CVS update [cvs1-11-x-branch]: /ccvs/, /ccvs/doc/, /ccvs/src/, /ccvs/vms/, /ccvs/windows-NT/
[email protected] 18 Apr 2005 17:36:53 -0000
| Newsgroups | gmane.comp.version-control.cvs.cvs |
|---|---|
| Message-ID | <[email protected]> |
Tag: cvs1-11-x-branch User: dprice Date: 05/04/18 10:36:53 Modified: /ccvs/ ChangeLog, NEWS, configure, configure.in /ccvs/doc/ stamp-1, stamp-vti, version-client.texi, version.texi /ccvs/src/ ChangeLog, login.c, patch.c, rcs.c /ccvs/vms/ config.h /ccvs/windows-NT/ config.h, stamp-ch Log: Update and regenerate for CVS 1.11.20. File Changes: Directory: /ccvs/ ================= File [changed]: ChangeLog Url: https://ccvs.cvshome.org/source/browse/ccvs/ChangeLog?r1=1.692.2.202&r2=1.692.2.203 Delta lines: +4 -0 ------------------- --- ChangeLog 14 Apr 2005 14:29:14 -0000 1.692.2.202 +++ ChangeLog 18 Apr 2005 17:36:41 -0000 1.692.2.203 @@ -1,3 +1,7 @@ +2005-04-15 Derek Price <[email protected]> + + * NEWS: Note Klocwork fixes. + 2005-04-14 Derek Price <[email protected]> * NEWS: Note contrib Perl taint vulnerability fix. File [changed]: NEWS Url: https://ccvs.cvshome.org/source/browse/ccvs/NEWS?r1=1.116.2.126&r2=1.116.2.127 Delta lines: +9 -0 ------------------- --- NEWS 14 Apr 2005 14:29:14 -0000 1.116.2.126 +++ NEWS 18 Apr 2005 17:36:41 -0000 1.116.2.127 @@ -3,6 +3,15 @@ SERVER SECURITY FIXES +* Thanks to a report from Alen Zukich <[email protected]>, several minor + security issues have been addressed. One was a buffer overflow that is + potentially serious but which may not be exploitable, assigned CAN-2005-0753 + by the Common Vulnerabilities and Exposures Project + <http://www.cve.mitre.org>. Other fixes resulting from Alen's report include + repair of an arbitrary free with no known exploit and several plugged memory + leaks and potentially freed NULL pointers which may have been exploitable for + a denial of service attack. + * Thanks to a report from Craig Monson <[email protected]>, minor potential vulnerabilities in the contributed Perl scripts have been fixed. The confirmed vulnerability could allow the execution of arbitrary code on File [changed]: configure Url: https://ccvs.cvshome.org/source/browse/ccvs/configure?r1=1.174.2.64&r2=1.174.2.65 Delta lines: +10 -20 --------------------- --- configure 3 Feb 2005 16:40:24 -0000 1.174.2.64 +++ configure 18 Apr 2005 17:36:41 -0000 1.174.2.65 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.59 for Concurrent Versions System (CVS) 1.11.19.1. +# Generated by GNU Autoconf 2.59 for Concurrent Versions System (CVS) 1.11.20. # # Report bugs to <[email protected]>. # @@ -269,8 +269,8 @@ # Identity of this package. PACKAGE_NAME='Concurrent Versions System (CVS)' PACKAGE_TARNAME='cvs' -PACKAGE_VERSION='1.11.19.1' -PACKAGE_STRING='Concurrent Versions System (CVS) 1.11.19.1' +PACKAGE_VERSION='1.11.20' +PACKAGE_STRING='Concurrent Versions System (CVS) 1.11.20' PACKAGE_BUGREPORT='[email protected]' ac_unique_file="src/cvs.h" @@ -784,7 +784,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures Concurrent Versions System (CVS) 1.11.19.1 to adapt to many kinds of systems. +\`configure' configures Concurrent Versions System (CVS) 1.11.20 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -846,7 +846,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of Concurrent Versions System (CVS) 1.11.19.1:";; + short | recursive ) echo "Configuration of Concurrent Versions System (CVS) 1.11.20:";; esac cat <<\_ACEOF @@ -1034,7 +1034,7 @@ test -n "$ac_init_help" && exit 0 if $ac_init_version; then cat <<\_ACEOF -Concurrent Versions System (CVS) configure 1.11.19.1 +Concurrent Versions System (CVS) configure 1.11.20 generated by GNU Autoconf 2.59 Copyright (C) 2003 Free Software Foundation, Inc. @@ -1048,7 +1048,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by Concurrent Versions System (CVS) $as_me 1.11.19.1, which was +It was created by Concurrent Versions System (CVS) $as_me 1.11.20, which was generated by GNU Autoconf 2.59. Invocation command line was $ $0 $@ @@ -1692,7 +1692,7 @@ # Define the identity of the package. PACKAGE='cvs' - VERSION='1.11.19.1' + VERSION='1.11.20' # Some tools Automake needs. @@ -13452,7 +13452,7 @@ } >&5 cat >&5 <<_CSEOF -This file was extended by Concurrent Versions System (CVS) $as_me 1.11.19.1, which was +This file was extended by Concurrent Versions System (CVS) $as_me 1.11.20, which was generated by GNU Autoconf 2.59. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -13518,7 +13518,7 @@ cat >>$CONFIG_STATUS <<_ACEOF ac_cs_version="\\ -Concurrent Versions System (CVS) config.status 1.11.19.1 +Concurrent Versions System (CVS) config.status 1.11.20 configured by $0, generated by GNU Autoconf 2.59, with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\" @@ -14687,14 +14687,4 @@ # Report the state of this version of CVS if this is from dev. - cat <<EOF - -You are about to use an unreleased version of CVS. Be sure to -read the relevant mailing lists, most importantly <[email protected]>. - -Below you will find information on the status of this version of CVS. - - -EOF - sed -n '/^\* Status/,$p' $srcdir/BUGS File [changed]: configure.in Url: https://ccvs.cvshome.org/source/browse/ccvs/configure.in?r1=1.176.2.58&r2=1.176.2.59 Delta lines: +1 -1 ------------------- --- configure.in 3 Feb 2005 16:40:27 -0000 1.176.2.58 +++ configure.in 18 Apr 2005 17:36:44 -0000 1.176.2.59 @@ -1,5 +1,5 @@ dnl configure.in for cvs -AC_INIT([Concurrent Versions System (CVS)],[1.11.19.1],[[email protected]],[cvs]) +AC_INIT([Concurrent Versions System (CVS)],[1.11.20],[[email protected]],[cvs]) AC_CONFIG_SRCDIR(src/cvs.h) AM_INIT_AUTOMAKE([gnu 1.7.9 dist-bzip2 no-define]) AC_PREREQ(2.58) Directory: /ccvs/doc/ ===================== File [changed]: stamp-1 Url: https://ccvs.cvshome.org/source/browse/ccvs/doc/stamp-1?r1=1.9.2.32&r2=1.9.2.33 Delta lines: +4 -4 ------------------- --- stamp-1 15 Mar 2005 21:56:54 -0000 1.9.2.32 +++ stamp-1 18 Apr 2005 17:36:44 -0000 1.9.2.33 @@ -1,4 +1,4 @@ -@set UPDATED 3 February 2004 -@set UPDATED-MONTH February 2004 -@set EDITION 1.11.19.1 -@set VERSION 1.11.19.1 +@set UPDATED 11 November 2004 +@set UPDATED-MONTH November 2004 +@set EDITION 1.11.20 +@set VERSION 1.11.20 File [changed]: stamp-vti Url: https://ccvs.cvshome.org/source/browse/ccvs/doc/stamp-vti?r1=1.19.2.68&r2=1.19.2.69 Delta lines: +3 -3 ------------------- --- stamp-vti 14 Apr 2005 14:24:55 -0000 1.19.2.68 +++ stamp-vti 18 Apr 2005 