diff options
Diffstat (limited to 'poky/meta/recipes-extended')
16 files changed, 216 insertions, 61 deletions
diff --git a/poky/meta/recipes-extended/asciidoc/asciidoc_9.0.4.bb b/poky/meta/recipes-extended/asciidoc/asciidoc_9.0.4.bb index 4d94adec0..bb4248a5e 100644 --- a/poky/meta/recipes-extended/asciidoc/asciidoc_9.0.4.bb +++ b/poky/meta/recipes-extended/asciidoc/asciidoc_9.0.4.bb @@ -8,7 +8,7 @@ LICENSE = "GPLv2" LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=4e5d1baf6f20559e3bec172226a47e4e \ file://LICENSE;md5=b234ee4d69f5fce4486a80fdaf4a4263 " -SRC_URI = "git://github.com/asciidoc/asciidoc-py3;protocol=https \ +SRC_URI = "git://github.com/asciidoc/asciidoc-py3;protocol=https;branch=main \ file://auto-catalogs.patch" SRCREV = "8de61a75572b5b8f90c1f87634aa3767472be7a7" diff --git a/poky/meta/recipes-extended/cups/cups.inc b/poky/meta/recipes-extended/cups/cups.inc index e7a704134..244c87001 100644 --- a/poky/meta/recipes-extended/cups/cups.inc +++ b/poky/meta/recipes-extended/cups/cups.inc @@ -15,6 +15,7 @@ SRC_URI = "https://github.com/apple/cups/releases/download/v${PV}/${BP}-source.t file://0004-cups-fix-multilib-install-file-conflicts.patch \ file://volatiles.99_cups \ file://cups-volatiles.conf \ + file://CVE-2020-10001.patch \ " UPSTREAM_CHECK_URI = "https://github.com/apple/cups/releases" @@ -54,6 +55,8 @@ EXTRA_OECONF = " \ --enable-debug \ --disable-relro \ --enable-libusb \ + --with-system-groups=lpadmin \ + --with-cups-group=lp \ --with-domainsocket=/run/cups/cups.sock \ DSOFLAGS='${LDFLAGS}' \ " diff --git a/poky/meta/recipes-extended/cups/cups/CVE-2020-10001.patch b/poky/meta/recipes-extended/cups/cups/CVE-2020-10001.patch new file mode 100644 index 000000000..09a0a5765 --- /dev/null +++ b/poky/meta/recipes-extended/cups/cups/CVE-2020-10001.patch @@ -0,0 +1,74 @@ +From efbea1742bd30f842fbbfb87a473e5c84f4162f9 Mon Sep 17 00:00:00 2001 +From: Michael R Sweet <msweet@msweet.org> +Date: Mon, 1 Feb 2021 15:02:32 -0500 +Subject: [PATCH] Fix a buffer (read) overflow in ippReadIO (CVE-2020-10001) + +Upstream-Status: Backport +CVE: CVE-2020-10001 + +Reference to upstream patch: +[https://github.com/OpenPrinting/cups/commit/efbea1742bd30f842fbbfb87a473e5c84f4162f9] + +[SG: Addapted for version 2.3.3] +Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> +--- + CHANGES.md | 2 ++ + cups/ipp.c | 8 +++++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/CHANGES.md b/CHANGES.md +index df72892..5ca12da 100644 +--- a/CHANGES.md ++++ b/CHANGES.md +@@ -4,6 +4,8 @@ CHANGES - 2.3.3 - 2020-04-24 + Changes in CUPS v2.3.3 + ---------------------- + ++- Security: Fixed a buffer (read) overflow in the `ippReadIO` function ++ (CVE-2020-10001) + - CVE-2020-3898: The `ppdOpen` function did not handle invalid UI + constraint. `ppdcSource::get_resolution` function did not handle + invalid resolution strings. +diff --git a/cups/ipp.c b/cups/ipp.c +index 3d52934..adbb26f 100644 +--- a/cups/ipp.c ++++ b/cups/ipp.c +@@ -2866,7 +2866,8 @@ ippReadIO(void *src, /* I - Data source */ + unsigned char *buffer, /* Data buffer */ + string[IPP_MAX_TEXT], + /* Small