Commit Graph

43364 Commits

Author SHA1 Message Date
Fabrice Fontaine
0ab0ca5e38 package/lxc: add optional dependency to bash-completion
lxc uses the completionsdir variable from bash-completions.pc to decide
where to install things.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 61a425590a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:17:35 +01:00
Asaf Kahlon
11079a8ff4 package/python-pyyaml: security bump to 4.2b4
Fixes CVE-2017-18342: In PyYAML before 4.1, the yaml.load() API
could execute arbitrary code.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1cf071726d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:56:07 +01:00
Peter Seiderer
e466b27674 boot/barebox: change download site to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2cf0688647)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:51:20 +01:00
Yann E. MORIN
a54a7e6bbb infra/pkg-cmake: use an obviously-invalid value for CMAKE_SYSTEM_VERSION
In 36568732e4, we expanded toolchain.cmake to also define the value for
CMAKE_SYSTEM_VERSION, as the cmake documentation states that it must be
manually defined when doing cross-compilation [0]:

    When the CMAKE_SYSTEM_NAME variable is set explicitly to enable
    cross compiling then the value of CMAKE_SYSTEM_VERSION must also
    be set explicitly to specify the target system version.

However, the fix in 36568732e4 uses the version of the kernel headers,
assuming that would be the oldest kernel we could run on. Yet, this is
not the case, because glibc (for example) has fallbacks to support
running on kernels older than the headers it was built against.

The cmake official wiki [1] additionally states:

  * CMAKE_SYSTEM_VERSION : optional, version of your target system, not
    used very much.

Folllowed a little bit below, by:

  * CMAKE_TOOLCHAIN_FILE : absolute or relative path to a cmake script
    which sets up all the toolchain related variables mentioned above

    For instance for crosscompiling from Linux to Embedded Linux on PowerPC
    this file could look like this:

        # this one is important
        SET(CMAKE_SYSTEM_NAME Linux)
        #this one not so much
        SET(CMAKE_SYSTEM_VERSION 1)

    [...]

Furthermore, using the kernel headers version can be a bit misleading (as
it really looks like is is the correct version to use when it is not),
while it is obvious that 1 is not really the output of `uname -r` and
thus is definitely not misleading.

Finally, random searches [2] about CMAKE_SYSTEM_VERSION, mostly only
turns up issues related with Windows, Mac-OS, and to a lesser extent,
Android (where it is forcibly set to 1), with issues realted to running
under just Linux (as opposed to Adnroid) mostly non-existent.

Consequently, we revert to using the value that is suggested in the
cmake WiKi, i.e. 1, and which is basically what we also used as a
workaround in the azure-iot-sdk-c paclkage up until d300b1d3b1.

A case were we will need to have a real kernel version, is if we one day
have a cmake-based pacakge that builds and installs a kernel module [3],
because it will need the _running_ kernel version to install it in
/lib/modules/VERSION/, but in that case it will anyway most probably
not be the headers version.

[0] https://cmake.org/cmake/help/v3.8/variable/CMAKE_SYSTEM_VERSION.html
[1] https://gitlab.kitware.com/cmake/community/wikis/doc/cmake/CrossCompiling
[2] https://duckduckgo.com/?q=CMAKE_SYSTEM_VERSION
[3] https://stackoverflow.com/questions/38205745/cmake-system-version-not-updated-for-new-kernel

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Samuel Martin <s.martin49@gmail.com>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fc8a5f56b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:48:02 +01:00
Arnout Vandecappelle (Essensium/Mind)
e5cde95606 package/pkg-cmake: add CMAKE_SYSTEM_VERSION to toolchainfile.cmake
Quoting the CMake documentation:

  When the CMAKE_SYSTEM_NAME variable is set explicitly to enable cross
  compiling then the value of CMAKE_SYSTEM_VERSION must also be set
  explicitly to specify the target system version.

Thus, we should also set CMAKE_SYSTEM_VERSION in toolchainfile.cmake. It
is supposed to be set to the value of `uname -r` on the target. We don't
have that exact value available (unless we build the kernel), but the
value of BR2_TOOLCHAIN_HEADERS_AT_LEAST contains the (minimum) version
of the kernel it will run on, so it should be OK for all practical
purposes.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 36568732e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:47:53 +01:00
Thomas Petazzoni
896695e8ad package/libsquish: re-enable for BR2_STATIC_LIBS configuration
Since the bump to version 1.15, libsquish can conditionally
build/install its shared library, which makes it possible to re-enable
this package for BR2_STATIC_LIBS configurations.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ae4b9e4afb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:45:22 +01:00
Romain Naour
7758db51e6 package/libsquish: really install shared library
While testing the new supertuxkart 0.10-beta1 version, the build
failed due to missing libsquash shared library.

Indeed, by default (see config file) the shared library is not build
and all symlinks created by LIBSQUISH_INSTALL_{STAGING,TARGET}_CMDS
are curently broken.

To fix that, add USE_SHARED=1 to LIBSQUISH_MAKE_ENV.

