Add dev-vcs/cvs-1.11.23 with Darwin fixes, update README.md

6 files changed, 310 insertions, 0 deletions

diff --git a/dev-vcs/cvs/Manifest b/dev-vcs/cvs/Manifest
new file mode 100644
index 00000000..9a611db4
--- /dev/null
+++ b/dev-vcs/cvs/Manifest
@@ -0,0 +1,9 @@
+AUX cvs-1.11.23-CVE-2010-3846.patch 5663 SHA256 c6506d0a5efc7b0cab6415f26e070ec214fb9781fac8d295506f4d0825431a8f SHA512 eed761af81c9bcd3edd898559e9be25c6612bdef19984cc6380a08039525179fa34d9ade6c55c1b4f23e495156b34cafeab3e63cfd120c0e68a42aa7992e5e85 WHIRLPOOL a1b60f9d573e4bfcb1e6bcf89db210db246be6921905bea8f177b29b22282d36b7ac7a7dece7cbe0d3c32b69199fa112d9d9865692a0883f9da1b15cfa308178
+AUX cvs-1.11.23-getline64.patch 826 SHA256 9604f0a5f07579a6e3fda37685be2b74cda2d621c0fd6aa04158d5107a15372a SHA512 3f90b125f9333de5e6dad9d349a3910e61917278a9751ff117efcb5cb29766ed82e1c536836477b784c953ce16ae868c035e73e105aaf056b6c93ec897f8d4e3 WHIRLPOOL 149c2f9042192a80cc12ce8910ef4af858d1221001d4ab1a4b6fecd4bc41adc631685ad372619b6829cda751424406fc5bd40d4401746e982b5afeae0a3f3842
+AUX cvs-1.11.23-md5.patch 401 SHA256 e37e3cb24db16addadd36f7ef91c0bc8f2142cf2a661cbbd26ba8ec4431ddd22 SHA512 0021f2ada1cd92c68b4edabf98261afa04595c93bacf8a0ff2751870451d9118dfb64da655d7c2f6f15537acaf0478ba987ef1f199e5676c6989a35b9d518ae0 WHIRLPOOL c7c7d1ee268abd690ec8e2db864e75ed882d4d362fbedde441839c9358d0d384ec54a85e0fc3b081211dd77daf5c23b54971cd2d2c667adc02e1a24b29669ec2
+AUX cvspserver.xinetd.d 282 SHA256 71b62c4f278ed17bf3cac8eacb2bfb17b6125bfe77f83b46fa5742395b74ef5f SHA512 6845a5fc38ed9d8f9194f14137066c3f2640f09ebc1dce7e9fa7c49761534003e5b1c59593496ba9f88a6c9b1196980bc145a2e2fdcbf662360d1b1ca8821411 WHIRLPOOL 949abc87f0d7c8f104ce8a896fdfd94e3db8f60d5aaa948d3358e348b17de942f19ba68fe545ec2af0026643d7b5efd5bc3bc26ccc7da47c70c544d01879646a
+DIST cederqvist-1.11.23.html.bz2 112336 SHA256 7b44791e77d3cc56e2ce970303f4003a8a759e432cfa97de93fa45c4d78f80d9 SHA512 671d9d0d364c7ec21c8b5ae357bf7be097447342053b6eb442d6b367ff1b79e17b8494cac21a08c7a897c039ede7e08992d4af158fb2a68847506f7841f98789 WHIRLPOOL c58dba2bf0ca96a17099f5488f34b1343385e67a22a20697a0de4c9affb30f21fbd790b5fd874487e5f40ce2978ee961e8b876910ac520da35ec7ceb07edf139
+DIST cederqvist-1.11.23.pdf 1134081 SHA256 0ef6dc37510e43be1bcae50c635dedcbb2d56f16968946ff0a304a43f87a7d59 SHA512 6b5f7603ff38eaf0747d364f74960c5bb3ba172fd93436440644396ba9e94538cc3c258c8c44d5fc3437c73eacc8727381f0caa94651227a74353bb46029d490 WHIRLPOOL 31d5e9ff2abe0bf93f9be6f8657690a24c55037d621bc54e735d078a7ac1b089d55d0ea57b8450c47611d6ea7aff54aeed7f7bfbe1ff02188b25abcea164bcd0
+DIST cederqvist-1.11.23.ps 1129600 SHA256 6b35cbeecd6fa069e59743716f2766f5bfffe3013a59cf72d833e5837b20abc0 SHA512 0a0e14bb611a210d4fbacd187a8fd2d8ce2746df1487ec0272cb4abe9027194109adfa7ffe97fada1457203eac7428605e3b3def11a6fece4140e08b66ded17e WHIRLPOOL c24b5dea728a9a317fdbdf212351bb04525daebccc94a68fee8bc717f68ce8f1a9de7446422bffc07e9a27a005bf4a8d6bffcee31a2e83cb3cac34ee993f8cbb
