singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup
call, leading to a heap-based buffer over-read that might affect a system that
compiles untrusted Lua code.
https://nvd.nist.gov/vuln/detail/CVE-2022-28805
(From OE-Core rev: d2ba3b8850d461bc7b773240cdf15b22b31a3f9e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport the fix for CVE-2021-43396 ("C stack overflow with coroutines")
from upstream.
(From OE-Core rev: e74fb3f7a8171cc1293583241a9ef43a515a9320)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop three backports and 0001-Allow-building-lua-without-readline-on-Linux.patch
(feature added upstream, adjust the recipe accordingly).
Adjust ar/ranlib flags for reproducibility on liblua.a.
License-Update: lines moved around, formatting
(From OE-Core rev: c2cad5ecfbbcee99b3cbe71efeeac9a875b6e5ff)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
