Skip to content

Commit 8f80393

Browse files
dschodscho
committed
Sync with 2.25.5
* maint-2.25: Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2 parents af6b65d + 42ce4c7 commit 8f80393

18 files changed

+256
-4
lines changed

‎Documentation/RelNotes/2.17.6.txt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Git v2.17.6 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2021-21300.
5+
6+
Fixes since v2.17.5
7+
-------------------
8+
9+
* CVE-2021-21300:
10+
On case-insensitive file systems with support for symbolic links,
11+
if Git is configured globally to apply delay-capable clean/smudge
12+
filters (such as Git LFS), Git could be fooled into running
13+
remote code during a clone.
14+
15+
Credit for finding and fixing this vulnerability goes to Matheus
16+
Tavares, helped by Johannes Schindelin.

‎Documentation/RelNotes/2.18.5.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.18.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6 to address
5+
the security issue CVE-2021-21300; see the release notes for that
6+
version for details.

‎Documentation/RelNotes/2.19.6.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.19.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6 and
5+
v2.18.5 to address the security issue CVE-2021-21300; see the
6+
release notes for these versions for details.

‎Documentation/RelNotes/2.20.5.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.20.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6, v2.18.5
5+
and v2.19.6 to address the security issue CVE-2021-21300; see
6+
the release notes for these versions for details.

‎Documentation/RelNotes/2.21.4.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.21.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6, v2.18.5,
5+
v2.19.6 and v2.20.5 to address the security issue CVE-2021-21300;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.22.5.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.22.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6,
5+
v2.18.5, v2.19.6, v2.20.5 and v2.21.4 to address the security
6+
issue CVE-2021-21300; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.23.4.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.23.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6, v2.18.5,
5+
v2.19.6, v2.20.5, v2.21.4 and v2.22.5 to address the security
6+
issue CVE-2021-21300; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.24.4.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.24.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6, v2.18.5,
5+
v2.19.6, v2.20.5, v2.21.4, v2.22.5 and v2.23.4 to address the
6+
security issue CVE-2021-21300; see the release notes for these
7+
versions for details.

‎Documentation/RelNotes/2.25.5.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.25.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.17.6, v2.18.5,
5+
v2.19.6, v2.20.5, v2.21.4, v2.22.5, v2.23.4 and v2.24.4 to address
6+
the security issue CVE-2021-21300; see the release notes for
7+
these versions for details.

‎cache.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1713,6 +1713,7 @@ int has_symlink_leading_path(const char *name, int len);
17131713
int threaded_has_symlink_leading_path(struct cache_def *, const char *, int);
17141714
int check_leading_path(const char *name, int len);
17151715
int has_dirs_only_path(const char *name, int len, int prefix_len);
1716+
void invalidate_lstat_cache(void);
17161717
void schedule_dir_for_removal(const char *name, int len);
17171718
void remove_scheduled_dirs(void);
17181719

‎compat/mingw.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -364,6 +364,8 @@ int mingw_rmdir(const char *pathname)
364364
ask_yes_no_if_possible("Deletion of directory '%s' failed. "
365365
"Should I try again?", pathname))
366366
ret = _wrmdir(wpathname);
367+
if (!ret)
368+
invalidate_lstat_cache();
367369
return ret;
368370
}
369371

‎git-compat-util.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,11 @@ static inline int noop_core_config(const char *var, const char *value, void *cb)
345345
#define platform_core_config noop_core_config
346346
#endif
347347

348+
int lstat_cache_aware_rmdir(const char *path);
349+
#if !defined(__MINGW32__) && !defined(_MSC_VER)
350+
#define rmdir lstat_cache_aware_rmdir
351+
#endif
352+
348353
#ifndef has_dos_drive_prefix
349354
static inline int git_has_dos_drive_prefix(const char *path)
350355
{

‎run-command.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -989,6 +989,7 @@ int finish_command(struct child_process *cmd)
989989
int ret = wait_or_whine(cmd->pid, cmd->argv[0], 0);
990990
trace2_child_exit(cmd, ret);
991991
child_process_clear(cmd);
992+
invalidate_lstat_cache();
992993
return ret;
993994
}
994995

@@ -1289,13 +1290,19 @@ int start_async(struct async *async)
12891290
int finish_async(struct async *async)
12901291
{
12911292
#ifdef NO_PTHREADS
1292-
return wait_or_whine(async->pid, "child process", 0);
1293+
int ret = wait_or_whine(async->pid, "child process", 0);
1294+
1295+
invalidate_lstat_cache();
1296+
1297+
return ret;
12931298
#else
12941299
void *ret = (void *)(intptr_t)(-1);
12951300

12961301
if (pthread_join(async->tid, &ret))
12971302
error("pthread_join failed");
1303+
invalidate_lstat_cache();
12981304
return (int)(intptr_t)ret;
1305+
12991306
#endif
13001307
}
13011308