Also add a patch to allow reinstall the package.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b621273755)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:44:55 +01:00
Romain Naour
8001021a16 package/libsquish: add license file hash
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9b377e9dcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:44:44 +01:00
Fabrice Fontaine
e8a5bf8660 package/swupdate: disable lua in static build
Since version 2018.11 and
624904cc18,
bindings for LUA is a shared library so disable lua if BR2_STATIC_LIBS
is set

Fixes:
 - http://autobuild.buildroot.org/results/55767e58c211656558af7916a4e0975089a2785b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b898b67209)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:43:20 +01:00
Fabrice Fontaine
af993e0684 package/gnuchess: license is GPL-3.0+, not GPL-2.0+
gnuchess is licensed under GPL-3.0+ not GPL-2.0+, also add hash for
license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ef25d13fc7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:28:13 +01:00
Arnout Vandecappelle (Essensium/Mind)
8175f6e889 patchelf: update _SITE to new location
releases.nixos.org gives some weird XML pages. The upstream location is
nixos.org/releases.

This side uses HSTS, so switch to https to avoid a needless redirect.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2fa462426)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:27:02 +01:00
Peter Korsgaard
fed0c666e6 package/lighttpd: adjust hash comment after 1.4.52 bump
Commit ec69d3820f (package/lighttpd: bump to version 1.4.52) bumped the
lighttpd version but forgot to adjust the upstream hash comment.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b99b09caee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:25:43 +01:00
Peter Korsgaard
1f14043c56 package/lighttpd: bump to version 1.4.52
Fixes location header parsing regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2918

Fixes header setting regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2919

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ec69d3820f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:25:38 +01:00
Peter Korsgaard
1ca9600c96 {linux, linux-headers}: bump 4.{9, 14, 19, 20}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 78f0c1fe4a)
[Peter: drop 4.19.x/4.20.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:04:13 +01:00
Peter Korsgaard
7286fc1803 package/xenomai: drop consecutive empty lines
Commit 4219c58c (xenomai: remove unnecessary autoreconf) introduced a
check-package warning:

1 warnings generated
package/xenomai/xenomai.mk:27: consecutive empty lines

https://gitlab.com/buildroot.org/buildroot/-/jobs/143155797

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d2e1617ccc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:37:49 +01:00
Thomas De Schampheleire
f17bde9466 xenomai: remove unnecessary autoreconf
As xenomai release tarballs ship with a configure script, there is only a
need for autoreconfiguring when patches are applied.

The last patch was removed with git commit
de993bc23a but the AUTORECONF line remained.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4219c58c38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:36:37 +01:00
Baruch Siach
4c909a095c tcpreplay: security bump to version 4.3.1
Upstream CHANGELOG entry for 4.3.0 lists these fixes:

    - CVE-2018-18408 use-after-free in post_args (#489)
    - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)
    - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486)
    - CVE-2018-17580 heap-buffer-overflow fast_edit_packet (#485)
    - CVE-2018-17582 heap-buffer-overflow in get_next_packet (#484)
    - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477 dup #408)

Drop tr_cv_libpcap_version and ac_cv_have_bpf; unused in current
configure script.

Make configure script use pcap-config to list library dependencies.
Unfortunately, pcap-config is not entirely correct, so we still need to
set the LIBS variable for static linking.

Use the smaller tar.xz archive.

Add license file hash.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f5961ff56a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:29:55 +01:00
Carlos Santos
8ce6f86666 package/liburiparser: security bump to version 0.9.1
Fixes an out-of-bounds read, the parsing of some a malformed URIs and a
function that reported 1 more byte than actually needed for IPv4 address
URIs. For additional datails, see

    https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 518eb53ec5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:26:56 +01:00
Peter Korsgaard
bca62e0a01 Makefile, manual, website: Bump copyright year
Happy 2019!

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8e928a8389)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:26:19 +01:00
Asaf Kahlon
6f6f5e28f5 package/python-django: security bump to version 2.1.5
Fixes CVE-2019-3498: Content spoofing possibility in the default 404 page

For more details, see the announcement:
https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
[Peter: mention that bump fixes security issues]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 86d0ecf076)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:00:39 +01:00
Asaf Kahlon
d2beca10ee python-django: bump to version 2.1.4
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 89829c4f11)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:00:33 +01:00
Peter Korsgaard
dcb3cf3a66 utils/get-developers: really make it callable from elsewhere than the toplevel directory
Commit 62d5558f76 (utils/get-developers: make it callable from elsewhere
than the toplevel directory) tried to fix this by passing in the toplevel
directory when the DEVELOPERS file is parsed.

Unfortunately this is not enough, as E.G.  also the paths listed in the
patches are relative to the toplevel directory, causing it to not match the
entries in the DEVELOPERS file.

In concept this can be fixed by also passing the toplevel directory to the
Developers class, but the simplest solution is just to chdir to the toplevel
Buildroot directory before calling any of the getdeveloperlib functions.

This does require us to finish parsing command line arguments (which opens
the provided patch files) to not get into trouble with relative paths to
patches before chdir'ing / initializing getdeveloperlib.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 45aabcddc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:30 +01:00
Peter Korsgaard
4402e082db Revert "utils/get-developers: make it callable from elsewhere than the toplevel directory"
This reverts commit 62d5558f76.

