Hi,

Since RCSNUM's rn_id array is limited to RCSNUM_MAXLEN it is very
sensible to make sure rcsnum_setsize() protects against this.

Index: rcsnum.c
===================================================================
RCS file: /cvs/src/usr.bin/cvs/rcsnum.c,v
retrieving revision 1.57
diff -u -p -r1.57 rcsnum.c
--- rcsnum.c    5 Nov 2015 09:48:21 -0000       1.57
+++ rcsnum.c    24 Jun 2016 09:27:07 -0000
@@ -427,6 +427,9 @@ rcsnum_branch_root(RCSNUM *brev)
 static void
 rcsnum_setsize(RCSNUM *num, u_int len)
 {
+       if (len > RCSNUM_MAXLEN)
+               fatal("rcsnum_setsize: len %u too long", len);
+
        num->rn_len = len;
 }

Reply via email to