summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2017-08-22 10:06:57 +0000
committerchristos <christos@NetBSD.org>2017-08-22 10:06:57 +0000
commitb47a1befbccdf97b23aa70ebebe817f63fc351d4 (patch)
treeb978c9ec0b308d4c167cf34055e6b2a6a5346917
parentd0c8c118d7c4bc280a4154d0a35625152bea1fff (diff)
Fix for CVE-2017-12836; (cvs command injection) from MirBSD.
XXX: pullup-8
-rw-r--r--external/gpl2/xcvs/dist/src/rsh-client.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/external/gpl2/xcvs/dist/src/rsh-client.c b/external/gpl2/xcvs/dist/src/rsh-client.c
index 02cd0054a46..cf1d5871455 100644
--- a/external/gpl2/xcvs/dist/src/rsh-client.c
+++ b/external/gpl2/xcvs/dist/src/rsh-client.c
@@ -10,7 +10,7 @@
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details. */
#include <sys/cdefs.h>
-__RCSID("$NetBSD: rsh-client.c,v 1.2 2016/05/17 14:00:09 christos Exp $");
+__RCSID("$NetBSD: rsh-client.c,v 1.3 2017/08/22 10:06:57 christos Exp $");
#include <config.h>
@@ -55,11 +55,11 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
char *cvs_server = (root->cvs_server != NULL
? root->cvs_server : getenv ("CVS_SERVER"));
int i = 0;
- /* This needs to fit "rsh", "-b", "-l", "USER", "host",
+ /* This needs to fit "rsh", "-b", "-l", "USER", "--", "host",
"cmd (w/ args)", and NULL. We leave some room to grow. */
- char *rsh_argv[10];
+ char *rsh_argv[16];
- if (!cvs_rsh)
+ if (!cvs_rsh || !*cvs_rsh)
/* People sometimes suggest or assume that this should default
to "remsh" on systems like HPUX in which that is the
system-supplied name for the rsh program. However, that
@@ -99,6 +99,9 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
rsh_argv[i++] = root->username;
}
+ /* Only non-option arguments from here. (CVE-2017-12836) */
+ rsh_argv[i++] = "--";
+
rsh_argv[i++] = root->hostname;
rsh_argv[i++] = cvs_server;
rsh_argv[i++] = "server";
@@ -159,7 +162,7 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
command = Xasprintf ("%s server", cvs_server);
{
- char *argv[10];
+ char *argv[16];
char **p = argv;
*p++ = cvs_rsh;
@@ -173,6 +176,8 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
*p++ = root->username;
}
+ *p++ = "--";
+
*p++ = root->hostname;
*p++ = command;
*p++ = NULL;