From 810f20f5733ebcef9818826882cddd9c9768804f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20R=C3=B6hling?= Date: Thu, 8 Feb 2024 09:08:57 +0100 Subject: [PATCH 1/3] New upstream version 1.7.2+ds --- CMakeLists.txt | 2 +- docs/changelog.md | 17 +++++++++++++++++ include/git2/version.h | 4 ++-- package.json | 2 +- src/libgit2/index.c | 7 +++++-- src/libgit2/revparse.c | 5 ++++- src/libgit2/transports/smart_pkt.c | 3 ++- tests/libgit2/index/add.c | 24 ++++++++++++++++++++++++ 8 files changed, 56 insertions(+), 8 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 29f276676..76d271449 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -6,7 +6,7 @@ cmake_minimum_required(VERSION 3.5.1) -project(libgit2 VERSION "1.7.1" LANGUAGES C) +project(libgit2 VERSION "1.7.2" LANGUAGES C) # Add find modules to the path set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${PROJECT_SOURCE_DIR}/cmake") diff --git a/docs/changelog.md b/docs/changelog.md index ab7f358db..1748309e7 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -1,3 +1,20 @@ +v1.7.2 +------ + +## What's Changed + +This release fixes three bugs that can cause undefined behavior when given well-crafted inputs, either in input files or over network connections. These bugs may be able to be leveraged to cause denial of service attacks or unauthorized code execution. + +Two of these issues were discovered and reported by security engineers at Amazon Web Services. We thank the AWS Security team for their efforts to identify these issues, provide helpful reproduction cases, and responsibly disclose their findings. + +### Security fixes + +* transport: safely handle messages with no caps +* revparse: fix parsing bug for trailing `@` +* index: correct index has_dir_name check + +**Full Changelog**: https://github.com/libgit2/libgit2/compare/v1.7.1...v1.7.2 + v1.7.1 ------ diff --git a/include/git2/version.h b/include/git2/version.h index 9062c92ff..d6aba3be7 100644 --- a/include/git2/version.h +++ b/include/git2/version.h @@ -11,7 +11,7 @@ * The version string for libgit2. This string follows semantic * versioning (v2) guidelines. */ -#define LIBGIT2_VERSION "1.7.1" +#define LIBGIT2_VERSION "1.7.2" /** The major version number for this version of libgit2. */ #define LIBGIT2_VER_MAJOR 1 @@ -20,7 +20,7 @@ #define LIBGIT2_VER_MINOR 7 /** The revision ("teeny") version number for this version of libgit2. */ -#define LIBGIT2_VER_REVISION 1 +#define LIBGIT2_VER_REVISION 2 /** The Windows DLL patch number for this version of libgit2. */ #define LIBGIT2_VER_PATCH 0 diff --git a/package.json b/package.json index 5fc0896b1..ed0ab4f44 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "libgit2", - "version": "1.7.1", + "version": "1.7.2", "repo": "https://github.com/libgit2/libgit2", "description": " A cross-platform, linkable library implementation of Git that you can use in your application.", "install": "mkdir build && cd build && cmake .. && cmake --build ." diff --git a/src/libgit2/index.c b/src/libgit2/index.c index 9d919093b..ccb38230a 100644 --- a/src/libgit2/index.c +++ b/src/libgit2/index.c @@ -1185,10 +1185,13 @@ static int has_dir_name(git_index *index, size_t len, pos; for (;;) { - if (*--slash == '/') - break; + slash--; + if (slash <= entry->path) return 0; + + if (*slash == '/') + break; } len = slash - name; diff --git a/src/libgit2/revparse.c b/src/libgit2/revparse.c index 964afe378..06d92f82b 100644 --- a/src/libgit2/revparse.c +++ b/src/libgit2/revparse.c @@ -701,6 +701,7 @@ static int revparse( git_object *base_rev = NULL; bool should_return_reference = true; + bool parsed = false; GIT_ASSERT_ARG(object_out); GIT_ASSERT_ARG(reference_out); @@ -710,7 +711,7 @@ static int revparse( *object_out = NULL; *reference_out = NULL; - while (spec[pos]) { + while (!parsed && spec[pos]) { switch (spec[pos]) { case '^': should_return_reference = false; @@ -817,6 +818,8 @@ static int revparse( break; } else if (spec[pos+1] == '\0') { spec = "HEAD"; + identifier_len = 4; + parsed = true; break; } /* fall through */ diff --git a/src/libgit2/transports/smart_pkt.c b/src/libgit2/transports/smart_pkt.c index 7805f3323..3307acfa0 100644 --- a/src/libgit2/transports/smart_pkt.c +++ b/src/libgit2/transports/smart_pkt.c @@ -232,7 +232,8 @@ static int set_data( GIT_ASSERT_ARG(data); - if ((caps = memchr(line, '\0', len)) != NULL) { + if ((caps = memchr(line, '\0', len)) != NULL && + len > (size_t)((caps - line) + 1)) { caps++; if (strncmp(caps, "object-format=", CONST_STRLEN("object-format=")) == 0) diff --git a/tests/libgit2/index/add.c b/tests/libgit2/index/add.c index b0c3bd2b7..588a2ad14 100644 --- a/tests/libgit2/index/add.c +++ b/tests/libgit2/index/add.c @@ -82,3 +82,27 @@ void test_index_add__invalid_entries_succeeds_by_default(void) test_add_entry(true, valid_commit_id, GIT_FILEMODE_LINK); } +void test_index_add__two_slash_prefixed(void) +{ + git_index_entry one = {{0}}, two = {{0}}; + const git_index_entry *result; + size_t orig_count; + + orig_count = git_index_entrycount(g_index); + + cl_git_pass(git_oid__fromstr(&one.id, "fa49b077972391ad58037050f2a75f74e3671e92", GIT_OID_SHA1)); + one.path = "/a"; + one.mode = GIT_FILEMODE_BLOB; + + cl_git_pass(git_oid__fromstr(&two.id, "3697d64be941a53d4ae8f6a271e4e3fa56b022cc", GIT_OID_SHA1)); + two.path = "/a"; + two.mode = GIT_FILEMODE_BLOB; + + cl_git_pass(git_index_add(g_index, &one)); + cl_git_pass(git_index_add(g_index, &two)); + + cl_assert_equal_i(orig_count + 1, git_index_entrycount(g_index)); + + cl_assert(result = git_index_get_bypath(g_index, "/a", 0)); + cl_assert_equal_oid(&two.id, &result->id); +} From a19400b2fd10ac7034d52c38c889d1630ef25081 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20R=C3=B6hling?= Date: Thu, 8 Feb 2024 09:24:47 +0100 Subject: [PATCH 2/3] Build-depend on pkgconf instead of pkg-config --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 432e6cd4d..bf48304b5 100644 --- a/debian/control +++ b/debian/control @@ -7,7 +7,7 @@ Uploaders: Pirate Praveen , Timo Röhling , Build-Depends: debhelper-compat (= 13), python3-minimal:any, - pkg-config, + pkgconf, ca-certificates, cmake, zlib1g-dev, From 9ce2765728cbb121bf49796547607966010ce8e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20R=C3=B6hling?= Date: Thu, 8 Feb 2024 09:25:13 +0100 Subject: [PATCH 3/3] Update changelog for 1.7.2+ds-1 release --- debian/changelog | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/debian/changelog b/debian/changelog index 9b76457c8..24174a95c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,14 @@ +libgit2 (1.7.2+ds-1) unstable; urgency=medium + + * New upstream version 1.7.2+ds + - Fix CVE-2024-24575: Denial of service in git_revparse_single + (Closes: #1063415) + - Fix CVE-2024-24577: Use-after-free in git_index_add + (Closes: #1063416) + * Build-depend on pkgconf instead of pkg-config + + -- Timo Röhling Thu, 08 Feb 2024 09:10:45 +0100 + libgit2 (1.7.1+ds-2) unstable; urgency=medium * Upload to unstable.