Skip to content

Commit f2798aa

Browse files
ttaylorrttaylorr
committed
Sync with 2.36.3
Signed-off-by: Taylor Blau <[email protected]>
2 parents 9a167cb + fcdaa21 commit f2798aa

File tree

71 files changed

+350
-60
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

71 files changed

+350
-60
lines changed

‎Documentation/RelNotes/2.30.6.txt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
Git v2.30.6 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2022-39253 and
5+
CVE-2022-39260.
6+
7+
Fixes since v2.30.5
8+
-------------------
9+
10+
* CVE-2022-39253:
11+
When relying on the `--local` clone optimization, Git dereferences
12+
symbolic links in the source repository before creating hardlinks
13+
(or copies) of the dereferenced link in the destination repository.
14+
This can lead to surprising behavior where arbitrary files are
15+
present in a repository's `$GIT_DIR` when cloning from a malicious
16+
repository.
17+
18+
Git will no longer dereference symbolic links via the `--local`
19+
clone mechanism, and will instead refuse to clone repositories that
20+
have symbolic links present in the `$GIT_DIR/objects` directory.
21+
22+
Additionally, the value of `protocol.file.allow` is changed to be
23+
"user" by default.
24+
25+
* CVE-2022-39260:
26+
An overly-long command string given to `git shell` can result in
27+
overflow in `split_cmdline()`, leading to arbitrary heap writes and
28+
remote code execution when `git shell` is exposed and the directory
29+
`$HOME/git-shell-commands` exists.
30+
31+
`git shell` is taught to refuse interactive commands that are
32+
longer than 4MiB in size. `split_cmdline()` is hardened to reject
33+
inputs larger than 2GiB.
34+
35+
Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The
36+
fix was authored by Taylor Blau, with help from Johannes Schindelin.
37+
38+
Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub.
39+
The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau.
40+
41+
42+
Jeff King (2):
43+
shell: add basic tests
44+
shell: limit size of interactive commands
45+
46+
Kevin Backhouse (1):
47+
alias.c: reject too-long cmdline strings in split_cmdline()
48+
49+
Taylor Blau (11):
50+
builtin/clone.c: disallow `--local` clones with symlinks
51+
t/lib-submodule-update.sh: allow local submodules
52+
t/t1NNN: allow local submodules
53+
t/2NNNN: allow local submodules
54+
t/t3NNN: allow local submodules
55+
t/t4NNN: allow local submodules
56+
t/t5NNN: allow local submodules
57+
t/t6NNN: allow local submodules
58+
t/t7NNN: allow local submodules
59+
t/t9NNN: allow local submodules
60+
transport: make `protocol.file.allow` be "user" by default

‎Documentation/RelNotes/2.31.5.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.31.5 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.32.4.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.32.4 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.33.5.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.33.5 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.34.5.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.34.5 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.35.5.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.35.5 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.36.3.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.36.3 Release Notes
2+
=========================
3+
4+
This release merges the security fix that appears in v2.30.6; see
5+
the release notes for that version for details.

‎Documentation/RelNotes/2.37.4.txt‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,45 @@ Git 2.37.4 Release Notes
22
========================
33

44
This primarily is to backport various fixes accumulated on the 'master'
5-
front since 2.37.3.
5+
front since 2.37.3, and also includes the same security fixes as in
6+
v2.30.6.
67

78
Fixes since v2.37.3
89
-------------------
910

11+
* CVE-2022-39253:
12+
When relying on the `--local` clone optimization, Git dereferences
13+
symbolic links in the source repository before creating hardlinks
14+
(or copies) of the dereferenced link in the destination repository.
15+
This can lead to surprising behavior where arbitrary files are
16+
present in a repository's `$GIT_DIR` when cloning from a malicious
17+
repository.
18+
19+
Git will no longer dereference symbolic links via the `--local`
20+
clone mechanism, and will instead refuse to clone repositories that
21+
have symbolic links present in the `$GIT_DIR/objects` directory.
22+
23+
Additionally, the value of `protocol.file.allow` is changed to be
24+
"user" by default.
25+
26+
Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis.
27+
The fix was authored by Taylor Blau, with help from Johannes
28+
Schindelin.
29+
30+
* CVE-2022-39260:
31+
An overly-long command string given to `git shell` can result in
32+
overflow in `split_cmdline()`, leading to arbitrary heap writes and
33+
remote code execution when `git shell` is exposed and the directory
34+
`$HOME/git-shell-commands` exists.
35+
36+
`git shell` is taught to refuse interactive commands that are
37+
longer than 4MiB in size. `split_cmdline()` is hardened to reject
38+
inputs larger than 2GiB.
39+
40+
Credit for finding CVE-2022-39260 goes to Kevin Backhouse of
41+
GitHub. The fix was authored by Kevin Backhouse, Jeff King, and
42+
Taylor Blau.
43+
1044
* An earlier optimization discarded a tree-object buffer that is
1145
still in use, which has been corrected.
1246

‎Documentation/config/protocol.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
protocol.allow::
22
If set, provide a user defined default policy for all protocols which
33
don't explicitly have a policy (`protocol.<name>.allow`). By default,
4-
if unset, known-safe protocols (http, https, git, ssh, file) have a
4+
if unset, known-safe protocols (http, https, git, ssh) have a
55
default policy of `always`, known-dangerous protocols (ext) have a
6-
default policy of `never`, and all other protocols have a default
7-
policy of `user`. Supported policies:
6+
default policy of `never`, and all other protocols (including file)
7+
have a default policy of `user`. Supported policies:
88
+
99
--
1010

‎alias.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,16 @@ void list_aliases(struct string_list *list)
4646

4747
#define SPLIT_CMDLINE_BAD_ENDING 1
4848
#define SPLIT_CMDLINE_UNCLOSED_QUOTE 2
49+
#define SPLIT_CMDLINE_ARGC_OVERFLOW 3
4950
static const char *split_cmdline_errors[] = {
5051
N_("cmdline ends with \\"),
51-
N_("unclosed quote")
52+
N_("unclosed quote"),
53+
N_("too many arguments"),
5254
};
5355

5456
int split_cmdline(char *cmdline, const char ***argv)
5557
{
56-
int src, dst, count = 0, size = 16;
58+
size_t src, dst, count = 0, size = 16;
5759
char quoted = 0;
5860

5961
ALLOC_ARRAY(*argv, size);
@@ -96,6 +98,11 @@ int split_cmdline(char *cmdline, const char ***argv)
9698
return -SPLIT_CMDLINE_UNCLOSED_QUOTE;
9799
}
98100

101+
if (count >= INT_MAX) {
102+
FREE_AND_NULL(*argv);
103+
return -SPLIT_CMDLINE_ARGC_OVERFLOW;
104+
}
105+
99106
ALLOC_GROW(*argv, count + 1, size);
100107
(*argv)[count] = NULL;
101108

0 commit comments

Comments
 (0)