Commit Graph

6 Commits

Author SHA1 Message Date
Hitendra Prajapati
9c934f60ce elfutils: Fix multiple CVEs
Backport fixes for:

* CVE-2025-1352 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753
* CVE-2025-1372 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db

(From OE-Core rev: 8ea258ad9c83be5d9548a796f7dda4ac820fc435)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-03-04 08:46:02 -08:00
Khem Raj
88ba7d2d3a elfutils: Disable stringop-overflow warning for build host
Some distributions shipping gcc12 end up with stringop-overflow warnings
e.g.
/usr/include/bits/unistd.h:74:10: error: ‘__pread_alias’ specified size between 9223372036854775813 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Werror=stringop-overflow=]
   74 |   return __glibc_fortify (pread, __nbytes, sizeof (char),
      |          ^~~~~~~~~~~~~~~

Until fixed, lets not treat this warning as hard error

MJ: this is needed e.g. on ubuntu 24.04 after gcc was upgraded
    from 13.2.0-8ubuntu1 to 13.2.0-9ubuntu1 which includes
    switch _FORTIFY_SOURCE to 3:
    https://changelogs.ubuntu.com/changelogs/pool/main/g/gcc-13/gcc-13_13.2.0-9ubuntu1/changelog

elfutils config.log then shows:

configure:6762: checking whether to add -D_FORTIFY_SOURCE=2 to CFLAGS
configure:6779: gcc  -c -D_FORTIFY_SOURCE=2 -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include -O2 -pipe -Werror -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include conftest.c >&5
<command-line>: error: "_FORTIFY_SOURCE" redefined [-Werror]
<built-in>: note: this is the location of the previous definition
cc1: all warnings being treated as errors
configure:6786: result: no

and -D_FORTIFY_SOURCE=2 missing in CFLAGS later causes the above error
in do_compile

(From OE-Core rev: 94d1640d374c9a8827957cba8dbc1c1f978701b5)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04 05:00:13 -10:00
Peter Kjellerstedt
83766c9fff meta, meta-selftest: Replace more non-SPDX license identifiers
In commit ceda3238 (meta/meta-selftest/meta-skeleton: Update LICENSE
variable to use SPDX license identifiers) all LICENSE variables were
updated to only use SPDX license identifiers.

This does the same for comments and other variables where it is
appropriate to use the official SPDX license identifiers. There are
still references to, e.g., "GPLv3", but they are then typically in
descriptive text where they refer to the license in a generic sense.

(From OE-Core rev: 165759dced7fbe73b1db2ede67047896071dc6d0)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-01 23:44:59 +00:00
Richard Purdie
b0130fcf91 meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.

(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-20 16:45:25 +00:00
Alexander Kanavin
1f1f12feca elfutils: update patch submitted upstream
As that's what upstream prefers.

(From OE-Core rev: 5a6cd9cc1b9d8fd3607f3df311accb483d2989a3)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-12-17 09:56:14 +00:00
Alexander Kanavin
5185608b60 elfutils: update 0.185 -> 0.186
Drop glibc-2.34-fix.patch merged upstream.

Rework support for error() on non-glibc targets:
upstream now provides its own implementation, so we can drop
the patch that adds ours; said implementation isn't
build-tested with tests, so ptest has to be disabled on musl.
This, in turns, allows dropping 0004-Fix-error-on-musl.patch.

License-Update: copyright years
(From OE-Core rev: 9c51ae20c0e4c0d3e7161fc6b51fca078dbf014a)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-25 21:55:10 +00:00