A fuzz on libpcre1 through the pcretest utility revealed an invalid read in the
library. For who is interested in a detailed description of the bug, will
follow a feedback from upstream:
This was a genuine bug in the 32-bit library. Thanks for finding it. The crash
was caused by trying to find a Unicode property for a code value greater than
0x10ffff, the Unicode maximum, when running in non-UTF mode (where character
values can be up to 0xffffffff).
(From OE-Core rev: 1b87201784e733f3a9d436f56cb5a6151ba6bdfa)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of
service (heap-based buffer overflow) or possibly have unspecified other impact
via a crafted regular expression.
(From OE-Core rev: dd63a26fedb8a578d34850ede4c27e26b8876e7e)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2017-12678: In TagLib 1.11.1, the rebuildAggregateFrames function in
id3v2framefactory.cpp has a pointer to cast vulnerability, which allows
remote attackers to cause a denial of service or possibly have
unspecified other impact via a crafted audio file.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-12678
Patch from:
eb9ded1206
(From OE-Core rev: 24ac12ecb19efc7c131c9711ba32e298ba860eb7)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix do_configure to be able to regenerate configure files
Use cross libtool as installed by OE, as done in normal autotooled recipes
These changes help in invoking the libtool with proper tags for C
and C++ compiler and linker invocation and not use same tag across all
different invocations
Fixes errors like
libtool: compile: unable to infer tagged configuration
libtool: compile: specify a tag with `--tag'
(From OE-Core rev: afa9f769d62034d4443dfe929422d1d591adf709)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We were relying on running ca-certificates from the -native version. This
meant the host and target path layouts had to match which might not be true,
it certainly isn't true for the sdk builds.
There was a dependency on run-parts which wasn't represented (we can get it
from busybox or debianutils).
Since this is an allarch script, call the script directly, making sure debianutils
and openssl are available as postinst rootfs time to resolve the issues.
(From OE-Core rev: d9575e05f2cb8bf293534c036ddc0d0336701256)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We want to provide python libs by default, and some other
popular Linux distributions like redhat/fedora does the same.
(From OE-Core rev: 41744c418009dccc5f79c1a4a28419807d67837c)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bmap-tools has run-time dependency on "python-mmp" which is missing in
the RDEPENDS. "bmaptool" command in the target will fail without this
patch.
(From OE-Core rev: 1127154b958d0a0e167cefff4bc40dfb86e3378a)
Signed-off-by: Binghua Guan <freebendy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Fixes:
ERROR: nativesdk-libcheck-0.10.0-r0 do_package_qa: QA Issue: /usr/local/oecore-x86_64/sysroots/x86_64-oesdk-linux/usr/bin/checkmk contained in package nativesdk-libcheck requires /usr/local/oecore-x86_64/sysroots/x86_64-oesdk-linux/usr/bin/gawk, but no providers found in RDEPENDS_nativesdk-libcheck? [file-rdeps]
(From OE-Core rev: 71c29b53f1a44430306eeda96dc43cf7d002afe5)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While multilib, the local m4/python.m4 incorrectly assigned
am_cv_python_pyexecdir and am_cv_python_pythondir which caused
the following error enabled:
...
ERROR: gpgme-1.9.0-r0 do_package: QA Issue: gpgme: Files/directories
were installed but not shipped in any package:
/usr/lib/python3.5/site-packages/gpg-1.9.0-py3.5.egg-info
...
(From OE-Core rev: f5c7e236582028638a26a5855d5e7ba0b55bb8f0)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Uprev from 3.19.3 to 3.2.0 for fixing CVE-2017-10989:
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3,
as used in GDAL and other products, mishandles undersized RTree blobs
in a crafted database, leading to a heap-based buffer over-read or
possibly unspecified other impact.
https://nvd.nist.gov/vuln/detail/CVE-2017-10989
* LIC_FILES_CHKSUM updated for below changes:
-** 2001 September 15
+** 2001-09-15
(From OE-Core rev: 95b802bfe74ac6a3f6dc05edb52c87ef90600f40)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrade nss from 3.30.2 to latest stable version 3.31.1.
* remove 0001-Fix-warnings-found-with-gcc7.patch which is not needed now
(From OE-Core rev: 86838f1c06002a62ded12a9a66d1eb82093c85a9)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove references to the host build system from generated/packaged
header file gmp.h. The file ends up in two different packages (libgmp-dev,
libgmp-dbg). Rather then modifying the file twice in two different
destinations after the installation, we modify the file gmp.h only once,
but before the installation.
[YOCTO #11922]
(From OE-Core rev: 693b42115e2f61abc9ca6096445dc494648cacb6)
Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
External compilers will explicitly pass -fPIE -pie flags
unlike internal toolchain which does not use them, so the build
fails with external toolchains because, its passing these
flags to linker when building shared library, which is not
correct it should just use -fPIC
Fixes errors e.g.
| /mnt/a/oe/build/tmp/work/corei7-64-bec-linux/libproxy/0.4.14-r0/recipe-sysroot-native/usr/bin/x86_64-bec-linux/x86_64-bec-linux-ld: ../libmodman/libmodman.a(module_manager.cpp.o): relocation R_X86_64_PC32 against symbol `_ZNSt8_Rb_treeINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_St6vectorIPN9libmodman14base_extensionESaISB_EEESt10_Select1stISE_ESt4lessIS5_ESaISE_EE8_M_eraseEPSt13_Rb_tree_nodeISE_E' can not be used when making a shared object; recompile with -fPIC
(From OE-Core rev: 8c8c01f8e68026228a3b76528a0039acf682c201)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtool tries to guess the --tag value based on CC/CXX environment
variables and the compile commandline generated by makefiles. This
heuristics however fails when we construct CC variables in OE
and add security flags to it, especially -fPIE -pie which are added
by external compilers e.g. clang particularly. It fails because
libtool removed PIE flags from compiler cmdline intelligently
if it figures out that its building a library, which means that
the CC variable passed from cmdline does not match with the compiler
cmdline constructed by libtool and we end up with errors like
| arm-bec-linux-musleabi-libtool: compile: unable to infer tagged configuration
| arm-bec-linux-musleabi-libtool: error: specify a tag with '--tag'
This works with internal gcc toolchain because we configure gcc for
PIE when hardening is selected and dont pass -fPIE -pie options explicitly
but this is not an option for clang, and some external gcc toolchains
using older gcc
This patch adds the --tag option to help libtool set correct tags
in packages where it cant get it right via its heuristics
(From OE-Core rev: 0505075ae8d339ba097aebb82b4d0ae62f87c0a9)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
debianutils-run-parts should have higher priority than
busybox (which is 50), so set the priority to 60 for
debianutils-run-parts.
(From OE-Core rev: 56f6fc7d6de0a46046ea2abcc392b1da88e398ec)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.19.2 -> 3.19.3
Fixes a bug associated with auto_vacuum that can lead to database
corruption.
(From OE-Core rev: 2635067901c932888a998ea0fbb45f5d4d3c7c24)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* The LIC_FILES_CHKSUM is changed becauses the files updated the date, and added
a BSD-3-clause-John-Birrell for man/timeradd.3bsd, this license is already
there for other files.
* Update 0002-Remove-funopen.patch
* Remove 0003-Fix-build-breaks-due-to-missing-a.out.h.patch, the a.out
code is gone in the source, so this patch is not needed any more.
(From OE-Core rev: 1be785e420c838080ce5dc608192794e46961582)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The recipe and patches (including this patch) had been moved into meta-mingw,
this dangling patch is useless here, so should be removed.
(From OE-Core rev: b1c4661742d12cfd444043e597d01bd627ee4ca4)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
