head	1.7;
access;
symbols
	pkgsrc-2013Q2:1.7.0.10
	pkgsrc-2013Q2-base:1.7
	pkgsrc-2012Q4:1.7.0.8
	pkgsrc-2012Q4-base:1.7
	pkgsrc-2011Q4:1.7.0.6
	pkgsrc-2011Q4-base:1.7
	pkgsrc-2011Q2:1.7.0.4
	pkgsrc-2011Q2-base:1.7
	pkgsrc-2009Q4:1.7.0.2
	pkgsrc-2009Q4-base:1.7
	pkgsrc-2009Q1:1.6.0.22
	pkgsrc-2009Q1-base:1.6
	pkgsrc-2008Q4:1.6.0.20
	pkgsrc-2008Q4-base:1.6
	pkgsrc-2008Q3:1.6.0.18
	pkgsrc-2008Q3-base:1.6
	cube-native-xorg:1.6.0.16
	cube-native-xorg-base:1.6
	pkgsrc-2008Q2:1.6.0.14
	pkgsrc-2008Q2-base:1.6
	cwrapper:1.6.0.12
	pkgsrc-2008Q1:1.6.0.10
	pkgsrc-2008Q1-base:1.6
	pkgsrc-2007Q4:1.6.0.8
	pkgsrc-2007Q4-base:1.6
	pkgsrc-2007Q3:1.6.0.6
	pkgsrc-2007Q3-base:1.6
	pkgsrc-2007Q2:1.6.0.4
	pkgsrc-2007Q2-base:1.6
	pkgsrc-2007Q1:1.6.0.2
	pkgsrc-2007Q1-base:1.6
	pkgsrc-2006Q4:1.5.0.4
	pkgsrc-2006Q4-base:1.5
	pkgsrc-2006Q3:1.5.0.2
	pkgsrc-2006Q3-base:1.5
	pkgsrc-2006Q2:1.4.0.2
	pkgsrc-2006Q2-base:1.4
	pkgsrc-2006Q1:1.2.0.20
	pkgsrc-2006Q1-base:1.2
	pkgsrc-2005Q4:1.2.0.18
	pkgsrc-2005Q4-base:1.2
	pkgsrc-2005Q3:1.2.0.16
	pkgsrc-2005Q3-base:1.2
	pkgsrc-2005Q2:1.2.0.14
	pkgsrc-2005Q2-base:1.2
	pkgsrc-2005Q1:1.2.0.12
	pkgsrc-2005Q1-base:1.2
	pkgsrc-2004Q4:1.2.0.10
	pkgsrc-2004Q4-base:1.2
	pkgsrc-2004Q3:1.2.0.8
	pkgsrc-2004Q3-base:1.2
	pkgsrc-2004Q2:1.2.0.6
	pkgsrc-2004Q2-base:1.2
	pkgsrc-2004Q1:1.2.0.4
	pkgsrc-2004Q1-base:1.2
	pkgsrc-2003Q4:1.2.0.2
	pkgsrc-2003Q4-base:1.2
	buildlink2-base:1.2;
locks; strict;
comment	@# @;


1.7
date	2009.05.23.09.04.01;	author tron;	state dead;
branches;
next	1.6;

1.6
date	2007.01.06.22.45.49;	author wiz;	state Exp;
branches
	1.6.22.1;
next	1.5;

1.5
date	2006.08.24.22.02.02;	author salo;	state Exp;
branches;
next	1.4;

1.4
date	2006.05.29.13.51.20;	author tron;	state Exp;
branches
	1.4.2.1;
next	1.3;

1.3
date	2006.05.29.13.48.53;	author tron;	state Exp;
branches;
next	1.2;

1.2
date	2000.05.19.11.03.42;	author wiz;	state dead;
branches
	1.2.20.1;
next	1.1;

1.1
date	2000.05.04.01.33.07;	author hubertf;	state Exp;
branches;
next	;

1.6.22.1
date	2009.06.04.08.56.16;	author spz;	state dead;
branches;
next	;

1.4.2.1
date	2006.08.25.11.05.02;	author ghen;	state Exp;
branches;
next	;

1.2.20.1
date	2006.05.30.20.18.31;	author ghen;	state Exp;
branches;
next	;


desc
@@


1.7
log
@Update "cscope" package to version 15.7a. This version fixes the
security vulnerability reported in CVE-2009-0148.
@
text
@$NetBSD: patch-ai,v 1.6 2007/01/06 22:45:49 wiz Exp $

