Commit Graph

29554 Commits

Author SHA1 Message Date
T.O. Radzy Radzykewycz
545a4d2e56 OpenSSL: CVE-2004-2761 replace MD5 hash algorithm
Use SHA256 as default digest for OpenSSL instead of MD5.

CVE: CVE-2004-2761

    The MD5 Message-Digest Algorithm is not collision resistant,
    which makes it easier for context-dependent attackers to
    conduct spoofing attacks, as demonstrated by attacks on the
    use of MD5 in the signature algorithm of an X.509 certificate.

Upstream-Status: Backport
Backport from OpenSSL 2.0 to OpenSSL 1.0.2
Commit f8547f62c212837dbf44fb7e2755e5774a59a57b

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(From OE-Core rev: f924428cf0c22a0b62769f8f31f11f173f25014f)

(From OE-Core rev: 0066e5c5559009f250b6e5953d5830db2c8769e1)

Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com>
Signed-off-by: T.O. Radzy Radzykewycz <radzy@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Khem Raj
8325c93df9 cmake.bbclass: Set CXXFLAGS and CFLAGS
We strip the TOOLCHAIN_OPTIONS and HOST_CC_ARCH from CC/CXX in cmake.bbclass
whereas CFLAFS and CXXFLAGS assume that TOOLCHAIN_OPTIONS are
part of CC/CXX variables, this causes compile failures when cmake
is running compiler tests during configure on some architectures
especially armhf, because hf ABI information -mfloat-abi is part
of TOOLCHAIN_OPTIONS, so what happens is that testcase gets compiled
without hard-float, howver, during linking the float ABI option
is passed via LDFLAGS, now linker rejects this and fails like
/mnt/a/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/arm-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/6.2.0/ld: error: cmTC_27947 uses VFP register arguments, CMakeFiles/cmTC_27947.dir/src.cxx.o does not
mnt/a/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/arm-oe-linux-gnueabi/gcc/arm-oe-linux-gnueabi/6.2.0/ld: failed to merge target specific data of file CMakeFiles/cmTC_27947.dir/src.cxx.o
collect2: error: ld returned 1 exit status

This means that CMake now fails the configure time test too
which is not right, e.g. it might disable features which actually do exist
and should be enabled e.g. in case above it is resulting as below

Performing C++ SOURCE FILE Test HAS_BUILTIN_SYNC_SUB_AND_FETCH failed with the following output:

Its actually a bug in CMake see
https://gitlab.kitware.com/cmake/cmake/issues/16421

CMake is ignoring CMAKE_CXX_FLAGS when using CHECK_CXX_SOURCE_COMPILES
function.

Until it is fixed upstream, we add HOST_CC_ARCH and TOOLCHAIN_OPTIONS
to CFLAGS and CXXFLAGS, so that we can ensure that compiler invocation
remains consistent.

(From OE-Core rev: 826f3cdb474b5728b22f08d2342fc90235ca9e7d)

(From OE-Core rev: 7e5fd5914e15397a56425130c2322ace67da2ee4)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Zhixiong Chi
cb2967921e tiff: Security fix CVE-2016-3658
The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool
allows remote attackers to cause a denial of service (out-of-bounds read) via vectors
involving the ma variable.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658
http://bugzilla.maptools.org/show_bug.cgi?id=2546

Patch from:
45c68450be

(From OE-Core rev: c060e91d2838f976774d074ef07c9e7cf709f70a)

(From OE-Core rev: cc266584158c8dfc8583d21534665b6152a4f7ee)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Kai Kang
460bbf456b qemu: update run-ptest script
The Makefile in directory tests has been renamed, then update script
run-ptest to follow the change.

(From OE-Core rev: 364565f3f3baccc9757ce0dcb393464b38055b4f)

(From OE-Core rev: aece2afafbd304adee30978537b9404a9344dd4e)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Kai Kang
8d1afc2a0d qemu: fix CVE-2016-7909
Backport patch to fix CVE-2016-7909 of qemu.

