Commit Graph

32 Commits

Author SHA1 Message Date
Ming Liu
af8b70d359 zip: fix a buffer overflow detected issue
A "buffer overflow detected" issue was observed as follows:
| *** buffer overflow detected ***: terminated
|
| zip error: Interrupted (aborting)

This issue is addressed by:
https://bugzilla.redhat.com/show_bug.cgi?id=2165653

Port the fix.

(From OE-Core rev: e2f3eeaedc0ea896f5f5b23f756056331b1647cf)

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-19 17:55:17 +01:00
Richard Purdie
ca65114e5e recipes: Drop remaining md5sum checksums
We have long since obsoleted md5sum in favour of sha256sum. Drop the remaining
56 entries (which were showing many recipes hadn't been touched in a long time).
They all do have the corresponding sha256sum entries as is clear from the diff.

(From OE-Core rev: 7e4bfcc9706fa8a09f6a0004174a2c3b21c90df3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-01 14:22:53 +01:00
Niko Mauno
ce383483f2 zip: Fix LICENSE
The contents of the LICENSE file included in the current source code
package match those of Info-ZIP license, which seems to originate from
the year 2007:

  This is version 2007-Mar-4 of the Info-ZIP license.

(From OE-Core rev: 3739a1af61ff6f0faca23bb565f9e71666953715)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-04 12:38:44 +01:00
Khem Raj
8dac1e9777 zip: Fix build with gcc-14
zip's configure fails to link this piece of test code:

  int main() { return closedir(opendir(".")); }

with GCC-14 because it now treats implicit declaration of function
as error, unline older GCC version where it was just a warning
and this test would build fine.

Remove 0002-unix.c-Do-not-redefine-DIR-as-FILE.patch which
is now unnecessary.

(From OE-Core rev: 3422411eb750c7e960b81676637cfb321dbadefb)

Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-05-13 15:42:27 +01:00
Richard Purdie
1b94ea8b25 recipes: Drop remaining PR values from recipes
We've been removing PR values from recipes at upgrade time for a while. In general
anyone maintaining a binary distro would end up having to curate these themselves
so the values in OE-Core aren't really that useful anymore. In many ways it makes
sense to clear out the remaining ones (which are mostly for 'config' recipes that
are unlikely to increase in PV) and leave a clean slate for anyone implementing
a binary distro config.

References are left in meta-selftest since the tests there do involve them and
their removal upon upgrade.

(From OE-Core rev: d4c346e8ab8f3cae25d1b01c7331ed9f6d4f96ef)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-22 07:45:17 +01:00
Andrej Valek
c15e506a46 cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS
- Try to add convert and apply statuses for old CVEs
- Drop some obsolete ignores, while they are not relevant for current
  version

(From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Reviewed-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-21 11:52:26 +01:00
Chen Qi
a3d3db655f zip: remove unnecessary LARGE_FILE_SUPPORT CLFAGS
As the zip's configure has been updated to use compile-time
check, it now can do the check correctly, thus no need to
pass LARGE_FILE_SUPPORT to CFLAGS.

(From OE-Core rev: 601f45bc4e6c563ebf16e724d56519a128815034)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-21 18:38:25 +01:00
Chen Qi
9c6d3c68d0 zip: fix configure check by using _Static_assert
It's incorrect to run a cross-compiled program on build machine
to check if some feature is available or not. As these two checks
in zip are basically just checking the size, we can use _Static_assert
and sizeof to do such check at compile time.

(From OE-Core rev: dda778d855b1838ae3004a9af310724b913490b4)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-21 18:38:25 +01:00
Khem Raj
f37a9d3b5e zip: Always enable LARGE_FILE_SUPPORT
largefile distro feature is deprecated

(From OE-Core rev: c1d1fdac00945e0b8793441a4737780ca00cec30)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-16 14:57:58 +01:00
Khem Raj
537c61b2ca zip: Make configure checks to be more robust
Newer compilers are strict and have turned some warnings into hard
errors which results in subtle configure check failures. Therefore fix
these tests and also enable largefile support via cflags when its
desired

(From OE-Core rev: 64e575a62ac2606e8f1037e712de66dff8156b46)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-12 19:22:04 +01:00
Khem Raj
e2bc510623 zip: Enable largefile support based on distro feature
The configure test tries to run a binary during build to determine
largefile support, which wont work in cross-compile mode, therefore
specify it when largefile DISTRO_FEATURE is on.