--- src/display.c.orig	2006-09-30 08:13:00.000000000 +0000
+++ src/display.c
@@@@ -478,21 +478,25 @@@@ search(void)
 	/* see if it is empty */
 	if ((c = getc(refsfound)) == EOF) {
 		if (findresult != NULL) {
-			(void) sprintf(lastmsg, "Egrep %s in this pattern: %s", 
-				       findresult, Pattern);
-		} else if (rc == NOTSYMBOL) {
-			(void) sprintf(lastmsg, "This is not a C symbol: %s", 
-				       Pattern);
-		} else if (rc == REGCMPERROR) {
-			(void) sprintf(lastmsg, "Error in this regcomp(3) regular expression: %s", 
-				       Pattern);
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Egrep %s in this pattern: %s", 
+				findresult, Pattern);
+		}
+		else if (rc == NOTSYMBOL) {
+			(void) snprintf(lastmsg, sizeof(lastmsg), "This is not a C symbol: %s", 
+				Pattern);
+		}
+		else if (rc == REGCMPERROR) {
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Error in this regcomp(3) regular expression: %s", 
+				Pattern);
 			
-		} else if (funcexist == NO) {
-			(void) sprintf(lastmsg, "Function definition does not exist: %s", 
-				       Pattern);
-		} else {
-			(void) sprintf(lastmsg, "Could not find the %s: %s", 
-				       fields[field].text2, Pattern);
+		}
+		else if (funcexist == NO) {
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Function definition does not exist: %s", 
+				Pattern);
+		}
+		else {
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Could not find the %s: %s", 
+				fields[field].text2, Pattern);
 		}
 		return(NO);
 	}
@@@@ -527,17 +531,17 @@@@ progress(char *what, long current, long 
 			move(MSGLINE, 0);
 			clrtoeol();
 			addstr(what);
-			sprintf(msg, "%ld", current);
+			snprintf(msg, sizeof(msg), "%ld", current);
 			move(MSGLINE, (COLS / 2) - (strlen(msg) / 2));
 			addstr(msg);
-			sprintf(msg, "%ld", max);
+			snprintf(msg, sizeof(msg), "%ld", max);
 			move(MSGLINE, COLS - strlen(msg));
 			addstr(msg);
 			refresh();
 		}
 		else if (verbosemode == YES)
 		{
-			sprintf(msg, "> %s %ld of %ld", what, current, max);
+			snprintf(msg, sizeof(msg), "> %s %ld of %ld", what, current, max);
 		}
 
 		start = now;
@@@@ -575,7 +579,7 @@@@ myperror(char *text) 
 		s = sys_errlist[errno];
 	}
 #endif
-	(void) sprintf(msg, "%s: %s", text, s);
+	(void) snprintf(msg, sizeof(msg), "%s: %s", text, s);
 	postmsg(msg);
 }
 
@


1.6
log
@Update to 15.6:

Some security problems have been addressed, and overall stability
has improved. There are no new features.

(The security problems were already fixed in pkgsrc.)
@
text
@d1 1
a1 1
$NetBSD: patch-ai,v 1.5 2006/08/24 22:02:02 salo Exp $
@


1.6.22.1
log
@Pullup ticket 2780 - requested by tron
Security update

Revisions pulled up:
- pkgsrc/devel/cscope/Makefile			1.50
- pkgsrc/devel/cscope/distinfo			1.19

Files deleted:
- pkgsrc/devel/cscope/patches/patch-ae
- pkgsrc/devel/cscope/patches/patch-af
- pkgsrc/devel/cscope/patches/patch-ag
- pkgsrc/devel/cscope/patches/patch-ah
- pkgsrc/devel/cscope/patches/patch-ai
- pkgsrc/devel/cscope/patches/patch-aj
- pkgsrc/devel/cscope/patches/patch-ak
- pkgsrc/devel/cscope/patches/patch-al
- pkgsrc/devel/cscope/patches/patch-am
- pkgsrc/devel/cscope/patches/patch-an
- pkgsrc/devel/cscope/patches/patch-ao
- pkgsrc/devel/cscope/patches/patch-ap

   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sat May 23 09:04:02 UTC 2009

   Modified Files:
   	pkgsrc/devel/cscope: Makefile distinfo
   Removed Files:
   	pkgsrc/devel/cscope/patches: patch-ae patch-af patch-ag patch-ah
   	    patch-ai patch-aj patch-ak patch-al patch-am patch-an patch-ao
   	    patch-ap

   Log Message:
   Update "cscope" package to version 15.7a. This version fixes the
   security vulnerability reported in CVE-2009-0148.


