db2b3d263a
- Fix remote code execution via buffer overflow (CVE-2016-2315, CVE-2016-2324, bsc#971328): 0012-http-push-stop-using-name_path.patch 0013-show_object_with_name-simplify-by-using-path_name.patch 0014-list-objects-convert-name_path-to-a-strbuf.patch 0015-list-objects-drop-name_path-entirely.patch 0016-list-objects-pass-full-pathname-to-callbacks.patch OBS-URL: https://build.opensuse.org/request/show/373839 OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm/cgit?expand=0&rev=27
111 lines
3.6 KiB
Diff
111 lines
3.6 KiB
Diff
From 415959387e0642842be7aad05fa5d95ea4ed350f Mon Sep 17 00:00:00 2001
|
|
From: Jeff King <peff@peff.net>
|
|
Date: Thu, 11 Feb 2016 17:23:48 -0500
|
|
Subject: [PATCH 2/6] http-push: stop using name_path
|
|
|
|
The graph traversal code here passes along a name_path to
|
|
build up the pathname at which we find each blob. But we
|
|
never actually do anything with the resulting names, making
|
|
it a waste of code and memory.
|
|
|
|
This usage came in aa1dbc9 (Update http-push functionality,
|
|
2006-03-07), and originally the result was passed to
|
|
"add_object" (which stored it, but didn't really use it,
|
|
either). But we stopped using that function in 1f1e895 (Add
|
|
"named object array" concept, 2006-06-19) in favor of
|
|
storing just the objects themselves.
|
|
|
|
Moreover, the generation of the name in process_tree() is
|
|
buggy. It sticks "name" onto the end of the name_path linked
|
|
list, and then passes it down again as it recurses (instead
|
|
of "entry.path"). So it's a good thing this was unused, as
|
|
the resulting path for "a/b/c/d" would end up as "a/a/a/a".
|
|
|
|
Signed-off-by: Jeff King <peff@peff.net>
|
|
Signed-off-by: Junio C Hamano <gitster@pobox.com>
|
|
---
|
|
http-push.c | 23 +++++++----------------
|
|
1 file changed, 7 insertions(+), 16 deletions(-)
|
|
|
|
diff --git a/http-push.c b/http-push.c
|
|
index d857b131a8f7..bd60668707b9 100644
|
|
--- a/http-push.c
|
|
+++ b/http-push.c
|
|
@@ -1277,9 +1277,7 @@ static struct object_list **add_one_object(struct object *obj, struct object_lis
|
|
}
|
|
|
|
static struct object_list **process_blob(struct blob *blob,
|
|
- struct object_list **p,
|
|
- struct name_path *path,
|
|
- const char *name)
|
|
+ struct object_list **p)
|
|
{
|
|
struct object *obj = &blob->object;
|
|
|
|
@@ -1293,14 +1291,11 @@ static struct object_list **process_blob(struct blob *blob,
|
|
}
|
|
|
|
static struct object_list **process_tree(struct tree *tree,
|
|
- struct object_list **p,
|
|
- struct name_path *path,
|
|
- const char *name)
|
|
+ struct object_list **p)
|
|
{
|
|
struct object *obj = &tree->object;
|
|
struct tree_desc desc;
|
|
struct name_entry entry;
|
|
- struct name_path me;
|
|
|
|
obj->flags |= LOCAL;
|
|
|
|
@@ -1310,21 +1305,17 @@ static struct object_list **process_tree(struct tree *tree,
|
|
die("bad tree object %s", oid_to_hex(&obj->oid));
|
|
|
|
obj->flags |= SEEN;
|
|
- name = xstrdup(name);
|
|
p = add_one_object(obj, p);
|
|
- me.up = path;
|
|
- me.elem = name;
|
|
- me.elem_len = strlen(name);
|
|
|
|
init_tree_desc(&desc, tree->buffer, tree->size);
|
|
|
|
while (tree_entry(&desc, &entry))
|
|
switch (object_type(entry.mode)) {
|
|
case OBJ_TREE:
|
|
- p = process_tree(lookup_tree(entry.sha1), p, &me, name);
|
|
+ p = process_tree(lookup_tree(entry.sha1), p);
|
|
break;
|
|
case OBJ_BLOB:
|
|
- p = process_blob(lookup_blob(entry.sha1), p, &me, name);
|
|
+ p = process_blob(lookup_blob(entry.sha1), p);
|
|
break;
|
|
default:
|
|
/* Subproject commit - not in this repository */
|
|
@@ -1343,7 +1334,7 @@ static int get_delta(struct rev_info *revs, struct remote_lock *lock)
|
|
int count = 0;
|
|
|
|
while ((commit = get_revision(revs)) != NULL) {
|
|
- p = process_tree(commit->tree, p, NULL, "");
|
|
+ p = process_tree(commit->tree, p);
|
|
commit->object.flags |= LOCAL;
|
|
if (!(commit->object.flags & UNINTERESTING))
|
|
count += add_send_request(&commit->object, lock);
|
|
@@ -1362,11 +1353,11 @@ static int get_delta(struct rev_info *revs, struct remote_lock *lock)
|
|
continue;
|
|
}
|
|
if (obj->type == OBJ_TREE) {
|
|
- p = process_tree((struct tree *)obj, p, NULL, name);
|
|
+ p = process_tree((struct tree *)obj, p);
|
|
continue;
|
|
}
|
|
if (obj->type == OBJ_BLOB) {
|
|
- p = process_blob((struct blob *)obj, p, NULL, name);
|
|
+ p = process_blob((struct blob *)obj, p);
|
|
continue;
|
|
}
|
|
die("unknown pending object %s (%s)", oid_to_hex(&obj->oid), name);
|
|
--
|
|
2.7.3
|
|
|