919 | 18920 | 19603 | 20020 | 20405 | 20524 | 20697