From owner-freebsd-security@FreeBSD.ORG Wed May 19 05:32:16 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6B34C16A4CE for ; Wed, 19 May 2004 05:32:16 -0700 (PDT) Received: from smtp.des.no (flood.des.no [217.116.83.31]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7924143D1D for ; Wed, 19 May 2004 05:32:15 -0700 (PDT) (envelope-from des@des.no) Received: by smtp.des.no (Pony Express, from userid 666) id 2BA8A5312; Wed, 19 May 2004 14:31:54 +0200 (CEST) Received: from dwp.des.no (des.no [80.203.228.37]) by smtp.des.no (Pony Express) with ESMTP id 5F4D95310; Wed, 19 May 2004 14:31:45 +0200 (CEST) Received: by dwp.des.no (Postfix, from userid 2602) id 183AE33CAA; Wed, 19 May 2004 14:31:45 +0200 (CEST) To: amal References: <20040519072516.5771133CAE@dwp.des.no> <20040519113106.GB21714@droso.net> <200405190807.47669.ajasen@spamcop.net> From: des@des.no (=?iso-8859-1?q?Dag-Erling_Sm=F8rgrav?=) Date: Wed, 19 May 2004 14:31:45 +0200 In-Reply-To: <200405190807.47669.ajasen@spamcop.net> (ajasen@spamcop.net's message of "Wed, 19 May 2004 08:07:18 -0400") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on flood.des.no X-Spam-Level: X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.63 X-Content-Filtered-By: Mailman/MimeDel 2.1.1 cc: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-04:10.cvs X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 May 2004 12:32:16 -0000 --=-=-= Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable amal writes: > My source tree was previously cvsuped to 5.2.1-RELEASE-p6. It's probably easier and safer for you to cvsup than to apply the patch manually. > I found cvs in /usr/src/contrib/cvs rather > than /usr/src/gnu/usr.bin/cvs, which is what the > advisory recommends. The sources are in contrib, but the build infrastructure is in gnu. Building and installing from /usr/src/contrib/cvs instead of /usr/src/gnu/usr.bin/cvs will *not* produce the correct results. > # cd /usr/src > # patch < /path/to/patch > > /* patch did not find the file to patch. */ Argh! I forgot to make sure the patch was relative to /usr/src. I'll upload a new patch (attached) ASAP. DES --=20 Dag-Erling Sm=F8rgrav - des@des.no --=-=-= Content-Type: text/x-patch Content-Disposition: inline; filename=cvs.patch Index: contrib/cvs/src/server.c =================================================================== RCS file: /home/ncvs/src/contrib/cvs/src/server.c,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- contrib/cvs/src/server.c 15 Apr 2004 01:17:27 -0000 1.21 +++ contrib/cvs/src/server.c 19 May 2004 06:17:52 -0000 1.22 @@ -1645,7 +1645,7 @@ && strncmp (arg, name, cp - name) == 0) { timefield = strchr (cp + 1, '/') + 1; - if (*timefield != '=') + if (*timefield == '/') { cp = timefield + strlen (timefield); cp[1] = '\0'; @@ -1689,7 +1689,7 @@ && strncmp (arg, name, cp - name) == 0) { timefield = strchr (cp + 1, '/') + 1; - if (!(timefield[0] == 'M' && timefield[1] == '/')) + if (*timefield == '/') { cp = timefield + strlen (timefield); cp[1] = '\0'; --=-=-=--