Skip to content

Commit 62298de

Browse files
dschodscho
committed
Sync with 2.35.8
* maint-2.35: (29 commits) Git 2.35.8 Git 2.34.8 Git 2.33.8 Git 2.32.7 Git 2.31.8 tests: avoid using `test_i18ncmp` Git 2.30.9 gettext: avoid using gettext if the locale dir is not present apply --reject: overwrite existing `.rej` symlink if it exists http.c: clear the 'finished' member once we are done with it clone.c: avoid "exceeds maximum object size" error with GCC v12.x range-diff: use ssize_t for parsed "len" in read_patches() range-diff: handle unterminated lines in read_patches() range-diff: drop useless "offset" variable from read_patches() t5604: GETTEXT_POISON fix, conclusion t5604: GETTEXT_POISON fix, part 1 t5619: GETTEXT_POISON fix t0003: GETTEXT_POISON fix, conclusion t0003: GETTEXT_POISON fix, part 1 t0033: GETTEXT_POISON fix http: support CURLOPT_PROTOCOLS_STR ...
2 parents 673472a + 7380a72 commit 62298de

File tree

17 files changed

+184
-30
lines changed

17 files changed

+184
-30
lines changed

‎.github/workflows/main.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -232,12 +232,12 @@ jobs:
232232
- jobname: linux-gcc
233233
cc: gcc
234234
cc_package: gcc-8
235-
pool: ubuntu-latest
235+
pool: ubuntu-20.04
236236
- jobname: linux-TEST-vars
237237
cc: gcc
238238
os: ubuntu
239239
cc_package: gcc-8
240-
pool: ubuntu-latest
240+
pool: ubuntu-20.04
241241
- jobname: osx-clang
242242
cc: clang
243243
pool: macos-latest
@@ -305,7 +305,7 @@ jobs:
305305
if: needs.ci-config.outputs.enabled == 'yes'
306306
env:
307307
jobname: StaticAnalysis
308-
runs-on: ubuntu-18.04
308+
runs-on: ubuntu-22.04
309309
steps:
310310
- uses: actions/checkout@v2
311311
- run: ci/install-dependencies.sh

‎Documentation/RelNotes/2.30.9.txt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Git v2.30.9 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2023-25652,
5+
CVE-2023-25815, and CVE-2023-29007.
6+
7+
8+
Fixes since v2.30.8
9+
-------------------
10+
11+
* CVE-2023-25652:
12+
13+
By feeding specially crafted input to `git apply --reject`, a
14+
path outside the working tree can be overwritten with partially
15+
controlled contents (corresponding to the rejected hunk(s) from
16+
the given patch).
17+
18+
* CVE-2023-25815:
19+
20+
When Git is compiled with runtime prefix support and runs without
21+
translated messages, it still used the gettext machinery to
22+
display messages, which subsequently potentially looked for
23+
translated messages in unexpected places. This allowed for
24+
malicious placement of crafted messages.
25+
26+
* CVE-2023-29007:
27+
28+
When renaming or deleting a section from a configuration file,
29+
certain malicious configuration values may be misinterpreted as
30+
the beginning of a new configuration section, leading to arbitrary
31+
configuration injection.
32+
33+
Credit for finding CVE-2023-25652 goes to Ry0taK, and the fix was
34+
developed by Taylor Blau, Junio C Hamano and Johannes Schindelin,
35+
with the help of Linus Torvalds.
36+
37+
Credit for finding CVE-2023-25815 goes to Maxime Escourbiac and
38+
Yassine BENGANA of Michelin, and the fix was developed by Johannes
39+
Schindelin.
40+
41+
Credit for finding CVE-2023-29007 goes to André Baptista and Vítor Pinho
42+
of Ethiack, and the fix was developed by Taylor Blau, and Johannes
43+
Schindelin, with help from Jeff King, and Patrick Steinhardt.

‎Documentation/RelNotes/2.31.8.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.31.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9 to address the
5+
security issues CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007;
6+
see the release notes for that version for details.

‎Documentation/RelNotes/2.32.7.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.32.7 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9 and v2.31.8 to
5+
address the security issues CVE-2023-25652, CVE-2023-25815, and
6+
CVE-2023-29007; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.33.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.33.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8 and
5+
v2.32.7 to address the security issues CVE-2023-25652,
6+
CVE-2023-25815, and CVE-2023-29007; see the release notes for these
7+
versions for details.

‎Documentation/RelNotes/2.34.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.34.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8,
5+
v2.32.7 and v2.33.8 to address the security issues CVE-2023-25652,
6+
CVE-2023-25815, and CVE-2023-29007; see the release notes for these
7+
versions for details.

