Skip to content

Commit 1479961

Browse files
dschodscho
committed
Sync with 2.43.6
* maint-2.43: Git 2.43.6 Git 2.42.4 Git 2.41.3 Git 2.40.4 credential: disallow Carriage Returns in the protocol by default credential: sanitize the user prompt credential_format(): also encode <host>[:<port>] t7300: work around platform-specific behaviour with long paths on MinGW compat/regex: fix argument order to calloc(3) mingw: drop bogus (and unneeded) declaration of `_pgmptr` ci: remove 'Upload failed tests' directories' step from linux32 jobs
2 parents 46698a8 + 664d4fa commit 1479961

19 files changed

+150
-53
lines changed

‎.github/workflows/main.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -356,12 +356,6 @@ jobs:
356356
with:
357357
name: failed-tests-${{matrix.vector.jobname}}
358358
path: ${{env.FAILED_TEST_ARTIFACTS}}
359-
- name: Upload failed tests' directories
360-
if: failure() && env.FAILED_TEST_ARTIFACTS != '' && matrix.vector.jobname == 'linux32'
361-
uses: actions/upload-artifact@v1 # cannot be upgraded because Node.js Actions aren't supported in this container
362-
with:
363-
name: failed-tests-${{matrix.vector.jobname}}
364-
path: ${{env.FAILED_TEST_ARTIFACTS}}
365359
static-analysis:
366360
needs: ci-config
367361
if: needs.ci-config.outputs.enabled == 'yes'

‎Documentation/RelNotes/2.40.4.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.40.4 Release Notes
2+
=========================
3+
4+
This release lets Git refuse to accept URLs that contain control
5+
sequences. This addresses CVE-2024-50349 and CVE-2024-52006.

‎Documentation/RelNotes/2.41.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.41.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 to address
5+
the security issues CVE-2024-50349 and CVE-2024-52006; see the
6+
release notes for that version for details.

‎Documentation/RelNotes/2.42.4.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.42.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 and v2.41.3
5+
to address the security issues CVE-2024-50349 and CVE-2024-52006;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.43.6.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.6 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3
5+
and v2.42.4 to address the security issues CVE-2024-50349 and
6+
CVE-2024-52006; see the release notes for these versions for
7+
details.

‎Documentation/config/credential.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,17 @@ credential.useHttpPath::
1414
or https URL to be important. Defaults to false. See
1515
linkgit:gitcredentials[7] for more information.
1616

17+
credential.sanitizePrompt::
18+
By default, user names and hosts that are shown as part of the
19+
password prompt are not allowed to contain control characters (they
20+
will be URL-encoded by default). Configure this setting to `false` to
21+
override that behavior.
22+
23+
credential.protectProtocol::
24+
By default, Carriage Return characters are not allowed in the protocol
25+
that is used when Git talks to a credential helper. This setting allows
26+
users to override this default.
27+
1728
credential.username::
1829
If no username is set for a network authentication, use this username
1930
by default. See credential.<context>.* below, and

‎compat/mingw.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ static const int delay[] = { 0, 1, 10, 20, 40 };
2626
void open_in_gdb(void)
2727
{
2828
static struct child_process cp = CHILD_PROCESS_INIT;
29-
extern char *_pgmptr;
3029

3130
strvec_pushl(&cp.args, "mintty", "gdb", NULL);
3231
strvec_pushf(&cp.args, "--pid=%d", getpid());

‎compat/regex/regcomp.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -868,7 +868,7 @@ init_dfa (re_dfa_t *dfa, size_t pat_len)
868868
if (table_size > pat_len)
869869
break;
870870

871-
dfa->state_table = calloc (sizeof (struct re_state_table_entry), table_size);
871+
dfa->state_table = calloc (table_size, sizeof (struct re_state_table_entry));
872872
dfa->state_hash_mask = table_size - 1;
873873

874874
dfa->mb_cur_max = MB_CUR_MAX;
@@ -936,7 +936,7 @@ init_dfa (re_dfa_t *dfa, size_t pat_len)
936936
{
937937
int i, j, ch;
938938

939-
dfa->sb_char = (re_bitset_ptr_t) calloc (sizeof (bitset_t), 1);
939+
dfa->sb_char = (re_bitset_ptr_t) calloc (1, sizeof (bitset_t));
940940
if (BE (dfa->sb_char == NULL, 0))
941941
return REG_ESPACE;
942942