‎symlinks.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,13 @@ int has_dirs_only_path(const char *name, int len, int prefix_len)
267267
*/
268268
static int threaded_has_dirs_only_path(struct cache_def *cache, const char *name, int len, int prefix_len)
269269
{
270+
/*
271+
* Note: this function is used by the checkout machinery, which also
272+
* takes care to properly reset the cache when it performs an operation
273+
* that would leave the cache outdated. If this function starts caching
274+
* anything else besides FL_DIR, remember to also invalidate the cache
275+
* when creating or deleting paths that might be in the cache.
276+
*/
270277
return lstat_cache(cache, name, len,
271278
FL_DIR|FL_FULLPATH, prefix_len) &
272279
FL_DIR;
@@ -321,3 +328,20 @@ void remove_scheduled_dirs(void)
321328
{
322329
do_remove_scheduled_dirs(0);
323330
}
331+
332+
void invalidate_lstat_cache(void)
333+
{
334+
reset_lstat_cache(&default_cache);
335+
}
336+
337+
#undef rmdir
338+
int lstat_cache_aware_rmdir(const char *path)
339+
{
340+
/* Any change in this function must be made also in `mingw_rmdir()` */
341+
int ret = rmdir(path);
342+
343+
if (!ret)
344+
invalidate_lstat_cache();
345+
346+
return ret;
347+
}

‎t/t0021-conversion.sh

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -819,4 +819,85 @@ test_expect_success PERL 'invalid file in delayed checkout' '
819819
grep "error: external filter .* signaled that .unfiltered. is now available although it has not been delayed earlier" git-stderr.log
820820
'
821821

822+
for mode in 'case' 'utf-8'
823+
do
824+
case "$mode" in
825+
case) dir='A' symlink='a' mode_prereq='CASE_INSENSITIVE_FS' ;;
826+
utf-8)
827+
dir=$(printf "\141\314\210") symlink=$(printf "\303\244")
828+
mode_prereq='UTF8_NFD_TO_NFC' ;;
829+
esac
830+
831+
test_expect_success PERL,SYMLINKS,$mode_prereq \
832+
"delayed checkout with $mode-collision don't write to the wrong place" '
833+
test_config_global filter.delay.process \
834+
"\"$TEST_ROOT/rot13-filter.pl\" --always-delay delayed.log clean smudge delay" &&
835+
test_config_global filter.delay.required true &&
836+
837+
git init $mode-collision &&
838+
(
839+
cd $mode-collision &&
840+
mkdir target-dir &&
841+
842+
empty_oid=$(printf "" | git hash-object -w --stdin) &&
843+
symlink_oid=$(printf "%s" "$PWD/target-dir" | git hash-object -w --stdin) &&
844+
attr_oid=$(echo "$dir/z filter=delay" | git hash-object -w --stdin) &&
845+
846+
cat >objs <<-EOF &&
847+
100644 blob $empty_oid $dir/x
848+
100644 blob $empty_oid $dir/y
849+
100644 blob $empty_oid $dir/z
850+
120000 blob $symlink_oid $symlink
851+
100644 blob $attr_oid .gitattributes
852+
EOF
853+
854+
git update-index --index-info <objs &&
855+
git commit -m "test commit"
856+
) &&
857+
858+
git clone $mode-collision $mode-collision-cloned &&
859+
# Make sure z was really delayed
860+
grep "IN: smudge $dir/z .* \\[DELAYED\\]" $mode-collision-cloned/delayed.log &&
861+
862+
# Should not create $dir/z at $symlink/z
863+
test_path_is_missing $mode-collision/target-dir/z
864+
'
865+
done
866+
867+
test_expect_success PERL,SYMLINKS,CASE_INSENSITIVE_FS \
868+
"delayed checkout with submodule collision don't write to the wrong place" '
869+
git init collision-with-submodule &&
870+
(
871+
cd collision-with-submodule &&
872+
git config filter.delay.process "\"$TEST_ROOT/rot13-filter.pl\" --always-delay delayed.log clean smudge delay" &&
873+
git config filter.delay.required true &&
874+
875+
# We need Git to treat the submodule "a" and the
876+
# leading dir "A" as different paths in the index.
877+
git config --local core.ignoreCase false &&
878+
879+
empty_oid=$(printf "" | git hash-object -w --stdin) &&
880+
attr_oid=$(echo "A/B/y filter=delay" | git hash-object -w --stdin) &&
881+
cat >objs <<-EOF &&
882+
100644 blob $empty_oid A/B/x
883+
100644 blob $empty_oid A/B/y
884+
100644 blob $attr_oid .gitattributes
885+
EOF
886+
git update-index --index-info <objs &&
887+
888+
git init a &&
889+
mkdir target-dir &&
890+
symlink_oid=$(printf "%s" "$PWD/target-dir" | git -C a hash-object -w --stdin) &&
891+
echo "120000 blob $symlink_oid b" >objs &&
892+
git -C a update-index --index-info <objs &&
893+
git -C a commit -m sub &&
894+
git submodule add ./a &&
895+
git commit -m super &&
896+
897+
git checkout --recurse-submodules . &&
898+
grep "IN: smudge A/B/y .* \\[DELAYED\\]" delayed.log &&
899+
test_path_is_missing target-dir/y
900+
)
901+
'
902+
822903
test_done

