summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Minor cosmetic changesAndreas Gruenbacher2015-02-281-4/+4
| | | | * src/safe.c: Minor cosmetic changes
* Fix handling of renamed filesAndreas Gruenbacher2015-02-221-5/+7
| | | | | | | | When a file has already been renamed, make sure it is not renamed back to its old name. Reported by Guido Draheim. * src/patch.c (main): Make sure we never rename a file back to its previous name. Report when a file was renamed already. * tests/copy-rename: Add "already renamed" test cases.
* Fix symlinks test case on some architecturesAndreas Gruenbacher2015-02-101-4/+13
| | | | | | | | | * src/safe.c: Include util.h for say(). Define EFTYPE if it isn't defined already. (traverse_another_path): When openat fails, also check for EMLINK, EFTYPE, and ENOTDIR. Change the error message to "file ... is not a directory" and only skip the rest of the patch instead of aborting. * tests/symlinks: Update.
* Switch from gen_tempname() to try_tempname()Andreas Gruenbacher2015-02-041-31/+33
| | | | | | | * Update gnulib submodule to latest. * src/util.c (try_safe_open_args, try_safe_open): Arguments and callback for try_tempname(). (make_tempfile): Switch from gen_tempname() to try_tempname().
* Link patch with LIB_EACCESS where neededAndreas Gruenbacher2015-02-011-1/+1
| | | | | * src/Makefile.am (patch_LDADD): Add LIB_EACCESS here. At least on Solaris, faccessat() is implemented through eaccess() which is in the "gen" library.
* Fix minor signedness warningAndreas Gruenbacher2015-02-011-1/+1
| | | | | * src/pch.c (intuit_diff_type): Don't assign signed dummy value to unsigned variable.
* Fix indentation heuristic for context diffsAndreas Gruenbacher2015-01-311-2/+5
| | | | | | | | | | | Diffs can be indented by a variable number of spaces, tabs, or X characters. Make sure that intuit_diff_type() only accepts context diffs where the first and second line are indented identically, or else another_hunk() will fail. * src/pch.c (intuit_diff_type): Remember the indentation of the last line. Only recognize context diff hunks with the same amount of indentation on the first and second line. * tests/garbage: New test case. * tests/Makefile.am (TESTS): Add test case.
* patch: git-diff mode: do not change permissions if there isn't an explicit ↵Quentin Casasnovas2015-01-311-1/+1
| | | | | | mode change. Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
* Allow arbitrary symlink targets againTim Waugh2015-01-311-28/+0
| | | | | | * src/util.c (symlink_target_is_valid): Remove. (move_file): Remove symlink target checking. * tests/symlinks: Update test case.
* Update list of gnulib modules usedAndreas Gruenbacher2015-01-311-1/+0
| | | | | | | * bootstrap.conf (gnulib_modules): Remove lchmod, lstat, mkdir, readlink, rename, mkdir, symlink, unlink, utimens. Add fchownat, fchmodat, fstatat, mkdirat, openat, readlinkat, renameat, symlinkat, unlinkat, utimensat. * src/util.h: Don't include <utimens.h> anymore.
* Use symlink-safe system call replacementsAndreas Gruenbacher2015-01-314-39/+57
| | | | | | | | | Use the symlink-safe replacements for system calls in many places throughout the code: In some places this makes patch safe against path traversal attacks; in other places, it saves the kernel from having to re-traverse the pathnames. * src/inp.c (plan_b): Use safe_open() + fdopen() instead of fopen(). * src/util.c (copy_attr): Document why we are safe here. (create_backup): Use safe_open() instead of creat().
* Add symlink-safe system call replacementsTim Waugh2015-01-313-0/+498
| | | | | | | | | | | | | Add wrappers around system calls that traverse relative pathnames without following symlinks. Written by Tim Waugh <twaugh@redhat.com> and Andreas Gruenbacher <agruenba@redhat.com>. * src/safe.h: Declare functions here. * src/safe.c: Implement safe_* system call replacements that do not follow symlinks along pathnames. Pathname components are resolved with openat(). Lookup results are cached to keep the overhead reasonably low. * tests/deep-directories: New path traversal cache test. * src/Makefile.am (patch_SOURCES): Add safe.[ch]. * tests/Makefile.am (TESTS): Add new test.
* Avoid closing file descriptor twiceTim Waugh2015-01-311-0/+2
| | | | | * src/patch.c (main): Make sure we don't close() outfd after passing it on to fdopen(): the file descriptor might have been reused in the meantime.