   To generate a diff of this commit:
   cvs rdiff -u -r1.49 -r1.50 pkgsrc/devel/cscope/Makefile
   cvs rdiff -u -r1.18 -r1.19 pkgsrc/devel/cscope/distinfo
   cvs rdiff -u -r1.10 -r0 pkgsrc/devel/cscope/patches/patch-ae
   cvs rdiff -u -r1.9 -r0 pkgsrc/devel/cscope/patches/patch-af
   cvs rdiff -u -r1.6 -r0 pkgsrc/devel/cscope/patches/patch-ag \
       pkgsrc/devel/cscope/patches/patch-ai
   cvs rdiff -u -r1.7 -r0 pkgsrc/devel/cscope/patches/patch-ah
   cvs rdiff -u -r1.4 -r0 pkgsrc/devel/cscope/patches/patch-aj
   cvs rdiff -u -r1.3 -r0 pkgsrc/devel/cscope/patches/patch-ak \
       pkgsrc/devel/cscope/patches/patch-al pkgsrc/devel/cscope/patches/patch-ap
   cvs rdiff -u -r1.2 -r0 pkgsrc/devel/cscope/patches/patch-am \
       pkgsrc/devel/cscope/patches/patch-an pkgsrc/devel/cscope/patches/patch-ao
@
text
@d1 1
a1 1
$NetBSD: patch-ai,v 1.6 2007/01/06 22:45:49 wiz Exp $
@


1.5
log
@Security fix for SA21601:

"Will Drewry has reported some vulnerabilities in Cscope, which
 potentially can be exploited by malicious people to compromise
 a vulnerable system.

 1) Various boundary errors within the parsing of file lists or
    the expansion of environment variables can be exploited to
    cause stack-based buffer overflows when parsing specially
    crafted "cscope.lists" files or directories.

 2) A boundary error within the parsing of command line arguments
    can be exploited to cause a stack-based buffer overflow when
    supplying an overly long "reffile" argument.

 Successful exploitation may allow execution of arbitrary code."

Patches adapted from cscope CVS.  Bump PKGREVISION.
@
text
@d1 1
a1 1
$NetBSD$
d3 3
a5 12
--- src/display.c.orig	2003-09-04 17:54:02.000000000 +0200
+++ src/display.c	2006-08-24 23:37:28.000000000 +0200
@@@@ -216,7 +216,7 @@@@ display(void)
 		     disprefs < mdisprefs && screenline <= lastdispline;
 		     ++disprefs, ++screenline) {
 			/* read the reference line */
-			if (fscanf(refsfound, "%s%s%s %[^\n]", file, function, 
+			if (fscanf(refsfound, "%" PATHLEN_STR "s%" PATHLEN_STR "s%" NUMLEN_STR "s %" TEMPSTRING_LEN_STR "[^\n]", file, function, 
 			    linenum, tempstring) < 4) {
 				break;
 			}
@@@@ -473,24 +473,24 @@@@ search(void)
d10 7
d18 3
a20 4
 				findresult, pattern);
 		}
 		else if (rc == NOTSYMBOL) {
-			(void) sprintf(lastmsg, "This is not a C symbol: %s", 
d22 3
a24 4
 				pattern);
 		}
 		else if (rc == REGCMPERROR) {
-			(void) sprintf(lastmsg, "Error in this regcomp(3) regular expression: %s", 
d26 1
a26 1
 				pattern);
d28 1
a28 2
 		}
 		else if (funcexist == NO) {
d30 6
d37 3
a39 4
 				pattern);
 		}
 		else {
-			(void) sprintf(lastmsg, "Could not find the %s: %s", 
d41 1
a41 1
 				fields[field].text2, pattern);
d44 2
a45 1
@@@@ -555,17 +555,17 @@@@ progress(char *what, long current, long 
d66 1
a66 1
@@@@ -603,7 +603,7 @@@@ myperror(char *text) 
@


1.4
log
@Add missing RCS Ids.
@
text
@d3 12
a14 3
--- src/display.c.orig	2003-09-04 16:54:02.000000000 +0100
+++ src/display.c	2006-05-29 14:34:26.000000000 +0100
@@@@ -473,24 +473,24 @@@@
d44 1
a44 1
@@@@ -555,17 +555,17 @@@@
d65 1
a65 1
@@@@ -603,7 +603,7 @@@@
@


1.4.2.1
log
@Pullup ticket 1808 - requested by salo
security fix for cscope

Revisions pulled up:
- pkgsrc/devel/cscope/Makefile				1.45
- pkgsrc/devel/cscope/distinfo				1.15
- pkgsrc/devel/cscope/patches/patch-aa			1.11
- pkgsrc/devel/cscope/patches/patch-ae			1.9
- pkgsrc/devel/cscope/patches/patch-af			1.8
- pkgsrc/devel/cscope/patches/patch-ag			1.5
- pkgsrc/devel/cscope/patches/patch-ah			1.5
- pkgsrc/devel/cscope/patches/patch-ai			1.5
- pkgsrc/devel/cscope/patches/patch-aj			1.3
- pkgsrc/devel/cscope/patches/patch-ap			1.

