rpms/git/F-11 git-1.6.2.5-daemon-extra-args.patch, NONE, 1.1 .cvsignore, 1.74, 1.75 git.spec, 1.83, 1.84 sources, 1.74, 1.75

[Todd M. Zullinger]

Author: tmz

Update of /cvs/pkgs/rpms/git/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv2807

Modified Files:
	.cvsignore git.spec sources 
Added Files:
	git-1.6.2.5-daemon-extra-args.patch 
Log Message:
Update to 1.6.2.5

- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)


git-1.6.2.5-daemon-extra-args.patch:

--- NEW FILE git-1.6.2.5-daemon-extra-args.patch ---
>From 73bb33a94ec67a53e7d805b12ad9264fa25f4f8d Mon Sep 17 00:00:00 2001
From: Shawn O. Pearce <spearce at spearce.org>
Date: Thu, 4 Jun 2009 18:33:32 -0700
Subject: [PATCH] daemon: Strictly parse the "extra arg" part of the command

Since 1.4.4.5 (49ba83fb67 "Add virtualization support to git-daemon")
git daemon enters an infinite loop and never terminates if a client
hides any extra arguments in the initial request line which is not
exactly "\0host=blah\0".

Since that change, a client must never insert additional extra
arguments, or attempt to use any argument other than "host=", as
any daemon will get stuck parsing the request line and will never
complete the request.

Since the client can't tell if the daemon is patched or not, it
is not possible to know if additional extra args might actually be
able to be safely requested.

If we ever need to extend the git daemon protocol to support a new
feature, we may have to do something like this to the exchange:

  # If both support git:// v2
  #
  C: 000cgit://v2
  S: 0010ok host user
  C: 0018host git.kernel.org
  C: 0027git-upload-pack /pub/linux-2.6.git
  S: ...git-upload-pack header...

  # If client supports git:// v2, server does not:
  #
  C: 000cgit://v2
  S: <EOF>

  C: 003bgit-upload-pack /pub/linux-2.6.git\0host=git.kernel.org\0
  S: ...git-upload-pack header...

This requires the client to create two TCP connections to talk to
an older git daemon, however all daemons since the introduction of
daemon.c will safely reject the unknown "git://v2" command request,
so the client can quite easily determine the server supports an
older protocol.

Signed-off-by: Shawn O. Pearce <spearce at spearce.org>
Signed-off-by: Junio C Hamano <gitster at pobox.com>

diff --git a/connect.c b/connect.c
index f6b8ba6..958c831 100644
--- a/connect.c
+++ b/connect.c
@@ -579,7 +579,10 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
 			git_tcp_connect(fd, host, flags);
 		/*
 		 * Separate original protocol components prog and path
-		 * from extended components with a NUL byte.
+		 * from extended host header with a NUL byte.
+		 *
+		 * Note: Do not add any other headers here!  Doing so
+		 * will cause older git-daemon servers to crash.
 		 */
 		packet_write(fd[1],
 			     "%s %s%chost=%s%c",
diff --git a/daemon.c b/daemon.c
index daa4c8e..b2babcc 100644
--- a/daemon.c
+++ b/daemon.c
@@ -406,15 +406,15 @@ static char *xstrdup_tolower(const char *str)
 }
 
 /*
- * Separate the "extra args" information as supplied by the client connection.
+ * Read the host as supplied by the client connection.
  */
-static void parse_extra_args(char *extra_args, int buflen)
+static void parse_host_arg(char *extra_args, int buflen)
 {
 	char *val;
 	int vallen;
 	char *end = extra_args + buflen;
 
-	while (extra_args < end && *extra_args) {
+	if (extra_args < end && *extra_args) {
 		saw_extended_args = 1;
 		if (strncasecmp("host=", extra_args, 5) == 0) {
 			val = extra_args + 5;
@@ -436,6 +436,8 @@ static void parse_extra_args(char *extra_args, int buflen)
 			/* On to the next one */
 			extra_args = val + vallen;
 		}
+		if (extra_args < end && *extra_args)
+			die("Invalid request");
 	}
 
 	/*
@@ -545,7 +547,7 @@ static int execute(struct sockaddr *addr)
 	hostname = canon_hostname = ip_address = tcp_port = NULL;
 
 	if (len != pktlen)
-		parse_extra_args(line + len + 1, pktlen - len - 1);
+		parse_host_arg(line + len + 1, pktlen - len - 1);
 
 	for (i = 0; i < ARRAY_SIZE(daemon_service); i++) {
 		struct daemon_service *s = &(daemon_service[i]);


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/git/F-11/.cvsignore,v
retrieving revision 1.74
retrieving revision 1.75
diff -u -p -r1.74 -r1.75
--- .cvsignore	4 Apr 2009 20:47:17 -0000	1.74
+++ .cvsignore	19 Jun 2009 13:47:55 -0000	1.75
@@ -1 +1 @@
-git-1.6.2.2.tar.bz2
+git-1.6.2.5.tar.bz2


Index: git.spec
===================================================================
RCS file: /cvs/pkgs/rpms/git/F-11/git.spec,v
retrieving revision 1.83
retrieving revision 1.84
diff -u -p -r1.83 -r1.84
--- git.spec	4 Apr 2009 20:47:17 -0000	1.83
+++ git.spec	19 Jun 2009 13:47:55 -0000	1.84
@@ -1,6 +1,6 @@
 # Pass --without docs to rpmbuild if you don't want the documentation
 Name:           git
-Version:        1.6.2.2
+Version:        1.6.2.5
 Release:        1%{?dist}
 Summary:        Core git tools
 License:        GPLv2
@@ -13,6 +13,8 @@ Source3:        git.conf.httpd
 Patch0:         git-1.5-gitweb-home-link.patch
 # https://bugzilla.redhat.com/490602
 Patch1:         git-cvsimport-Ignore-cvsps-2.2b1-Branches-output.patch
+# http://git.kernel.org/?p=git/git.git;a=commitdiff;h=73bb33a9
+Patch2:         git-1.6.2.5-daemon-extra-args.patch
 BuildRequires:  zlib-devel >= 1.2, openssl-devel, libcurl-devel, expat-devel, emacs, gettext %{!?_without_docs:, xmlto, asciidoc > 6.0.3}
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -143,6 +145,7 @@ Requires:       git = %{version}-%{relea
 %setup -q
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 # Use these same options for every invocation of 'make'.
 # Otherwise it will rebuild in %%install due to flags changes.
@@ -298,6 +301,10 @@ rm -rf $RPM_BUILD_ROOT
 # No files for you!
 
 %changelog
+* Fri Jun 19 2009 Todd Zullinger <tmz at pobox.com> - 1.6.2.5-1
+- Update to 1.6.2.5
+- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)
+
 * Fri Apr 03 2009 Todd Zullinger <tmz at pobox.com> - 1.6.2.2-1
 - git-1.6.2.2
 - Include contrib/ dir in %%doc (bug 492490)


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/git/F-11/sources,v
retrieving revision 1.74
retrieving revision 1.75
diff -u -p -r1.74 -r1.75
--- sources	4 Apr 2009 20:47:17 -0000	1.74
+++ sources	19 Jun 2009 13:47:55 -0000	1.75
@@ -1 +1 @@
-d219aa5480ed6396f8ab968f3f7eb0f9  git-1.6.2.2.tar.bz2
+7ecacfbc97188b7680addf954ecf481f  git-1.6.2.5.tar.bz2