string buffer */ +- *bufptr; /* Pointer into buffer */ ++ *bufptr, /* Pointer into buffer */ ++ *bufend; /* End of buffer */ + ipp_attribute_t *attr; /* Current attribute */ + ipp_tag_t tag; /* Current tag */ + ipp_tag_t value_tag; /* Current value tag */ +@@ -3441,6 +3442,7 @@ ippReadIO(void *src, /* I - Data source */ + } + + bufptr = buffer; ++ bufend = buffer + n; + + /* + * text-with-language and name-with-language are composite +@@ -3454,7 +3456,7 @@ ippReadIO(void *src, /* I - Data source */ + + n = (bufptr[0] << 8) | bufptr[1]; + +- if ((bufptr + 2 + n) >= (buffer + IPP_BUF_SIZE) || n >= (int)sizeof(string)) ++ if ((bufptr + 2 + n + 2) > bufend || n >= (int)sizeof(string)) + { + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, + _("IPP language length overflows value."), 1); +@@ -3481,7 +3483,7 @@ ippReadIO(void *src, /* I - Data source */ + bufptr += 2 + n; + n = (bufptr[0] << 8) | bufptr[1]; + +- if ((bufptr + 2 + n) >= (buffer + IPP_BUF_SIZE)) ++ if ((bufptr + 2 + n) > bufend) + { + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, + _("IPP string length overflows value."), 1); +-- +2.17.1 + diff --git a/poky/meta/recipes-extended/go-examples/go-helloworld_0.1.bb b/poky/meta/recipes-extended/go-examples/go-helloworld_0.1.bb index ab70ea98a..d3f7525dc 100644 --- a/poky/meta/recipes-extended/go-examples/go-helloworld_0.1.bb +++ b/poky/meta/recipes-extended/go-examples/go-helloworld_0.1.bb @@ -6,13 +6,14 @@ LICENSE = "MIT" LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302" SRC_URI = "git://${GO_IMPORT}" -SRCREV = "46695d81d1fae905a270fb7db8a4d11a334562fe" +SRCREV = "bcf50bfd7dcd8020c90965747d857ae42802e0c5" UPSTREAM_CHECK_COMMITS = "1" GO_IMPORT = "github.com/golang/example" GO_INSTALL = "${GO_IMPORT}/hello" +GO_WORKDIR = "${GO_INSTALL}" -inherit go +inherit go-mod # This is just to make clear where this example is do_install_append() { diff --git a/poky/meta/recipes-extended/groff/groff_1.22.4.bb b/poky/meta/recipes-extended/groff/groff_1.22.4.bb index 7bb393e09..983cb9aea 100644 --- a/poky/meta/recipes-extended/groff/groff_1.22.4.bb +++ b/poky/meta/recipes-extended/groff/groff_1.22.4.bb @@ -20,7 +20,6 @@ SRC_URI[sha256sum] = "e78e7b4cb7dec310849004fa88847c44701e8d133b5d4c13057d876c1b # Remove at the next upgrade PR = "r1" -HASHEQUIV_HASH_VERSION .= ".1" DEPENDS = "bison-native" RDEPENDS_${PN} += "perl sed" diff --git a/poky/meta/recipes-extended/iputils/iputils_s20200821.bb b/poky/meta/recipes-extended/iputils/iputils_s20200821.bb index 28dd194a1..e43abf262 100644 --- a/poky/meta/recipes-extended/iputils/iputils_s20200821.bb +++ b/poky/meta/recipes-extended/iputils/iputils_s20200821.bb @@ -26,7 +26,7 @@ CVE_CHECK_WHITELIST += "CVE-2000-1213 CVE-2000-1214" PACKAGECONFIG ??