* Remove unused variableAndreas Gruenbacher2015-01-291-1/+0
| | | | * src/pch.c (name_is_valid): Remove unused variable.
* Fix the fix for CVE-2015-1196v2.7.3Andreas Gruenbacher2015-01-223-62/+38
| | | | | | | | | * src/util.c (filename_is_safe): New function split off from name_is_valid(). (symlink_target_is_valid): Explain why we cannot have absolute symlinks or symlinks with ".." components for now. (move_file): Move absolute filename check here and explain. * tests/symlinks: Put test case with ".." symlink in comments for now. * NEWS: Add CVE number.
* For renames and copies, make sure that both file names are validAndreas Gruenbacher2015-01-212-4/+15
| | | | | | | | | * src/patch.c (main): Allow there_is_another_patch() to set the skip_rest_of_patch flag. * src/pch.c (intuit_diff_type): For renames and copies, also check the "other" file name. (pch_copy, pch_rename): Now that both names are checked in intuit_diff_type(), we know they are defined here.
* Fail when out of memory in set_hunkmax()v2.7.2Andreas Gruenbacher2015-01-202-6/+6
| | | | | | | | src/pch.c (another_hunk): Call set_hunkmax() from here to make sure it is called even when falling back from plan A to plan B. (open_patch_file): No need to call set_hunkmax() anymore. src/pch.c (set_hunkmax): Fail when out of memory. Make static. src/pch.h: Remove set_hunkmax() prototype.
* Don't try applying hunks at offsets that can't workAndreas Gruenbacher2015-01-201-4/+8
| | | | | | * src/patch.c (locate_hunk): Start trying to apply the hunk at the minimum offset which puts the hunk in the valid range of lines. This will often still be offset 0.
* Move symlink_target_is_valid() and cwd_is_root()Andreas Gruenbacher2015-01-204-78/+78
| | | | | * src/util.c: Move symlink_target_is_valid() and cwd_is_root() here from src/pch.c.
* Make sure symlinks don't point outside working directory (CVE-2015-119)Andreas Gruenbacher2015-01-193-0/+62
| | | | | | | | | | | When creating symlinks from git-style patches, make sure the symlinks don't point above the current working directory. Otherwise, a subsequent patch could use the symlink to write outside the working directory. * src/pch.c (symlink_target_is_valid): New function to check for valid symlink targets. * src/util.c (move_file): Use symlink_target_is_valid() here. * tests/symlinks: Add valid and invalid symlink test cases.
* Add line number overflow checkingAndreas Gruenbacher2014-11-302-3/+31
| | | | | | | | * bootstrap.conf: use intprops module. * src/common.h: Define LINENUM_MIN and LINENUM_MAX macros. * src/pch.c (another_hunk): Add line number overflow checking. Based on Robert C. Seacord's INT32-C document for integer overflow checking and Tobias Stoeckmann's "integer overflows and oob memory access" patch for FreeBSD.
* More savebuf/savestr error handlingAndreas Gruenbacher2014-11-302-10/+12
| | | | | | | | | | | | * bootstrap.conf: use xmemdup0 module. * src/pch.c (there_is_another_patch): Use xmemdup0 instead of savebuf when we cannot recover from out-of-memory situations. (intuit_diff_type): Likewise, use xstrdup instead of savestr. (another_hunk): Handle the case when savestr returns NULL. * src/util.c (fetchname, parse_name): Use xmemdup0 instead of savebuf when we cannot recover from out-of-memory situations. Bugs pointed out by Tobias Stoeckmann <tobias@stoeckmann.org>.
* savebuf/savestr error handlingTobias Stoeckmann2014-11-301-9/+9
| | | | | | | | * src/patch.c (get_some_switches): The function savebuf (and therefore savestr) copies strings using malloc. If malloc fails, NULL is returned. This is intentional behavior so that in case of failure during "plan a" patching, "plan b" can step in. The return value has to be properly checked for NULL. If the return value must not be NULL, use xstrdup instead.
* build: update gnulib submodule to latestAndreas Gruenbacher2014-11-301-2/+1
| | | | | | * src/merge.c (compute_changes): The TOO_EXPENSIVE heuristic in diffseq has been removed, including compareseq's find_minimal parameter and the context's too_expensive limit. Adjust.
* Drop useless test in another_hunk()Jean Delvare2014-11-101-1/+1
| | | | src/pch.c (another_hunk): This test will always succeed.
