Re: CVS_RSH env-var feature patch

[Derek R. Price]

Larry Jones wrote:

> Ellison, Martin [IT] writes:
> >
> > I notice that you have redimensioned argv without changing any other code.
> > Does this mean that the code is susceptible to an overrun attack?
>
> Yes.  (The original code isn't, but the patch introduces a potential
> buffer overflow bug and thus isn't acceptable.  I also question how much
> need there is for the enhancement.)

I can see this as somewhat useful, done correctly, but not all that important
as there is an obvious work-around - call a script as the single argument then
put the correct ssh arguments inside the script.

Of course, this probably won't work properly under Windoze, but then, I don't
think CVS_RSH works at all there, anyhow.

Derek

--
Derek Price                      CVS Solutions Architect ( http://CVSHome.org )
mailto:dprice@collab.net         CollabNet ( http://collab.net )
--
I saw nothing unusual in the teacher's lounge.
I saw nothing unusual in the teacher's lounge.
I saw nothing unusual in the teacher's lounge...

          - Bart Simpson on chalkboard, _The Simpsons_