(From OE-Core rev: 0becc36f930969a237af7d7486fc94249b0395eb)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-12 19:22:04 +01:00
Alexander Kanavin
b2a1465d61 zip/unzip: mark all submittable patches as Inactive-Upstream
(From OE-Core rev: df78f7bb461c7d3eccac469fd01a77a3d0b800df)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-27 23:50:48 +01:00
Khem Raj
c6aa831fe5 zip: Pass ldflags to configure tests using linking
(From OE-Core rev: 118e4ca244a8ff48b126225b8f98b7c9f66b71f1)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-10 13:07:37 +00:00
Joe Slater
62644e48da zip: modify when match.S is built
Use the correct $CPP to test if *.S are buildable,
but do not build match.S because it is not PIC code.

(From OE-Core rev: 58b16da805b774465f15c8bee59f8361a47ccd4e)

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-27 12:34:40 +00:00
Richard Purdie
71ef319193 meta/scripts: Automated conversion of OE renamed variables
(From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21 23:37:27 +00:00
Alexander Kanavin
6e61460549 unzip/zip: mark all patches as non-upstreamable
While upstream is not technically dead as of today [1], it has not made
a release in over a decade, and there is no source code repo to
rebase the patches on. If/when a new release ever comes, or someone
takes over the maintenance, we can reassess the situation with these patches.

[1] Discussion in https://sourceforge.net/p/infozip/bugs/53/

(From OE-Core rev: 982e5fa5d7ca9920e2a63b5a3f1435cf57d94345)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-21 11:05:01 +00:00
Dorinda
76e7ccfc30 meta/recipes-extended: Add HOMEPAGE / DESCRIPTION
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage

[YOCTO #13471]

(From OE-Core rev: cc6c7af900ae0196a62b7fa1375c55bbcd8e68b4)

Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-06 22:39:04 +00:00
Mikko Rapeli
615cb60fd4 zip: whitelist CVE-2018-13410 and CVE-2018-13684
https://nvd.nist.gov/vuln/detail/CVE-2018-13410 is disputed and
also Debian considers it not a vulnerability:

https://security-tracker.debian.org/tracker/CVE-2018-13410

http://seclists.org/fulldisclosure/2018/Jul/24
"Negligible security impact, would involve that a untrusted party controls the -TT value."

https://nvd.nist.gov/vuln/detail/CVE-2018-13684 is not for zip, also Debian concludes this:

https://security-tracker.debian.org/tracker/CVE-2018-13684

"NOT-FOR-US: smart contract implementation for ZIP"

(From OE-Core rev: 06b72a91b6dcf63fed437fd2105c59e922ba6525)

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-16 22:39:36 +00:00
Jate Sujjavanich
a2983a2635 zip: Add patch fixing zipnote segfault
This patch has been applied in several Linux distributions

(From OE-Core rev: 8e662fced80c98c5495d49c905cc0008cb812589)

Signed-off-by: Jate Sujjavanich <jatedev@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-10 21:18:22 +00:00
Joshua Watt
5eb1d8b63f zip: Remove build date to improve reproducibility
Applies a patch from Debian to remove the build date from zip.

(From OE-Core rev: 222d485e4eb789307093d57cb3c8d373c2e695b8)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-04 09:09:42 +01:00
Alexander Kanavin
5813f1f764 selftest: fix distrodata.py to use per-recipe UPSTREAM_VERSION_UNKNOWN setting
... instead of a global exception list which was problematic.

[YOCTO #11896]

(From OE-Core rev: 89dfede4ca795ba085f1ee7290c6dede573c11db)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-16 00:03:13 +01:00
Ross Burton
a53a9ddbdd zip: update SRC_URI
The infozip FTP server appears to have been taken down, so change the SRC_URI to
point at their SourceForge project.

Also as the SRC_URI can't be generated from the version and there is no other
user of the .inc, merge the .bb and .inc together.

[ YOCTO #9655 ]

(From OE-Core rev: 5cb1e0ec46e4fde1c15aeb6812eaaece4840ac1c)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19 22:32:07 +01:00
Edwin Plauchu
c676d5dd6f zip: fix security issues
This patch avoids zip recipe fails to compile with compiler
flags which elevate common string formatting issues into an
error (-Wformat -Wformat-security -Werror=format-security).

