CVS commit: pkgsrc/devel/libgit2

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sat Dec  1 20:18:18 UTC 2018

Modified Files:
        pkgsrc/devel/libgit2: Makefile distinfo

Log Message:
libgit2: update to 0.27.7.

v0.27.7
-------

This is a bugfix release with the following changes or improvements:

- Our continuous integration environment has switched from Travis and
  AppVeyor to Azure Pipelines CI.

- Fix adding worktrees for bare repositories.

- Fix parsed patches not computing the old respectively new line
  numbers correctly.

- Fix parsing configuration variables which do not have a section.

- Fix a zero-byte allocation when trying to detect file renames and
  copies of a diff without any hunks.

- Fix a zero-byte allocation when trying to resize or duplicate
  vectors.

- Fix return value when trying to unlock worktrees which aren't
  locked.

- Fix returning an unitialized error code when preparing a revision
  walk without any pushed commits.

- Fix return value of `git_remote_lookup` when lookup of
  "remote.$remote.tagopt" fails.

- Fix the revision walk always labelling commits as interesting due
  to a mishandling of the commit date.

- Fix the packbuilder inserting uninteresting blobs when adding a
  tree containing references to such blobs.

- Ignore unsupported authentication schemes in HTTP transport.

- Improve performane of `git_remote_prune`.

- Fix detection of whether `qsort_r` has a BSD or GNU function
  signature.

- Fix detection of iconv if it is provided by libc.

v0.27.6
-------

This as a security release fixing the following list of issues:

- The function family `git__strtol` is used to parse integers
  from a buffer. As the functions do not take a buffer length as
  argument, they will scan either until the end of the current
  number or until a NUL byte is encountered. Many callers have
  been misusing the function and called it on potentially
  non-NUL-terminated buffers, resulting in possible out-of-bounds
  reads. Callers have been fixed to use `git__strntol` functions
  instead and `git__strtol` functions were removed.

- The function `git__strntol64` relied on the undefined behavior
  of signed integer overflows. While the code tried to detect
  such overflows after they have happened, this is unspecified
  behavior and may lead to weird behavior on uncommon platforms.

- In the case where `git__strntol32` was unable to parse an
  integer because it doesn't fit into an `int32_t`, it printed an
  error message containing the string that is currently being
  parsed. The code didn't truncate the string though, which
  caused it to print the complete string until a NUL byte is
  encountered and not only the currently parsed number. In case
  where the string was not NUL terminated, this could have lead
  to an out-of-bounds read.

- When parsing tags, all unknown fields that appear before the
  tag message are skipped. This skipping is done by using a plain
  `strstr(buffer, "\n\n")` to search for the two newlines that
  separate tag fields from tag message. As it is not possible to
  supply a buffer length to `strstr`, this call may skip over the
  buffer's end and thus result in an out of bounds read. As
  `strstr` may return a pointer that is out of bounds, the
  following computation of `buffer_end - buffer` will overflow
  and result in an allocation of an invalid length. Note that
  when reading objects from the object database, we make sure to
  always NUL terminate them, making the use of `strstr` safe.

- When parsing the "encoding" field of a commit, we may perform
  an out of bounds read due to using `git__prefixcmp` instead of
  `git__prefixncmp`. This can result in the parsed commit object
  containing uninitialized data in both its message encoding and
  message fields. Note that when reading objects from the object
  database, we make sure to always NUL terminate them, making the
  use of `strstr` safe.


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/devel/libgit2/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/devel/libgit2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libgit2/Makefile
diff -u pkgsrc/devel/libgit2/Makefile:1.30 pkgsrc/devel/libgit2/Makefile:1.31
--- pkgsrc/devel/libgit2/Makefile:1.30  Fri Oct 19 12:29:57 2018
+++ pkgsrc/devel/libgit2/Makefile       Sat Dec  1 20:18:18 2018
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2018/10/19 12:29:57 ryoon Exp $
+# $NetBSD: Makefile,v 1.31 2018/12/01 20:18:18 wiz Exp $
 
-DISTNAME=      libgit2-0.27.5
+DISTNAME=      libgit2-0.27.7
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libgit2/distinfo
diff -u pkgsrc/devel/libgit2/distinfo:1.14 pkgsrc/devel/libgit2/distinfo:1.15
--- pkgsrc/devel/libgit2/distinfo:1.14  Thu Oct 18 14:43:01 2018
+++ pkgsrc/devel/libgit2/distinfo       Sat Dec  1 20:18:18 2018
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.14 2018/10/18 14:43:01 taca Exp $
+$NetBSD: distinfo,v 1.15 2018/12/01 20:18:18 wiz Exp $
 
-SHA1 (libgit2-0.27.5.tar.gz) = dc339e9dd54316bd44b2769b52d5e30943e90dcf
-RMD160 (libgit2-0.27.5.tar.gz) = 864a350940288b3bdbdc90601cb24aed46ce7cbe
-SHA512 (libgit2-0.27.5.tar.gz) = 318b981456d55f60f8aa1897f1f70274329e48f09769b661eb4bbe76399071eca0fbc7deacb3191db16bc89dba8cc69a64adaf8cbc65e34a65b6e72ca122e21f
-Size (libgit2-0.27.5.tar.gz) = 4775158 bytes
+SHA1 (libgit2-0.27.7.tar.gz) = 1898564266b4672ac3a1e98e9ce5a57bd1cd48c0
+RMD160 (libgit2-0.27.7.tar.gz) = fba3719288325573fcbce5d11b560d5cac4b2b89
+SHA512 (libgit2-0.27.7.tar.gz) = de2e266939bd40bc580603539e1156906b97299523336ddc6a66c3bec26729495bef2daa2d240b83b7e011e93852381e95a4407132b0440a5aa1e1b7642c0011
+Size (libgit2-0.27.7.tar.gz) = 4782856 bytes