= "libcap rarpd \ ${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'ninfod traceroute6', '', d)} \ ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}" -PACKAGECONFIG[libcap] = "-DUSE_CAP=true, -DUSE_CAP=false, libcap" +PACKAGECONFIG[libcap] = "-DUSE_CAP=true, -DUSE_CAP=false -DNO_SETCAP_OR_SUID=true, libcap libcap-native" PACKAGECONFIG[libidn] = "-DUSE_IDN=true, -DUSE_IDN=false, libidn2" PACKAGECONFIG[gettext] = "-DUSE_GETTEXT=true, -DUSE_GETTEXT=false, gettext" PACKAGECONFIG[ninfod] = "-DBUILD_NINFOD=true,-DBUILD_NINFOD=false," @@ -38,8 +38,7 @@ PACKAGECONFIG[docs] = "-DBUILD_HTML_MANS=true -DBUILD_MANS=true,-DBUILD_HTML_MAN inherit meson systemd update-alternatives -# Have to disable setcap/suid as its not deterministic -EXTRA_OEMESON += "--prefix=${root_prefix}/ -DNO_SETCAP_OR_SUID=true" +EXTRA_OEMESON += "--prefix=${root_prefix}/" ALTERNATIVE_PRIORITY = "100" diff --git a/poky/meta/recipes-extended/ltp/ltp/determinism.patch b/poky/meta/recipes-extended/ltp/ltp/determinism.patch new file mode 100644 index 000000000..76d40721b --- /dev/null +++ b/poky/meta/recipes-extended/ltp/ltp/determinism.patch @@ -0,0 +1,43 @@ +open_posix_testsuite/generate-makefiles.sh: Fix determinism issue + +Currently the list of tests is generated by the order of the files found +within the directories. This results in differences in the run.sh and +Makefiles. Within Yocto Project this results in differing target +test packages. The fix is simple, just sort the output from locate-test. + +mk/lib.mk: Sort wildcard expansion for determinism + +The order of the objects linked into libltp.a varies depending on the +order of the files found on disk. This results in most ltp binaries +differing depending on that order too. + +Sort the wildcard expansion of *.c which leads to reproducible binaries. + +Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> +Upstream-Status: Submitted [http://lists.linux.it/pipermail/ltp/2021-March/021272.html http://lists.linux.it/pipermail/ltp/2021-March/021273.html] + +Index: git/testcases/open_posix_testsuite/scripts/generate-makefiles.sh +=================================================================== +--- git.orig/testcases/open_posix_testsuite/scripts/generate-makefiles.sh ++++ git/testcases/open_posix_testsuite/scripts/generate-makefiles.sh +@@ -24,7 +24,7 @@ generate_locate_test_makefile() { + + echo "Generating $maketype Makefiles" + +- locate-test --$maketype | sed -e 's,^./,,g' > make-gen.$maketype ++ locate-test --$maketype | sed -e 's,^./,,g' | sort > make-gen.$maketype + + generate_makefiles make-gen.$maketype $* + +Index: git/include/mk/lib.mk +=================================================================== +--- git.orig/include/mk/lib.mk ++++ git/include/mk/lib.mk +@@ -50,6 +50,7 @@ endif + MAKE_TARGETS += $(LIB) + + LIBSRCS ?= $(wildcard $(abs_srcdir)/*.c) ++LIBSRCS := $(sort $(LIBSRCS)) + LIBSRCS := $(abspath $(LIBSRCS)) + LIBSRCS := $(subst $(abs_srcdir)/,,$(wildcard $(LIBSRCS))) + LIBSRCS := $(filter-out $(FILTER_OUT_LIBSRCS),$(LIBSRCS)) diff --git a/poky/meta/recipes-extended/ltp/ltp_20210121.bb b/poky/meta/recipes-extended/ltp/ltp_20210121.bb index c541f9859..593f07087 100644 --- a/poky/meta/recipes-extended/ltp/ltp_20210121.bb +++ b/poky/meta/recipes-extended/ltp/ltp_20210121.bb @@ -29,11 +29,16 @@ CFLAGS_append_powerpc64 = " -D__SANE_USERSPACE_TYPES__" CFLAGS_append_mipsarchn64 = " -D__SANE_USERSPACE_TYPES__" SRCREV = "4d005621edd109d119627eb9210b224a63bf22cb" +# remove at next version upgrade or when output changes +PR = "r1" +HASHEQUIV_HASH_VERSION .