cvs: fetch up to date version of the debian patchset (#364035)

pkgs/by-name/cv/cvs/CVE-2012-0804.patch

···
-diff --git a/src/client.c b/src/client.c
-index 751406b..b45d89c 100644
---- a/src/client.c
-+++ b/src/client.c
-@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, struct buffer **to_server_p,
-          * code.
-          */
- 	read_line_via (from_server, to_server, &read_buf);
--	sscanf (read_buf, "%s %d", write_buf, &codenum);
-+	count = sscanf (read_buf, "%*s %d", &codenum);
-
--	if ((codenum / 100) != 2)
-+	if (count != 1 || (codenum / 100) != 2)
- 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
- 		   root->proxy_hostname, proxy_port_number);
- 	free (read_buf);

pkgs/by-name/cv/cvs/CVE-2017-12836.patch

···
---- a/src/rsh-client.c.orig	2005-10-02 17:17:21.000000000 +0200
-+++ b/src/rsh-client.c	2017-11-07 16:56:06.957370469 +0100
-@@ -53,7 +53,7 @@
-     char *cvs_server = (root->cvs_server != NULL
- 			? root->cvs_server : getenv ("CVS_SERVER"));
-     int i = 0;
--    /* This needs to fit "rsh", "-b", "-l", "USER", "host",
-+    /* This needs to fit "rsh", "-b", "-l", "USER", "--", "host",
-        "cmd (w/ args)", and NULL.  We leave some room to grow. */
-     char *rsh_argv[10];
- 
-@@ -97,6 +97,9 @@
- 	rsh_argv[i++] = root->username;
-     }
- 
-+    /* Only non-option arguments from here. (CVE-2017-12836) */
-+    rsh_argv[i++] = "--";
-+
-     rsh_argv[i++] = root->hostname;
-     rsh_argv[i++] = cvs_server;
-     rsh_argv[i++] = "server";
-@@ -171,6 +174,7 @@
- 	    *p++ = root->username;
- 	}
- 
-+	*p++ = "--";
- 	*p++ = root->hostname;
- 	*p++ = command;
- 	*p++ = NULL;

pkgs/by-name/cv/cvs/package.nix

···
-{ lib, stdenv, fetchurl, fetchpatch, nano }:
+{ lib, stdenv, fetchurl, fetchpatch, texinfo, nano, autoreconfHook }:
 
-stdenv.mkDerivation rec {
+let
+  version = "1.12.13";
+  debianRevision = "real-30";
+in
+
+stdenv.mkDerivation {
   pname = "cvs";
-  version = "1.12.13";
+  version = "${version}+${debianRevision}";
 
   src = fetchurl {
     url = "mirror://savannah/cvs/source/feature/${version}/cvs-${version}.tar.bz2";
···
 
   patches = [
     ./getcwd-chroot.patch
-    ./CVE-2012-0804.patch
-    ./CVE-2017-12836.patch
     (fetchpatch {
       url = "https://raw.githubusercontent.com/Homebrew/formula-patches/24118ec737c7/cvs/vasnprintf-high-sierra-fix.diff";
       sha256 = "1ql6aaia7xkfq3vqhlw5bd2z2ywka82zk01njs1b2szn699liymg";
     })
+    # Debian Patchset,
+    # contains patches for CVE-2017-12836 and CVE-2012-0804 among other things
+    (fetchurl {
+        url = "http://deb.debian.org/debian/pool/main/c/cvs/cvs_1.12.13+${debianRevision}.diff.gz";
+        sha256 = "085124619dfdcd3e53c726e049235791b67dcb9f71619f1e27c5f1cbdef0063e";
+     })
   ];
 
   hardeningDisable = [ "fortify" "format" ];
 
-  preConfigure = ''
-    # Apply the Debian patches.
-    for p in "debian/patches/"*; do
-      echo "applying \`$p' ..."
-      patch --verbose -p1 < "$p"
-    done
-  '';
+  nativeBuildInputs = [ autoreconfHook texinfo ];
 
   configureFlags = [
     "--with-editor=${nano}/bin/nano"
 
     # Required for cross-compilation.
     "cvs_cv_func_printf_ptr=yes"
+  ] ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [
+    # So that fputs_unlocked is defined
+    "CFLAGS=-D_GNU_SOURCE"
   ];
 
   makeFlags = [
     "AR=${stdenv.cc.targetPrefix}ar"
+  ] ++ lib.optionals (!stdenv.cc.bintools.isGNU) [
+    # Don't pass --as-needed to linkers that don't support it
+    # (introduced in debian patchset)
+    "cvs_LDFLAGS="
   ];
-
-  env = lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.cc.isClang) {
-    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-  };
 
   doCheck = false; # fails 1 of 1 tests