Pullup ticket #4953 - requested by sevan

devel/git-base: security fix

Revisions pulled up:
- devel/git-base/Makefile                                       1.22-1.23
- devel/git-base/PLIST                                          1.11-1.12
- devel/git-base/distinfo                                       1.42-1.46
- devel/git-base/patches/patch-builtin_pack-objects.c           1.1
- devel/git-base/patches/patch-builtin_rev-list.c               1.1
- devel/git-base/patches/patch-http-push.c                      1.1
- devel/git-base/patches/patch-list-objects.c                   1.1
- devel/git-base/patches/patch-list-objects.h                   1.1
- devel/git-base/patches/patch-pack-bitmap-write.c              1.1
- devel/git-base/patches/patch-pack-bitmap.c                    1.1
- devel/git-base/patches/patch-reachable.c                      1.1
- devel/git-base/patches/patch-revision.c                       1.1
- devel/git-base/patches/patch-revision.h                       1.1
- devel/git/Makefile.version                                    1.36-1.39

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Fri Jan  8 17:37:20 UTC 2016

   Modified Files:
           pkgsrc/devel/git: Makefile.version
           pkgsrc/devel/git-base: PLIST distinfo

   Log Message:
   Changes 2.7.0:
   UI, Workflows & Features

   * The appearance of "gitk", particularly on high DPI monitors, have
     been improved.  "gitk" also comes with an undated translation for
     Swedish and Japanese.

   * "git remote" learned "get-url" subcommand to show the URL for a
     given remote name used for fetching and pushing.

   * There was no way to defeat a configured rebase.autostash variable
     from the command line, as "git rebase --no-autostash" was missing.

   * "git log --date=local" used to only show the normal (default)
     format in the local timezone.  The command learned to take 'local'
     as an instruction to use the local timezone with other formats,

   * The refs used during a "git bisect" session is now per-worktree so
     that independent bisect sessions can be done in different worktrees
     created with "git worktree add".

   * Users who are too busy to type three extra keystrokes to ask for
     "git stash show -p" can now set stash.showPatch configuration
     variable to true to always see the actual patch, not just the list
     of paths affected with feel for the extent of damage via diffstat.

   * "quiltimport" allows to specify the series file by honoring the
     $QUILT_SERIES environment and also --series command line option.

   * The use of 'good/bad' in "git bisect" made it confusing to use when
     hunting for a state change that is not a regression (e.g. bugfix).
     The command learned 'old/new' and then allows the end user to
     say e.g. "bisect start --term-old=fast --term-new=slow" to find a
     performance regression.

   * "git interpret-trailers" can now run outside of a Git repository.

   * "git p4" learned to reencode the pathname it uses to communicate
     with the p4 depot with a new option.

   * Give progress meter to "git filter-branch".

   * Allow a later "!/abc/def" to override an earlier "/abc" that
     appears in the same .gitignore file to make it easier to express
     "everything in /abc directory is ignored, except for ...".

   * Teach "git p4" to send large blobs outside the repository by
     talking to Git LFS.

   * Prepare for Git on-disk repository representation to undergo
     backward incompatible changes by introducing a new repository
     format version "1", with an extension mechanism.

   * "git worktree" learned a "list" subcommand.

   * "git clone --dissociate" learned that it can be used even when
     "--reference" was not used at the same time.

   * "git blame" learnt to take "--first-parent" and "--reverse" at the
     same time when it makes sense.

   * "git checkout" did not follow the usual "--[no-]progress"
     convention and implemented only "--quiet" that is essentially
     a superset of "--no-progress".  Extend the command to support the
     usual "--[no-]progress".

   * The semantics of transfer.hideRefs configuration variable have been
     extended to work better with the ref "namespace" feature that lets
     you throw unrelated bunches of repositories in a single physical
     repository and virtually serve them as separate ones.

   * send-email config variables whose values are pathnames now go
     through the ~username/ expansion.

   * bash completion learnt to TAB-complete recipient addresses given
     to send-email.

   * The credential-cache daemon can be told to ignore SIGHUP to work
     around issue when running Git from inside emacs.

   * "git push" learned new configuration for doing "--recurse-submodules"
     on each push.

   * "format-patch" has learned a new option to zero-out the commit
     object name on the mbox "From " line.

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Sun Feb  7 10:27:23 UTC 2016

   Modified Files:
           pkgsrc/devel/git: Makefile.version
           pkgsrc/devel/git-base: PLIST distinfo

   Log Message:
   Git v2.7.1 Release Notes
   ========================

   Fixes since v2.7
   ----------------

    * An earlier change in 2.5.x-era broke users' hooks and aliases by
      exporting GIT_WORK_TREE to point at the root of the working tree,
      interfering when they tried to use a different working tree without
      setting GIT_WORK_TREE environment themselves.