* Buffer overflow on malicious input fileTobias Stoeckmann2014-10-301-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a hard to reach but possible buffer overflow when using patch with a very large (modified) input file. I doubt you will ever see this with a 64 bit system, but it's possible with 32 bit: $ echo hello > file1 $ echo world > file2 $ diff -Nau file1 file2 > file.diff Nothing fancy so far. Adjust file1 so it contains at least one line that is 2 GB in size. Larger is fine too, but stay below 4 GB. $ tr '\0' c < /dev/zero | dd bs=1K count=2097152 of=file1 Now try to patch it. $ patch -Np0 -i file.diff Segmentation fault The issue is in patch's "plan b" strategy (If your system would still want to use "plan a", force patch to use "plan b" through debug flag). Plan b writes lines into a temporary file, with equally long lines, so it can use a buffer mechanism to access them in a kind of randomly fassion. In order to do that, it retrieves the longest line. In this example, it will encounter the 2 GB line and stores that as the longest one. Afterwards it will adjust the tibufsize variable to be large enough: for (tibufsize = TIBUFSIZE_MINIMUM; tibufsize < maxlen; tibufsize <<= 1) /* do nothing */ ; Due to maxlen's size (2 GB), tibufsize will be SIZE_T_MAX, i.e. 4 GB. A few lines later it allocates space for the tibuf buffers: tibuf[0] = xmalloc (2 * tibufsize); tibuf[1] = tibuf[0] + tibufsize; This will allocate 0 bytes because tibufsize overflowed. The next time patch writes into the buffer, a segmentation fault will occur... Depends on your system how long it takes until that happens. ;) The fix is simple: Bail out on lines that are too long. Patch already does that for files that have too many lines.
* Improve error message when refusing to delete fileAndreas Gruenbacher2014-08-131-1/+1
| | | | | * src/patch.c: Improve error message. * tests/create-delete: Update the test case.
* Correct the --help text of option --mergeAndreas Gruenbacher2013-12-091-1/+1
| | | | | * src/patch.c (option_help): The --merge option does not have a short form; update the help text.
* Preserve function names in reject filesSteven Rostedt2013-08-191-1/+2
| | | | | | | * src/patch.c (main): Preserve function names in reject files. * tests/reject-format: Update the test case. Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andreas Gruenbacher <agruen@linbit.com>
* In dry-run mode, create temporary files in a temporary directoryoriginAndreas Gruenbacher2013-07-301-1/+1
| | | | | | * src/util.c (make_tempfile): Do not create temporary files in the final output directory when in dry-run mode: the path may be read-only. In addition, we do not want to leave intermediary empty output directories around.
* Fix removing empty directoriesAndreas Gruenbacher2013-03-101-1/+1
| | | | | | | | | Reported by Thomas Moschny <thomas.moschny@gmx.de>: src/patch.c (main): Temporary output files are created in the same directory as the output file. Make sure to remove them before removing empty files and their empty ancestor directories; else the directories won't be empty. tests/remove-directories: Add directory removal test case. tests/Makefile.am (TESTS): Add new test case.
* Initialize data structures early enoughAndreas Gruenbacher2012-10-041-4/+4
| | | | | | | * src/patch.c (main): Initialize data structures early enough, before error paths can access them. * tests/bad-usage: Test bad command line usage. * tests/Makefile.am (TESTS): Add bad-usage here.
* Use gnulib errno module instead of our own default ENOTSUP fallbackAndreas Gruenbacher2012-09-281-4/+0
| | | | | * bootstrap.conf (gnulib_modules): Add errno module. * src/common.h: Remove ENOTSUP fallback.
* Improve the previous commitAndreas Gruenbacher2012-09-261-1/+2
| | | | | | | | * src/patch.c: Only print the "file is not empty after patch" message when trying to delete the output file. Say that we were trying to delete the file. * tests/create-delete: Fix the expected messages. Add test cases for the --remove-empty-files and --posix options. * NEWS: Better describe this change.
* Only expect files to become empty if the patch says soAndreas Gruenbacher2012-09-251-1/+1
| | | | | | | Test cases based on patches from Dmitry V. Levin <ldv@altlinux.org>. * src/patch.c (main): Only expect files to become empty if the patch says so. * NEWS: Document this change. * tests/create-delete: Add (more) empty vs. non-empty test cases.
* Improve messages when in --dry-run modeAndreas Gruenbacher2012-09-221-2/+5
| | | | | | | | * src/patch.c (main): Say that we are checking a file and not that we are patching it in --dry-run mode. Don't say "saving rejects to file" when we don't create reject files. * tests/reject-format: Add rejects with --dry-run test case. * tests/bad-filenames, tests/fifo, tests/mixed-patch-types: Update.
