3 files changed, 38 insertions(+), 1 deletions(-)

M gnu/local.mk
A gnu/packages/patches/libgit2-use-after-free.patch
M gnu/packages/version-control.scm

@@ 687,6 687,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libevent-2.1-dns-tests.patch		\
   %D%/packages/patches/libevent-2.1-skip-failing-test.patch	\
   %D%/packages/patches/libextractor-ffmpeg-3.patch		\
+  %D%/packages/patches/libgit2-use-after-free.patch		\
   %D%/packages/patches/libjxr-fix-function-signature.patch	\
   %D%/packages/patches/libjxr-fix-typos.patch			\
   %D%/packages/patches/liboop-mips64-deplibs-fix.patch		\

@@ 0,0 1,24 @@
+This patch is taken from <https://github.com/libgit2/libgit2/pull/4122>;
+we need it to fix the use-after-free error in 'git_commit_extract_signature'
+reported at <https://github.com/libgit2/libgit2/issues/4118>.
+
+From ade0d9c658fdfc68d8046935f6908f033fe7a529 Mon Sep 17 00:00:00 2001
+From: Patrick Steinhardt <ps@pks.im>
+Date: Mon, 13 Feb 2017 13:46:17 +0100
+Subject: [PATCH 3/3] commit: avoid possible use-after-free
+
+diff --git a/src/commit.c b/src/commit.c
+index 89a4db1..05b70a9 100644
+--- a/src/commit.c
++++ b/src/commit.c
+@@ -766,8 +766,9 @@ int git_commit_extract_signature(git_buf *signature, git_buf *signed_data, git_r
+ 		if (git_buf_oom(signature))
+ 			goto oom;
+ 
++		error = git_buf_puts(signed_data, eol+1);
+ 		git_odb_object_free(obj);
+-		return git_buf_puts(signed_data, eol+1);
++		return error;
+ 	}
+ 
+ 	giterr_set(GITERR_OBJECT, "this commit is not signed");

@@ 342,13 342,25 @@ everything from small to very large projects with speed and efficiency.")
                (("/bin/cp") (which "cp"))
                (("/bin/rm") (which "rm")))
              #t))
+         (add-after 'unpack 'apply-patch
+           (lambda* (#:key inputs #:allow-other-keys)
+             ;; XXX: For some reason adding the patch in 'patches', which
+             ;; leads to a new tarball with all timestamps reset and ordering
+             ;; by name (slightly different file order compared to the
+             ;; original tarball) leads to an obscure Python error while
+             ;; running 'generate.py':
+             ;;   'Module' object has no attribute 'callbacks'
+             ;; Thus, apply the patch here, which minimizes disruption.
+             (let ((patch (assoc-ref inputs "patch")))
+               (zero? (system* "patch" "-p1" "--force" "--input" patch)))))
          ;; Run checks more verbosely.
          (replace 'check
            (lambda _ (zero? (system* "./libgit2_clar" "-v" "-Q")))))))
     (inputs
      `(("libssh2" ,libssh2)
        ("libcurl" ,curl)
-       ("python" ,python-wrapper)))
+       ("python" ,python-wrapper)
+       ("patch" ,(search-patch "libgit2-use-after-free.patch"))))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (propagated-inputs