Index: branches/2018Q1/devel/cvs/Makefile
===================================================================
--- branches/2018Q1/devel/cvs/Makefile	(revision 462776)
+++ branches/2018Q1/devel/cvs/Makefile	(revision 462777)
@@ -1,45 +1,45 @@
 # $FreeBSD$
 
 PORTNAME=	cvs
 PORTVERSION=	1.20120905
-PORTREVISION?=	4
+PORTREVISION?=	5
 CATEGORIES=	devel
 MASTER_SITES=	LOCAL/eadler
 
 MAINTAINER?=	ports@FreeBSD.org
 COMMENT?=	Version control system
 
 LICENSE=	GPLv2+
 
 CONFLICTS_INSTALL?=	cvs+ipv6-[12]* cvs-devel-[12]*
 
 OPTIONS_DEFINE=	IPV6 KERBEROS EXAMPLES
 OPTIONS_DEFAULT=KERBEROS
 .if !make(makesum)
 OPTIONS_EXCLUDE?=IPV6
 .endif
 
 IPV6_CATEGORIES=	ipv6
 IPV6_PATCH_SITES=	ftp://ftp.kame.net/pub/kame/misc/
 IPV6_PATCHFILES=	${DISTNAME}-v6-20140105.diff.gz:-p1
 KERBEROS_MAKE_ARGS=	KERBEROS_SUPPORT=yes
 
 USES=		cpe makeinfo shebangfix tar:xz uidfix
 CPE_VENDOR=	gnu
 SHEBANG_FILES=	contrib/clmerge contrib/cln_hist \
 		contrib/commit_prep contrib/cvs_acls \
 		contrib/easy-import contrib/log \
 		contrib/log_accum contrib/mfpipe \
 		contrib/rcslock
 PATCH_WRKSRC=	${WRKDIR}/call/cvs
 WRKSRC=		${WRKDIR}/call/cvs-build
 INFO=		cvs cvsclient
 
 # bsd.stage.makes sets the wrong value for DESTDIR
 DESTDIRNAME=	NADA
 MAKE_ARGS=	DESTDIR=${STAGEDIR}${PREFIX}
 
 pre-install:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/contrib
 
 .include <bsd.port.mk>
Index: branches/2018Q1/devel/cvs/files/patch-src-client.c
===================================================================
--- branches/2018Q1/devel/cvs/files/patch-src-client.c	(nonexistent)
+++ branches/2018Q1/devel/cvs/files/patch-src-client.c	(revision 462777)
@@ -0,0 +1,55 @@
+From 9c448da8bb5f592ddcd2d980d01d81305f920f78 Mon Sep 17 00:00:00 2001
+From: Fabian Keil <fk@fabiankeil.de>
+Date: Mon, 21 Aug 2017 10:49:05 +0200
+Subject: [PATCH] Add fix for CVE-2017-12836
+
+Based on a patch by Thorsten Glaser:
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10
+
+The patched file had to be changed and in the first
+chunk the size of rsh_argv has been extended to 16
+to match Debian's upstream version.
+---
+ cvs/src/client.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git cvs/src/client.c cvs/src/client.c
+index c9fe170..09771ce 100644
+--- src/client.c
++++ src/client.c
+@@ -4736,9 +4736,10 @@ start_rsh_server (root, to_server, from_server)
+     char *cvs_rsh;
+     char *cvs_server = getenv ("CVS_SERVER");
+     int i = 0;
+-    /* This needs to fit "rsh", "-b", "-l", "USER", "host",
+-       "cmd (w/ args)", and NULL.  We leave some room to grow. */
+-    char *rsh_argv[10];
++    /* This needs to fit "rsh", "-b", "-l", "USER", "-p", port,
++       "--", "host", "cvs", "-R", "server", and NULL.
++       We leave some room to grow. */
++    char *rsh_argv[16];
+ 
+     if (root->method == extssh_method)
+ 	cvs_rsh = env_cvs_ssh ? env_cvs_ssh : SSH_DFLT;
+@@ -4763,6 +4764,9 @@ start_rsh_server (root, to_server, from_server)
+ 	rsh_argv[i++] = root->username;
+     }
+ 
++    /* Only non-option arguments from here. (CVE-2017-12836) */
++    rsh_argv[i++] = "--";
++
+     rsh_argv[i++] = root->hostname;
+     rsh_argv[i++] = cvs_server;
+     rsh_argv[i++] = "server";
+@@ -4841,6 +4845,8 @@ start_rsh_server (root, to_server, from_server)
+ 	    *p++ = root->username;
+ 	}
+ 
++	*p++ = "--";
++
+ 	*p++ = root->hostname;
+ 	*p++ = command;
+ 	*p++ = NULL;
+-- 
+2.14.1
+

Property changes on: branches/2018Q1/devel/cvs/files/patch-src-client.c
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: branches/2018Q1
===================================================================
--- branches/2018Q1	(revision 462776)
+++ branches/2018Q1	(revision 462777)

Property changes on: branches/2018Q1
___________________________________________________________________
Modified: svn:mergeinfo
## -0,0 +0,1 ##
   Merged /head:r462776