Re: [ANNOUNCE] GIT 1.1.5
- From
- Eric Sandall <eric@sandall.us>
- Date
- Jan 31, 2006, 17:38 UTC
- Message-ID
- <Pine.LNX.4.63.0601310937490.29839@cerberus>
- In-Reply-To
- <7virs5x8im.fsf@assigned-by-dhcp.cox.net>
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Fri, 27 Jan 2006, Junio C Hamano wrote:
Show 24 quoted lines
> The latest maintenance release GIT 1.1.5 is available at the
> usual places:
>
> http://www.kernel.org/pub/software/scm/git/
>
> git-1.1.5.tar.{gz,bz2} (tarball)
> RPMS/$arch/git-*-1.1.5-1.$arch.rpm (RPM)
>
> Mark Wooding noticed that there is a bug in git-checkout-index
> to overflow its internal buffer, if you construct a blob that
> records an insanely long symbolic link in your index file and
> try to check it out. This makes it dump core or worse.
>
> The fix for this problem is the only change from v1.1.4. The
> master branch has been updated with the same fix (so has "pu").
>
>
> ---
>
> By the way, "dump core or worse" is a subtle way to say that
> this is a security fix. To be victimized, you have to somehow
> first get such a bogus symbolic link in your index. Merging
> with somebody of dubious trustworthiness is a way to do so;
> please practice safe merge ;-).I've updated the Source Mage GNU/Linux package, thanks!
- -sandalle
- -- Eric Sandall | Source Mage GNU/Linux Developer eric@sandall.us | http://www.sourcemage.org/ http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU http://counter.li.org/ #196285 | http://www.shock.wsu.edu/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFD36CPHXt9dKjv3WERAhpUAKCXdVE+RgUUEY2BGl2jf0Bicdo7lgCgu/PJ yfRqXjYEzA8etWJBWQ+fK7E= =4UVq -----END PGP SIGNATURE-----