Ref:
https://security-tracker.debian.org/tracker/CVE-2016-7909

(From OE-Core rev: 126783ca25a5ae9daf87ac563239fbff4696a682)

(From OE-Core rev: 469267010b43a1c114e22009c9ac68f36c22f896)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
André Draszik
31d4000b15 openssl: fix bashism in c_rehash shell script
This script claims to be a /bin/sh script, but it uses
a bashism:

from checkbashisms:

possible bashism in meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh line 151 (should be 'b = a'):
	    if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ]

This causes build issues on systems that don't have
/bin/sh symlinked to bash:

Updating certificates in ${WORKDIR}/rootfs/etc/ssl/certs...
<builddir>/tmp/sysroots/x86_64-linux/usr/bin/c_rehash: 151: [: x/: unexpected operator
 ...

Fix this by using POSIX shell syntax for the comparison.

(From OE-Core rev: 0526524c74d4c9019fb014a2984119987f6ce9d3)

(From OE-Core rev: 2ece9c0e955ee99543968ddfd14da909e23ae611)

Signed-off-by: André Draszik <adraszik@tycoint.com>
Reviewed-by: Sylvain Lemieux <slemieux@tycoint.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Ross Burton
a469b6efc6 systemtap: fix native linking on recent Ubuntu
The latest Ubuntu uses yet more aggressive hardening options, which causes the
unconventional build order used by systemtap to fail.

[ YOCTO #10521 ]

(From OE-Core rev: 5ca6ac8739ea4a273df7b8e5c5f7d481619923d8)

(From OE-Core rev: 3397af5877a41a6a59aeb90f8610c759cad38795)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Ross Burton
6d57ce3fa3 systemtap: remove explicit msgfmt check
Passing --disable-nls should be enough to disable the requirement for a full
gettext to be present, but the upstream configure explicitly checks for msgfmt
even if it isn't going to be used.  To avoid having to depend on gettext-native,
patch this check out.

(From OE-Core rev: 2f8d2a74f73490c1ae35131d3eb3592f7ee0a1e4)

(From OE-Core rev: 7d689876574ba47e5ad07d67ad40fd865b0c27f5)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Khem Raj
c0526ab007 libbsd: Fix build with musl
a.out.h support is not across all architectures only
x86/x86_64 support is in linux/a.out.h, this patch
abstracts the minimum needed constructs into itself

(From OE-Core rev: 757224640bbf4ebf17aea22fa1419c9c3bcd89ce)

(From OE-Core rev: 7985b295384f98fd6ea88f3aff197ccf0369977b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Li Zhou
1a118330c3 db: disable the ARM assembler mutex code
The swpb in macro MUTEX_SET will cause "undefined instruction" error
on the new arm arches which don't support this assembly instruction
any more. If use ldrex/strex to replace swpb, the old arm arches don't
support them. So to avoid this issue, just disable the ARM assembler
mutex code, and use the default pthreads mutex.

(From OE-Core rev: aafbc548ebc66dc0d703526f9a98f784e9c9605b)

(From OE-Core rev: d6a0ef7e9dfbda3d55ba18f2bcc69f04d502495d)

Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
André Draszik
53ad465b40 cve-check.bbclass: CVE-2014-2524 / readline v5.2
Contrary to the CVE report, the vulnerable trace functions
don't exist in readline v5.2 (which we keep for GPLv2+
purposes), they were added in readline v6.0 only - let's
whitelist that CVE in order to avoid false positives.

See also the discussion in
 https://patchwork.openembedded.org/patch/81765/

(From OE-Core rev: b881a288eec598002685f68da80a24e0478fa496)

(From OE-Core rev: b4498a6b734661fdfe3ff4e0a9850e796b72005c)

Signed-off-by: André Draszik <adraszik@tycoint.com>
Reviewed-by: Lukasz Nowak <lnowak@tycoint.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Robert Yang
2336faa9aa qemuarm64.conf: make runqemu's graphics work
Fixed:
$ runqemu qemuarm64 (without -nographics)
There is no output in qemu console without this fix.

(From OE-Core rev: 40a64e64b2ff41661ff254d0836c5f60120c6795)

(From OE-Core rev: f07c139e91d2173dac4289727d1401a19d6ed821)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Daniel Díaz
a4c7f45b8b weston: Add no-input-device patch to 1.11.0.
The included patch, backported from Weston master (and OE-Core
master since Weston 1.11.1, b6864b1), allows it to run without
any input device at launch. An ini option is introduced for
this purpose, so there is no behavioral change.

Related change in weston.ini:
  [core]
  require-input=true

Default is true; setting it false allows Weston to run
without a keyboard or mouse, which is handy for automated
environments.