17:36:44 -0000 1.19.2.69 @@ -1,4 +1,4 @@ -@set UPDATED 8 April 2005 +@set UPDATED 14 April 2005 @set UPDATED-MONTH April 2005 -@set EDITION 1.11.19.1 -@set VERSION 1.11.19.1 +@set EDITION 1.11.20 +@set VERSION 1.11.20 File [changed]: version-client.texi Url: https://ccvs.cvshome.org/source/browse/ccvs/doc/version-client.texi?r1=1.9.2.32&r2=1.9.2.33 Delta lines: +4 -4 ------------------- --- version-client.texi 15 Mar 2005 21:56:54 -0000 1.9.2.32 +++ version-client.texi 18 Apr 2005 17:36:44 -0000 1.9.2.33 @@ -1,4 +1,4 @@ -@set UPDATED 3 February 2004 -@set UPDATED-MONTH February 2004 -@set EDITION 1.11.19.1 -@set VERSION 1.11.19.1 +@set UPDATED 11 November 2004 +@set UPDATED-MONTH November 2004 +@set EDITION 1.11.20 +@set VERSION 1.11.20 File [changed]: version.texi Url: https://ccvs.cvshome.org/source/browse/ccvs/doc/version.texi?r1=1.20.2.68&r2=1.20.2.69 Delta lines: +3 -3 ------------------- --- version.texi 14 Apr 2005 14:24:55 -0000 1.20.2.68 +++ version.texi 18 Apr 2005 17:36:44 -0000 1.20.2.69 @@ -1,4 +1,4 @@ -@set UPDATED 8 April 2005 +@set UPDATED 14 April 2005 @set UPDATED-MONTH April 2005 -@set EDITION 1.11.19.1 -@set VERSION 1.11.19.1 +@set EDITION 1.11.20 +@set VERSION 1.11.20 Directory: /ccvs/src/ ===================== File [changed]: ChangeLog Url: https://ccvs.cvshome.org/source/browse/ccvs/src/ChangeLog?r1=1.2336.2.359&r2=1.2336.2.360 Delta lines: +10 -0 -------------------- --- ChangeLog 17 Mar 2005 16:31:47 -0000 1.2336.2.359 +++ ChangeLog 18 Apr 2005 17:36:45 -0000 1.2336.2.360 @@ -1,5 +1,15 @@ 2005-03-17 Derek Price <[email protected]> + * login.c (password_entry_parseline): Avoid using uninitialized + variable. + * rcs.c (RCS_deltas): Avoid buffer overflow. + (RCS_checkout): Avoid using uninitialized loglen. + * patch.c (patch_fileproc): Free original pointer, not one that may + have been incremented. + (Thanks to report from Alen Zukich <[email protected]>.) + +2005-03-17 Derek Price <[email protected]> + * commit.c (checkaddfile): Avoid dereferencing a NULL pointer in response to a rare error. * admin.c (admin_fileproc), log.c (log_expand_revlist), mkmodules.c File [changed]: login.c Url: https://ccvs.cvshome.org/source/browse/ccvs/src/login.c?r1=1.70.4.5&r2=1.70.4.6 Delta lines: +1 -1 ------------------- --- login.c 28 Feb 2005 15:55:56 -0000 1.70.4.5 +++ login.c 18 Apr 2005 17:36:45 -0000 1.70.4.6 @@ -119,7 +119,7 @@ if (isspace(*(linebuf + 1))) /* special case since strtoul ignores leading white space */ - entry_version = 0; + q = linebuf + 1; else entry_version = strtoul (linebuf + 1, &q, 10); File [changed]: patch.c Url: https://ccvs.cvshome.org/source/browse/ccvs/src/patch.c?r1=1.80.4.10&r2=1.80.4.11 Delta lines: +4 -3 ------------------- --- patch.c 15 Mar 2005 17:44:40 -0000 1.80.4.10 +++ patch.c 18 Apr 2005 17:36:45 -0000 1.80.4.11 @@ -391,6 +391,7 @@ struct utimbuf t; char *vers_tag, *vers_head; char *rcs = NULL; + char *rcs_orig = NULL; RCSNode *rcsfile; FILE *fp1, *fp2, *fp3; int ret = 0; @@ -421,7 +422,7 @@ if ((rcsfile->flags & VALID) && (rcsfile->flags & INATTIC)) isattic = 1; - rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5); + rcs_orig = rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5); (void) sprintf (rcs, "%s%s", finfo->file, RCSEXT); /* if vers_head is NULL, may have been removed from the release */ @@ -763,8 +764,8 @@ free (vers_tag); if (vers_head != NULL) free (vers_head); - if (rcs != NULL) - free (rcs); + if (rcs_orig) + free (rcs_orig); return ret; } File [changed]: rcs.c Url: https://ccvs.cvshome.org/source/browse/ccvs/src/rcs.c?r1=1.262.4.35&r2=1.262.4.36 Delta lines: +5 -4 ------------------- --- rcs.c 17 Mar 2005 16:31:48 -0000 1.262.4.35 +++ rcs.c 18 Apr 2005 17:36:45 -0000 1.262.4.36 @@ -3067,8 +3067,7 @@ if (retval != NULL) return (retval); - if (!force_tag_match || - (vers != NULL && RCS_datecmp (vers->date, date) <= 0)) + if (vers && (!force_tag_match || RCS_datecmp (vers->date, date) <= 0)) return xstrdup (vers->version); else return NULL; @@ -4155,7 +4154,7 @@ size_t len; int free_value = 0; char *log = NULL; - size_t loglen; + size_t loglen = 0; Node *vp = NULL; #ifdef PRESERVE_PERMISSIONS_SUPPORT uid_t rcs_owner = (uid_t) -1; @@ -7529,7 +7528,7 @@ for (ln = 0; ln < headlines.nlines; ++ln) { - char buf[80]; + char *buf; /* Period which separates year from month in date. */ char *ym; /* Period which separates month from day in date. */ @@ -7540,10 +7539,12 @@ if (prvers == NULL) prvers = vers; + buf = xmalloc (strlen (prvers->version) + 24); sprintf (buf, "%-12s (%-8.8s ", prvers->version, prvers->author); cvs_output (buf, 0); + free (buf); /* Now output the date. */ ym = strchr (prvers->date, '.'); Directory: /ccvs/vms/ ===================== File [changed]: config.h Url: https://ccvs.cvshome.org/source/browse/ccvs/vms/config.h?r1=1.25.4.3&r2=1.25.4.4 Delta lines: +1 -1 ------------------- --- config.h 15 Mar 2005 21:48:52 -0000 1.25.4.3 +++ config.h 18 Apr 2005 17:36:46 -0000 1.25.4.4 @@ -9,7 +9,7 @@ June 1995 - <[email protected]> */ /* The following macro are defined by running ./configure under UNIX OSs. */ -#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.19.1" +#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.20" /* We only want to build the client */ #define CLIENT_SUPPORT 1 Directory: /ccvs/windows-NT/ ============================ File [changed]: config.h Url: https://ccvs.cvshome.org/source/browse/ccvs/windows-NT/config.h?r1=1.46.2.30&r2=1.46.2.31 Delta lines: +1 -1 ------------------- --- config.h 9 Feb 2005 03:52:28 -0000 1.46.2.30 +++ config.h 18 Apr 2005 17:36:46 -0000 1.46.2.31 @@ -454,7 +454,7 @@ /* The following macro is defined by running ./configure and then make * under UNIX OSs. */ -#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.19.1" +#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.20" /* The following were added to make #include "xsize.h" work. */ File [changed]: stamp-ch Url: https://ccvs.cvshome.org/source/browse/ccvs/windows-NT/stamp-ch?r1=1.1.2.30&r2=1.1.2.31 Delta lines: +1 -1 ------------------- --- stamp-ch 9 Feb 2005 03:52:28 -0000 1.1.2.30 +++ stamp-ch 18 Apr 2005 17:36:46 -0000 1.1.2.31 @@ -454,7 +454,7 @@ /* The following macro is defined by running ./configure and then make * under UNIX OSs. */ -#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.19.1" +#define PACKAGE_STRING "Concurrent Versions System (CVS) 1.11.20" /* The following were added to make #include "xsize.h" work. */