@@ -3079,9 +3079,9 @@ parse_bracket_exp (re_string_t *regexp, re_dfa_t *dfa, re_token_t *token,
30793079
_NL_COLLATE_SYMB_EXTRAMB);
30803080
}
30813081
#endif
3082-
sbcset = (re_bitset_ptr_t) calloc (sizeof (bitset_t), 1);
3082+
sbcset = (re_bitset_ptr_t) calloc (1, sizeof (bitset_t));
30833083
#ifdef RE_ENABLE_I18N
3084-
mbcset = (re_charset_t *) calloc (sizeof (re_charset_t), 1);
3084+
mbcset = (re_charset_t *) calloc (1, sizeof (re_charset_t));
30853085
#endif /* RE_ENABLE_I18N */
30863086
#ifdef RE_ENABLE_I18N
30873087
if (BE (sbcset == NULL || mbcset == NULL, 0))
@@ -3626,9 +3626,9 @@ build_charclass_op (re_dfa_t *dfa, RE_TRANSLATE_TYPE trans,
36263626
re_token_t br_token;
36273627
bin_tree_t *tree;
36283628

3629-
sbcset = (re_bitset_ptr_t) calloc (sizeof (bitset_t), 1);
3629+
sbcset = (re_bitset_ptr_t) calloc (1, sizeof (bitset_t));
36303630
#ifdef RE_ENABLE_I18N
3631-
mbcset = (re_charset_t *) calloc (sizeof (re_charset_t), 1);
3631+
mbcset = (re_charset_t *) calloc (1, sizeof (re_charset_t));
36323632
#endif /* RE_ENABLE_I18N */
36333633

36343634
#ifdef RE_ENABLE_I18N

‎compat/regex/regex_internal.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1628,7 +1628,7 @@ create_ci_newstate (const re_dfa_t *dfa, const re_node_set *nodes,
16281628
reg_errcode_t err;
16291629
re_dfastate_t *newstate;
16301630

1631-
newstate = (re_dfastate_t *) calloc (sizeof (re_dfastate_t), 1);
1631+
newstate = (re_dfastate_t *) calloc (1, sizeof (re_dfastate_t));
16321632
if (BE (newstate == NULL, 0))
16331633
return NULL;
16341634
err = re_node_set_init_copy (&newstate->nodes, nodes);
@@ -1678,7 +1678,7 @@ create_cd_newstate (const re_dfa_t *dfa, const re_node_set *nodes,
16781678
reg_errcode_t err;
16791679
re_dfastate_t *newstate;
16801680

1681-
newstate = (re_dfastate_t *) calloc (sizeof (re_dfastate_t), 1);
1681+
newstate = (re_dfastate_t *) calloc (1, sizeof (re_dfastate_t));
16821682
if (BE (newstate == NULL, 0))
16831683
return NULL;
16841684
err = re_node_set_init_copy (&newstate->nodes, nodes);

‎compat/regex/regexec.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2796,8 +2796,8 @@ get_subexp (re_match_context_t *mctx, int bkref_node, int bkref_str_idx)
27962796
continue; /* No. */
27972797
if (sub_top->path == NULL)
27982798
{
2799-
sub_top->path = calloc (sizeof (state_array_t),
2800-
sl_str - sub_top->str_idx + 1);
2799+
sub_top->path = calloc (sl_str - sub_top->str_idx + 1,
2800+
sizeof (state_array_t));
28012801
if (sub_top->path == NULL)
28022802
return REG_ESPACE;
28032803
}
@@ -3361,7 +3361,7 @@ build_trtable (const re_dfa_t *dfa, re_dfastate_t *state)
33613361
if (ndests == 0)
33623362
{
33633363
state->trtable = (re_dfastate_t **)
3364-
calloc (sizeof (re_dfastate_t *), SBC_MAX);
3364+
calloc (SBC_MAX, sizeof (re_dfastate_t *));
33653365
return 1;
33663366
}
33673367
return 0;
@@ -3457,7 +3457,7 @@ build_trtable (const re_dfa_t *dfa, re_dfastate_t *state)
34573457
discern by looking at the character code: allocate a
34583458
256-entry transition table. */
34593459
trtable = state->trtable =
3460-
(re_dfastate_t **) calloc (sizeof (re_dfastate_t *), SBC_MAX);
3460+
(re_dfastate_t **) calloc (SBC_MAX, sizeof (re_dfastate_t *));
34613461
if (BE (trtable == NULL, 0))
34623462
goto out_free;
34633463

@@ -3488,7 +3488,7 @@ build_trtable (const re_dfa_t *dfa, re_dfastate_t *state)
34883488
transition tables, one starting at trtable[0] and one
34893489
starting at trtable[SBC_MAX]. */
34903490
trtable = state->word_trtable =
3491-
(re_dfastate_t **) calloc (sizeof (re_dfastate_t *), 2 * SBC_MAX);
3491+
(re_dfastate_t **) calloc (2 * SBC_MAX, sizeof (re_dfastate_t *));
34923492
if (BE (trtable == NULL, 0))
34933493
goto out_free;
34943494

0 commit comments

Comments
 (0)