Blame SOURCES/git-cve-2018-17456-arbitrary-execution-fsck.patch

4e7677
diff -ruN git-2.9.3/fsck.c git-2.9.3_patched/fsck.c
4e7677
--- git-2.9.3/fsck.c	2018-10-29 17:34:24.023464636 +0100
4e7677
+++ git-2.9.3_patched/fsck.c	2018-10-29 17:37:41.345363601 +0100
4e7677
@@ -94,7 +94,9 @@
4e7677
 	FUNC(GITMODULES_BLOB, ERROR) \
4e7677
 	FUNC(GITMODULES_PARSE, ERROR) \
4e7677
 	FUNC(GITMODULES_NAME, ERROR) \
4e7677
+	FUNC(GITMODULES_PATH, ERROR) \
4e7677
 	FUNC(GITMODULES_SYMLINK, ERROR) \
4e7677
+	FUNC(GITMODULES_URL, ERROR) \
4e7677
 	/* warnings */ \
4e7677
 	FUNC(BAD_FILEMODE, WARN) \
4e7677
 	FUNC(EMPTY_NAME, WARN) \
4e7677
@@ -872,6 +874,20 @@
4e7677
 				    FSCK_MSG_GITMODULES_NAME,
4e7677
 				    "disallowed submodule name: %s",
4e7677
 				    name);
4e7677
+
4e7677
+	if (!strcmp(key, "path") && value &&
4e7677
+	    looks_like_command_line_option(value))
4e7677
+		data->ret |= report(data->options, data->obj,
4e7677
+				    FSCK_MSG_GITMODULES_PATH,
4e7677
+				    "disallowed submodule path: %s",
4e7677
+				    value);
4e7677
+
4e7677
+	if (!strcmp(key, "url") && value &&
4e7677
+	    looks_like_command_line_option(value))
4e7677
+		data->ret |= report(data->options, data->obj,
4e7677
+				    FSCK_MSG_GITMODULES_URL,
4e7677
+				    "disallowed submodule url: %s",
4e7677
+				    value);
4e7677
 	free(name);
4e7677
 
4e7677
 	return 0;