diff options
| author | christos <christos@NetBSD.org> | 2017-08-22 10:06:57 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2017-08-22 10:06:57 +0000 |
| commit | b47a1befbccdf97b23aa70ebebe817f63fc351d4 (patch) | |
| tree | b978c9ec0b308d4c167cf34055e6b2a6a5346917 | |
| parent | d0c8c118d7c4bc280a4154d0a35625152bea1fff (diff) | |
Fix for CVE-2017-12836; (cvs command injection) from MirBSD.
XXX: pullup-8
| -rw-r--r-- | external/gpl2/xcvs/dist/src/rsh-client.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/external/gpl2/xcvs/dist/src/rsh-client.c b/external/gpl2/xcvs/dist/src/rsh-client.c index 02cd0054a46..cf1d5871455 100644 --- a/external/gpl2/xcvs/dist/src/rsh-client.c +++ b/external/gpl2/xcvs/dist/src/rsh-client.c @@ -10,7 +10,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. */ #include <sys/cdefs.h> -__RCSID("$NetBSD: rsh-client.c,v 1.2 2016/05/17 14:00:09 christos Exp $"); +__RCSID("$NetBSD: rsh-client.c,v 1.3 2017/08/22 10:06:57 christos Exp $"); #include <config.h> @@ -55,11 +55,11 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, char *cvs_server = (root->cvs_server != NULL ? root->cvs_server : getenv ("CVS_SERVER")); int i = 0; - /* This needs to fit "rsh", "-b", "-l", "USER", "host", + /* This needs to fit "rsh", "-b", "-l", "USER", "--", "host", "cmd (w/ args)", and NULL. We leave some room to grow. */ - char *rsh_argv[10]; + char *rsh_argv[16]; - if (!cvs_rsh) + if (!cvs_rsh || !*cvs_rsh) /* People sometimes suggest or assume that this should default to "remsh" on systems like HPUX in which that is the system-supplied name for the rsh program. However, that @@ -99,6 +99,9 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, rsh_argv[i++] = root->username; } + /* Only non-option arguments from here. (CVE-2017-12836) */ + rsh_argv[i++] = "--"; + rsh_argv[i++] = root->hostname; rsh_argv[i++] = cvs_server; rsh_argv[i++] = "server"; @@ -159,7 +162,7 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, command = Xasprintf ("%s server", cvs_server); { - char *argv[10]; + char *argv[16]; char **p = argv; *p++ = cvs_rsh; @@ -173,6 +176,8 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, *p++ = root->username; } + *p++ = "--"; + *p++ = root->hostname; *p++ = command; *p++ = NULL; |
