cvs: patch against CVE-2012-0804 (heap overflow)

2017-01-25 07:24:19 -05:00
parent 87a3ee0c40
commit 04ae7febc8
2 changed files with 20 additions and 1 deletions
@@ -0,0 +1,16 @@
+diff --git a/src/client.c b/src/client.c
+index 751406b..b45d89c 100644
+--- a/src/client.c
+++ b/src/client.c
+@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, struct buffer **to_server_p,
+          * code.
+          */
+ 	read_line_via (from_server, to_server, &read_buf);
+-	sscanf (read_buf, "%s %d", write_buf, &codenum);
+	count = sscanf (read_buf, "%*s %d", &codenum);
+
+-	if ((codenum / 100) != 2)
+	if (count != 1 || (codenum / 100) != 2)
+ 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
+ 		   root->proxy_hostname, proxy_port_number);
+ 	free (read_buf);