    * The "exclude_list" structure has the usual "alloc, nr" pair of
      fields to be used by ALLOC_GROW(), but clear_exclude_list() forgot
      to reset 'alloc' to 0 when it cleared 'nr' to discard the managed
      array.

    * "git send-email" was confused by escaped quotes stored in the alias
      files saved by "mutt", which has been corrected.

    * A few unportable C construct have been spotted by clang compiler
      and have been fixed.

    * The documentation has been updated to hint the connection between
      the '--signoff' option and DCO.

    * "git reflog" incorrectly assumed that all objects that used to be
      at the tip of a ref must be commits, which caused it to segfault.

    * The ignore mechanism saw a few regressions around untracked file
      listing and sparse checkout selection areas in 2.7.0; the change
      that is responsible for the regression has been reverted.

    * Some codepaths used fopen(3) when opening a fixed path in $GIT_DIR
      (e.g. COMMIT_EDITMSG) that is meant to be left after the command is
      done.  This however did not work well if the repository is set to
      be shared with core.sharedRepository and the umask of the previous
      user is tighter.  They have been made to work better by calling
      unlink(2) and retrying after fopen(3) fails with EPERM.

    * Asking gitweb for a nonexistent commit left a warning in the server
      log.

    * "git rebase", unlike all other callers of "gc --auto", did not
      ignore the exit code from "gc --auto".

    * Many codepaths that run "gc --auto" before exiting kept packfiles
      mapped and left the file descriptors to them open, which was not
      friendly to systems that cannot remove files that are open.  They
      now close the packs before doing so.

    * A recent optimization to filter-branch in v2.7.0 introduced a
      regression when --prune-empty filter is used, which has been
      corrected.

    * The description for SANITY prerequisite the test suite uses has
      been clarified both in the comment and in the implementation.

    * "git tag" started listing a tag "foo" as "tags/foo" when a branch
      named "foo" exists in the same repository; remove this unnecessary
      disambiguation, which is a regression introduced in v2.7.0.

    * The way "git svn" uses auth parameter was broken by Subversion
      1.9.0 and later.

    * The "split" subcommand of "git subtree" (in contrib/) incorrectly
      skipped merges when it shouldn't, which was corrected.

    * A few options of "git diff" did not work well when the command was
      run from a subdirectory.

    * dirname() emulation has been added, as Msys2 lacks it.

    * The underlying machinery used by "ls-files -o" and other commands
      have been taught not to create empty submodule ref cache for a
      directory that is not a submodule.  This removes a ton of wasted
      CPU cycles.

    * Drop a few old "todo" items by deciding that the change one of them
      suggests is not such a good idea, and doing the change the other
      one suggested to do.

    * Documentation for "git fetch --depth" has been updated for clarity.

    * The command line completion learned a handful of additional options
      and command specific syntax.

   Also includes a handful of documentation and test updates.

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Mon Feb 29 10:50:55 UTC 2016

   Modified Files:
           pkgsrc/devel/git: Makefile.version
           pkgsrc/devel/git-base: distinfo

   Log Message:
   Changes 2.7.2:
   * The low-level merge machinery has been taught to use CRLF line
     termination when inserting conflict markers to merged contents that
     are themselves CRLF line-terminated.
   * "git worktree" had a broken code that attempted to auto-fix
     possible inconsistency that results from end-users moving a
     worktree to different places without telling Git (the original
     repository needs to maintain backpointers to its worktrees, but
     "mv" run by end-users who are not familiar with that fact will
     obviously not adjust them), which actually made things worse
     when triggered.
   * "git push --force-with-lease" has been taught to report if the push
     needed to force (or fast-forwarded).
   * The emulated "yes" command used in our test scripts has been
     tweaked not to spend too much time generating unnecessary output
     that is not used, to help those who test on Windows where it would
     not stop until it fills the pipe buffer due to lack of SIGPIPE.
   * The vimdiff backend for "git mergetool" has been tweaked to arrange
     and number buffers in the order that would match the expectation of
     majority of people who read left to right, then top down and assign
     buffers 1 2 3 4 "mentally" to local base remote merge windows based
     on that order.
   * The documentation for "git clean" has been corrected; it mentioned
     that .git/modules/* are removed by giving two "-f", which has never
     been the case.
   * Paths that have been told the index about with "add -N" are not
     quite yet in the index, but a few commands behaved as if they
     already are in a harmful way.

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Sat Mar 12 11:33:32 UTC 2016

   Modified Files:
           pkgsrc/devel/git: Makefile.version
           pkgsrc/devel/git-base: Makefile distinfo

   Log Message:
   Changes 2.7.3:

   * Traditionally, the tests that try commands that work on the
     contents in the working tree were named with "worktree" in their
     filenames, but with the recent addition of "git worktree"
     subcommand, whose tests are also named similarly, it has become
     harder to tell them apart.  The traditional tests have been renamed
     to use "work-tree" instead in an attempt to differentiate them.