(From OE-Core rev: 8fa5e442d16b1d04066b51b9fd56be41ae67d2d5)

Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Koen Kooi
6b736febdc libbsd 0.8.3: BBCLASSEXTEND to native and nativesdk
Android-tools depends on it and to build the native versions of fastboot, adb, mkbootimg and others libbsd needs to support native builds.

(From OE-Core rev: 5d6761dacd370fdb6f29269a22cfbca86f301024)

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit b02cef58ee35dd277fff48538ce2803df1cbc4d5)
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Armin Kuster
4c1020aad6 tzdata: update to 2016i
Briefly: Cyprus split into two time zones on 2016-10-30, and Tonga
  reintroduces DST on 2016-11-06.

  Changes to future time stamps

    Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on
    2017-01-15 at 03:00.  Assume future observances in Tonga will be
    from the first Sunday in November through the third Sunday in
    January, like Fiji.  (Thanks to Pulu ʻAnau.)  Switch to numeric
    time zone abbreviations for this zone.

  Changes to past and future time stamps

    Northern Cyprus is now +03 year round, causing a split in Cyprus
    time zones starting 2016-10-30 at 04:00.  This creates a zone
    Asia/Famagusta.  (Thanks to Even Scharning and Matt Johnson.)

    Antarctica/Casey switched from +08 to +11 on 2016-10-22.
    (Thanks to Steffen Thorsen.)

  Changes to past time stamps

    Several corrections were made for pre-1975 time stamps in Italy.
    These affect Europe/Malta, Europe/Rome, Europe/San_Marino, and
    Europe/Vatican.

    First, the 1893-11-01 00:00 transition in Italy used the new UT
    offset (+01), not the old (+00:49:56).  (Thanks to Michael
    Deckers.)

    Second, rules for daylight saving in Italy were changed to agree
    with Italy's National Institute of Metrological Research (INRiM)
    except for 1944, as follows (thanks to Pierpaolo Bernardi, Brian
    Inglis, and Michael Deckers):

      The 1916-06-03 transition was at 24:00, not 00:00.

      The 1916-10-01, 1919-10-05, and 1920-09-19 transitions were at
      00:00, not 01:00.

      The 1917-09-30 and 1918-10-06 transitions were at 24:00, not
      01:00.

      The 1944-09-17 transition was at 03:00, not 01:00.  This
      particular change is taken from Italian law as INRiM's table,
      (which says 02:00) appears to have a typo here.  Also, keep the
      1944-04-03 transition for Europe/Rome, as Rome was controlled by
      Germany then.

      The 1967-1970 and 1972-1974 fallback transitions were at 01:00,
      not 00:00.

(From OE-Core rev: daf95f7fd9f7ab65685d7b764d8e50df8d00d308)

(From OE-Core rev: 550901db388eda2476da24b71117223be999688b)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Armin Kuster
afaef2018f tzcode: update to 2016i
Changes to code

  The code should now be buildable on AmigaOS merely by setting the
  appropriate Makefile variables.  (From a patch by Carsten Larsen.)

(From OE-Core rev: d2b8c4ee535684f5d874082a7f76efbda1907ea5)

(From OE-Core rev: 757f2cb2f2acaf41d3f81c5b9bb0afd8e05001db)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:41 +00:00
Kai Kang
724fa5a489 openssh: fix CVE-2016-8858
Backport patch to fix CVE-2016-8858 of openssh.

Ref:
https://bugzilla.redhat.com/show_bug.cgi?id=1384860

(From OE-Core rev: 134a05616839d002970b2e7124ea38348d10209b)

(From OE-Core rev: 07e289d7212d6343370bfc883631a19f37bc85f1)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:40 +00:00
Ross Burton
101173d6cf lib/oe/qa: handle binaries with segments outside the first 4kb
The ELF parser was assuming that the segment tables are in the first 4kb of the
binary.  Whilst this generally appears to be the case, there have been instances
where the segment table is elsewhere (offset 2MB, in this sample I have).  Solve
this problem by mmap()ing the file instead.

Also clean up the code a little whilst chasing the problem.

(From OE-Core rev: b88c6bd61e7c3388b3902de1adb5e48a88f2e235)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:40 +00:00
Ross Burton
b0b646ab3c Revert "epiphany: remove unnecessary libwnck3 dependency"
This version of epiphany still needs libwnck3.

This reverts commit fb5c4f181176710a4cfb3c875b5edb4e5aa5df73.

