Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)
This commit is contained in:
Todd Zullinger
parent
e8f3787a2a
commit
4387c32ff0
104
git-1.6.3.2-daemon-extra-args.patch
Normal file
104
git-1.6.3.2-daemon-extra-args.patch
Normal file
@ -0,0 +1,104 @@
|
||||
From 73bb33a94ec67a53e7d805b12ad9264fa25f4f8d Mon Sep 17 00:00:00 2001
|
||||
From: Shawn O. Pearce <spearce@spearce.org>
|
||||
Date: Thu, 4 Jun 2009 18:33:32 -0700
|
||||
Subject: [PATCH] daemon: Strictly parse the "extra arg" part of the command
|
||||
|
||||
Since 1.4.4.5 (49ba83fb67 "Add virtualization support to git-daemon")
|
||||
git daemon enters an infinite loop and never terminates if a client
|
||||
hides any extra arguments in the initial request line which is not
|
||||
exactly "\0host=blah\0".
|
||||
|
||||
Since that change, a client must never insert additional extra
|
||||
arguments, or attempt to use any argument other than "host=", as
|
||||
any daemon will get stuck parsing the request line and will never
|
||||
complete the request.
|
||||
|
||||
Since the client can't tell if the daemon is patched or not, it
|
||||
is not possible to know if additional extra args might actually be
|
||||
able to be safely requested.
|
||||
|
||||
If we ever need to extend the git daemon protocol to support a new
|
||||
feature, we may have to do something like this to the exchange:
|
||||
|
||||
# If both support git:// v2
|
||||
#
|
||||
C: 000cgit://v2
|
||||
S: 0010ok host user
|
||||
C: 0018host git.kernel.org
|
||||
C: 0027git-upload-pack /pub/linux-2.6.git
|
||||
S: ...git-upload-pack header...
|
||||
|
||||
# If client supports git:// v2, server does not:
|
||||
#
|
||||
C: 000cgit://v2
|
||||
S: <EOF>
|
||||
|
||||
C: 003bgit-upload-pack /pub/linux-2.6.git\0host=git.kernel.org\0
|
||||
S: ...git-upload-pack header...
|
||||
|
||||
This requires the client to create two TCP connections to talk to
|
||||
an older git daemon, however all daemons since the introduction of
|
||||
daemon.c will safely reject the unknown "git://v2" command request,
|
||||
so the client can quite easily determine the server supports an
|
||||
older protocol.
|
||||
|
||||
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
|
||||
Signed-off-by: Junio C Hamano <gitster@pobox.com>
|
||||
|
||||
diff --git a/connect.c b/connect.c
|
||||
index f6b8ba6..958c831 100644
|
||||
--- a/connect.c
|
||||
+++ b/connect.c
|
||||
@@ -579,7 +579,10 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
|
||||
git_tcp_connect(fd, host, flags);
|
||||
/*
|
||||
* Separate original protocol components prog and path
|
||||
- * from extended components with a NUL byte.
|
||||
+ * from extended host header with a NUL byte.
|
||||
+ *
|
||||
+ * Note: Do not add any other headers here! Doing so
|
||||
+ * will cause older git-daemon servers to crash.
|
||||
*/
|
||||
packet_write(fd[1],
|
||||
"%s %s%chost=%s%c",
|
||||
diff --git a/daemon.c b/daemon.c
|
||||
index daa4c8e..b2babcc 100644
|
||||
--- a/daemon.c
|
||||
+++ b/daemon.c
|
||||
@@ -406,15 +406,15 @@ static char *xstrdup_tolower(const char *str)
|
||||
}
|
||||
|
||||
/*
|
||||
- * Separate the "extra args" information as supplied by the client connection.
|
||||
+ * Read the host as supplied by the client connection.
|
||||
*/
|
||||
-static void parse_extra_args(char *extra_args, int buflen)
|
||||
+static void parse_host_arg(char *extra_args, int buflen)
|
||||
{
|
||||
char *val;
|
||||
int vallen;
|
||||
char *end = extra_args + buflen;
|
||||
|
||||
- while (extra_args < end && *extra_args) {
|
||||
+ if (extra_args < end && *extra_args) {
|
||||
saw_extended_args = 1;
|
||||
if (strncasecmp("host=", extra_args, 5) == 0) {
|
||||
val = extra_args + 5;
|
||||
@@ -436,6 +436,8 @@ static void parse_extra_args(char *extra_args, int buflen)
|
||||
/* On to the next one */
|
||||
extra_args = val + vallen;
|
||||
}
|
||||
+ if (extra_args < end && *extra_args)
|
||||
+ die("Invalid request");
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -545,7 +547,7 @@ static int execute(struct sockaddr *addr)
|
||||
hostname = canon_hostname = ip_address = tcp_port = NULL;
|
||||
|
||||
if (len != pktlen)
|
||||
- parse_extra_args(line + len + 1, pktlen - len - 1);
|
||||
+ parse_host_arg(line + len + 1, pktlen - len - 1);
|
||||
|
||||
for (i = 0; i < ARRAY_SIZE(daemon_service); i++) {
|
||||
struct daemon_service *s = &(daemon_service[i]);
|
||||
8
git.spec
8
git.spec
@ -1,7 +1,7 @@
|
||||
# Pass --without docs to rpmbuild if you don't want the documentation
|
||||
Name: git
|
||||
Version: 1.6.3.2
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
Summary: Core git tools
|
||||
License: GPLv2
|
||||
Group: Development/Tools
|
||||
@ -14,6 +14,8 @@ Source4: git-gui.desktop
|
||||
Patch0: git-1.5-gitweb-home-link.patch
|
||||
# https://bugzilla.redhat.com/490602
|
||||
Patch1: git-cvsimport-Ignore-cvsps-2.2b1-Branches-output.patch
|
||||
# http://git.kernel.org/?p=git/git.git;a=commitdiff;h=73bb33a9
|
||||
Patch2: git-1.6.3.2-daemon-extra-args.patch
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||
|
||||
BuildRequires: desktop-file-utils
|
||||
@ -187,6 +189,7 @@ Requires: git = %{version}-%{release}, emacs-common >= 22.2
|
||||
%setup -q
|
||||
%patch0 -p1
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
|
||||
# Use these same options for every invocation of 'make'.
|
||||
# Otherwise it will rebuild in %%install due to flags changes.
|
||||
@ -363,6 +366,9 @@ rm -rf $RPM_BUILD_ROOT
|
||||
# No files for you!
|
||||
|
||||
%changelog
|
||||
* Fri Jun 19 2009 Todd Zullinger <tmz@pobox.com> - 1.6.3.2-2
|
||||
- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)
|
||||
|
||||
* Fri Jun 05 2009 Todd Zullinger <tmz@pobox.com> - 1.6.3.2-1
|
||||
- git-1.6.3.2
|
||||
- Require emacs >= 22.2 for emacs support (bug 495312)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user