+DIST cvs-1.11.23.tar.bz2 2942652 SHA256 400f51b59d85116e79b844f2d5dbbad4759442a789b401a94aa5052c3d7a4aa9 SHA512 d84360b51b966f19ac3f1728265ff25e46d3a3ce6d9e7e30b154f0975bb10ce4f82f5ca3f308d2ff169c2b5dd97b0243e910d2e8ad59a5857aef7a70b9026b19 WHIRLPOOL 0f4a14989c29ee76a911edcbcb9b946f3710d1015391e7a219c841bf3cd03678994d572f23a66975030e9ca2eb64abc7f7665a535203bc81653d754491039252
+EBUILD cvs-1.11.23.ebuild 2249 SHA256 a87c06b56728adf38dc70231721808d6a598fc9f1ad9c7872c80c94997278599 SHA512 8a202a99c8cdb78fd08c7fb1388c070ac5b49a9e51ce44a6bcb94c81a319e1600da54ce9bb0dd908522f1e1bcad0ec4438aa70afc491147f2b6297a037e310a4 WHIRLPOOL 278be5a5013f45a403614356972f1d74952f8e7d8798afa392a11dce5f992b031ac5e19c5b0eaffb8811bc22968969f6c308a096f28fd35d9e3ad246a1f09f09
diff --git a/dev-vcs/cvs/cvs-1.11.23.ebuild b/dev-vcs/cvs/cvs-1.11.23.ebuild
new file mode 100644
index 00000000..00d4082c
--- /dev/null
+++ b/dev-vcs/cvs/cvs-1.11.23.ebuild
@@ -0,0 +1,73 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/cvs-1.11.23.ebuild,v 1.6 2014/05/14 00:17:49 robbat2 Exp $
+
+EAPI=3
+
+inherit eutils
+
+DESCRIPTION="Concurrent Versions System - source code revision control tools"
+HOMEPAGE="http://www.nongnu.org/cvs/"
+SRC_URI="mirror://gnu/non-gnu/cvs/source/stable/${PV}/${P}.tar.bz2
+	doc? ( mirror://gnu/non-gnu/cvs/source/stable/${PV}/cederqvist-${PV}.html.bz2
+		mirror://gnu/non-gnu/cvs/source/stable/${PV}/cederqvist-${PV}.pdf
+		mirror://gnu/non-gnu/cvs/source/stable/${PV}/cederqvist-${PV}.ps )"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+#KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+KEYWORDS="~arm64 ~ppc-aix ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="doc emacs"
+RESTRICT='test'
+
+DEPEND=">=sys-libs/zlib-1.1.4"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-CVE-2010-3846.patch
+	epatch "${FILESDIR}"/${P}-getline64.patch
+	epatch "${FILESDIR}"/${P}-md5.patch
+
+	# remove a useless binary
+	einfo "Removing a compiled binary"
+	find "${S}" -type f -name getdate -exec rm \{\} \;
+}
+
+src_configure() {
+	[[ ${CHOST} == *-interix* ]] && export ac_cv_header_inttypes_h=no
+
+	econf --with-tmpdir=/tmp --without-gssapi || die
+}
+
+src_install() {
+	einstall || die
+
+	insinto /etc/xinetd.d
+	newins "${FILESDIR}"/cvspserver.xinetd.d cvspserver || die "newins failed"
+
+	dodoc BUGS ChangeLog* DEVEL* FAQ HACKING \
+		MINOR* NEWS PROJECTS README* TESTS TODO
+
+	if use emacs; then
+		insinto /usr/share/emacs/site-lisp
+		doins cvs-format.el || die "doins failed"
+	fi
+
+	if use doc; then
+		dodoc "${DISTDIR}"/cederqvist-${PV}.pdf
+		dodoc "${DISTDIR}"/cederqvist-${PV}.ps
+		tar xjf "${DISTDIR}"/cederqvist-${PV}.html.tar.bz2
+		dohtml -r cederqvist-${PV}.html/*
+		cd "${ED}"/usr/share/doc/${PF}/html/
+		ln -s cvs.html index.html
+	fi
+}
+
+src_test() {
+	# 'test' is restricted by default, but this is needed for the test-suite to
+	# run if testing is forced...
