diff options
author | tonnerre <tonnerre> | 2008-05-04 22:27:07 +0000 |
---|---|---|
committer | tonnerre <tonnerre> | 2008-05-04 22:27:07 +0000 |
commit | 6025c67e5ad4be125a1bcc96d3714ee4cf77796d (patch) | |
tree | 4f655829df743223189105b51928548cd883d06d /editors/xemacs-current/patches | |
parent | 3648eff3e8611ecd566bb4d11969f4c76b9a861d (diff) | |
download | pkgsrc-6025c67e5ad4be125a1bcc96d3714ee4cf77796d.tar.gz |
Fix vcdiff insecure temp file creation vulnerability (CVE-2008-1694) for
xemacs-current as well.
Diffstat (limited to 'editors/xemacs-current/patches')
-rw-r--r-- | editors/xemacs-current/patches/patch-am | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/editors/xemacs-current/patches/patch-am b/editors/xemacs-current/patches/patch-am new file mode 100644 index 00000000000..e648ccec369 --- /dev/null +++ b/editors/xemacs-current/patches/patch-am @@ -0,0 +1,111 @@ +$NetBSD: patch-am,v 1.1 2008/05/04 22:27:07 tonnerre Exp $ + +--- lib-src/vcdiff.orig 1996-12-18 22:42:33.000000000 +0000 ++++ lib-src/vcdiff 2008-04-29 13:27:28.000000000 +0100 +@@ -1,23 +1,35 @@ +-#!/bin/sh ++#! /bin/sh + # + # Enhanced sccs diff utility for use with vc mode. + # This version is more compatible with rcsdiff(1). + # +-# !Id: vcdiff,v 1.4 1993/12/03 09:29:18 eggert Exp ! ++# Copyright (C) 1992, 1993, 1995, 1997, 2001, 2002, 2003, 2004, ++# 2005, 2006, 2007, 2008 Free Software Foundation, Inc. + # +-# Modified by: vladimir@Eng.Sun.COM on 95-06-07 +-# * Made sure that file arguments are specifed as s.<filename>. +-# * Switched the assignments to $f inside the 3rd and 4th case statements of +-# the first for-loop +-# * Removed the incorrect initialization of sid1 before the first for-loop. ++# This file is part of GNU Emacs. ++# ++# GNU Emacs is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3, or (at your option) ++# any later version. ++# ++# GNU Emacs is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with GNU Emacs; see the file COPYING. If not, write to the ++# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, ++# Boston, MA 02110-1301, USA. + # + + DIFF="diff" + usage="$0: Usage: vcdiff [--brief] [-q] [-r<sid1>] [-r<sid2>] [diffopts] sccsfile..." + +-PATH=$PATH:/usr/ccs/bin:/usr/sccs # common SCCS hangouts ++PATH=$PATH:/usr/ccs/bin:/usr/sccs:/usr/xpg4/bin # common SCCS hangouts + +-echo= ++echo="echo" + sid1= sid2= + + for f +@@ -31,14 +43,14 @@ + echo=:;; + -r?*) + case $sid1 in +- -r*) +- sid2=$f ++ '') ++ sid1=$f + ;; +- *) ++ *) + case $sid2 in +- ?*) echo "$usage" >&2; exit 2 ;; ++ ?*) echo "$usage" >&2; exit 2 ;; + esac +- sid1=$f ++ sid2=$f + ;; + esac + ;; +@@ -67,31 +79,24 @@ + + for f + do +- s=2 +- +- # For files under SCCS control, fixup the file name to be the s. filename +- if [ -d SCCS ]; then +- if [ $f = `echo $f | sed -e 's|SCCS/s.||'` ]; then +- f="SCCS/s.$f" +- fi +- fi ++ s=2 + + case $f in + s.* | */s.*) + if +- rev1=/tmp/geta$$ ++ rev1=`mktemp /tmp/geta.XXXXXXXX` + get -s -p -k $sid1 "$f" > $rev1 && + case $sid2 in + '') + workfile=`expr " /$f" : '.*/s.\(.*\)'` + ;; + *) +- rev2=/tmp/getb$$ ++ rev2=`mktemp /tmp/getb.XXXXXXXX` + get -s -p -k $sid2 "$f" > $rev2 + workfile=$rev2 + esac + then +- $echo $DIFF $options $sid1 $sid2 $workfile >&2 ++ $echo $DIFF $options $rev1 $workfile >&2 + $DIFF $options $rev1 $workfile + s=$? + fi +@@ -104,3 +109,5 @@ + then status=$s + fi + done ++ ++# arch-tag: 4344ba3a-bcbe-4f77-971c-f43c1606953a |