   * Many codepaths forget to check return value from git_config_set();
     the function is made to die() to make sure we do not proceed when
     setting a configuration variable failed.

   * Handling of errors while writing into our internal asynchronous
     process has been made more robust, which reduces flakiness in our
     tests.

   * "git show 'HEAD:Foo[BAR]Baz'" did not interpret the argument as a
     rev, i.e. the object named by the the pathname with wildcard
     characters in a tree object.

   * "git rev-parse --git-common-dir" used in the worktree feature
     misbehaved when run from a subdirectory.

   * The "v(iew)" subcommand of the interactive "git am -i" command was
     broken in 2.6.0 timeframe when the command was rewritten in C.

   * "git merge-tree" used to mishandle "both sides added" conflict with
     its own "create a fake ancestor file that has the common parts of
     what both sides have added and do a 3-way merge" logic; this has
     been updated to use the usual "3-way merge with an empty blob as
     the fake common ancestor file" approach used in the rest of the
     system.

   * The memory ownership rule of fill_textconv() API, which was a bit
     tricky, has been documented a bit better.

   * The documentation did not clearly state that the 'simple' mode is
     now the default for "git push" when push.default configuration is
     not set.

   * Recent versions of GNU grep are pickier when their input contains
     arbitrary binary data, which some of our tests uses.  Rewrite the
     tests to sidestep the problem.

   * A helper function "git submodule" uses since v2.7.0 to list the
     modules that match the pathspec argument given to its subcommands
     (e.g. "submodule add <repo> <path>") has been fixed.

   * "git config section.var value" to set a value in per-repository
     configuration file failed when it was run outside any repository,
     but didn't say the reason correctly.

   * The code to read the pack data using the offsets stored in the pack
     idx file has been made more carefully check the validity of the
     data in the idx.

---
   Module Name:    pkgsrc
   Committed By:   sevan
   Date:           Wed Mar 16 19:38:52 UTC 2016

   Modified Files:
           pkgsrc/devel/git-base: Makefile distinfo
   Added Files:
           pkgsrc/devel/git-base/patches: patch-builtin_pack-objects.c
               patch-builtin_rev-list.c patch-http-push.c patch-list-objects.c
               patch-list-objects.h patch-pack-bitmap-write.c patch-pack-bitmap.c
               patch-reachable.c patch-revision.c patch-revision.h

   Log Message:
   Patch for CVE-2016-2324
    Obtained via Debian Security Tracker
    https://security-tracker.debian.org/tracker/CVE-2016-2324
    https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
   Bump pkgrev

13 files changed, 519 insertions, 8 deletions

diff --git a/devel/git-base/PLIST b/devel/git-base/PLIST
index f3380e408e4..26b25a06c80 100644
--- a/devel/git-base/PLIST
+++ b/devel/git-base/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.10 2015/07/31 12:57:23 adam Exp $
+@comment $NetBSD: PLIST,v 1.10.4.1 2016/03/22 18:55:23 bsiegert Exp $
 bin/git
 bin/git-cvsserver
 bin/git-receive-pack
@@ -149,6 +149,7 @@ libexec/git-core/git-stash
 libexec/git-core/git-status
 libexec/git-core/git-stripspace
 libexec/git-core/git-submodule
+libexec/git-core/git-submodule--helper
 libexec/git-core/git-svn
 libexec/git-core/git-symbolic-ref
 libexec/git-core/git-tag
@@ -210,6 +211,7 @@ share/locale/de/LC_MESSAGES/git.mo
 share/locale/fr/LC_MESSAGES/git.mo
 share/locale/is/LC_MESSAGES/git.mo
 share/locale/it/LC_MESSAGES/git.mo
+share/locale/ko/LC_MESSAGES/git.mo
 share/locale/pt_PT/LC_MESSAGES/git.mo
 share/locale/ru/LC_MESSAGES/git.mo
 share/locale/sv/LC_MESSAGES/git.mo
diff --git a/devel/git-base/distinfo b/devel/git-base/distinfo
index 6b1c7c1fe62..aa09672de57 100644
--- a/devel/git-base/distinfo
+++ b/devel/git-base/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.41 2015/12/10 13:35:46 adam Exp $
+$NetBSD: distinfo,v 1.41.2.1 2016/03/22 18:55:23 bsiegert Exp $
 