+
+	[[ ${CHOST} == *-darwin* ]] && export tmp="${T}"
+	[[ ${CHOST} == *-darwin* ]] && export TESTDIR="${T}"/cvs-sanity
+
+	default
+}
diff --git a/dev-vcs/cvs/files/cvs-1.11.23-CVE-2010-3846.patch b/dev-vcs/cvs/files/cvs-1.11.23-CVE-2010-3846.patch
new file mode 100644
index 00000000..e1560cef
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.11.23-CVE-2010-3846.patch
@@ -0,0 +1,167 @@
+From b122edcb68ff05bb6eb22f6e50423e7f1050841b Mon Sep 17 00:00:00 2001
+From: Larry Jones <lawrence.jones@siemens.com>
+Date: Thu, 21 Oct 2010 10:08:16 +0200
+Subject: [PATCH] Fix for CVE-2010-3846
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Mallformed RCS revision (delete after the end of input file, or overlayed
+deleted regions) screws output file image size computation. This leads to
+write attempt after the allocated memory opening hiden memory corruption
+driven by CVS server.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ src/rcs.c |   52 +++++++++++++++++++++++++++++-----------------------
+ 1 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/src/rcs.c b/src/rcs.c
+index 7d0d078..2f88f85 100644
+--- a/src/rcs.c
++++ b/src/rcs.c
+@@ -7128,7 +7128,7 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+     struct deltafrag *dfhead;
+     struct deltafrag **dftail;
+     struct deltafrag *df;
+-    unsigned long numlines, lastmodline, offset;
++    unsigned long numlines, offset;
+     struct linevector lines;
+     int err;
+ 
+@@ -7202,12 +7202,12 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 
+     /* New temp data structure to hold new org before
+        copy back into original structure. */
+-    lines.nlines = lines.lines_alloced = numlines;
++    lines.lines_alloced = numlines;
+     lines.vector = xmalloc (numlines * sizeof *lines.vector);
+ 
+     /* We changed the list order to first to last -- so the
+        list never gets larger than the size numlines. */
+-    lastmodline = 0; 
++    lines.nlines = 0; 
+ 
+     /* offset created when adding/removing lines
+        between new and original structure */
+@@ -7216,25 +7216,24 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+     for (df = dfhead; df != NULL; )
+     {
+ 	unsigned int ln;
+-	unsigned long deltaend;
++	unsigned long newpos = df->pos - offset;
+ 
+-	if (df->pos > orig_lines->nlines)
++	if (newpos < lines.nlines || newpos > numlines)
+ 	    err = 1;
+ 
+ 	/* On error, just free the rest of the list.  */
+ 	if (!err)
+ 	{
+-	    /* Here we need to get to the line where the next insert will
++	    /* Here we need to get to the line where the next change will
+ 	       begin, which is DF->pos in ORIG_LINES.  We will fill up to
+ 	       DF->pos - OFFSET in LINES with original items.  */
+-	    for (deltaend = df->pos - offset;
+-		 lastmodline < deltaend;
+-		 lastmodline++)
++	    while (lines.nlines < newpos)
+ 	    {
+ 		/* we need to copy from the orig structure into new one */
+-		lines.vector[lastmodline] =
+-			orig_lines->vector[lastmodline + offset];
+-		lines.vector[lastmodline]->refcount++;
++		lines.vector[lines.nlines] =
++			orig_lines->vector[lines.nlines + offset];
++		lines.vector[lines.nlines]->refcount++;
++		lines.nlines++;
+ 	    }
+ 
+ 	    switch (df->type)
+@@ -7246,7 +7245,12 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 		    struct line *q;
+ 		    int nextline_newline;
+ 		    size_t nextline_len;
+-		
++
++		    if (newpos + df->nlines > numlines)
++		    {
++			err = 1;
++			break;
++		    }
+ 		    textend = df->new_lines + df->len;
+ 		    nextline_newline = 0;
+ 		    nextline_text = df->new_lines;
+@@ -7271,8 +7275,7 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 			    q->has_newline = nextline_newline;
+ 			    q->refcount = 1;
+ 			    memcpy (q->text, nextline_text, nextline_len);
+-			    lines.vector[lastmodline++] = q;
+-			    offset--;
++			    lines.vector[lines.nlines++] = q;
+ 		    
+ 			    nextline_text = (char *)p + 1;
+ 			    nextline_newline = 0;
+@@ -7286,11 +7289,11 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 		    q->has_newline = nextline_newline;
+ 		    q->refcount = 1;
+ 		    memcpy (q->text, nextline_text, nextline_len);
+-		    lines.vector[lastmodline++] = q;
++		    lines.vector[lines.nlines++] = q;
+ 
+ 		    /* For each line we add the offset between the #'s
+ 		       decreases. */
+-		    offset--;
++		    offset -= df->nlines;
+ 		    break;
+ 		}
+ 
+@@ -7301,7 +7304,9 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 		    if (df->pos + df->nlines > orig_lines->nlines)
+ 			err = 1;
+ 		    else if (delvers)
++		    {
+ 			for (ln = df->pos; ln < df->pos + df->nlines; ++ln)
++			{
+ 			    if (orig_lines->vector[ln]->refcount > 1)
+ 				/* Annotate needs this but, since the original
+ 				 * vector is disposed of before returning from
+@@ -7309,6 +7314,8 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+ 				 * there are multiple references.