‎Documentation/RelNotes/2.35.8.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.35.8 Release Notes
2+
=========================
3+
4+
This release merges the fixes that appear in v2.30.9, v2.31.8,
5+
v2.32.7, v2.33.8 and v2.34.8 to address the security issues
6+
CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007; see the release
7+
notes for these versions for details.

‎Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1311,6 +1311,7 @@ BASIC_CFLAGS += -DSHA1DC_FORCE_ALIGNED_ACCESS
13111311
endif
13121312
ifneq ($(filter leak,$(SANITIZERS)),)
13131313
BASIC_CFLAGS += -DSUPPRESS_ANNOTATED_LEAKS
1314+
BASIC_CFLAGS += -O0
13141315
SANITIZE_LEAK = YesCompiledWithIt
13151316
endif
13161317
ifneq ($(filter address,$(SANITIZERS)),)

‎apply.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4566,7 +4566,7 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)
45664566
FILE *rej;
45674567
char namebuf[PATH_MAX];
45684568
struct fragment *frag;
4569-
int cnt = 0;
4569+
int fd, cnt = 0;
45704570
struct strbuf sb = STRBUF_INIT;
45714571

45724572
for (cnt = 0, frag = patch->fragments; frag; frag = frag->next) {
@@ -4606,7 +4606,17 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)
46064606
memcpy(namebuf, patch->new_name, cnt);
46074607
memcpy(namebuf + cnt, ".rej", 5);
46084608

4609-
rej = fopen(namebuf, "w");
4609+
fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);
4610+
if (fd < 0) {
4611+
if (errno != EEXIST)
4612+
return error_errno(_("cannot open %s"), namebuf);
4613+
if (unlink(namebuf))
4614+
return error_errno(_("cannot unlink '%s'"), namebuf);
4615+
fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);
4616+
if (fd < 0)
4617+
return error_errno(_("cannot open %s"), namebuf);
4618+
}
4619+
rej = fdopen(fd, "w");
46104620
if (!rej)
46114621
return error_errno(_("cannot open %s"), namebuf);
46124622

‎ci/install-dependencies.sh

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,17 @@
55

66
. ${0%/*}/lib.sh
77

8-
P4WHENCE=https://cdist2.perforce.com/perforce/r$LINUX_P4_VERSION
8+
P4WHENCE=https://cdist2.perforce.com/perforce/r21.2
99
LFSWHENCE=https://github.com/github/git-lfs/releases/download/v$LINUX_GIT_LFS_VERSION
1010
UBUNTU_COMMON_PKGS="make libssl-dev libcurl4-openssl-dev libexpat-dev
1111
tcl tk gettext zlib1g-dev perl-modules liberror-perl libauthen-sasl-perl
1212
libemail-valid-perl libio-socket-ssl-perl libnet-smtp-ssl-perl"
1313

1414
case "$runs_on_pool" in
15-
ubuntu-latest)
15+
ubuntu-*)
1616
sudo apt-get -q update
1717
sudo apt-get -q -y install language-pack-is libsvn-perl apache2 \
18-
$UBUNTU_COMMON_PKGS $CC_PACKAGE
18+
$UBUNTU_COMMON_PKGS $CC_PACKAGE $PYTHON_PACKAGE
1919
mkdir --parents "$P4_PATH"
2020
pushd "$P4_PATH"
2121
wget --quiet "$P4WHENCE/bin.linux26x86_64/p4d"
@@ -40,7 +40,7 @@ macos-latest)
4040
mkdir -p $HOME/bin
4141
(
4242
cd $HOME/bin
43-
wget -q "https://cdist2.perforce.com/perforce/r21.2/bin.macosx1015x86_64/helix-core-server.tgz" &&
43+
wget -q "$P4WHENCE/bin.macosx1015x86_64/helix-core-server.tgz" &&
4444
tar -xf helix-core-server.tgz &&
4545
sudo xattr -d com.apple.quarantine p4 p4d 2>/dev/null || true
4646
)
@@ -83,11 +83,9 @@ esac
8383
if type p4d >/dev/null 2>&1 && type p4 >/dev/null 2>&1
8484
then
8585
echo "$(tput setaf 6)Perforce Server Version$(tput sgr0)"
86-
p4d -V | grep Rev.
86+
p4d -V
8787
echo "$(tput setaf 6)Perforce Client Version$(tput sgr0)"
88-
p4 -V | grep Rev.
89-
else
90-
echo >&2 "WARNING: perforce wasn't installed, see above for clues why"
88+
p4 -V
9189
fi
9290
if type git-lfs >/dev/null 2>&1
9391
then

0 commit comments

Comments
 (0)