"Will Drewry has reported some vulnerabilities in Cscope, which
potentially can be exploited by malicious people to compromise
a vulnerable system.
1) Various boundary errors within the parsing of file lists or
the expansion of environment variables can be exploited to
cause stack-based buffer overflows when parsing specially
crafted "cscope.lists" files or directories.
2) A boundary error within the parsing of command line arguments
can be exploited to cause a stack-based buffer overflow when
supplying an overly long "reffile" argument.
Successful exploitation may allow execution of arbitrary code."
Patches adapted from cscope CVS. Bump PKGREVISION.
developer is officially maintaining the package.
The rationale for changing this from "tech-pkg" to "pkgsrc-users" is
that it implies that any user can try to maintain the package (by
submitting patches to the mailing list). Since the folks most likely
to care about the package are the folks that want to use it or are
already using it, this would leverage the energy of users who aren't
developers.
(2003/08/14 - broeker) Cleaned up man page, INSTALL and TODO files.
(2003/08/14 - broeker) Have configure check for <regex.h>. Bail out if none
found.
(2003/08/14 - broeker) New options --help and --version.
(2003/06/12 - broeker) New option -v to output progress updates even in
line mode. To be used by interface kscope.
(2003/06/02 - broeker) Use the basename of files only to test for SCCS/RCS
files in -R traversal.
(2003/04/29 - broeker) Check that a src file is a regular file before trying to
scan it. Change from S_IFDIR/S_IFREG bit tests to
macros S_ISDIR/S_ISREG.
(2003/03/05 - broeker) Remove '-y' option from pipe call to utility "sort".
It's long since deprecated, and some modern versions
will barf seeing it.
(2003/03/02 - broeker) Don't restrict to 14 character filenames any longer.
(2003/01/23 - broeker) Update to latest auto* tools. First step towards
integration of GNOME GUI version.
(2002/12/11 - broeker) Get rid of deprecated ={...} style actions in egrep.y.
Use plain {...} instead.
(2002/10/29 - broeker) Fix bug #588671: disprefs was still 0 if only 1 very
long reference output shown by curses display.
(2002/08/27 - broeker) Fix bug #600494: use mygetenv() for HOME, and provide
a fall-back if it's not there.
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
curses.buildlink2.mk. This was wrong because we _really_ do want to
express that we want _n_curses when we include the buildlink2.mk file.
We should have a better way to say that the NetBSD curses doesn't
quite work well enough. In fact, it's far better to depend on ncurses
by default, and exceptionally note when it's okay to use NetBSD curses
for specific packages. We will look into this again in the future.
Makefiles during the build process by touching various auto{conf,make}
source files to make them up-to-date. Packages that require regenerating
the configure script and Makefile.in files should make the appropriate
calls to auto{conf,make} in a pre-configure target. This allows the
various targets listed in ${_CONFIG_PREREQ} to modify the generated files
without triggering the GNU auto* tools and having the modifications be
overwritten.
Changes in release 15.3: Improvements, major bug fixes, XEmacs, Vim and web
interface support
Changes in release 15.1: Improvements to interface and major bug fixes
