commit mercurial

Hello community, here is the log from the commit of package mercurial checked in at Fri Jul 11 23:08:27 CEST 2008. -------- --- mercurial/mercurial.changes 2008-06-10 16:17:34.000000000 +0200 +++ mercurial/mercurial.changes 2008-06-30 14:10:00.000000000 +0200 @@ -1,0 +2,5 @@ +Mon Jun 30 14:09:37 CEST 2008 - tiwai@suse.de + +- VUL-0: mercurial: Insufficient input validation (bnc#404959) + +------------------------------------------------------------------- New: ---- mercurial-git-patch-root-fix.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mercurial.spec ++++++ --- /var/tmp/diff_new_pack.ws4057/_old 2008-07-11 23:07:19.000000000 +0200 +++ /var/tmp/diff_new_pack.ws4057/_new 2008-07-11 23:07:19.000000000 +0200 @@ -15,7 +15,7 @@ BuildRequires: asciidoc fdupes python-devel sgml-skel xmlto Summary: Scalable Distributed SCM Version: 1.0.1 -Release: 1 +Release: 15 License: GPL v2 or later Group: Development/Tools/Version Control BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -23,6 +23,7 @@ Source: %{name}-%{version}.tar.bz2 Source1: hgrc Patch: mercurial-hgk-path-fix.diff +Patch1: mercurial-git-patch-root-fix.diff # require rcs for 3-way "merge" command. Requires: rcs %py_requires @@ -44,6 +45,7 @@ # sed -e s"/^version = ''$/version = '"%{version}"'/" setup.py > foo.py # mv foo.py setup.py %patch +%patch1 -p1 %build python setup.py build_ext -i @@ -96,6 +98,8 @@ %{_datadir}/xemacs %changelog +* Mon Jun 30 2008 tiwai@suse.de +- VUL-0: mercurial: Insufficient input validation (bnc#404959) * Tue Jun 10 2008 tiwai@suse.de - updated to version 1.0.1: General: ++++++ mercurial-git-patch-root-fix.diff ++++++ # HG changeset patch # User Brendan Cully # Date 1214428400 25200 # Node ID 87c704ac92d42f7e16b24593f56a0d33ffc8fd20 # Parent 55c71226eceb05379f60a6b51830151198a83c59 Check that git patches only touch files under root diff -r 55c71226eceb -r 87c704ac92d4 mercurial/patch.py --- a/mercurial/patch.py Thu Jun 26 18:44:54 2008 -0500 +++ b/mercurial/patch.py Wed Jun 25 14:13:20 2008 -0700 @@ -1039,9 +1039,12 @@ continue elif state == 'git': gitpatches = values + cwd = os.getcwd() for gp in gitpatches: if gp.op in ('COPY', 'RENAME'): - copyfile(gp.oldpath, gp.path) + src, dst = [util.canonpath(cwd, cwd, x) + for x in [gp.oldpath, gp.path]] + copyfile(src, dst) changed[gp.path] = (gp.op, gp) else: raise util.Abort(_('unsupported parser state: %s') % state) diff -r 55c71226eceb -r 87c704ac92d4 tests/test-import --- a/tests/test-import Thu Jun 26 18:44:54 2008 -0500 +++ b/tests/test-import Wed Jun 25 14:13:20 2008 -0700 @@ -261,3 +261,15 @@ hg status cat a cd .. + +echo % 'test paths outside repo root' +mkdir outside +touch outside/foo +hg init inside +cd inside +hg import - <