= ".1" + SRC_URI = "git://github.com/linux-test-project/ltp.git \ file://0001-build-Add-option-to-select-libc-implementation.patch \ file://0007-Fix-test_proc_kill-hanging.patch \ file://0001-Add-more-musl-exclusions.patch \ file://0001-Remove-OOM-tests-from-runtest-mm.patch \ + file://determinism.patch \ " S = "${WORKDIR}/git" @@ -51,6 +56,14 @@ EXTRA_OECONF = " --with-realtime-testsuite --with-open-posix-testsuite " # ltp network/rpc test cases ftbfs when libtirpc is found EXTRA_OECONF += " --without-tirpc " +do_compile_prepend() { + # Reported at http://lists.linux.it/pipermail/ltp/2021-March/021274.html + # Avoid a race over construction of libswapon.o which is built by swapon and swapoff + # but the object differs depending upon which one built it + # ("../swapon/libswapon.c" vs "libswapon.c" references) + make -C ${B}/testcases/kernel/syscalls/swapon/ +} + do_install(){ install -d ${D}${prefix}/ oe_runmake DESTDIR=${D} SKIP_IDCHECK=1 install diff --git a/poky/meta/recipes-extended/net-tools/net-tools/Bug_443075-ifconfig.c-pointtopoint_spelling.patch b/poky/meta/recipes-extended/net-tools/net-tools/Bug_443075-ifconfig.c-pointtopoint_spelling.patch deleted file mode 100644 index 74d74668c..000000000 --- a/poky/meta/recipes-extended/net-tools/net-tools/Bug_443075-ifconfig.c-pointtopoint_spelling.patch +++ /dev/null @@ -1,26 +0,0 @@ -Description: Accept "pointtopoint" as a synonym for "pointopoint" -Bug-Debian: https://bugs.debian.org/443075 -Author: Justin Pryzby <pryzbyj@libra> - -Upstream-Status: Pending -Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> - ---- a/ifconfig.c -+++ b/ifconfig.c -@@ -644,14 +644,14 @@ - spp++; - continue; - } -- if (!strcmp(*spp, "-pointopoint")) { -+ if (!strcmp(*spp, "-pointopoint") || !strcmp(*spp, "-pointtopoint")) { - goterr |= clr_flag(ifr.ifr_name, IFF_POINTOPOINT); - spp++; - if (test_flag(ifr.ifr_name, IFF_POINTOPOINT) > 0) - fprintf(stderr, _("Warning: Interface %s still in POINTOPOINT mode.\n"), ifr.ifr_name); - continue; - } -- if (!strcmp(*spp, "pointopoint")) { -+ if (!strcmp(*spp, "pointopoint") || !strcmp(*spp, "pointtopoint")) { - if (*(spp + 1) != NULL) { - spp++; - safe_strncpy(host, *spp, (sizeof host)); diff --git a/poky/meta/recipes-extended/net-tools/net-tools/Bug_541172-netstat.c-exit-codes.patch b/poky/meta/recipes-extended/net-tools/net-tools/Bug_541172-netstat.c-exit-codes.patch deleted file mode 100644 index 782b94bc6..000000000 --- a/poky/meta/recipes-extended/net-tools/net-tools/Bug_541172-netstat.c-exit-codes.patch +++ /dev/null @@ -1,22 +0,0 @@ -Description: Bug#541172: netstat.c exit codes - -Upstream-Status: Pending -Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> - ---- a/netstat.c -+++ b/netstat.c -@@ -2237,12 +2237,14 @@ - parsesnmp(flag_raw, flag_tcp, flag_udp, flag_sctp); - #else - ENOSUPP("netstat", "AF INET"); -+ exit(1); - #endif - } else if(!strcmp(afname, "inet6")) { - #if HAVE_AFINET6 - parsesnmp6(flag_raw, flag_tcp, flag_udp); - #else - ENOSUPP("netstat", "AF