Module Name:	pkgsrc
Committed By:	salo
Date:		Thu Aug 24 22:02:02 UTC 2006

Modified Files:
	pkgsrc/devel/cscope: Makefile distinfo
	pkgsrc/devel/cscope/patches: patch-aa patch-ae patch-af patch-ag
	    patch-ah patch-ai patch-aj
Added Files:
	pkgsrc/devel/cscope/patches: patch-ap

Log Message:
Security fix for SA21601:

"Will Drewry has reported some vulnerabilities in Cscope, which
 potentially can be exploited by malicious people to compromise
 a vulnerable system.

 1) Various boundary errors within the parsing of file lists or
    the expansion of environment variables can be exploited to
    cause stack-based buffer overflows when parsing specially
    crafted "cscope.lists" files or directories.

 2) A boundary error within the parsing of command line arguments
    can be exploited to cause a stack-based buffer overflow when
    supplying an overly long "reffile" argument.

 Successful exploitation may allow execution of arbitrary code."

Patches adapted from cscope CVS.  Bump PKGREVISION.
@
text
@d1 1
a1 1
$NetBSD: patch-ai,v 1.5 2006/08/24 22:02:02 salo Exp $
d3 3
a5 12
--- src/display.c.orig	2003-09-04 17:54:02.000000000 +0200
+++ src/display.c	2006-08-24 23:37:28.000000000 +0200
@@@@ -216,7 +216,7 @@@@ display(void)
 		     disprefs < mdisprefs && screenline <= lastdispline;
 		     ++disprefs, ++screenline) {
 			/* read the reference line */
-			if (fscanf(refsfound, "%s%s%s %[^\n]", file, function, 
+			if (fscanf(refsfound, "%" PATHLEN_STR "s%" PATHLEN_STR "s%" NUMLEN_STR "s %" TEMPSTRING_LEN_STR "[^\n]", file, function, 
 			    linenum, tempstring) < 4) {
 				break;
 			}
@@@@ -473,24 +473,24 @@@@ search(void)
d35 1
a35 1
@@@@ -555,17 +555,17 @@@@ progress(char *what, long current, long 
d56 1
a56 1
@@@@ -603,7 +603,7 @@@@ myperror(char *text) 
@


1.3
log
@Integrate Debian's fix for security whole reported in CVE-2004-2541.
Bump package revision.
@
text
@d1 2
@


1.2
log
@Update to 15.0bl2.
Changes: Bugfixes, better man page, code cleanup.
Fixes pkg/10153.
@
text
@d1 51
a51 6
$NetBSD: patch-ai,v 1.1 2000/05/04 01:33:07 hubertf Exp $

diff -x *.orig -urN ./i386/Makefile /disk1/cvs/pkgsrc/devel/cscope/work.i386.unpatched/cscope-13.0/i386/Makefile
--- ./i386/Makefile	Tue Apr 18 03:43:47 2000
+++ /disk1/cvs/pkgsrc/devel/cscope/work.i386.unpatched/cscope-13.0/i386/Makefile	Thu May  4 03:24:27 2000
@@@@ -37,12 +37,12 @@@@
d53 9
a61 6
 COMCS= ../common
 INCLIST= -I$(COMCS)
-DEFLIST= -DLinux
-LIBS= -lncurses -lfl
+DEFLIST= -DBSD
+LIBS= -lcurses -lfl
a62 18
 INS= install
-INSDIR=/usr/local/bin
-INSMANDIR=/usr/local/man/man1
+INSDIR=${PREFIX}/bin
+INSMANDIR=${PREFIX}/man/man1
 MANPAGE=../doc/cscope.1
 
