From 2667a732bcb0d292d9cd57606a179fdd0ba97591 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Grubbstr=C3=B6m=20=28Grubba=29?= <grubba@grubba.org> Date: Mon, 26 Oct 2020 14:47:57 +0100 Subject: [PATCH] Created new patch 2020-10-26T144755 on branch 8.0. Pike 8.0: Fix race-condition in Concurrent.Promise From commit 390d6181d989365f3ed1dd1c7a7d0daa2ef56877 to commit 30dcc4ac544c71544191678bf6a42ad2dbc62753. --- .../patches/2020-10-26T144755/metadata.txt | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 refs/heads/8.0/patches/2020-10-26T144755/metadata.txt diff --git a/refs/heads/8.0/patches/2020-10-26T144755/metadata.txt b/refs/heads/8.0/patches/2020-10-26T144755/metadata.txt new file mode 100644 index 0000000000..d0574cf62c --- /dev/null +++ b/refs/heads/8.0/patches/2020-10-26T144755/metadata.txt @@ -0,0 +1,20 @@ +subject: Pike 8.0: Fix race-condition in Concurrent.Promise +from: 390d6181d989365f3ed1dd1c7a7d0daa2ef56877 +to: 30dcc4ac544c71544191678bf6a42ad2dbc62753 +originator: Henrik Grubbström (Grubba) <grubba@grubba.org> +depends: 2020-08-28T110259 +restart: true + +Multiple fixes: + +• Concurrent.Promise: Fixed race-condition in finalise(). + +The API for finalise() raced with on_{success,failure}(), as +new callbacks could get registered after finalise() was called, +but before the state was updated. + +Fixes #10055. + +• Tools.Standalone.httpserver: Fix directory traversal vulnerability + +Thanks to Chris Angelico <rosuav@gmail.com> for the report. -- GitLab