(From OE-Core rev: eec53627ac5c3aa811a0bd97f06a4827ef0189d3)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:40 +00:00
Ross Burton
7dc792da69 Revert "libwnck3: remove the recipe"
The epiphany in morty still needs libwnck3, so bring it back.

This reverts commit 129281e8557ec8d29ecf863675884713a3050f4b.

(From OE-Core rev: d09108805dab4595101706f6e75a0a622d3b0cda)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:40 +00:00
Richard Purdie
350df1de9c rm_work: Ensure we don't remove sigbasedata files
We don't remove sigdata files, we also shouldn't remove sigbasedata files
as this hinders debugging.

(From OE-Core rev: 988349f90c8dc5498b1f08f71e99b13e928a0fd0)

(From OE-Core rev: c8d96b10ee3bc2eae0fd269d2564286fd0bc82ed)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:58 +00:00
Richard Purdie
350a850d44 sstate: Ensure we don't remove sigbasedata files
We don't remove sigdata files, we also shouldn't remove sigbasedata files
as this hinders debugging.

(From OE-Core rev: 1ebd85f8dfe45b92c0137547c05e013e340f9cec)

(From OE-Core rev: 3764a5ce8a1f26b46c389c256c10596ed8d31cc7)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:58 +00:00
Andre McCurdy
87d51bd79b gdb: update 7.11+git1a982b689c -> 7.11.1
41d8236 Set GDB version number to 7.11.1.
  136613e Fix PR gdb/19828: gdb -p <process from a container>: internal error
  a0de87e Make gdb/linux-nat.c consider a waitstatus pending on the infrun side
  cf2cd51 Add mi-threads-interrupt.exp test (PR 20039)
  f0a8d0d Fix double prompt output after run control MI commands with mi-async on (PR 20045)
  b5f0db4 Fix -exec-run not running asynchronously with mi-async on (PR gdb/18077)
  7f8e34d Use target_terminal_ours_for_output in MI

(From OE-Core rev: 371345c0dc49bf781c27aea1e9f6a4c947fa30e6)

(From OE-Core rev: 23a7c411b39eece9c80e1fde84894c75ca8dcbe0)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:58 +00:00
Dengke Du
d16356eb26 subversion: fix "svnadmin create" fail on x86
When run the following command on x86:

        svnadmin create /var/test_repo

It cause segmentation fault error like the following:

        [16499.751837] svnadmin[21117]: segfault at 83 ip 00000000f74bf7f6 sp 00000000ffdd9b34 error 4 in libc-2.24.so[f7441000+1af000]
        Segmentation fault (core dumped)

This is because in source code ./subversion/libsvn_fs_fs/low_level.c,
function svn_fs_fs__unparse_footer, when:

        target arch:    x86
        apr_off_t:      4 bytes

if the "APR_OFF_T_FMT" is "lld", it still use type "apr_off_t" to pass
data to apr, but in apr source code file apr_snprintf.c the function
apr_vformatter meet "lld", it would use the:

        i_quad = va_arg(ap, apr_int64_t);

It uses the apr_int64_t to deal data, it read 8 bytes, so the follow-up
data may be error.

(From OE-Core rev: 7ea7e3db7801b58495b89a95ec2751d618d3a29f)

(From OE-Core rev: 81b9ac05bdb3dc89c6fd17acbfff7cc4f4685108)

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:58 +00:00
Paul Eggleton
a531ca4636 classes/populate_sdk_ext: prevent invalid TEMPLATECONF entering eSDK
If you are using a repository which contains a .templateconf file that
sets TEMPLATECONF to point into a layer it contains, but you aren't
using that layer in your bblayers.conf, the eSDK would produce an error
during the preparation step of the installation. An example would be
using the poky repository but setting DISTRO to your own custom distro
and removing meta-poky from your bblayers.conf. The eSDK doesn't
support creating new build directories, so we don't care about the
templates and can thus force a known good value to prevent this from
happening.

Fixes [YOCTO #10568].

(From OE-Core rev: 5ee32191a18013061dfa72e64713a94c5d321496)

(From OE-Core rev: 7fbc086f47ef6e36c819836deaa1b2fb3f0ec97a)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:58 +00:00
André Draszik
c2fd90f245 bash_3.2.x: update recipe version to match what we're shipping
Make sure the recipe version matches what we're
actually shipping, so that tools like cve-check
can do the right thing.