 OBJ = dir.o crossref.o scanner.o lookup.o command.o display.o find.o \
@@@@ -163,7 +163,7 @@@@
 
 install: all
 	$(INS) -s -m 755 $(PROGRAM) $(INSDIR)
-	$(INS) -m 755 $(MANPAGE) $(INSMANDIR)
+#	$(INS) -m 755 $(MANPAGE) $(INSMANDIR)
 
 clean:
 	rm -f *.o *.out lex.yy.c y.tab.? scanner.c egrep.c

@


1.2.20.1
log
@Pullup ticket 1675 - requested by tron
security fix for cscope

Revisions pulled up:
- pkgsrc/devel/cscope/Makefile		1.44
- pkgsrc/devel/cscope/distinfo		1.13
- pkgsrc/devel/cscope/patches/patch-ae	1.7
- pkgsrc/devel/cscope/patches/patch-af	1.6
- pkgsrc/devel/cscope/patches/patch-ag	1.3
- pkgsrc/devel/cscope/patches/patch-ah	1.3
- pkgsrc/devel/cscope/patches/patch-ai	1.3
- pkgsrc/devel/cscope/patches/patch-aj	1.1
- pkgsrc/devel/cscope/patches/patch-ak	1.1
- pkgsrc/devel/cscope/patches/patch-al	1.1
- pkgsrc/devel/cscope/patches/patch-am	1.1
- pkgsrc/devel/cscope/patches/patch-an	1.1
- pkgsrc/devel/cscope/patches/patch-ao	1.1

   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Mon May 29 13:48:53 UTC 2006

   Modified Files:
           pkgsrc/devel/cscope: Makefile distinfo
           pkgsrc/devel/cscope/patches: patch-af
   Added Files:
           pkgsrc/devel/cscope/patches: patch-ae patch-ag patch-ah patch-ai
               patch-aj patch-ak patch-al patch-am patch-an patch-ao

   Log Message:
   Integrate Debian's fix for security whole reported in CVE-2004-2541.
   Bump package revision.
@
text
@d1 6
a6 51
--- src/display.c.orig	2003-09-04 16:54:02.000000000 +0100
+++ src/display.c	2006-05-29 14:34:26.000000000 +0100
@@@@ -473,24 +473,24 @@@@
 	/* see if it is empty */
 	if ((c = getc(refsfound)) == EOF) {
 		if (findresult != NULL) {
-			(void) sprintf(lastmsg, "Egrep %s in this pattern: %s", 
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Egrep %s in this pattern: %s", 
 				findresult, pattern);
 		}
 		else if (rc == NOTSYMBOL) {
-			(void) sprintf(lastmsg, "This is not a C symbol: %s", 
+			(void) snprintf(lastmsg, sizeof(lastmsg), "This is not a C symbol: %s", 
 				pattern);
 		}
 		else if (rc == REGCMPERROR) {
-			(void) sprintf(lastmsg, "Error in this regcomp(3) regular expression: %s", 
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Error in this regcomp(3) regular expression: %s", 
 				pattern);
 			
 		}
 		else if (funcexist == NO) {
-			(void) sprintf(lastmsg, "Function definition does not exist: %s", 
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Function definition does not exist: %s", 
 				pattern);
 		}
 		else {
-			(void) sprintf(lastmsg, "Could not find the %s: %s", 
+			(void) snprintf(lastmsg, sizeof(lastmsg), "Could not find the %s: %s", 
 				fields[field].text2, pattern);
 		}
 		return(NO);
@@@@ -555,17 +555,17 @@@@
 			move(MSGLINE, 0);
 			clrtoeol();
 			addstr(what);
-			sprintf(msg, "%ld", current);
+			snprintf(msg, sizeof(msg), "%ld", current);
 			move(MSGLINE, (COLS / 2) - (strlen(msg) / 2));
 			addstr(msg);
-			sprintf(msg, "%ld", max);
+			snprintf(msg, sizeof(msg), "%ld", max);
 			move(MSGLINE, COLS - strlen(msg));
 			addstr(msg);
 			refresh();
 		}
 		else if (verbosemode == YES)
 		{
-			sprintf(msg, "> %s %ld of %ld", what, current, max);
+			snprintf(msg, sizeof(msg), "> %s %ld of %ld", what, current, max);
 		}
d8 6
a13 9
 		start = now;
@@@@ -603,7 +603,7 @@@@
 		s = sys_errlist[errno];
 	}
 #endif
-	(void) sprintf(msg, "%s: %s", text, s);
+	(void) snprintf(msg, sizeof(msg), "%s: %s", text, s);
 	postmsg(msg);
 }
d15 18
@


1.1
log
@ * split
 * don't change the name of cbreak to crmode if sun is not defined

Hint by Brett Lymn <blymn@@baesystems.com.au>, sent to me by Thomas
Klausner.
@
text
@d1 1
a1 1
$NetBSD$
@