-SHA1 (git-2.6.4.tar.xz) = aa38f1a026add0d840049abd0040ad2938c113e8
-RMD160 (git-2.6.4.tar.xz) = 0064d711eb4cac1b7c15b62f9f83bf3bed88ef16
-SHA512 (git-2.6.4.tar.xz) = 935233c6dc504448af5dce3115174f9d36489288f7f16790f21dd0faa2699ed71609b8053182e0e2b100b9229cde80ca4d944ecc7723e697bec7af5b28b8f12e
-Size (git-2.6.4.tar.xz) = 3820804 bytes
+SHA1 (git-2.7.3.tar.xz) = d7be9af73cc56c606e0744beb0091b612b416909
+RMD160 (git-2.7.3.tar.xz) = 5111811158362bbc6d4e0a97ec8df8e56c1bd674
+SHA512 (git-2.7.3.tar.xz) = f7acbf52d12f39d323bd90a82c7135aa2aacf2661f7087c71b41dbfbec688342e0a2fc061fc0f216848a538a0dbc4fce68e24ea2a26e747f5eb92f763fa5bc72
+Size (git-2.7.3.tar.xz) = 3909636 bytes
 SHA1 (patch-aa) = 892e2dc9336a794399046ac2b4c59f3650d458f8
 SHA1 (patch-ac) = 376cdd1c58b143c820ff6395987a8a77cf9b52ba
 SHA1 (patch-ae) = 9bc2e6c7f0a8fbc385b6ffda638d3245a62dc5ca
@@ -11,5 +11,15 @@ SHA1 (patch-af) = 06460f220b4703a1ff98809006ec1aed5017bb23
 SHA1 (patch-ag) = 4f0b9a5745203ea7ef369c8272b3ea7c644762f0
 SHA1 (patch-ah) = f22a2160631fb624e9e20616c68ad1a4aa2bebc7
 SHA1 (patch-ai) = 56b63d4790a11f5eb128186ad5efdd1bcf102f2e
+SHA1 (patch-builtin_pack-objects.c) = 8038e9fca76f465c87d6e4265cb657965fca5fee
+SHA1 (patch-builtin_rev-list.c) = 52605a6e05e62e45a161e09dba5cf0ae448d642c
 SHA1 (patch-config.mak.uname) = 5316873147acf5b6ef29e426946280bb6441c886
+SHA1 (patch-http-push.c) = ff931b9043ca8ddedc336d27efe8102e5372b66a
+SHA1 (patch-list-objects.c) = 0250fb74b635d27694dc8e7c99f48a0ba1f23ab7
+SHA1 (patch-list-objects.h) = e341343431e6b64bb6bf4463d632f50107110f37
+SHA1 (patch-pack-bitmap-write.c) = 31492718f3812a9229d33ebe4b8bfcebce0e5805
+SHA1 (patch-pack-bitmap.c) = 76c23b6b328a6b113b58ef026231623d73d1f088
+SHA1 (patch-reachable.c) = b58b59073662b74bbae02f83a5e05c29dee76185
+SHA1 (patch-revision.c) = d9b372b3930578817f5517cc76639fce832a0c58
+SHA1 (patch-revision.h) = 3258d405f6d2d3e5103d1e34cbcefec3da767298
 SHA1 (patch-wrapper.c) = 1fb629ec301d0431cb5bebd716b1c3a7ae45577f
diff --git a/devel/git-base/patches/patch-builtin_pack-objects.c b/devel/git-base/patches/patch-builtin_pack-objects.c
new file mode 100644
index 00000000000..34a50717bd6
--- /dev/null
+++ b/devel/git-base/patches/patch-builtin_pack-objects.c
@@ -0,0 +1,41 @@
+$NetBSD: patch-builtin_pack-objects.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- builtin/pack-objects.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ builtin/pack-objects.c
+@@ -2285,21 +2285,11 @@ static void show_commit(struct commit *c
+ 		index_commit_for_bitmap(commit);
+ }
+ 
+-static void show_object(struct object *obj,
+-			const struct name_path *path, const char *last,
+-			void *data)
++static void show_object(struct object *obj, const char *name, void *data)
+ {
+-	char *name = path_name(path, last);
+-
+ 	add_preferred_base_object(name);
+ 	add_object_entry(obj->oid.hash, obj->type, name, 0);
+ 	obj->flags |= OBJECT_ADDED;
+-
+-	/*
+-	 * We will have generated the hash from the name,
+-	 * but not saved a pointer to it - we can free it
+-	 */
+-	free((char *)name);
+ }
+ 
+ static void show_edge(struct commit *commit)
+@@ -2481,8 +2471,7 @@ static int get_object_list_from_bitmap(s
+ }
+ 
+ static void record_recent_object(struct object *obj,
+-				 const struct name_path *path,
+-				 const char *last,
++				 const char *name,
+ 				 void *data)
+ {
+ 	sha1_array_append(&recent_objects, obj->oid.hash);
diff --git a/devel/git-base/patches/patch-builtin_rev-list.c b/devel/git-base/patches/patch-builtin_rev-list.c
new file mode 100644
index 00000000000..1da32191712
--- /dev/null
+++ b/devel/git-base/patches/patch-builtin_rev-list.c
@@ -0,0 +1,38 @@
+$NetBSD: patch-builtin_rev-list.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- builtin/rev-list.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ builtin/rev-list.c
