poky: subtree update:5951cbcabe..968fcf4989

Alejandro Hernandez (3):
      baremetal-helloworld: Use do_image_complete instead of do_deploy
      baremetal-image.bbclass: Create a class for baremetal applications or an RTOS
      baremetal-helloworld: Use baremetal-image class to deploy the application

Alejandro del Castillo (2):
      opkg-utils: upgrade to 0.4.3
      opkg: upgrade to version 0.4.3

Alexander Kanavin (30):
      dnf: upgrade 4.2.21 -> 4.2.23
      meson: upgrade 0.54.2 -> 0.54.3
      libdnf: update 0.47.0 -> 0.48.0
      ffmpeg: disable altivec on ppc by default
      dropbear: update 2019.78 -> 2020.79
      elfutils: upgrade 0.179 -> 0.180
      gnu-config: update to latest revision
      libgpg-error: update 1.37 -> 1.38
      perl: update 5.30.2 -> 5.32.0
      gst-examples: upstream releases are even numbered
      bison: upgrade 3.6.3 -> 3.6.4
      python3-cython: upgrade 0.29.19 -> 0.29.20
      stress-ng: upgrade 0.11.12 -> 0.11.14
      piglit: upgrade to latest revision
      linux-firmware: upgrade 20200519 -> 20200619
      systemtap: upgrade 4.2 -> 4.3
      alsa-lib: upgrade 1.2.2 -> 1.2.3.1
      alsa-topology-conf: upgrade 1.2.2 -> 1.2.3
      alsa-ucm-conf: upgrade 1.2.2 -> 1.2.3
      alsa-utils: upgrade 1.2.2 -> 1.2.3
      puzzles: upgrade to latest revision
      diffoscope: upgrade 147 -> 148
      libcheck: upgrade 0.14.0 -> 0.15.0
      rsync: update 3.1.3 -> 3.2.1
      sudo: upgrade 1.9.0 -> 1.9.1
      python3-numpy: update 1.18.5 -> 1.19.0
      mesa: update 20.0.7 -> 20.1.2
      go-binary-native: fix upstream version check
      Revert "python3-setuptools: patch entrypoints for faster initialization"
      python3-setuptools: upgrade 47.1.1 -> 47.3.1

Alistair Francis (1):
      opensbi: Update to OpenSBI v0.8 release

Andreas Müller (3):
      nfs-utils: upgrade 2.4.3 -> 2.5.1
      ccache: merge ccache.inc into recipe
      ccache: upgrade 3.7.9 -> 3.7.10

Andrej Valek (2):
      busybox: 1.31.1 -> 1.32.0
      dropbear: update to 2020.80

Andrey Zhizhikin (1):
      kernel/yocto: fix search for defconfig from src_uri

Armin Kuster (1):
      wpa-supplicant: Security fix CVE-2020-12695

Bjarne Michelsen (1):
      devtool: default to empty string, if LIC_FILES_CHKSUM is not available

Bruce Ashfield (10):
      kernel/yocto: ensure that defconfigs are processed first
      linux-yocto/5.4: update to v5.4.45
      linux-yocto-rt/5.4: update to rt25
      linux-yocto/5.4: update to v5.4.46
      linux-yocto/5.4: update to v5.4.47
      linux-yocto/5.4: update to v5.4.49 and -rt28
      yocto-bsps: bump reference boards to v5.4.49
      linux-yocto/5.4: update to v5.4.50
      linux-yocto-dev: bump to 5.8-rc
      lttng-modules: bump devupstream to v2.12.1+

Changqing Li (5):
      xinit: add rxvt-unicode in RDEPENDS
      modutils-initscripts: update postinst
      initscripts: update postinst
      gtk-icon-cache.bbclass: add runtime dependency
      logrotate.py: fix testimage occasionally failure

Chen Qi (2):
      oescripts.py: fix typo
      oescripts: ignore whitespaces when comparing lines

Chris Laplante (2):
      bitbake: contrib/vim: synchronize from kergoth/vim-bitbake rev 4225ee8b4818d7e4696520567216a3a031c26f7d
      bitbake: ui/teamcity: don't use removed logging classes

Christian Eggers (1):
      libnl: Extend for native/nativesdk

Damian Wrobel (1):
      rootfs: do not let ldconfig to create symlinks

Daniel Klauer (2):
      uboot-sign: Refactor do_deploy prefunc to do_deploy_prepend
      deploy.bbclass: Clean DEPLOYDIR before do_deploy

David Khouya (2):
      bitbake: lib/ui/taskexp: Validate gi import
      bitbake: lib/ui/taskexp: Fix missing Gtk import

Hannu Lounento (1):
      openssl: move ${libdir}/[...]/openssl.cnf to ${PN}-conf

Hongxu Jia (1):
      iso-codes: switch upstream branch master -> main

Jason Wessel (1):
      runqemu: If using a vmtype image do not add the -no-reboot flag

Joe Slater (1):
      jquery: use ${S}

Joshua Watt (4):
      bitbake: hashserv: Chunkify large messages
      bitbake: siggen: Fix error when hash equivalence has an exception
      classes/archiver: run do_unpack_and_patch after do_preconfigure
      classes/archive: do_configure should not depend on do_ar_patched