Rather than fetching version 3.2.48 and applying all
patches up to and including version 3.2.57, we just
fetch the latter in the first place.

(From OE-Core rev: 614ac87f2832c5359f371439559be88d6106cd6b)

(From OE-Core rev: db3f5330d7a38bb07aca0d65aa94ca36beb721d6)

Signed-off-by: André Draszik <adraszik@tycoint.com>
Acked-by: Sylvain Lemieux <slemieux@tycoint.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Kai Kang
0572d73d11 qemu: fix CVE-2016-7423 and CVE-2016-7908
Backport patches to fix CVE-2016-7423 and CVE-2016-7908 of qemu.

(From OE-Core rev: 1f4c303fd64a4bc05882de01676f241f0df6da78)

(From OE-Core rev: 34b9be55c31deb4eab5056cf1698c8052aca2596)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Kai Kang
1bad6c2d73 qemu: supplementary fix of CVE-2016-5403
It is reported in qemu community that VM always exits with:

| 2016-10-17T07:33:40.393592Z qemu-kvm: Virtqueue size exceede

when VM is suspend and resume. Solution from the maintainer of virtio
is to merge following 3 commits:

http://git.qemu.org/?p=qemu.git;a=commit;h=bccdef6
http://git.qemu.org/?p=qemu.git;a=commit;h=58a83c6
http://git.qemu.org/?p=qemu.git;a=commit;h=4b7f91e

The first 2 commits have been merged in qemu 2.7.0. Then apply the
third one.

(From OE-Core rev: db5b9254fbbc30e50b50c7c8cd1f04dcc965cd52)

(From OE-Core rev: 7fa650825957257e6f99d44907c65fd46875125c)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Armin Kuster
ff95390bee tzdata: Update to 2016h
Changes to future time stamps

    Asia/Gaza and Asia/Hebron end DST on 2016-10-29 at 01:00, not
    2016-10-21 at 00:00.  (Thanks to Sharef Mustafa.)  Predict that
    future fall transitions will be on the last Saturday of October
    at 01:00, which is consistent with predicted spring transitions
    on the last Saturday of March.  (Thanks to Tim Parenti.)

Changes to past time stamps

    In Turkey, transitions in 1986-1990 were at 01:00 standard time
    not at 02:00, and the spring 1994 transition was on March 20, not
    March 27.  (Thanks to Kıvanç Yazan.)

Changes to past and future time zone abbreviations

    Asia/Colombo now uses numeric time zone abbreviations like "+0530"
    instead of alphabetic ones like "IST" and "LKT".  Various
    English-language sources use "IST", "LKT" and "SLST", with no
    working consensus.  (Usage of "SLST" mentioned by Sadika
    Sumanapala.)

(From OE-Core rev: ff11ca44fec8e4b2aa523e032bd967e3ab8339a8)

(From OE-Core rev: 5637d1555b51569cdd7202ee47a0b913a0b429cb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Armin Kuster
19bee74728 tzcode-native: update to 2016h
Changes to code

zic no longer mishandles relativizing file names when creating
symbolic links like /etc/localtime, when these symbolic links
are outside the usual directory hierarchy.  This fixes a bug
introduced in 2016g.  (Problem reported by Andreas Stieger.)

(From OE-Core rev: 9c5de646e01a83219be74e99dcf7c1e56ba38b53)

(From OE-Core rev: 9288b6e699abbf5b314029b0db9230ca159b335a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Robert P. J. Day
849863fdaf testsdk.bbclass: Clean up comments, clarify image choices.
Make it clear that SDK testing can use any valid image.

(From OE-Core rev: d190c69347921a626665a53469dcf99b3c86994b)

(From OE-Core rev: 7c16202e8c532f4d6ae78ac4bd324f7d975e8a76)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Olaf Mandel
ac8981c01d texi2html: Allow compiling out-of-source
Compiling texi2html 5.0 out-of-source with USE_NLS set to no failed
because it tried to copy from srcdir without using that variable.
Fix this issue and add a reference to the upstream commit.

(From OE-Core rev: 28a37020f50e513b247015b1b0a784c99d41aae3)

(From OE-Core rev: f31ec69379a752e18321ce600a09db9de48fc263)

Signed-off-by: Olaf Mandel <o.mandel@menlosystems.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
3081194a9f valgrind: update to 3.12.0
Remove backported gcc5-port.patch
Remove 11_mips-link-tool.patch as there is nothing in the target file
(or the entire source tree) that resembles anything contained in the patch.