+@@ -177,9 +177,7 @@ static void finish_commit(struct commit 
+ 	free_commit_buffer(commit);
+ }
+ 
+-static void finish_object(struct object *obj,
+-			  const struct name_path *path, const char *name,
+-			  void *cb_data)
++static void finish_object(struct object *obj, const char *name, void *cb_data)
+ {
+ 	struct rev_list_info *info = cb_data;
+ 	if (obj->type == OBJ_BLOB && !has_object_file(&obj->oid))
+@@ -188,15 +186,13 @@ static void finish_object(struct object 
+ 		parse_object(obj->oid.hash);
+ }
+ 
+-static void show_object(struct object *obj,
+-			const struct name_path *path, const char *component,
+-			void *cb_data)
++static void show_object(struct object *obj, const char *name, void *cb_data)
+ {
+ 	struct rev_list_info *info = cb_data;
+-	finish_object(obj, path, component, cb_data);
++	finish_object(obj, name, cb_data);
+ 	if (info->flags & REV_LIST_QUIET)
+ 		return;
+-	show_object_with_name(stdout, obj, path, component);
++	show_object_with_name(stdout, obj, name);
+ }
+ 
+ static void show_edge(struct commit *commit)
diff --git a/devel/git-base/patches/patch-http-push.c b/devel/git-base/patches/patch-http-push.c
new file mode 100644
index 00000000000..9b45418a54a
--- /dev/null
+++ b/devel/git-base/patches/patch-http-push.c
@@ -0,0 +1,82 @@
+$NetBSD: patch-http-push.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- http-push.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ http-push.c
+@@ -1277,9 +1277,7 @@ static struct object_list **add_one_obje
+ }
+ 
+ static struct object_list **process_blob(struct blob *blob,
+-					 struct object_list **p,
+-					 struct name_path *path,
+-					 const char *name)
++					 struct object_list **p)
+ {
+ 	struct object *obj = &blob->object;
+ 
+@@ -1293,14 +1291,11 @@ static struct object_list **process_blob
+ }
+ 
+ static struct object_list **process_tree(struct tree *tree,
+-					 struct object_list **p,
+-					 struct name_path *path,
+-					 const char *name)
++					 struct object_list **p)
+ {
+ 	struct object *obj = &tree->object;
+ 	struct tree_desc desc;
+ 	struct name_entry entry;
+-	struct name_path me;
+ 
+ 	obj->flags |= LOCAL;
+ 
+@@ -1310,21 +1305,17 @@ static struct object_list **process_tree
+ 		die("bad tree object %s", oid_to_hex(&obj->oid));
+ 
+ 	obj->flags |= SEEN;
+-	name = xstrdup(name);
+ 	p = add_one_object(obj, p);
+-	me.up = path;
+-	me.elem = name;
+-	me.elem_len = strlen(name);
+ 
+ 	init_tree_desc(&desc, tree->buffer, tree->size);
+ 
+ 	while (tree_entry(&desc, &entry))
+ 		switch (object_type(entry.mode)) {
+ 		case OBJ_TREE:
+-			p = process_tree(lookup_tree(entry.sha1), p, &me, name);
++			p = process_tree(lookup_tree(entry.sha1), p);
+ 			break;
+ 		case OBJ_BLOB:
+-			p = process_blob(lookup_blob(entry.sha1), p, &me, name);
++			p = process_blob(lookup_blob(entry.sha1), p);
+ 			break;
+ 		default:
+ 			/* Subproject commit - not in this repository */
+@@ -1343,7 +1334,7 @@ static int get_delta(struct rev_info *re
+ 	int count = 0;
+ 
+ 	while ((commit = get_revision(revs)) != NULL) {
+-		p = process_tree(commit->tree, p, NULL, "");
++		p = process_tree(commit->tree, p);
+ 		commit->object.flags |= LOCAL;
+ 		if (!(commit->object.flags & UNINTERESTING))
+ 			count += add_send_request(&commit->object, lock);
+@@ -1362,11 +1353,11 @@ static int get_delta(struct rev_info *re
+ 			continue;
+ 		}
+ 		if (obj->type == OBJ_TREE) {
+-			p = process_tree((struct tree *)obj, p, NULL, name);
++			p = process_tree((struct tree *)obj, p);
+ 			continue;
+ 		}
+ 		if (obj->type == OBJ_BLOB) {
+-			p = process_blob((struct blob *)obj, p, NULL, name);
++			p = process_blob((struct blob *)obj, p);
+ 			continue;
+ 		}
+ 		die("unknown pending object %s (%s)", oid_to_hex(&obj->oid), name);
diff --git a/devel/git-base/patches/patch-list-objects.c b/devel/git-base/patches/patch-list-objects.c
