Fixes:
CVE-2016-0718 - The Expat XML parser mishandles certain kinds of
malformed input documents, resulting in buffer overflows during
processing and error reporting. The overflows can manifest as a
segmentation fault or as memory corruption during a parse operation. The
bugs allow for a denial of service attack in many applications by an
unauthenticated attacker, and could conceivably result in remote code
execution.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This was added in 0dece985 to deal with kernel headers 4.5 -> 4.5.4
breakage. Unfortunately the fix in 4.5.5 and 4.6+ doesn't deal correctly
with this causing more build breakage, so we'd rather "break" for the
small range of 4.5.x versions broken than for the rest of time.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
glibc-2.22 does not build with gcc 6.x. The first issues can be fixed
by:
- Using the same 0004-gcc6.patch as we're using with glibc 2.23 since
Buildroot commit ab8de336eb.
- Backport glibc commit 5542236837c5c41435f8282ec92799f480c36f18 to fix
strchr() build failure.
But then, there are some more failures caused by the fact that numerous
glibc files were not using modern prototypes in the function
definitions, causing build failures such as:
../sysdeps/unix/sysv/linux/dl-openat64.c:26:1: error: 'openat64' defined as variadic function without prototype [-Werror]
openat64 (dfd, file, oflag)
^~~~~~~~
In file included from ../include/fcntl.h:2:0,
from ../sysdeps/unix/sysv/linux/dl-openat64.c:21:
../io/fcntl.h:214:12: note: previous declaration of 'openat64' was here
extern int openat64 (int __fd, const char *__file, int __oflag, ...)
^~~~~~~~
This could be fixed by backporting glibc commit
9dd346ff431fc761f1b748bd4da8bb59f7652094, but this is a large commit,
touching a significant number of files. We probably don't want to take
this path, and instead making glibc 2.22 as not available with gcc 6.x
seems like the right course of action.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Due to patch 840-microblaze-enable-dwarf-eh-support.patch, gcc 6.x
does not build:
../../gcc/config/microblaze/microblaze.c: In function 'void microblaze_expand_epilogue()':
../../gcc/config/microblaze/microblaze.c:3046: error: 'gen_rtx_raw_REG' was not declared in this scope
This patch was originally added to gcc 4.9 to make it capable of
building glibc. However, this is no longer needed with gcc 6.x, which
builds glibc just fine.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
With systemd, samba4 will need some special temporary files to be
created on each boot, as explained in:
packaging/systemd/README
Install the provided template file as configuration.
However, this is not enough, as even the log directory is a tmpfs in
the default Buildroot configuration, so we must also create the log
directory on each boot. Hence we append this to the template installed
above.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Now that we need to bump openvpn to version 2.3.11 for security fixes
the time has come to remove the polarssl option.
Add legacy handling explaining the situation:
PolarSSL 1.2.x can coexist with mbedTLS 2.x+, but OpenVPN requires
PolarSSL/mbedTLS 1.3.x (the transition branch) >= 1.3.8 but doesn't
build/work with the 2.x series. And PolarSSL/mbedTLS 1.3.x can't coexist
with mbedTLS 2.x on the same target.
So, unfortunately, openssl is now the only option (until libressl
arrives) which means no more backend options in general.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The android-tools Config.in.host has some logic to ensure that at
least one of its sub-options is enabled. However, this logic
incorrectly uses the sub-option names from the *target* android-tools
package, while it should be using the ones from the *host*
android-tools package.
Fixes the following kconfig warning:
warning: (BR2_PACKAGE_HOST_ANDROID_TOOLS) selects BR2_PACKAGE_ANDROID_TOOLS_ADB which has unmet direct dependencies (BR2_PACKAGE_ANDROID_TOOLS && BR2_USE_MMU)
Reported-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The fastboot sub-option of android-tools did not properly replicate the
dependency of libselinux, which it is selecting. Due to this, an invalid
configuration could be generated, with fastboot selected while thread
support is not available for example (and therefore libselinux is not
available). This problem was causing the following build failure:
http://autobuild.buildroot.net/results/21e45cee04fd983c85c6702595ee3f7ed8470931/
This is fixed by replicating the selinux dependencies in the fastboot
sub-option and adding the relevant Config.in comment.
In addition, the main android-tools option had some logic to make sure
at least one of its sub-option is enabled: adbd by default on systems
with MMU, and fastboot by default on systems without MMU (because
fastboot is the only part that builds on noMMU systems).
However, with the new dependencies in the fastboot sub-option, this
logic would have become a lot more complicated. Since fastboot is very
unlikely to be used on noMMU systems, we simply make the whole package
not available on noMMU systems.
Cc: Gary Bisson <gary.bisson@boundarydevices.com>
Cc: Antoine Tenart <antoine.tenart@free-electrons.com>
Cc: Julien Corjon <corjon.j@ecagroup.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Since 919c06c282 the calls to gcc always pass
through the toolchain wrapper and all gcc patches to support poisoning has been
removed.
Update the BR2_COMPILER_PARANOID_UNSAFE_PATH comment.
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Mesa3d DRI drivers can be enabled without support for libgl (for
example without x11). So make glmark2 gl (x11) support depend on
BR2_PACKAGE_HAS_LIBGL being present as well.
It doesn't exactly mean mesa3d providing libgl, but since we can't have
more than one libgl provider at the same time it's equivalent.
This is fallout from f1894ec957 which
enabled DRI drivers for non-xorg builds. Fixes:
http://autobuild.buildroot.net/results/174/1743ee5a340e5f4b1f8519e0b11eb196caa4f30e/
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Quagga runs as the "quagga" user, but it also needs to modify files
in /etc and /var - config files, pid files and vty sockets for vtysh.
Tell the configure script the right folders to use, create the
user, fix the permissions, and then let systemd know (if needed).
Signed-off-by: Nathaniel Roach <nroach44@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