+ 				 */
+ 				orig_lines->vector[ln]->vers = delvers;
++			}
++		    }
+ 		    break;
+ 	    }
+ 	}
+@@ -7328,21 +7335,20 @@ apply_rcs_changes (orig_lines, diffbuf, difflen, name, addvers, delvers)
+     else
+     {
+ 	/* add the rest of the remaining lines to the data vector */
+-	for (; lastmodline < numlines; lastmodline++)
++	while (lines.nlines < numlines)
+ 	{
+ 	    /* we need to copy from the orig structure into new one */
+-	    lines.vector[lastmodline] = orig_lines->vector[lastmodline
++	    lines.vector[lines.nlines] = orig_lines->vector[lines.nlines
+ 							   + offset];
+-	    lines.vector[lastmodline]->refcount++;
++	    lines.vector[lines.nlines]->refcount++;
++	    lines.nlines++;
+ 	}
+ 
+ 	/* Move the lines vector to the original structure for output,
+ 	 * first deleting the old.
+ 	 */
+ 	linevector_free (orig_lines);
+-	orig_lines->vector = lines.vector;
+-	orig_lines->lines_alloced = numlines;
+-	orig_lines->nlines = lines.nlines;
++	*orig_lines = lines;
+     }
+ 
+     return !err;
+-- 
+1.7.2.3
+
diff --git a/dev-vcs/cvs/files/cvs-1.11.23-getline64.patch b/dev-vcs/cvs/files/cvs-1.11.23-getline64.patch
new file mode 100644
index 00000000..f93fca46
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.11.23-getline64.patch
@@ -0,0 +1,36 @@
+http://pkgs.fedoraproject.org/gitweb/?p=cvs.git;a=blob;f=cvs-1.11.23-getline64.patch;h=99942e0589e4ff26e87a927c1a54662954876e64;hb=HEAD
+
+--- cvs-1.11.23/lib/getline.c
++++ cvs-1.11.23/lib/getline.c
+@@ -154,7 +154,7 @@
+   return ret;
+ }
+ 
+-int
++ssize_t
+ getline (lineptr, n, stream)
+      char **lineptr;
+      size_t *n;
+@@ -163,7 +163,7 @@
+   return getstr (lineptr, n, stream, '\n', 0, GETLINE_NO_LIMIT);
+ }
+ 
+-int
++ssize_t
+ getline_safe (lineptr, n, stream, limit)
+      char **lineptr;
+      size_t *n;
+--- cvs-1.11.23/lib/getline.h
++++ cvs-1.11.23/lib/getline.h
+@@ -11,9 +11,9 @@
+ 
+ #define GETLINE_NO_LIMIT -1
+ 
+-int
++ssize_t
+   getline __PROTO ((char **_lineptr, size_t *_n, FILE *_stream));
+-int
++ssize_t
+   getline_safe __PROTO ((char **_lineptr, size_t *_n, FILE *_stream,
+                          int limit));
+ int
diff --git a/dev-vcs/cvs/files/cvs-1.11.23-md5.patch b/dev-vcs/cvs/files/cvs-1.11.23-md5.patch
new file mode 100644
index 00000000..d3c63d58
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.11.23-md5.patch
@@ -0,0 +1,11 @@
+--- lib/md5.c.dist	2014-12-06 20:31:29.000000000 +0000
++++ lib/md5.c	2014-12-06 20:31:35.000000000 +0000
+@@ -183,7 +183,7 @@ cvs_MD5Final (digest, ctx)
+ 	putu32(ctx->buf[1], digest + 4);
+ 	putu32(ctx->buf[2], digest + 8);
+ 	putu32(ctx->buf[3], digest + 12);
+-	memset(ctx, 0, sizeof(ctx));	/* In case it's sensitive */
++	memset(ctx, 0, sizeof(*ctx));	/* In case it's sensitive */
+ }
+ 
+ #ifndef ASM_MD5
diff --git a/dev-vcs/cvs/files/cvspserver.xinetd.d b/dev-vcs/cvs/files/cvspserver.xinetd.d
new file mode 100644
index 00000000..0f2edb09
--- /dev/null
+++ b/dev-vcs/cvs/files/cvspserver.xinetd.d
@@ -0,0 +1,14 @@
+service cvspserver
+{
+	disable		= yes
+	socket_type	= stream
+	wait		= no
+	user		= root
+	log_type	= FILE /var/log/cvspserver
+	protocol	= tcp
+	env		= HOME=/var/cvsroot
+	log_on_failure	+= USERID
+	port		= 2401
+	server		= /usr/bin/cvs
+	server_args	= -f --allow-root=/var/cvsroot pserver
+}