diff options
Diffstat (limited to 'meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p3.patch')
-rw-r--r-- | meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p3.patch | 160 |
1 files changed, 160 insertions, 0 deletions
diff --git a/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p3.patch b/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p3.patch new file mode 100644 index 0000000000..35aded049d --- /dev/null +++ b/meta/recipes-devtools/git/git-2.5.0/CVE-2016-2315_p3.patch | |||
@@ -0,0 +1,160 @@ | |||
1 | From f3badaed5106a16499d0fae31a382f9047b272d7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Jeff King <peff@peff.net> | ||
3 | Date: Thu, 11 Feb 2016 17:26:18 -0500 | ||
4 | Subject: [PATCH] list-objects: convert name_path to a strbuf | ||
5 | |||
6 | The "struct name_path" data is examined in only two places: | ||
7 | we generate it in process_tree(), and we convert it to a | ||
8 | single string in path_name(). Everyone else just passes it | ||
9 | through to those functions. | ||
10 | |||
11 | We can further note that process_tree() already keeps a | ||
12 | single strbuf with the leading tree path, for use with | ||
13 | tree_entry_interesting(). | ||
14 | |||
15 | Instead of building a separate name_path linked list, let's | ||
16 | just use the one we already build in "base". This reduces | ||
17 | the amount of code (especially tricky code in path_name() | ||
18 | which did not check for integer overflows caused by deep | ||
19 | or large pathnames). | ||
20 | |||
21 | It is also more efficient in some instances. Any time we | ||
22 | were using tree_entry_interesting, we were building up the | ||
23 | strbuf anyway, so this is an immediate and obvious win | ||
24 | there. In cases where we were not, we trade off storing | ||
25 | "pathname/" in a strbuf on the heap for each level of the | ||
26 | path, instead of two pointers and an int on the stack (with | ||
27 | one pointer into the tree object). On a 64-bit system, the | ||
28 | latter is 20 bytes; so if path components are less than that | ||
29 | on average, this has lower peak memory usage. In practice | ||
30 | it probably doesn't matter either way; we are already | ||
31 | holding in memory all of the tree objects leading up to each | ||
32 | pathname, and for normal-depth pathnames, we are only | ||
33 | talking about hundreds of bytes. | ||
34 | |||
35 | This patch leaves "struct name_path" as a thin wrapper | ||
36 | around the strbuf, to avoid disrupting callbacks. We should | ||
37 | fix them, but leaving it out makes this diff easier to view. | ||
38 | |||
39 | Signed-off-by: Jeff King <peff@peff.net> | ||
40 | Signed-off-by: Junio C Hamano <gitster@pobox.com> | ||
41 | |||
42 | Upstream-Status: Backport | ||
43 | CVE: CVE-2016-2315 patch3 | ||
44 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
45 | |||
46 | --- | ||
47 | list-objects.c | 22 +++++++++------------- | ||
48 | revision.c | 25 +++++-------------------- | ||
49 | revision.h | 4 +--- | ||
50 | 3 files changed, 15 insertions(+), 36 deletions(-) | ||
51 | |||
52 | diff --git a/list-objects.c b/list-objects.c | ||
53 | index 41736d2..dc46b9a 100644 | ||
54 | --- a/list-objects.c | ||
55 | +++ b/list-objects.c | ||
56 | @@ -62,7 +62,6 @@ static void process_gitlink(struct rev_info *revs, | ||
57 | static void process_tree(struct rev_info *revs, | ||
58 | struct tree *tree, | ||
59 | show_object_fn show, | ||
