diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2017-03-27 23:46:28 +0200 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2017-03-28 00:32:37 +0200 |
| commit | a48a1071a686b250bf8b7982ca0ce8dda1d93c61 (patch) | |
| tree | 38f17af2b10d7ba3697bd85c9cb405c24f77be33 /gnu | |
| parent | bc4a2b853c92b29d8590db711dbd8bd1bc22db3d (diff) | |
| download | guix-a48a1071a686b250bf8b7982ca0ce8dda1d93c61.tar.gz | |
gnu: libgit2: Patch use-after-free.
* gnu/packages/patches/libgit2-use-after-free.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/version-control.scm (libgit2)[inputs]: Add it. [arguments] <#:phases>: Add 'apply-patch' phase.
Diffstat (limited to 'gnu')
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/libgit2-use-after-free.patch | 24 | ||||
| -rw-r--r-- | gnu/packages/version-control.scm | 14 |
3 files changed, 38 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 0bb2276a2a..cc187e2d20 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -687,6 +687,7 @@ dist_patch_DATA = \ %D%/packages/patches/libevent-2.1-dns-tests.patch \ %D%/packages/patches/libevent-2.1-skip-failing-test.patch \ %D%/packages/patches/libextractor-ffmpeg-3.patch \ + %D%/packages/patches/libgit2-use-after-free.patch \ %D%/packages/patches/libjxr-fix-function-signature.patch \ %D%/packages/patches/libjxr-fix-typos.patch \ %D%/packages/patches/liboop-mips64-deplibs-fix.patch \ diff --git a/gnu/packages/patches/libgit2-use-after-free.patch b/gnu/packages/patches/libgit2-use-after-free.patch new file mode 100644 index 0000000000..580af8781a --- /dev/null +++ b/gnu/packages/patches/libgit2-use-after-free.patch @@ -0,0 +1,24 @@ +This patch is taken from <https://github.com/libgit2/libgit2/pull/4122>; +we need it to fix the use-after-free error in 'git_commit_extract_signature' +reported at <https://github.com/libgit2/libgit2/issues/4118>. + +From ade0d9c658fdfc68d8046935f6908f033fe7a529 Mon Sep 17 00:00:00 2001 +From: Patrick Steinhardt <ps@pks.im> +Date: Mon, 13 Feb 2017 13:46:17 +0100 +Subject: [PATCH 3/3] commit: avoid possible use-after-free + +diff --git a/src/commit.c b/src/commit.c +index 89a4db1..05b70a9 100644 +--- a/src/commit.c ++++ b/src/commit.c +@@ -766,8 +766,9 @@ int git_commit_extract_signature(git_buf *signature, git_buf *signed_data, git_r + if (git_buf_oom(signature)) + goto oom; + ++ error = git_buf_puts(signed_data, eol+1); + git_odb_object_free(obj); +- return git_buf_puts(signed_data, eol+1); ++ return error; + } + + giterr_set(GITERR_OBJECT, "this commit is not signed"); diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm index 0e04f1a1c3..57589c04aa 100644 --- a/gnu/packages/version-control.scm +++ b/gnu/packages/version-control.scm @@ -342,13 +342,25 @@ everything from small to very large projects with speed and efficiency.") (("/bin/cp") (which "cp")) (("/bin/rm") (which "rm"))) #t)) + (add-after 'unpack 'apply-patch + (lambda* (#:key inputs #:allow-other-keys) + ;; XXX: For some reason adding the patch in 'patches', which + ;; leads to a new tarball with all timestamps reset and ordering + ;; by name (slightly different file order compared to the + ;; original tarball) leads to an obscure Python error while + ;; running 'generate.py': + ;; 'Module' object has no attribute 'callbacks' + ;; Thus, apply the patch here, which minimizes disruption. + (let ((patch (assoc-ref inputs "patch"))) + (zero? (system* "patch" "-p1" "--force" "--input" patch))))) ;; Run checks more verbosely. (replace 'check (lambda _ (zero? (system* "./libgit2_clar" "-v" "-Q"))))))) (inputs `(("libssh2" ,libssh2) ("libcurl" ,curl) - ("python" ,python-wrapper))) + ("python" ,python-wrapper) + ("patch" ,(search-patch "libgit2-use-after-free.patch")))) (native-inputs `(("pkg-config" ,pkg-config))) (propagated-inputs |