Version in base suite: 2.8-2

Base version: patch_2.8-2
Target version: patch_2.8-2+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/patch/patch_2.8-2.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/p/patch/patch_2.8-2+deb13u1.dsc

 changelog                     |    7 ++
 patches/CVE-2026-115207.patch |   99 ++++++++++++++++++++++++++++++++++++++++++
 patches/series                |    1 
 3 files changed, 107 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj6cd0jiq/patch_2.8-2.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj6cd0jiq/patch_2.8-2+deb13u1.dsc: no acceptable signature found
diff -Nru patch-2.8/debian/changelog patch-2.8/debian/changelog
--- patch-2.8/debian/changelog	2025-06-13 18:59:38.000000000 +0000
+++ patch-2.8/debian/changelog	2026-10-29 16:22:30.000000000 +0000
@@ -1,3 +1,10 @@
+patch (2.8-2+deb13u1) trixie; urgency=medium
+
+  * Backport upstream fix for CVE-2026-115207: prevent creation of out-of-tree
+    files.
+
+ -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 29 Oct 2026 17:22:30 +0100
+
 patch (2.8-2) unstable; urgency=medium
 
   [ Samuel Thibault <sthibault@debian.org> ]
diff -Nru patch-2.8/debian/patches/CVE-2026-115207.patch patch-2.8/debian/patches/CVE-2026-115207.patch
--- patch-2.8/debian/patches/CVE-2026-115207.patch	1970-01-01 00:00:00.000000000 +0000
+++ patch-2.8/debian/patches/CVE-2026-115207.patch	2026-10-29 16:22:01.000000000 +0000
@@ -0,0 +1,99 @@
+commit 0cd45bb2132a42cd38d84b20661f3eae9b4da7ce
+Author: Andreas Gruenbacher <andreas.gruenbacher@gmail.com>
+Date:   Wed Oct 21 16:49:38 2026 +0200
+
+    Prevent creation of out-of-tree files (CVE-2026-115207)
+    
+    When reverse-applying a patch that deletes a file, patch created that
+    file without checking if the pathname is safe.  Fix that by adding the
+    missing check.
+    * src/pch.c (intuit_diff_type): Add the missing check.
+    * tests/create-delete: Add two new tests.
+    * tests/bad-filenames: This changes the output of these tests.
+
+diff --git a/src/pch.c b/src/pch.c
+index a65322c..64ce72f 100644
+--- a/src/pch.c
++++ b/src/pch.c
+@@ -956,6 +956,7 @@ intuit_diff_type (bool need_header, mode_t *p_file_type)
+ 	      }
+ 
+ 	    if (i0 != NONE
++		&& name_is_valid (p_name[i0])
+ 		&& (i == NONE || (st[i].st_mode & S_IFMT) == file_type)
+ 		&& maybe_reverse (p_name[i == NONE ? i0 : i], i == NONE,
+ 				  i == NONE || st[i].st_size == 0)
+diff --git a/tests/bad-filenames b/tests/bad-filenames
+index 2515f0a..ae6ba13 100644
+--- a/tests/bad-filenames
++++ b/tests/bad-filenames
+@@ -104,6 +104,7 @@ cat > d.diff <<EOF
+ EOF
+ 
+ check 'patch -f -p0 --dry-run < d.diff || echo status: $?' <<EOF
++Ignoring potentially dangerous file name ../g
+ can't find file to patch at input line 3
+ Perhaps you used the wrong -p or --strip option?
+ The text leading up to this was:
+@@ -118,6 +119,7 @@ EOF
+ 
+ echo 1 > f
+ check 'patch -f -p0 --dry-run < d.diff || echo status: $?' <<EOF
++Ignoring potentially dangerous file name ../g
+ checking file f
+ EOF
+ 
+diff --git a/tests/create-delete b/tests/create-delete
+index adcce27..8edeb67 100644
+--- a/tests/create-delete
++++ b/tests/create-delete
+@@ -295,3 +295,49 @@ EOF
+ check 'cat target.orig' <<EOF
+ data
+ EOF
++
++# ================================================================
++# CVE-2026-XXXXX: Reverse-applying a patch should not create
++# out-of-tree files.
++
++cat > p.diff <<EOF
++--- ../invalid
+++++ ../invalid
++@@ -1 +0,0 @@
++-data
++EOF
++
++check 'patch -p0 -t < p.diff || echo status: $?' <<EOF
++Ignoring potentially dangerous file name ../invalid
++can't find file to patch at input line 3
++Perhaps you used the wrong -p or --strip option?
++The text leading up to this was:
++--------------------------
++|--- ../invalid
++|+++ ../invalid
++--------------------------
++No file to patch.  Skipping patch.
++1 out of 1 hunk ignored
++status: 1
++EOF
++
++cat > p.diff <<EOF
++--- $PWD/invalid	2025-01-01 12:00:00.000000000 +0000
+++++ $PWD/invalid	1970-01-01 00:00:00.000000000 +0000
++@@ -1 +0,0 @@
++-data
++EOF
++
++check 'patch -p0 -t < p.diff || echo status: $?' <<EOF
++Ignoring potentially dangerous file name $PWD/invalid
++can't find file to patch at input line 3
++Perhaps you used the wrong -p or --strip option?
++The text leading up to this was:
++--------------------------
++|--- $PWD/invalid	2025-01-01 12:00:00.000000000 +0000
++|+++ $PWD/invalid	1970-01-01 00:00:00.000000000 +0000
++--------------------------
++No file to patch.  Skipping patch.
++1 out of 1 hunk ignored
++status: 1
++EOF
diff -Nru patch-2.8/debian/patches/series patch-2.8/debian/patches/series
--- patch-2.8/debian/patches/series	2025-06-12 22:38:08.000000000 +0000
+++ patch-2.8/debian/patches/series	2026-10-29 16:22:30.000000000 +0000
@@ -2,3 +2,4 @@
 add_some_missing_filename_quoting.patch
 reject_empty_filenames.patch
 skip_read-only_check_when_output_file_specified.patch
+CVE-2026-115207.patch