# HG changeset patch
# User Rich Burridge <rich.burridge@oracle.com>
# Date 1386694681 28800
# Node ID 07e597d0017b6029a8d37f62eca1649f89b0a98d
# Parent  f9f1e8f54c5af9b5823c1b4388abeb1d03ae5cb5
17562742 problem in UTILITY/CVS

diff -r f9f1e8f54c5a -r 07e597d0017b components/cvs/patches/CVE-2012-0804.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/cvs/patches/CVE-2012-0804.patch	Tue Dec 10 08:58:01 2013 -0800
@@ -0,0 +1,25 @@
+CVE-2012-0804 - Fix proxy response parser
+
+If proxy sends overlong HTTP vesion string, the string will be copied
+to unallocatd space (write_buf) causing heap overflow.
+
+This patch fixes it by ignoring the HTTP version string and checking
+the response line has been parsed correctly.
+
+See <https://bugzilla.redhat.com/show_bug.cgi?id=773699> for more
+details.
+
+--- cvs-1.12.13/src/client.c.orig	2013-12-09 13:26:55.209065160 -0800
++++ cvs-1.12.13/src/client.c	2013-12-09 13:32:25.632884394 -0800
+@@ -3558,9 +3558,9 @@
+          * code.
+          */
+ 	read_line_via (from_server, to_server, &read_buf);
+-	sscanf (read_buf, "%s %d", write_buf, &codenum);
++	count = sscanf (read_buf, "%*s %d", &codenum);
+ 
+-	if ((codenum / 100) != 2)
++	if (count != 1 || (codenum / 100) != 2)
+ 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
+ 		   root->proxy_hostname, proxy_port_number);
+ 	free (read_buf);