CVS/Entries file can lose data due to cvs stat

[Archit Shah]

Preconditions:

1) User has write access on the CVS directory
2) User does not have read access on the CVS/Entries file
3) User attempts cvs stat filename

Output:

cvs status: cannot open CVS/Entries for reading: No such file or
directory
===================================================================
File: base.c            Status: Needs Checkout

   Working revision:    No entry for base.c
   Repository revision: 1.1     /var/tmp/repository/modules/base.c,v
   Sticky Tag:          (none)
   Sticky Date:         (none)
   Sticky Options:      (none)


Effects:

CVS/Entries file is left containing only the filename from the cvs stat
command.

This bug occured using version 1.10.8 (client/server) on Solaris 7. It
was reproduced using cvs 1.11 on Redhat Linux 6.2.

I think rename_file in write_entries() is the culprit. Because reading
the file fails, no entries are read in. But then entries are created and
written to disk successfully, because that does not depend on the
permission on the Entries file itself, only on the permissions on the
CVS directory.

Archit Shah
ashah@arsdigita.com