From e6919e604a8f07cd83693db3d5fe93257c47c591 Mon Sep 17 00:00:00 2001 From: Martin Afanasjew Date: Thu, 7 Apr 2016 22:09:14 +0200 Subject: [PATCH] scm/git: prevent exec bomb with 'env :userpaths' Using `git` from `Formula#install` can cause an exec bomb if used in a formula with `env :userpaths` because that causes both `Library/ENV/4.3` and `Library/ENV/scm` to be in PATH, both of which contain a `git` binary that is the same SCM wrapper. Those will mutually exec each other indefinitely as they fail to detect that they are the same wrapper. Extend the exec-bomb protection to check the paths after all symbolic links have been expanded to prevent this situation. Fixes #43. Fixes Homebrew/homebrew-core#133. --- Library/ENV/scm/git | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Library/ENV/scm/git b/Library/ENV/scm/git index 05148339a9500..1e74a175dc883 100755 --- a/Library/ENV/scm/git +++ b/Library/ENV/scm/git @@ -13,13 +13,16 @@ exec "$HOMEBREW_RUBY_PATH" -x "$0" "$@" # This script because we support $GIT, $HOMEBREW_SVN, etc., Xcode-only and # no Xcode/CLT configurations. Order is careful to be what the user would want. +require "pathname" + +SELF_REAL = Pathname.new(__FILE__).realpath F = File.basename(__FILE__).freeze D = File.expand_path(File.dirname(__FILE__)).freeze def exec(*args) # prevent fork-bombs arg0 = args.first - return if arg0 =~ /^#{F}/i || File.expand_path(arg0) == File.expand_path(__FILE__) + return if arg0 =~ /^#{F}/i || Pathname.new(arg0).realpath == SELF_REAL super end