Git 2.25.4

This merges up the security fix from v2.17.5.

Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>

diff --cc Documentation/RelNotes/2.25.4.txt
index 0000000000000000000000000000000000000000,0000000000000000000000000000000000000000..0dbb5daeec3edc6652d18e95cd15a9992dca53dc
new file mode 100644 (file)
--- /dev/null
--- /dev/null
+++ b/Documentation/RelNotes/2.25.4.txt
@@@ -1,0 -1,0 +1,5 @@@
++Git v2.25.4 Release Notes
++=========================
++
++This release merges the security fix that appears in v2.17.5; see
++the release notes for that version for details.

diff --cc GIT-VERSION-GEN
index 26fbde3f210b71d655078318a8ef0a2cb1210ab4,9e7b797dfd37e94f140e276e8dc42ccfac05806a..77217e089748f0b92a88bc6e64f5f741fa9be6b4
--- 1/GIT-VERSION-GEN
--- 2/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@@ -1,7 -1,7 +1,7 @@@
  #!/bin/sh
  
  GVF=GIT-VERSION-FILE
- DEF_VER=v2.25.3
 -DEF_VER=v2.24.3
++DEF_VER=v2.25.4
  
  LF='
  '

diff --cc RelNotes
index 96469c66f863b3b6b3f8f5717d4874c94baabb09,0b74eb5378b8e5ad30c10658e2cc6ae61a06e36b..f579f9f817f741268a49a6a22d640f50f235cb92
--- 1/RelNotes
--- 2/RelNotes
+++ b/RelNotes
@@@ -1,1 -1,1 +1,1 @@@
- Documentation/RelNotes/2.25.3.txt
 -Documentation/RelNotes/2.24.3.txt
++Documentation/RelNotes/2.25.4.txt

diff --cc fsck.c
index dc6f6ac3de193dec0854b8b2242de1544abd1de0,00077b107d7e0a22950cfead776071940285da25..73f30773f28acc06f4b9c04dda1e1a54b46c6930
--- 1/fsck.c
--- 2/fsck.c
+++ b/fsck.c
@@@ -911,10 -937,116 +912,104 @@@ done
        return ret;
  }
  
 -static int fsck_tag(struct tag *tag, const char *data,
 -      unsigned long size, struct fsck_options *options)
 -{
 -      struct object *tagged = tag->tagged;
 -
 -      if (!tagged)
 -              return report(options, &tag->object, FSCK_MSG_BAD_TAG_OBJECT, "could not load tagged object");
 -
 -      return fsck_tag_buffer(tag, data, size, options);
 -}
 -
+ /*
+  * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
+  * relying on the platform-dependent is_dir_sep helper.
+  *
+  * This is for use in checking whether a submodule URL is interpreted as
+  * relative to the current directory on any platform, since \ is a
+  * directory separator on Windows but not on other platforms.
+  */
+ static int starts_with_dot_slash(const char *str)
+ {
+       return str[0] == '.' && (str[1] == '/' || str[1] == '\\');
+ }
+ 
+ /*
+  * Like starts_with_dot_slash, this is a variant of submodule--helper's
+  * helper of the same name with the twist that it accepts backslash as a
+  * directory separator even on non-Windows platforms.
+  */
+ static int starts_with_dot_dot_slash(const char *str)
+ {
+       return str[0] == '.' && starts_with_dot_slash(str + 1);
+ }
+ 
+ static int submodule_url_is_relative(const char *url)
+ {
+       return starts_with_dot_slash(url) || starts_with_dot_dot_slash(url);
+ }
+ 
+ /*
+  * Count directory components that a relative submodule URL should chop
+  * from the remote_url it is to be resolved against.
+  *
+  * In other words, this counts "../" components at the start of a
+  * submodule URL.
+  *
+  * Returns the number of directory components to chop and writes a
+  * pointer to the next character of url after all leading "./" and
+  * "../" components to out.
+  */
+ static int count_leading_dotdots(const char *url, const char **out)
+ {
+       int result = 0;
+       while (1) {
+               if (starts_with_dot_dot_slash(url)) {
+                       result++;
+                       url += strlen("../");
+                       continue;
+               }
+               if (starts_with_dot_slash(url)) {
+                       url += strlen("./");
+                       continue;
+               }
+               *out = url;
+               return result;
+       }
+ }
+ /*
+  * Check whether a transport is implemented by git-remote-curl.
+  *
+  * If it is, returns 1 and writes the URL that would be passed to
+  * git-remote-curl to the "out" parameter.
+  *
+  * Otherwise, returns 0 and leaves "out" untouched.
+  *
+  * Examples:
+  *   http::https://example.com/repo.git -> 1, https://example.com/repo.git
+  *   https://example.com/repo.git -> 1, https://example.com/repo.git
+  *   git://example.com/repo.git -> 0
+  *
+  * This is for use in checking for previously exploitable bugs that
+  * required a submodule URL to be passed to git-remote-curl.
+  */
+ static int url_to_curl_url(const char *url, const char **out)
+ {
+       /*
+        * We don't need to check for case-aliases, "http.exe", and so
+        * on because in the default configuration, is_transport_allowed
+        * prevents URLs with those schemes from being cloned
+        * automatically.
+        */
+       if (skip_prefix(url, "http::", out) ||
+           skip_prefix(url, "https::", out) ||
+           skip_prefix(url, "ftp::", out) ||
+           skip_prefix(url, "ftps::", out))
+               return 1;
+       if (starts_with(url, "http://") ||
+           starts_with(url, "https://") ||
+           starts_with(url, "ftp://") ||
+           starts_with(url, "ftps://")) {
+               *out = url;
+               return 1;
+       }
+       return 0;
+ }
+ 
  static int check_submodule_url(const char *url)
  {
-       struct credential c = CREDENTIAL_INIT;
-       int ret;
+       const char *curl_url;
  
        if (looks_like_command_line_option(url))
                return -1;

diff --cc http.c
Simple merge