‎t/t0021/rot13-filter.pl

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,15 @@
22
# Example implementation for the Git filter protocol version 2
33
# See Documentation/gitattributes.txt, section "Filter Protocol"
44
#
5-
# The first argument defines a debug log file that the script write to.
6-
# All remaining arguments define a list of supported protocol
7-
# capabilities ("clean", "smudge", etc).
5+
# Usage: rot13-filter.pl [--always-delay] <log path> <capabilities>
6+
#
7+
# Log path defines a debug log file that the script writes to. The
8+
# subsequent arguments define a list of supported protocol capabilities
9+
# ("clean", "smudge", etc).
10+
#
11+
# When --always-delay is given all pathnames with the "can-delay" flag
12+
# that don't appear on the list bellow are delayed with a count of 1
13+
# (see more below).
814
#
915
# This implementation supports special test cases:
1016
# (1) If data with the pathname "clean-write-fail.r" is processed with
@@ -53,6 +59,13 @@ sub gitperllib {
5359
use Git::Packet;
5460

5561
my $MAX_PACKET_CONTENT_SIZE = 65516;
62+
63+
my $always_delay = 0;
64+
if ( $ARGV[0] eq '--always-delay' ) {
65+
$always_delay = 1;
66+
shift @ARGV;
67+
}
68+
5669
my $log_file = shift @ARGV;
5770
my @capabilities = @ARGV;
5871

@@ -134,6 +147,8 @@ sub rot13 {
134147
if ( $buffer eq "can-delay=1" ) {
135148
if ( exists $DELAY{$pathname} and $DELAY{$pathname}{"requested"} == 0 ) {
136149
$DELAY{$pathname}{"requested"} = 1;
150+
} elsif ( !exists $DELAY{$pathname} and $always_delay ) {
151+
$DELAY{$pathname} = { "requested" => 1, "count" => 1 };
137152
}
138153
} else {
139154
die "Unknown message '$buffer'";

‎t/t2006-checkout-index-basic.sh

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,50 @@ test_expect_success 'checkout-index -h in broken repository' '
2121
test_i18ngrep "[Uu]sage" broken/usage
2222
'
2323

24+
for mode in 'case' 'utf-8'
25+
do
26+
case "$mode" in
27+
case) dir='A' symlink='a' mode_prereq='CASE_INSENSITIVE_FS' ;;
28+
utf-8)
29+
dir=$(printf "\141\314\210") symlink=$(printf "\303\244")
30+
mode_prereq='UTF8_NFD_TO_NFC' ;;
31+
esac
32+
33+
test_expect_success SYMLINKS,$mode_prereq \
34+
"checkout-index with $mode-collision don't write to the wrong place" '
35+
git init $mode-collision &&
36+
(
37+
cd $mode-collision &&
38+
mkdir target-dir &&
39+
40+
empty_obj_hex=$(git hash-object -w --stdin </dev/null) &&
41+
symlink_hex=$(printf "%s" "$PWD/target-dir" | git hash-object -w --stdin) &&
42+
43+
cat >objs <<-EOF &&
44+
100644 blob ${empty_obj_hex} ${dir}/x
45+
100644 blob ${empty_obj_hex} ${dir}/y
46+
100644 blob ${empty_obj_hex} ${dir}/z
47+
120000 blob ${symlink_hex} ${symlink}
48+
EOF
49+
50+
git update-index --index-info <objs &&
51+
52+
# Note: the order is important here to exercise the
53+
# case where the file at ${dir} has its type changed by
54+
# the time Git tries to check out ${dir}/z.
55+
#
56+
# Also, we use core.precomposeUnicode=false because we
57+
# want Git to treat the UTF-8 paths transparently on
58+
# Mac OS, matching what is in the index.
59+
#
60+
git -c core.precomposeUnicode=false checkout-index -f \
61+
${dir}/x ${dir}/y ${symlink} ${dir}/z &&
62+
63+
# Should not create ${dir}/z at ${symlink}/z
64+
test_path_is_missing target-dir/z
65+
66+
)
67+
'
68+
done
69+
2470
test_done

‎unpack-trees.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,9 @@ static int check_updates(struct unpack_trees_options *o)
383383

384384
progress = get_progress(o);
385385

386+
/* Start with clean cache to avoid using any possibly outdated info. */
387+
invalidate_lstat_cache();
388+
386389
git_attr_set_direction(GIT_ATTR_CHECKOUT);
387390

388391
if (should_update_submodules())

0 commit comments

Comments
 (0)