[YOCTO #9552]

(From OE-Core rev: f63a36360b7e138d2a63c84b5b1a8287ffe3d2ae)

Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19 09:05:20 +01:00
Alexander Kanavin
74bfa62f85 package_regex.inc: split entries which blacklist specific versions to their recipes
(From OE-Core rev: 1eb9e190ef3bb1170b3eaabd9f7900e7ce176624)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-08 10:20:52 +00:00
Paul Eggleton
cec8b230cf Replace one-line DESCRIPTION with SUMMARY
A lot of our recipes had short one-line DESCRIPTION values and no
SUMMARY value set. In this case it's much better to just set SUMMARY
since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY
is at least useful. I also took the opportunity to fix up a lot of the
new SUMMARY values, making them concisely explain the function of the
recipe / package where possible.

(From OE-Core rev: b8feee3cf21f70ba4ec3b822d2f596d4fc02a292)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-02 12:50:18 +00:00
Martin Jansa
1242dc5a70 zip: explictly disable bzip2 support
* we don't depends on bzip2, so make sure it's not autodetected in
  sysroot

(From OE-Core rev: e93186642708cb99bfba776012e345c42e9bd0d5)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-03-02 12:56:54 +00:00
Muhammad Shakeel
6847325ff4 zip: Remove QA warnings: No GNU_HASH in the elf binary
Update the LFLAGS1 in the Makefile to remove warnings:
QA Issue: No GNU_HASH in the elf binary

(From OE-Core rev: 3b41513a63df6636b617eff09ff1ea9574c5e6f0)

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Muhammad Shakeel <muhammad_shakeel@mentor.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-12-06 12:31:17 +00:00
Joe Slater
0311826390 zip: pay some attention to our CFLAGS
Makefile makes use of CFLAGS_NOOPT.  If we set that
when calling make we can options like -g.  The Makefile
will override any optimization to -O3.

Upstream-Status: Pending

(From OE-Core rev: df2c260f9cda2e291c72f7debe1e6d53846ce058)

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-11-24 15:12:35 +00:00
Elizabeth Flanagan
5eeea9e170 OECore license fixes: meta/*
This is a quick audit of only the most obviously wrong licenses
found within OECore. These fixes fall into four areas:

- LICENSE field had incorrect format so that the parser choked
- LICENSE field has a license with no version
- LICENSE field was actually incorrect
- LICENSE field has an imaginary license that didn't exist

This fixes most of the LICENSE warnings thrown, along with my prior
commit adding additional licenses to common-licenses and additional
SPDXLICENSEMAP entries.

HOWEVER..... there is much to be done on the license front.
For a list of recipes with licenses that need obvious fixing see:

https://wiki.yoctoproject.org/wiki/License_Audit

That said, I would suggest another license audit as I've found
enough inconsistencies. A good suggestion is when in doubt, look at
how openSuse or Gentoo or Debian license the package.

(From OE-Core rev: 3083dd70b3a9fa01fcc3cf00373b05502505996e)

Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-12-08 15:24:32 +00:00
Richard Purdie
c8dee9b92d Convert to use direct access to the data store (instead of bb.data.*Var*())
This is the result of running the following over the metadata:

sed \
-e 's:bb.data.\(setVar([^,()]*,[^,()]*\), *\([^ )]*\) *):\2.\1):g' \
-e 's:bb.data.\(setVarFlag([^,()]*,[^,()]*,[^,()]*\), *\([^) ]*\) *):\2.\1):g' \
-e 's:bb.data.\(getVar([^,()]*\), *\([^(), ]*\) *,\([^)]*\)):\2.\1,\3):g' \
-e 's:bb.data.\(getVarFlag([^,()]*,[^,()]*\), *\([^(), ]*\) *,\([^)]*\)):\2.\1,\3):g' \
-e 's:bb.data.\(getVarFlag([^,()]*,[^,()]*\), *\([^() ]*\) *):\2.\1):g' \
-e 's:bb.data.\(getVar([^,()]*\), *\([^) ]*\) *):\2.\1):g' \
-i `grep -ril bb.data *`

(From OE-Core rev: b22831fd63164c4db9c0b72934d7d734a6585251)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-11-10 11:51:19 +00:00
Saul Wold
3d08b9f2c6 SRC_URI Checksums Additionals
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2010-12-09 08:18:17 -08:00
Richard Purdie
d62ee7eaf2 packages: Separate out most of the remaining packages into recipes
Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
2010-09-01 19:09:57 +01:00