* Improve handling of LF vs. CRLF line endingsAndreas Gruenbacher2012-09-222-3/+33
| | | | | | | | | * src/patch.c (check_line_endings): New function. (main): When a hunk fails, report when the line endings differ between the input file and the patch. * src/pch.c (there_is_another_patch): When saying that we strip trailing CRs, also say how to turn this off. * tests/crlf-handling: Update changed messages. Add test case that fails.
* Ignore when preserving extended attributes is not supported or allowedAndreas Gruenbacher2012-09-222-6/+13
| | | | | * src/common.h (ENOTSUP): Make sure this error code is defined. * src/util.c (set_file_attributes): Ignore ENOSYS, ENOTSUP, and EPERM errors.
* Add --follow-symlinks option for backwards compatibilityAndreas Gruenbacher2012-09-193-1/+9
| | | | | | | | | * src/common.h (follow_symlinks): New variable. * src/patch.c (longopts): Add new --follow-symlinks option. (get_some_switches): Recognize the new option. * src/util.c (stat_file): Follow symlinks if requested. * patch.man: Document the new option. * tests/symlinks: Add test case.
* Introduce function to lstat all input filesAndreas Gruenbacher2012-09-195-21/+26
| | | | | | | | | | | * src/util.c (stat_file): New function. (move_file): Use here. * src/util.h (stat_file): Declare here. * src/inp.c (get_input_file): Use here. * src/patch.c (main): Use here. (delete_file_later): Use here. * src/pch.c (there_is_another_patch): Use here. (intuit_diff_type): Use here.
* Use stat where we want to follow symlinksAndreas Gruenbacher2012-09-191-3/+3
| | | | | * src/pch.c (prefix_components): Follow symlinks. (cwd_is_root): Follow symlinks.
* Fix file truncation when switching from git diff to non-git diffAndreas Gruenbacher2012-09-181-1/+5
| | | | | | | | * src/patch.c (main): Output queued output files only when switching from a git diff to a non-git diff. This can modify the input file, so make sure to stat() it again. * tests/concat-git-diff: Add test case growing a file with a git diff and then with a non-git diff; without this fix; the result would be truncated.
* Rename get_input_file() parameter to clarify codeAndreas Gruenbacher2012-09-181-5/+5
| | | | | * src/inp.c (get_input_file): Rename mode parameter to file_type, it's all we care about here.
* Improve error message when patching a file of different typeAndreas Gruenbacher2012-09-181-1/+1
| | | | | | * src/inp.c (get_input_file): Improve error message when patching a file of different type. * tests/symlinks: Update test case.
* Disable xattrs if libattr doesn't implement attr_copy_action()Andreas Gruenbacher2012-09-171-6/+0
| | | | | | | * m4/xattr.m4 (gl_FUNC_XATTR): Only enable USE_XATTR if both attr_copy_file() and attr_copy_action() are defined. * src/util.c (copy_attr_check): No fallback needed if attr_copy_action() is not defined.
* Allow to use potentially dangerous filenames from the root directoryAndreas Gruenbacher2012-09-171-0/+27
| | | | | | | | | * src/pch.c (cwd_is_root): New function to check if we are in the root directory of a filename. (name_is_valid): Allow to use potentially dangerous filenames when the current working directory is the root directory: from there, those names are not any more dangerous than other names. * tests/bad-filenames: New test case.
* Check if libattr implements attr_copy_action()Andreas Gruenbacher2012-09-141-0/+6
| | | | | | * m4/xattr.m4 (gl_FUNC_XATTR): Check if attr_copy_action() is defined. * src/util.c: If attr_copy_action() doesn't exist, fall back to the default copy_attr_file() behavior of copying most extended attributes except ACLs.
* Change the type of *_needs_removal from int to boolAndreas Gruenbacher2012-09-137-23/+23
|
* In a git-style diff, make sure not to unlink the original by accidentAndreas Gruenbacher2012-09-131-1/+2
| | | | | | | | * src/patch.c (main): Fail if a file is not empty as expected. (output_files): In a git-style diff, make sure not to unlink the original when making a backup of an unmodified file. * tests/create-delete: Fix failed-file-deletion test and add successful-file-deletion test.
* Do not pass file type in mode of open(..., O_CREAT, mode)Andreas Gruenbacher2012-09-131-1/+2
| | | | | | * src/patch.c (main): Strip file type off of create mode for temporary output files: some systems don't ignore the file type; we want to create a regular file even when patching a symlink.
View Lorry Controller Status