new file mode 100644
index 00000000000..bb54c054022
--- /dev/null
+++ b/devel/git-base/patches/patch-list-objects.c
@@ -0,0 +1,126 @@
+$NetBSD: patch-list-objects.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- list-objects.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ list-objects.c
+@@ -11,11 +11,12 @@
+ static void process_blob(struct rev_info *revs,
+ 			 struct blob *blob,
+ 			 show_object_fn show,
+-			 struct name_path *path,
++			 struct strbuf *path,
+ 			 const char *name,
+ 			 void *cb_data)
+ {
+ 	struct object *obj = &blob->object;
++	size_t pathlen;
+ 
+ 	if (!revs->blob_objects)
+ 		return;
+@@ -24,7 +25,11 @@ static void process_blob(struct rev_info
+ 	if (obj->flags & (UNINTERESTING | SEEN))
+ 		return;
+ 	obj->flags |= SEEN;
+-	show(obj, path, name, cb_data);
++
++	pathlen = path->len;
++	strbuf_addstr(path, name);
++	show(obj, path->buf, cb_data);
++	strbuf_setlen(path, pathlen);
+ }
+ 
+ /*
+@@ -52,7 +57,7 @@ static void process_blob(struct rev_info
+ static void process_gitlink(struct rev_info *revs,
+ 			    const unsigned char *sha1,
+ 			    show_object_fn show,
+-			    struct name_path *path,
++			    struct strbuf *path,
+ 			    const char *name,
+ 			    void *cb_data)
+ {
+@@ -62,7 +67,6 @@ static void process_gitlink(struct rev_i
+ static void process_tree(struct rev_info *revs,
+ 			 struct tree *tree,
+ 			 show_object_fn show,
+-			 struct name_path *path,
+ 			 struct strbuf *base,
+ 			 const char *name,
+ 			 void *cb_data)
+@@ -70,7 +74,6 @@ static void process_tree(struct rev_info
+ 	struct object *obj = &tree->object;
+ 	struct tree_desc desc;
+ 	struct name_entry entry;
+-	struct name_path me;
+ 	enum interesting match = revs->diffopt.pathspec.nr == 0 ?
+ 		all_entries_interesting: entry_not_interesting;
+ 	int baselen = base->len;
+@@ -86,17 +89,12 @@ static void process_tree(struct rev_info
+ 			return;
+ 		die("bad tree object %s", oid_to_hex(&obj->oid));
+ 	}
++
+ 	obj->flags |= SEEN;
+-	show(obj, path, name, cb_data);
+-	me.up = path;
+-	me.elem = name;
+-	me.elem_len = strlen(name);
+-
+-	if (!match) {
+-		strbuf_addstr(base, name);
+-		if (base->len)
+-			strbuf_addch(base, '/');
+-	}
++	strbuf_addstr(base, name);
++	show(obj, base->buf, cb_data);
++	if (base->len)
++		strbuf_addch(base, '/');
+ 
+ 	init_tree_desc(&desc, tree->buffer, tree->size);
+ 
+@@ -113,16 +111,16 @@ static void process_tree(struct rev_info
+ 		if (S_ISDIR(entry.mode))
+ 			process_tree(revs,
+ 				     lookup_tree(entry.sha1),
+-				     show, &me, base, entry.path,
++				     show, base, entry.path,
+ 				     cb_data);
+ 		else if (S_ISGITLINK(entry.mode))
+ 			process_gitlink(revs, entry.sha1,
+-					show, &me, entry.path,
++					show, base, entry.path,
+ 					cb_data);
+ 		else
+ 			process_blob(revs,
+ 				     lookup_blob(entry.sha1),
+-				     show, &me, entry.path,
++				     show, base, entry.path,
+ 				     cb_data);
+ 	}
+ 	strbuf_setlen(base, baselen);
+@@ -213,19 +211,19 @@ void traverse_commit_list(struct rev_inf
+ 			continue;
+ 		if (obj->type == OBJ_TAG) {
+ 			obj->flags |= SEEN;
+-			show_object(obj, NULL, name, data);
++			show_object(obj, name, data);
+ 			continue;
+ 		}
+ 		if (!path)
+ 			path = "";
+ 		if (obj->type == OBJ_TREE) {
+ 			process_tree(revs, (struct tree *)obj, show_object,
+-				     NULL, &base, path, data);
++				     &base, path, data);
+ 			continue;
+ 		}
+ 		if (obj->type == OBJ_BLOB) {
+ 			process_blob(revs, (struct blob *)obj, show_object,
+-				     NULL, path, data);
++				     &base, path, data);
+ 			continue;
+ 		}
+ 		die("unknown pending object %s (%s)",
diff --git a/devel/git-base/patches/patch-list-objects.h b/devel/git-base/patches/patch-list-objects.h
new file mode 100644
index 00000000000..2c327d263e1
--- /dev/null
+++ b/devel/git-base/patches/patch-list-objects.h
