Subject: [PATCH] Fix CVE-2017-12836
From: Thorsten Glaser <tg@mirbsd.de>
--- cvs-1.12.13+real/src/rsh-client.c
+++ cvs-1.12.13+real/src/rsh-client.c
@@ -53,7 +53,8 @@
char *cvs_server = (root->cvs_server != NULL
? root->cvs_server : getenv ("CVS_SERVER"));
int i = 0;
- /* This needs to fit "rsh", "-b", "-l", "USER", "host",
- "cmd (w/ args)", and NULL. We leave some room to grow. */
- char *rsh_argv[10];
+ /* This needs to fit "rsh", "-b", "-l", "USER", "-p", port,
+ "--", "host", "cvs", "-R", "server", and NULL.
+ We leave some room to grow. */
+ char *rsh_argv[16];
@@ -105,6 +106,9 @@
rsh_argv[i++] = argvport;
}
+ /* Only non-option arguments from here. (CVE-2017-12836) */
+ rsh_argv[i++] = "--";
+
rsh_argv[i++] = root->hostname;
rsh_argv[i++] = cvs_server;
if (readonlyfs)
@@ -189,6 +193,8 @@
*p++ = argvport;
}
+ *p++ = "--";
+
*p++ = root->hostname;
*p++ = command;
*p++ = NULL;