(From OE-Core rev: 221093e850fbc3c154e9069f1958384b59ba3f70)

(From OE-Core rev: 7178febeb04f9b7326554f6b57ed50345fd95126)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
b6335e4251 libarchive: update to 3.2.2
(From OE-Core rev: 14fc66856a59e44d6861ed4ef88909908e597615)

(From OE-Core rev: 9fde7e21d5f61553c371124380982ecd6402ccb9)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
274d77860f libwnck3: remove the recipe
Nothing requires it in oe-core now, so it will be re-added to meta-openembedded.

(From OE-Core rev: 5741419426c6f8255d55560e3a4721fa4c68a179)

(From OE-Core rev: 129281e8557ec8d29ecf863675884713a3050f4b)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
8d2e24810e epiphany: remove unnecessary libwnck3 dependency
libwnck3 dependency was removed upstream

(From OE-Core rev: 0af26d519fd282d0b270939a75ce33eba715669b)

(From OE-Core rev: fb5c4f181176710a4cfb3c875b5edb4e5aa5df73)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
a368478133 rt-tests: fix the recipe version to match upstream
Upstream had a 2.0 tag for a while, then removed it and added a 1.1 tag :-/
Let's make it match to avoid confusion. There's only one new commit
added, which adds a missing manpage.

Also, update the outdated version comment in rt-tests.inc

(From OE-Core rev: 799a7b74f1219040fe2d43dcdcd145600a9fecbd)

(From OE-Core rev: 5a577f1aa4891646075a559fc94e52cfe34b96c9)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
77bc68c7ac webkitgtk: remove lib_package inherit as executables are now installed in libexecdir
(From OE-Core rev: 60751d66118103712f7670412051234cec41e439)

(From OE-Core rev: dd46a43b9ebc6b3183e5ad154c1736330e93e04e)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
4708f7af51 gnome-desktop3: fix dependencies
libxrandr dependency has been removed upstream

Udev dependecy has been added upstream:

    commit b8cbfbe06475703f333367976eae9477f229891a

    pnp-ids: Use udev's hwdb to query PNP IDs

(From OE-Core rev: 5f939fbf229e3c05d6b726f481a0e862ad5a5ceb)

(From OE-Core rev: 623f9eb815ae0a53f96222947b566c4e6d74ab97)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Alexander Kanavin
17a550b9de lttng-tools: do not install shared libraries in ptest package
This was creating a race in runtime library dependency resolution
where sometimes the library was assumed to be provided by the ptest
package.

(From OE-Core rev: c4a10c0b4bc14f4bac06deed8ecb64d0303f4029)

(From OE-Core rev: 10e32463236df05458af7fb7d1ef388f380ab10c)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Ross Burton
30cdca66c5 shadow: add nologin.8 to alternatives
This manpage is also shipped in util-linux-doc as an alternative, so it needs to
be managed as an alternative here too.

(From OE-Core rev: 0c1e8e0939b39dcf6ea753b41da5ec9bc6ebb82a)

(From OE-Core rev: 4a916484adbf7ae38338279b83f8a64c2cee4f3e)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Ross Burton
54e8fa5060 util-linux: add su.1 to update-alternatives
The su binary is handled by alternatives but the man page wasn't, so
installing both util-linux-doc and shadow-doc produces errors.

Also use d.expand() to neaten the code.

(From OE-Core rev: 70a161ee88d3d54fec6d59039c181b43f1857dc3)

(From OE-Core rev: bec07530536c36b2ab2a7818a9ffc475faba27ac)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Mike Looijmans
9600da51e4 busybox/mdev.conf: Ignore eMMC RPMB and boot block devices
eMMC devices may report block devices like "mmcblk0rpmb" and
"mmcblk0boot0". These are not actually block devices and any
read/write operation on them will fail. To prevent spamming error
messages attempting to mount them, just ignore these devices.

(From OE-Core rev: 9f4a85eb929f67420d9689d7dddadd120ed49843)

(From OE-Core rev: 50d97edaeb18a4c6374101d222410a3b0f344bf2)

Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Samuli Piippo
ee6ff5ce83 package_manager.py: correctly remove all dependent packages
Do not use --force-depends when trying to remove all dependent packages,
as it removes only the selected package and not the dependent packages.