@@ -0,0 +1,17 @@
+$NetBSD: patch-list-objects.h,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- list-objects.h.orig	2016-03-10 22:11:15.000000000 +0000
++++ list-objects.h
+@@ -2,7 +2,7 @@
+ #define LIST_OBJECTS_H
+ 
+ typedef void (*show_commit_fn)(struct commit *, void *);
+-typedef void (*show_object_fn)(struct object *, const struct name_path *, const char *, void *);
++typedef void (*show_object_fn)(struct object *, const char *, void *);
+ void traverse_commit_list(struct rev_info *, show_commit_fn, show_object_fn, void *);
+ 
+ typedef void (*show_edge_fn)(struct commit *);
diff --git a/devel/git-base/patches/patch-pack-bitmap-write.c b/devel/git-base/patches/patch-pack-bitmap-write.c
new file mode 100644
index 00000000000..70260037519
--- /dev/null
+++ b/devel/git-base/patches/patch-pack-bitmap-write.c
@@ -0,0 +1,18 @@
+$NetBSD: patch-pack-bitmap-write.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- pack-bitmap-write.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ pack-bitmap-write.c
+@@ -148,8 +148,7 @@ static uint32_t find_object_pos(const un
+ 	return entry->in_pack_pos;
+ }
+ 
+-static void show_object(struct object *object, const struct name_path *path,
+-			const char *last, void *data)
++static void show_object(struct object *object, const char *name, void *data)
+ {
+ 	struct bitmap *base = data;
+ 	bitmap_set(base, find_object_pos(object->oid.hash));
diff --git a/devel/git-base/patches/patch-pack-bitmap.c b/devel/git-base/patches/patch-pack-bitmap.c
new file mode 100644
index 00000000000..88a3895d138
--- /dev/null
+++ b/devel/git-base/patches/patch-pack-bitmap.c
@@ -0,0 +1,42 @@
+$NetBSD: patch-pack-bitmap.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- pack-bitmap.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ pack-bitmap.c
+@@ -417,19 +417,15 @@ static int ext_index_add_object(struct o
+ 	return bitmap_pos + bitmap_git.pack->num_objects;
+ }
+ 
+-static void show_object(struct object *object, const struct name_path *path,
+-			const char *last, void *data)
++static void show_object(struct object *object, const char *name, void *data)
+ {
+ 	struct bitmap *base = data;
+ 	int bitmap_pos;
+ 
+ 	bitmap_pos = bitmap_position(object->oid.hash);
+ 
+-	if (bitmap_pos < 0) {
+-		char *name = path_name(path, last);
++	if (bitmap_pos < 0)
+ 		bitmap_pos = ext_index_add_object(object, name);
+-		free(name);
+-	}
+ 
+ 	bitmap_set(base, bitmap_pos);
+ }
+@@ -897,9 +893,8 @@ struct bitmap_test_data {
+ 	size_t seen;
+ };
+ 
+-static void test_show_object(struct object *object,
+-			     const struct name_path *path,
+-			     const char *last, void *data)
++static void test_show_object(struct object *object, const char *name,
++			     void *data)
+ {
+ 	struct bitmap_test_data *tdata = data;
+ 	int bitmap_pos;
diff --git a/devel/git-base/patches/patch-reachable.c b/devel/git-base/patches/patch-reachable.c
new file mode 100644
index 00000000000..4be8411e9e3
--- /dev/null
+++ b/devel/git-base/patches/patch-reachable.c
@@ -0,0 +1,26 @@
+$NetBSD: patch-reachable.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- reachable.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ reachable.c
+@@ -43,15 +43,14 @@ static int add_one_ref(const char *path,
+  * The traversal will have already marked us as SEEN, so we
+  * only need to handle any progress reporting here.
+  */
+-static void mark_object(struct object *obj, const struct name_path *path,
+-			const char *name, void *data)
++static void mark_object(struct object *obj, const char *name, void *data)
+ {
+ 	update_progress(data);
+ }
+ 
+ static void mark_commit(struct commit *c, void *data)
+ {
+-	mark_object(&c->object, NULL, NULL, data);
++	mark_object(&c->object, NULL, data);
+ }
+ 
+ struct recent_data {
diff --git a/devel/git-base/patches/patch-revision.c b/devel/git-base/patches/patch-revision.c
