Skip to content

Commit 1df551c

Browse files
dschodscho
committed
Sync with 2.36.6
* maint-2.36: (30 commits) Git 2.36.6 Git 2.35.8 Git 2.34.8 Git 2.33.8 Git 2.32.7 Git 2.31.8 tests: avoid using `test_i18ncmp` Git 2.30.9 gettext: avoid using gettext if the locale dir is not present apply --reject: overwrite existing `.rej` symlink if it exists http.c: clear the 'finished' member once we are done with it clone.c: avoid "exceeds maximum object size" error with GCC v12.x range-diff: use ssize_t for parsed "len" in read_patches() range-diff: handle unterminated lines in read_patches() range-diff: drop useless "offset" variable from read_patches() t5604: GETTEXT_POISON fix, conclusion t5604: GETTEXT_POISON fix, part 1 t5619: GETTEXT_POISON fix t0003: GETTEXT_POISON fix, conclusion t0003: GETTEXT_POISON fix, part 1 t0033: GETTEXT_POISON fix ...
2 parents eb88fe1 + ecaa3db commit 1df551c

File tree

17 files changed

+189
-28
lines changed

17 files changed

+189
-28
lines changed

‎.github/workflows/main.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,12 +232,12 @@ jobs:
232232
- jobname: linux-gcc
233233
cc: gcc
234234
cc_package: gcc-8
235-
pool: ubuntu-latest
235+
pool: ubuntu-20.04
236236
- jobname: linux-TEST-vars
237237
cc: gcc
238238
os: ubuntu
239239
cc_package: gcc-8
240-
pool: ubuntu-latest
240+
pool: ubuntu-20.04
241241
- jobname: osx-clang
242242
cc: clang
243243
pool: macos-latest

‎Documentation/RelNotes/2.30.9.txt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Git v2.30.9 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2023-25652,
5+
CVE-2023-25815, and CVE-2023-29007.
6+
7+
8+
Fixes since v2.30.8
9+
-------------------
10+
11+
* CVE-2023-25652:
12+
13+
By feeding specially crafted input to `git apply --reject`, a
14+
path outside the working tree can be overwritten with partially
15+
controlled contents (corresponding to the rejected hunk(s) from
16+
the given patch).
17+
18+
* CVE-2023-25815:
19+
20+
When Git is compiled with runtime prefix support and runs without
21+
translated messages, it still used the gettext machinery to
22+
display messages, which subsequently potentially looked for
23+
translated messages in unexpected places. This allowed for
24+
malicious placement of crafted messages.
25+
26+
* CVE-2023-29007:
27+
28+
When renaming or deleting a section from a configuration file,
29+
certain malicious configuration values may be misinterpreted as
30+
the beginning of a new configuration section, leading to arbitrary
31+
configuration injection.
32+
33+
Credit for finding CVE-2023-25652 goes to Ry0taK, and the fix was
34+
developed by Taylor Blau, Junio C Hamano and Johannes Schindelin,
35+
with the help of Linus Torvalds.
36+
37+
Credit for finding CVE-2023-25815 goes to Maxime Escourbiac and
38+
Yassine BENGANA of Michelin, and the fix was developed by Johannes
39+
Schindelin.
40+
41+
Credit for finding CVE-2023-29007 goes to André Baptista and Vítor Pinho
42+
of Ethiack, and the fix was developed by Taylor Blau, and Johannes
43+
Schindelin, with help from Jeff King, and Patrick Steinhardt.

‎Documentation/RelNotes/2.31.8.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.31.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9 to address the
5+
security issues CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007;
6+
see the release notes for that version for details.

‎Documentation/RelNotes/2.32.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.32.7 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9 and v2.31.8 to
5+
address the security issues CVE-2023-25652, CVE-2023-25815, and
6+
CVE-2023-29007; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.33.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.33.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8 and
5+
v2.32.7 to address the security issues CVE-2023-25652,
6+
CVE-2023-25815, and CVE-2023-29007; see the release notes for these
7+
versions for details.

‎Documentation/RelNotes/2.34.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.34.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8,
5+
v2.32.7 and v2.33.8 to address the security issues CVE-2023-25652,
6+
CVE-2023-25815, and CVE-2023-29007; see the release notes for these
7+
versions for details.

‎Documentation/RelNotes/2.35.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.35.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8,
5+
v2.32.7, v2.33.8 and v2.34.8 to address the security issues
6+
CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007; see the release
7+
notes for these versions for details.

‎Documentation/RelNotes/2.36.6.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.36.6 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8,
5+
v2.32.7, v2.33.8, v2.34.8 and v2.35.8 to address the security issues
6+
CVE-2023-25652, CVS-2023-25815, and CVE-2023-29007; see the release
7+
notes for these versions for details.

‎Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1324,6 +1324,7 @@ BASIC_CFLAGS += -DSHA1DC_FORCE_ALIGNED_ACCESS
13241324
endif
13251325
ifneq ($(filter leak,$(SANITIZERS)),)
13261326
BASIC_CFLAGS += -DSUPPRESS_ANNOTATED_LEAKS
1327+
BASIC_CFLAGS += -O0
13271328
SANITIZE_LEAK = YesCompiledWithIt
13281329
endif
13291330
ifneq ($(filter address,$(SANITIZERS)),)

‎apply.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4566,7 +4566,7 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)
45664566
FILE *rej;
45674567
char namebuf[PATH_MAX];
45684568
struct fragment *frag;
4569-
int cnt = 0;
4569+
int fd, cnt = 0;
45704570
struct strbuf sb = STRBUF_INIT;
45714571

45724572
for (cnt = 0, frag = patch->fragments; frag; frag = frag->next) {
@@ -4606,7 +4606,17 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)
46064606
memcpy(namebuf, patch->new_name, cnt);
46074607
memcpy(namebuf + cnt, ".rej", 5);
46084608

4609-
rej = fopen(namebuf, "w");
4609+
fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);
4610+
if (fd < 0) {
4611+
if (errno != EEXIST)
4612+
return error_errno(_("cannot open %s"), namebuf);
4613+
if (unlink(namebuf))
4614+
return error_errno(_("cannot unlink '%s'"), namebuf);
4615+
fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);
4616+
if (fd < 0)
4617+
return error_errno(_("cannot open %s"), namebuf);
4618+
}
4619+
rej = fdopen(fd, "w");
46104620
if (!rej)
46114621
return error_errno(_("cannot open %s"), namebuf);
46124622

0 commit comments

Comments
 (0)