60 | - struct name_path *path, | ||
61 | struct strbuf *base, | ||
62 | const char *name, | ||
63 | void *cb_data) | ||
64 | @@ -86,17 +85,14 @@ static void process_tree(struct rev_info *revs, | ||
65 | return; | ||
66 | die("bad tree object %s", sha1_to_hex(obj->sha1)); | ||
67 | } | ||
68 | + | ||
69 | obj->flags |= SEEN; | ||
70 | - show(obj, path, name, cb_data); | ||
71 | - me.up = path; | ||
72 | - me.elem = name; | ||
73 | - me.elem_len = strlen(name); | ||
74 | - | ||
75 | - if (!match) { | ||
76 | - strbuf_addstr(base, name); | ||
77 | - if (base->len) | ||
78 | - strbuf_addch(base, '/'); | ||
79 | - } | ||
80 | + me.base = base; | ||
81 | + show(obj, &me, name, cb_data); | ||
82 | + | ||
83 | + strbuf_addstr(base, name); | ||
84 | + if (base->len) | ||
85 | + strbuf_addch(base, '/'); | ||
86 | |||
87 | init_tree_desc(&desc, tree->buffer, tree->size); | ||
88 | |||
89 | @@ -113,7 +109,7 @@ static void process_tree(struct rev_info *revs, | ||
90 | if (S_ISDIR(entry.mode)) | ||
91 | process_tree(revs, | ||
92 | lookup_tree(entry.sha1), | ||
93 | - show, &me, base, entry.path, | ||
94 | + show, base, entry.path, | ||
95 | cb_data); | ||
96 | else if (S_ISGITLINK(entry.mode)) | ||
97 | process_gitlink(revs, entry.sha1, | ||
98 | @@ -220,7 +216,7 @@ void traverse_commit_list(struct rev_info *revs, | ||
99 | path = ""; | ||
100 | if (obj->type == OBJ_TREE) { | ||
101 | process_tree(revs, (struct tree *)obj, show_object, | ||
102 | - NULL, &base, path, data); | ||
103 | + &base, path, data); | ||
104 | continue; | ||
105 | } | ||
106 | if (obj->type == OBJ_BLOB) { | ||
107 | diff --git a/revision.c b/revision.c | ||
108 | index cf544b6..f8c3034 100644 | ||
109 | --- a/revision.c | ||
110 | +++ b/revision.c | ||
111 | @@ -23,26 +23,11 @@ volatile show_early_output_fn_t show_early_output; | ||
112 | |||
113 | char *path_name(const struct name_path *path, const char *name) | ||
114 | { | ||
115 | - const struct name_path *p; | ||
116 | - char *n, *m; | ||
117 | - int nlen = strlen(name); | ||
118 | - int len = nlen + 1; | ||
119 | - | ||
120 | - for (p = path; p; p = p->up) { | ||
121 | - if (p->elem_len) | ||
122 | - len += p->elem_len + 1; | ||
123 | - } | ||
124 | - n = xmalloc(len); | ||
125 | - m = n + len - (nlen + 1); | ||
126 | - strcpy(m, name); | ||
127 | - for (p = path; p; p = p->up) { | ||
128 | - if (p->elem_len) { | ||
129 | - m -= p->elem_len + 1; | ||
130 | - memcpy(m, p->elem, p->elem_len); | ||
131 | - m[p->elem_len] = '/'; | ||
132 | - } | ||
133 | - } | ||
134 | - return n; | ||
135 | + struct strbuf ret = STRBUF_INIT; | ||
136 | + if (path) | ||
137 | + strbuf_addbuf(&ret, path->base); | ||
138 | + strbuf_addstr(&ret, name); | ||
139 | + return strbuf_detach(&ret, NULL); | ||
140 | } | ||
141 | |||
142 | void show_object_with_name(FILE *out, struct object *obj, | ||
143 | diff --git a/revision.h b/revision.h | ||
144 | index 0ea8b4e..5e3c47c 100644 | ||
145 | --- a/revision.h | ||
146 | +++ b/revision.h | ||
147 | @@ -257,9 +257,7 @@ extern void mark_parents_uninteresting(struct commit *commit); | ||
148 | extern void mark_tree_uninteresting(struct tree *tree); | ||
149 | |||
150 | struct name_path { | ||
151 | - struct name_path *up; | ||
152 | - int elem_len; | ||
153 | - const char *elem; | ||
154 | + struct strbuf *base; | ||
155 | }; | ||
156 | |||
157 | char *path_name(const struct name_path *path, const char *name); | ||
158 | -- | ||
159 | 2.7.4 | ||
160 | |||