Khem Raj (2):
      musl: Update to tip of master
      rxvt-unicode: Disable wtmp on musl

Konrad Weihmann (2):
      systemd: remove kernel-install from base pkg
      bitbake.conf: fix whitespace issues

Lee Chee Yang (3):
      json-c: fix CVE-2020-12762
      qemu: fix CVE-2020-10761
      oeqa/core/loader: refine regex to find module

Lili Li (1):
      kernel.bbclass: Fix Module.symvers support

Matt Madison (1):
      kernel.bbclass: add gzip-native to do_deploy dependencies

Max Krummenacher (2):
      cogl-1.0: : don't require eglmesaext.h
      cogl-1.0: cope with missing x11 headers

Mingli Yu (2):
      python3-libarchive-c: add the missing rdepends
      python3: add ldconfig rdepends for python3-ctypes

Nicolas Dechesne (1):
      checklayer: parse LAYERDEPENDS with bb.utils.explode_dep_versions2()

Pierre-Jean Texier (3):
      libubootenv: bump to revision 86bd30a
      curl: upgrade 7.71.0 -> 7.71.1
      diffoscope: upgrade 148 -> 150

Rahul Kumar (1):
      bzip2: Add test suite for bzip2

Rasmus Villemoes (1):
      coreutils: don't split stdbuf to own package with single-binary

Richard Purdie (13):
      pseudo: Switch to oe-core branch in git repo
      pseudo: merge in fixes for setfacl issue
      oeqa/selftest: Clean up separate builddir in success case when non-threaded
      populate_sdk_ext: Fix to use python3, not python
      bitbake: taskdata: Improve handling of regex in ASSUME_PROVIDED
      bitbake: runqueue: Avoid unpickle errors in rare cases
      bitbake: msg: Avoid issues where paths have relative components
      oeqa/selftest: recipetool/devtool: Avoid load_plugin test race
      oeqa/targetcontrol: Attempt to fix log closure warning message
      rootfs-postcommands: Improve/fix rootfs_check_host_user_contaminated
      spdx: Remove the class as its obsolete
      adwaita-icon-theme: Add missing license files to LIC_FILES_CHKSUM
      bitbake: server/process: Increase timeout for commands

Ross Burton (3):
      ovmf: build natively everywhere
      common-licenses: fix filename of BSD-2-Clause-Patent
      gtk+3: fix reproducible build failure

Timon Ulrich (2):
      kernel.bbclass: add lz4 dependency and fix the call to lz4
      kernel.bbclass: make dependency on lzop-native conditional

Vacek, Patrick (1):
      oeqa/core/loader: fix regex to include numbers

Wang Mingyu (1):
      gtk+3: upgrade 3.24.20 -> 3.24.21

Yanfei Xu (1):
      classes/kernel: Use a copy of image for kernel*.rpm if fs doesn't support symlinks

akuster (5):
      libuv: update to the last version in meta-oe
      bitbake: test/fetch: change to better svn source
      overview-manual: add SPDX license header
      mega-manual: Add SPDX license headers
      ref-manual: Add SPDX license headers

hongxu (2):
      qemu: switches from libcap to libcap-ng for PACAKGECONFIG virtfs
      cpio: add nativesdk support

zangrc (1):
      libjpeg-turbo:upgrade 2.0.4 -> 2.0.5

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I41e066e5957aa74c9a24e86a6c214bcf96e9c46b