(From OE-Core rev: a82e8725902086dab785a0b14305927dae1e4e8d)

(From OE-Core rev: 0666c66b2719f59e556c12d5875dea696006ed0b)

Signed-off-by: Samuli Piippo <samuli.piippo@qt.io>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Robert Yang
7a308a7919 insane.bbclass:buildpaths: open() file with 'rb'
open() is default to 'rt' which may cause decoding errors when open
binary file:
$ bitbake xcursor-transparent-theme
[snip]
Exception: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xfd in position 18: invalid start byte
[snip]

(From OE-Core rev: ddbab61f47efd9b4fde38ef8f0f3482c78abe37c)

(From OE-Core rev: 8364558a2904d21c9b31d29bfb8f2d9cbeac8659)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:57 +00:00
Paul Eggleton
6a1ef8a965 classes/nativesdk: set SDK_OLDEST_KERNEL appropriately
SDK_OLDEST_KERNEL currently only controls the check on SDK installation,
however as with OLDEST_KERNEL it should be controlling the OLDEST_KERNEL
value for building glibc used in the SDK. Thus, set it in
nativesdk.bbclass. This means we need to move the default to
bitbake.conf so that it can be seen in both places.

Also set a more reasonable default for SDK_OLDEST_KERNEL for x86/x86-64 as
glibc 2.24 still supports back to 2.6.32 there and there are still
people wanting to build SDKs that will install on older distros (e.g.
CentOS 6). However it's not possible to set this with overrides since
there aren't any for the SDK_ARCH, however we can instead set the variable
from conf files in conf/machine-sdk especially as there is now a soft
default for SDKMACHINE.

Fixes [YOCTO #10561].

(From OE-Core rev: 42d5781e31c5bf76b5b7e27abed4f6f3fd65bf40)

(From OE-Core rev: e02aa8e8b62eae0f83beca850466408dd060b248)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:56 +00:00
Paul Eggleton
95a10d1dfc classes/populate_sdk_base: fix usage of & character in SDK_TITLE
If you used an & character in SDK_TITLE (possibly indirectly from
DISTRO_NAME) then sed interpreted this as a directive to paste in the
replaced string (@SDK_TITLE@ in this case). Escape any & characters in
SDK_TITLE to avoid that.

(From OE-Core rev: acb85689c13cfdac21435509001048af5c3a7e99)

(From OE-Core rev: bbad3402d431ac178cabdc00fcaf37b3a1a6bfd6)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:56 +00:00
Yi Zhao
914e89709c tiff: Security fix CVE-2016-3622
CVE-2016-3622 libtiff: The fpAcc function in tif_predict.c in the
tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to
cause a denial of service (divide-by-zero error) via a crafted TIFF
image.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3622
http://www.openwall.com/lists/oss-security/2016/04/07/4

Patch from:
92d966a5fc

(From OE-Core rev: 0af0466f0381a72b560f4f2852e1d19be7b6a7fb)

(From OE-Core rev: 928eadf8442cf87fb2d4159602bd732336d74bb7)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:56 +00:00
Yi Zhao
f33e739fc2 tiff: Security fix CVE-2016-3623
CVE-2016-3623 libtiff: The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier
allows remote attackers to cause a denial of service (divide-by-zero) by
setting the (1) v or (2) h parameter to 0.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3623
http://bugzilla.maptools.org/show_bug.cgi?id=2569

Patch from:
bd024f0701

(From OE-Core rev: d66824eee47b7513b919ea04bdf41dc48a9d85e9)

(From OE-Core rev: f0e77ffa6bbc3adc61a2abd5dbc9228e830c055d)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:56 +00:00
Yi Zhao
719a8dcd0d tiff: Security fix CVE-2016-3991
CVE-2016-3991 libtiff: Heap-based buffer overflow in the loadImage
function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote
attackers to cause a denial of service (out-of-bounds write) or execute
arbitrary code via a crafted TIFF image with zero tiles.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3991
http://bugzilla.maptools.org/show_bug.cgi?id=2543

Patch from:
e596d4e27c

(From OE-Core rev: d31267438a654ecb396aefced201f52164171055)

(From OE-Core rev: cf58711f12425fc1c29ed1e3bf3919b3452aa2b2)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:37:56 +00:00