diff options
Diffstat (limited to 'meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p1.patch')
| -rw-r--r-- | meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p1.patch | 115 |
1 files changed, 115 insertions, 0 deletions
diff --git a/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p1.patch b/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p1.patch new file mode 100644 index 0000000000..d251a3d5ab --- /dev/null +++ b/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p1.patch @@ -0,0 +1,115 @@ +From c6bd2a1decc252d823104f9849c87ec8484b18ea Mon Sep 17 00:00:00 2001 +From: Jeff King <peff@peff.net> +Date: Thu, 11 Feb 2016 17:23:48 -0500 +Subject: [PATCH] http-push: stop using name_path + +The graph traversal code here passes along a name_path to +build up the pathname at which we find each blob. But we +never actually do anything with the resulting names, making +it a waste of code and memory. + +This usage came in aa1dbc9 (Update http-push functionality, +2006-03-07), and originally the result was passed to +"add_object" (which stored it, but didn't really use it, +either). But we stopped using that function in 1f1e895 (Add +"named object array" concept, 2006-06-19) in favor of +storing just the objects themselves. + +Moreover, the generation of the name in process_tree() is +buggy. It sticks "name" onto the end of the name_path linked +list, and then passes it down again as it recurses (instead +of "entry.path"). So it's a good thing this was unused, as +the resulting path for "a/b/c/d" would end up as "a/a/a/a". + +Signed-off-by: Jeff King <peff@peff.net> +Signed-off-by: Junio C Hamano <gitster@pobox.com> + +Upstream-Status: Backport +CVE: CVE-2016-2315 patch1 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + http-push.c | 23 +++++++---------------- + 1 file changed, 7 insertions(+), 16 deletions(-) + +diff --git a/http-push.c b/http-push.c +index c98dad2..8341909 100644 +--- a/http-push.c ++++ b/http-push.c +@@ -1276,9 +1276,7 @@ static struct object_list **add_one_object(struct object *obj, struct object_lis + } + + static struct object_list **process_blob(struct blob *blob, +- struct object_list **p, +- struct name_path *path, +- const char *name) ++ struct object_list **p) + { + struct object *obj = &blob->object; + +@@ -1292,14 +1290,11 @@ static struct object_list **process_blob(struct blob *blob, + } + + static struct object_list **process_tree(struct tree *tree, +- struct object_list **p, +- struct name_path *path, +- const char *name) ++ struct object_list **p) + { + struct object *obj = &tree->object; + struct tree_desc desc; + struct name_entry entry; +- struct name_path me; + + obj->flags |= LOCAL; + +@@ -1309,21 +1304,17 @@ static struct object_list **process_tree(struct tree *tree, + die("bad tree object %s", sha1_to_hex(obj->sha1)); + + obj->flags |= SEEN; +- name = xstrdup(name); + p = add_one_object(obj, p); +- me.up = path; +- me.elem = name; +- me.elem_len = strlen(name); + + init_tree_desc(&desc, tree->buffer, tree->size); + + while (tree_entry(&desc, &entry)) + switch (object_type(entry.mode)) { + case OBJ_TREE: +- p = process_tree(lookup_tree(entry.sha1), p, &me, name); ++ p = process_tree(lookup_tree(entry.sha1), p); + break; + case OBJ_BLOB: +- p = process_blob(lookup_blob(entry.sha1), p, &me, name); ++ p = process_blob(lookup_blob(entry.sha1), p); + break; + default: + /* Subproject commit - not in this repository */ +@@ -1342,7 +1333,7 @@ static int get_delta(struct rev_info *revs, struct remote_lock *lock) + int count = 0; + + while ((commit = get_revision(revs)) != NULL) { +- p = process_tree(commit->tree, p, NULL, ""); ++ p = process_tree(commit->tree, p); + commit->object.flags |= LOCAL; + if (!(commit->object.flags & UNINTERESTING)) + count += add_send_request(&commit->object, lock); +@@ -1361,11 +1352,11 @@ static int get_delta(struct rev_info *revs, struct remote_lock *lock) + continue; + } + if (obj->type == OBJ_TREE) { +- p = process_tree((struct tree *)obj, p, NULL, name); ++ p = process_tree((struct tree *)obj, p); + continue; + } + if (obj->type == OBJ_BLOB) { +- p = process_blob((struct blob *)obj, p, NULL, name); ++ p = process_blob((struct blob *)obj, p); + continue; + } + die("unknown pending object %s (%s)", sha1_to_hex(obj->sha1), name); +-- +2.7.4 + |