Hi,
Since RCSNUM's rn_id array is limited to RCSNUM_MAXLEN it is very
sensible to make sure rcsnum_setsize() protects against this.
Index: rcsnum.c
===================================================================
RCS file: /cvs/src/usr.bin/cvs/rcsnum.c,v
retrieving revision 1.57
diff -u -p -r1.57 rcsnum.c
--- rcsnum.c 5 Nov 2015 09:48:21 -0000 1.57
+++ rcsnum.c 24 Jun 2016 09:27:07 -0000
@@ -427,6 +427,9 @@ rcsnum_branch_root(RCSNUM *brev)
static void
rcsnum_setsize(RCSNUM *num, u_int len)
{
+ if (len > RCSNUM_MAXLEN)
+ fatal("rcsnum_setsize: len %u too long", len);
+
num->rn_len = len;
}