new file mode 100644
index 00000000000..8c251e19ed6
--- /dev/null
+++ b/devel/git-base/patches/patch-revision.c
@@ -0,0 +1,82 @@
+$NetBSD: patch-revision.c,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- revision.c.orig	2016-03-10 22:11:15.000000000 +0000
++++ revision.c
+@@ -25,69 +25,13 @@ volatile show_early_output_fn_t show_ear
+ static const char *term_bad;
+ static const char *term_good;
+ 
+-char *path_name(const struct name_path *path, const char *name)
++void show_object_with_name(FILE *out, struct object *obj, const char *name)
+ {
+-	const struct name_path *p;
+-	char *n, *m;
+-	int nlen = strlen(name);
+-	int len = nlen + 1;
+-
+-	for (p = path; p; p = p->up) {
+-		if (p->elem_len)
+-			len += p->elem_len + 1;
+-	}
+-	n = xmalloc(len);
+-	m = n + len - (nlen + 1);
+-	memcpy(m, name, nlen + 1);
+-	for (p = path; p; p = p->up) {
+-		if (p->elem_len) {
+-			m -= p->elem_len + 1;
+-			memcpy(m, p->elem, p->elem_len);
+-			m[p->elem_len] = '/';
+-		}
+-	}
+-	return n;
+-}
+-
+-static int show_path_component_truncated(FILE *out, const char *name, int len)
+-{
+-	int cnt;
+-	for (cnt = 0; cnt < len; cnt++) {
+-		int ch = name[cnt];
+-		if (!ch || ch == '\n')
+-			return -1;
+-		fputc(ch, out);
+-	}
+-	return len;
+-}
+-
+-static int show_path_truncated(FILE *out, const struct name_path *path)
+-{
+-	int emitted, ours;
+-
+-	if (!path)
+-		return 0;
+-	emitted = show_path_truncated(out, path->up);
+-	if (emitted < 0)
+-		return emitted;
+-	if (emitted)
+-		fputc('/', out);
+-	ours = show_path_component_truncated(out, path->elem, path->elem_len);
+-	if (ours < 0)
+-		return ours;
+-	return ours || emitted;
+-}
+-
+-void show_object_with_name(FILE *out, struct object *obj,
+-			   const struct name_path *path, const char *component)
+-{
+-	struct name_path leaf;
+-	leaf.up = (struct name_path *)path;
+-	leaf.elem = component;
+-	leaf.elem_len = strlen(component);
++	const char *p;
+ 
+ 	fprintf(out, "%s ", oid_to_hex(&obj->oid));
+-	show_path_truncated(out, &leaf);
++	for (p = name; *p && *p != '\n'; p++)
++		fputc(*p, out);
+ 	fputc('\n', out);
+ }
+ 
diff --git a/devel/git-base/patches/patch-revision.h b/devel/git-base/patches/patch-revision.h
new file mode 100644
index 00000000000..3c8bb951d67
--- /dev/null
+++ b/devel/git-base/patches/patch-revision.h
@@ -0,0 +1,27 @@
+$NetBSD: patch-revision.h,v 1.1.2.2 2016/03/22 18:55:23 bsiegert Exp $
+
+CVE-2016-2324 via Debian
+https://security-tracker.debian.org/tracker/CVE-2016-2324
+https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d
+
+--- revision.h.orig	2016-03-10 22:11:15.000000000 +0000
++++ revision.h
+@@ -257,16 +257,9 @@ extern void put_revision_mark(const stru
+ extern void mark_parents_uninteresting(struct commit *commit);
+ extern void mark_tree_uninteresting(struct tree *tree);
+ 
+-struct name_path {
+-	struct name_path *up;
+-	int elem_len;
+-	const char *elem;
+-};
+-
+-char *path_name(const struct name_path *path, const char *name);
++char *path_name(struct strbuf *path, const char *name);
+ 
+-extern void show_object_with_name(FILE *, struct object *,
+-				  const struct name_path *, const char *);
++extern void show_object_with_name(FILE *, struct object *, const char *);
+ 
+ extern void add_pending_object(struct rev_info *revs,
+ 			       struct object *obj, const char *name);
diff --git a/devel/git/Makefile.version b/devel/git/Makefile.version
index a1e4fbab2ff..f3953217677 100644
--- a/devel/git/Makefile.version
+++ b/devel/git/Makefile.version
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile.version,v 1.35 2015/12/10 13:35:46 adam Exp $
+# $NetBSD: Makefile.version,v 1.35.2.1 2016/03/22 18:55:23 bsiegert Exp $
 #
 # used by devel/git/Makefile.common
 # used by devel/git-svn/Makefile
 
-GIT_VERSION=	2.6.4
+GIT_VERSION=	2.7.3