INET6"); -+ exit(1); - #endif - } else { - printf(_("netstat: No statistics support for specified address family: %s\n"), afname); diff --git a/poky/meta/recipes-extended/net-tools/net-tools_1.60-20181103.bb b/poky/meta/recipes-extended/net-tools/net-tools_2.10.bb index e163a6948..de4a71597 100644 --- a/poky/meta/recipes-extended/net-tools/net-tools_1.60-20181103.bb +++ b/poky/meta/recipes-extended/net-tools/net-tools_2.10.bb @@ -6,14 +6,11 @@ LICENSE = "GPLv2+" LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ file://ifconfig.c;beginline=11;endline=15;md5=d1ca372080ad5401e23ca0afc35cf9ba" -PV = "1.60-20181103+git${SRCPV}" -SRCREV = "0eebece8c964e3cfa8a018f42b2e7e751a7009a0" +SRCREV = "80d7b95067f1f22fece9537dea6dff53081f4886" SRC_URI = "git://git.code.sf.net/p/net-tools/code;protocol=https \ file://net-tools-config.h \ file://net-tools-config.make \ file://Add_missing_headers.patch \ - file://Bug_443075-ifconfig.c-pointtopoint_spelling.patch \ - file://Bug_541172-netstat.c-exit-codes.patch \ " S = "${WORKDIR}/git" @@ -28,6 +25,8 @@ PACKAGECONFIG[hostname] = "" PACKAGECONFIG[arp] = "" PACKAGECONFIG[serial] = "" PACKAGECONFIG[plip] = "" +PACKAGECONFIG[slattach] = "" +PACKAGECONFIG[plipconfig] = "" do_configure() { # net-tools has its own config mechanism requiring "make config" @@ -119,4 +118,4 @@ ALTERNATIVE_${PN}-mii-tool = "mii-tool" ALTERNATIVE_TARGET[mii-tool] = "${base_sbindir}/mii-tool" ALTERNATIVE_LINK_NAME[mii-tool] = "${base_sbindir}/mii-tool" -BBCLASSEXTEND = "native nativesdk"
\ No newline at end of file +BBCLASSEXTEND = "native nativesdk" diff --git a/poky/meta/recipes-extended/parted/parted_3.4.bb b/poky/meta/recipes-extended/parted/parted_3.4.bb index db59189fa..79dad5468 100644 --- a/poky/meta/recipes-extended/parted/parted_3.4.bb +++ b/poky/meta/recipes-extended/parted/parted_3.4.bb @@ -39,6 +39,7 @@ do_install_ptest() { sed -i "s|^abs_srcdir =.*|abs_srcdir = \.|g" $t/tests/Makefile sed -i "s|^abs_top_srcdir =.*|abs_top_srcdir = \.\.|g" $t/tests/Makefile sed -i "s|^Makefile:.*|Makefile:|g" $t/tests/Makefile + sed -i "/^BUILDINFO.*$/d" $t/tests/Makefile for i in print-align print-max print-flags dup-clobber duplicate fs-resize; \ do cp ${B}/tests/.libs/$i $t/tests/; \ done diff --git a/poky/meta/recipes-extended/screen/screen/CVE-2021-26937.patch b/poky/meta/recipes-extended/screen/screen/CVE-2021-26937.patch new file mode 100644 index 000000000..983b35c1b --- /dev/null +++ b/poky/meta/recipes-extended/screen/screen/CVE-2021-26937.patch @@ -0,0 +1,68 @@ +Description: [CVE-2021-26937] Fix out of bounds array access +Author: Michael Schröder <mls@suse.de> +Bug-Debian: https://bugs.debian.org/982435 +Bug: https://savannah.gnu.org/bugs/?60030 +Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html +Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3 +Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html + +CVE: CVE-2021-26937 +Upstream-Status: Pending +Signed-off-by: Scott Murray <scott.murray@konsulko.com> + +--- a/encoding.c ++++ b/encoding.c +@@ -43,7 +43,7 @@ + # ifdef UTF8 + static int recode_char __P((int, int, int)); + static int recode_char_to_encoding __P((int, int)); +-static void comb_tofront __P((int, int)); ++static void comb_tofront __P((int)); + # ifdef DW_CHARS + static int recode_char_dw __P((int, int *, int, int)); + static int recode_char_dw_to_encoding __P((int, int *, int)); +@@ -1263,6 +1263,8 @@ + {0x30000, 0x3FFFD}, + }; + ++ if (c >= 0xdf00 && c <= 0xdfff) ++ return 1; /* dw combining sequence */ + return ((bisearch(c, wide, sizeof(wide) / sizeof(struct interval) - 1)) || + (cjkwidth && + bisearch(c, ambiguous, +@@ -1330,11 +1332,12 @@ + } + + static void +-comb_tofront(root, i) +-int root, i; ++comb_tofront(i) ++int i; + { + for (;;) + { ++ int root = i >= 0x700 ? 0x801 : 0x800; + debug1("bring to front: %x\n", i); + combchars[combchars[i]->prev]->next = combchars[i]->next; + combchars[combchars[i]->next]->prev = combchars[i]->prev; +@@ -1396,9 +1399,9 @@ + { + /* full, recycle old entry */ + if (c1 >= 0xd800 && c1 < 0xe000) +- comb_tofront(root, c1 - 0xd800); ++ comb_tofront(c1 - 0xd800); + i = combchars[root]->prev; +- if (c1 == i + 0xd800) ++ if (i == 0x800 || i == 0x801 || c1 == i + 0xd800) + { + /* completely full, can't recycle */ + debug("utf8_handle_comp: completely full!\n"); +@@ -1422,7 +1425,7 @@ + mc->font = (i >> 8) + 0xd8; + mc->fontx = 0; + debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800); +- comb_tofront(root, i); ++ comb_tofront(i); + } + + #else /* !UTF8 */ diff --git a/poky/meta/recipes-extended/screen/screen_4.8.0.bb b/poky/meta/recipes-extended/screen/screen_4.8.0.bb index 4772eb6c7..fe640c262 100644 --- a/poky/meta/recipes-extended/screen/screen_4.8.0.bb +++ b/poky/meta/recipes-extended/screen/screen_4.8.0.bb @@ -21,6 +21,7 @@ SRC_URI = "${GNU_MIRROR}/screen/screen-${PV}.tar.gz \ file://0002-comm.h-now-depends-on-term.h.patch \ file://0001-fix-for-multijob-build.patch \ file://0001-Remove-more-compatibility-stuff.patch \ + file://CVE-2021-26937.patch \ " SRC_URI[md5sum] = "d276213d3acd10339cd37848b8c4ab1e" diff --git a/poky/meta/recipes-extended/sysklogd/files/sysklogd b/poky/meta/recipes-extended/sysklogd/files/sysklogd index 2a356a637..050772b59 100755 --- a/poky/meta/recipes-extended/sysklogd/files/sysklogd +++ b/poky/meta/recipes-extended/sysklogd/files/sysklogd @@ -22,6 +22,9 @@ binpath_syslogd=/usr/sbin/syslogd test -x $binpath || exit 0 +# run secure by default +SYSLOGD="-ss" + test ! -r /etc/default/syslogd || . /etc/default/syslogd create_xconsole() diff --git a/poky/meta/recipes-extended/watchdog/watchdog_5.16.bb b/poky/meta/recipes-extended/watchdog/watchdog_5.16.bb index a44a459c2..19e94757c 100644 --- a/poky/meta/recipes-extended/watchdog/watchdog_5.16.bb +++ b/poky/meta/recipes-extended/watchdog/watchdog_5.16.bb @@ -21,7 +21,6 @@ SRC_URI[sha256sum] = "b8e7c070e1b72aee2663bdc13b5cc39f76c9232669cfbb1ac0adc7275a # Can be dropped when the output next changes, avoids failures after # reproducibility issues PR = "r1" -HASHEQUIV_HASH_VERSION .= ".1" UPSTREAM_CHECK_URI = "http://sourceforge.net/projects/watchdog/files/watchdog/" UPSTREAM_CHECK_REGEX = "/watchdog/(?P<pver>(\d+[\.\-_]*)+)/" |