2 files changed, 164 insertions, 1 deletions

diff --git a/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch b/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch
new file mode 100644
index 000000000..a45cfb61b
--- /dev/null
+++ b/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch
@@ -0,0 +1,160 @@
+From 099016b7e8d70a6d5dd814e788bba08d33d48426 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:41:16 +0200
+Subject: [PATCH 1/3] Protect array_list_del_idx against size_t overflow.
+
+If the assignment of stop overflows due to idx and count being
+larger than SIZE_T_MAX in sum, out of boundary access could happen.
+
+It takes invalid usage of this function for this to happen, but
+I decided to add this check so array_list_del_idx is as safe against
+bad usage as the other arraylist functions.
+
+Upstream-Status: Backport [https://github.com/json-c/json-c/commit/31243e4d1204ef78be34b0fcae73221eee6b83be]
+CVE: CVE-2020-12762
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+
+---
+ arraylist.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arraylist.c b/arraylist.c
+index 12ad8af6d3..e5524aca75 100644
+--- a/arraylist.c
++++ b/arraylist.c
+@@ -136,6 +136,9 @@ int array_list_del_idx(struct array_list *arr, size_t idx, size_t count)
+ {
+ 	size_t i, stop;
+ 
++	/* Avoid overflow in calculation with large indices. */
++	if (idx > SIZE_T_MAX - count)
++		return -1;
+ 	stop = idx + count;
+ 	if (idx >= arr->length || stop > arr->length)
+ 		return -1;
+
+From 77d935b7ae7871a1940cd827e850e6063044ec45 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:46:45 +0200
+Subject: [PATCH 2/3] Prevent division by zero in linkhash.
+
+If a linkhash with a size of zero is created, then modulo operations
+are prone to division by zero operations.
+
+Purely protective measure against bad usage.
+---
+ linkhash.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/linkhash.c b/linkhash.c
+index 7ea58c0abf..f05cc38030 100644
+--- a/linkhash.c
++++ b/linkhash.c
+@@ -12,6 +12,7 @@
+ 
+ #include "config.h"
+ 
++#include <assert.h>
+ #include <limits.h>
+ #include <stdarg.h>
+ #include <stddef.h>
+@@ -499,6 +500,8 @@ struct lh_table *lh_table_new(int size, lh_entry_free_fn *free_fn, lh_hash_fn *h
+ 	int i;
+ 	struct lh_table *t;
+ 
++	/* Allocate space for elements to avoid divisions by zero. */
++	assert(size > 0);
+ 	t = (struct lh_table *)calloc(1, sizeof(struct lh_table));
+ 	if (!t)
+ 		return NULL;
+
+From d07b91014986900a3a75f306d302e13e005e9d67 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:47:25 +0200
+Subject: [PATCH 3/3] Fix integer overflows.
+
+The data structures linkhash and printbuf are limited to 2 GB in size
+due to a signed integer being used to track their current size.
+
+If too much data is added, then size variable can overflow, which is
+an undefined behaviour in C programming language.
+
+Assuming that a signed int overflow just leads to a negative value,
+like it happens on many sytems (Linux i686/amd64 with gcc), then
+printbuf is vulnerable to an out of boundary write on 64 bit systems.
+---
+ linkhash.c |  7 +++++--
+ printbuf.c | 19 ++++++++++++++++---
+ 2 files changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/linkhash.c b/linkhash.c
+index f05cc38030..51e90b13a2 100644
+--- a/linkhash.c
++++ b/linkhash.c
+@@ -580,9 +580,12 @@ int lh_table_insert_w_hash(struct lh_table *t, const void *k, const void *v, con
+ {
+ 	unsigned long n;
+ 
+-	if (t->count >= t->size * LH_LOAD_FACTOR)
+-		if (lh_table_resize(t, t->size * 2) != 0)
++	if (t->count >= t->size * LH_LOAD_FACTOR) {
++		/* Avoid signed integer overflow with large tables. */
++		int new_size = INT_MAX / 2 < t->size ? t->size * 2 : INT_MAX;
++		if (t->size == INT_MAX || lh_table_resize(t, new_size) != 0)
+ 			return -1;
++	}
+ 
+ 	n = h % t->size;
+ 
+diff --git a/printbuf.c b/printbuf.c
+index 976c12dde5..00822fac4f 100644
+--- a/printbuf.c
++++ b/printbuf.c
+@@ -15,6 +15,7 @@
+ 
+ #include "config.h"
+ 
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -65,10 +66,16 @@ static int printbuf_extend(struct printbuf *p, int min_size)
+ 
+ 	if (p->size >= min_size)
+ 		return 0;
+-
+-	new_size = p->size * 2;
+-	if (new_size < min_size + 8)
++	/* Prevent signed integer overflows with large buffers. */
++	if (min_size > INT_MAX - 8)
++		return -1;
++	if (p->size > INT_MAX / 2)
+ 		new_size = min_size + 8;
++	else {
++		new_size = p->size * 2;
++		if (new_size < min_size + 8)
++			new_size = min_size + 8;
++	}
+ #ifdef PRINTBUF_DEBUG
+ 	MC_DEBUG("printbuf_memappend: realloc "
+ 	         "bpos=%d min_size=%d old_size=%d new_size=%d\n",
+@@ -83,6 +90,9 @@ static int printbuf_extend(struct printbuf *p, int min_size)
+ 
+ int printbuf_memappend(struct printbuf *p, const char *buf, int size)
+ {
++	/* Prevent signed integer overflows with large buffers. */
++	if (size > INT_MAX - p->bpos - 1)
++		return -1;
+ 	if (p->size <= p->bpos + size + 1)
+ 	{
+ 		if (printbuf_extend(p, p->bpos + size + 1) < 0)
+@@ -100,6 +110,9 @@ int printbuf_memset(struct printbuf *pb, int offset, int charvalue, int len)
+ 
+ 	if (offset == -1)
+ 		offset = pb->bpos;
++	/* Prevent signed integer overflows with large buffers. */
++	if (len > INT_MAX - offset)
++		return -1;
+ 	size_needed = offset + len;
+ 	if (pb->size < size_needed)
+ 	{
diff --git a/poky/meta/recipes-devtools/json-c/json-c_0.14.bb b/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
index 99fde873b..1d501d129 100644
--- a/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
+++ b/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
@@ -4,7 +4,10 @@ HOMEPAGE = "https://github.com/json-c/json-c/wiki"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2"
 
-SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz"
+SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \
+           file://CVE-2020-12762.patch \
+"
+
 SRC_URI[sha256sum] = "b377de08c9b23ca3b37d9a9828107dff1de5ce208ff4ebb35005a794f30c6870"
 
 UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/releases"