This actually does not work, as patches contain paths relative to the
toplevel directory as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74fbc20504)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:24 +01:00
Peter Korsgaard
4baa5cb31b package/nodejs: bump version to v8.15.0
Fixes regressions introduced by the v8.14.0 security release.  From the
announcement:

The 8.14.0 security release introduced some unexpected breakages on the 8.x
release line.  This is a special release to fix a regression in the HTTP
binary upgrade response body and add a missing CLI flag to adjust the max
header size of the http parser.

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f68e5cf72)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:53:45 +01:00
Peter Korsgaard
e8b60ec4da package/libhttpparser: bump version to v2.9.0
Needed by nodejs v8.15.0+

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a02ce33aa5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:53:39 +01:00
Peter Korsgaard
c3935fe3c2 package/efivar: bump version to 35
Fixes:
http://autobuild.buildroot.net/results/545/545013d3977b3eddd27ca0fc21cc1248f3bb0dbb/
http://autobuild.buildroot.net/results/695/6952b99eb0b0e85b2f5408accdca2b4dd17d14c0/

Includes a workaround for -Werror=stringop-overflow= erroring out on strncpy
on some toolchains:

7461d47cdd

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5816a0a122)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:52:34 +01:00
Thomas De Schampheleire
f379011d1f docs/manual: fix typo get-developer (-> get-developers)
The script is utils/get-developers but the manual refers to get-developer in
several places.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81aeab60cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:48:57 +01:00
Mark Corbin
d61df00174 package/glibc: bump version for more post-2.28 fixes
This update includes two specific fixes that have been backported
to the glibc 2.28 release branch from the glibc master branch:

1) UAPI header file asm/syscalls.h has been merged into the UAPI
asm/unistd.h header file for the RISC-V architecture in the
4.20 kernel. This causes the glibc 2.28 build to break.

2) sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O
[BZ #19444]. The current patch for this issue can now be dropped
from Buildroot.

Signed-off-by: Mark Corbin <mark.corbin@embecosm.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7ab6281075)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:48:17 +01:00
Thomas De Schampheleire
f331b23934 support/download: fix scp downloads
scp download is broken, because scp is called without filename argument and
only the server is specified. The call is:
    scp <server> <outputfile>

but should be:
    scp <server>/<filename> <outputfile>

Instead of assuming '-u' lists a full URL including filename (which it is
not), align with the wget helper where -u is the server URL and -f gives the
filename.

With this commit, an scp download can work if FOO_SITE_METHOD is explicitly
set to 'scp' and the server does not have a scheme prefix 'scp://'.
The next commit will handle the case where a scheme prefix is present.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Thomas: s/URL/URI/, as noticed by Yann.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 4d6e20ff46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:47:35 +01:00
Peter Korsgaard
81eba6d012 package/linux-headers: bump 4.{4, 9, 14, 19}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5bbc472463)
[Peter: drop 4.19.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:27:23 +01:00
Thomas Petazzoni
446ba17e95 package/lua-msgpack-native: adjust Config.in comment
The Config.in comment of lua-msgpack-native only indicates that it
needs Lua 5.1, while the package can actually build with LuaJIT. This
commit adjusts the comment to match the reality.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6141506760)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:12:34 +01:00
Grégoire Delattre
a130f69330 board/pc: ensure grub.cfg is copied to target filesystem
Before this commit, the grub configuration file was copied to the
TARGET_DIR in a post-image hook, after the filesystem has been
generated. It was kinda working because the board/pc's grub
configuration and the default one are the same and the later was
copied during the build process of the grub2 package.

This commit ensures the custom board/pc grub configuration is copied at
the right time.

Signed-off-by: Grégoire Delattre <gregoire.delattre@gmail.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0b28397a9b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:17:38 +01:00
Vadim Kochan
4d4c5750d3 package/udisks: fix compilation issue with glibc 2.28+
It fixes a compilation failure with undefined "minor", "major" and
"makedev" objects which is caused by the missing include of
<sys/sysmacros.h>.

Fixes:

  http://autobuild.buildroot.net/results/74a8d8c247cfc9c0024e749e1f1ac423c9e90855/

Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dbd80a2737)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:16:04 +01:00
Peter Korsgaard
1644fead67 package/wireshark: security bump to version 2.6.6
Fixes the following security vulnerabilities:

- wnpa-sec-2019-01 The 6LoWPAN dissector could crash. Bug 15217. CVE-2019-5716
  https://www.wireshark.org/security/wnpa-sec-2019-01

- wnpa-sec-2019-02 The P_MUL dissector could crash. Bug 15337. CVE-2019-5717
  https://www.wireshark.org/security/wnpa-sec-2019-02

- wnpa-sec-2019-03 The RTSE dissector and other dissectors could crash.  Bug
  15373.  CVE-2019-5718
  https://www.wireshark.org/security/wnpa-sec-2019-03

- wnpa-sec-2019-04 The ISAKMP dissector could crash. Bug 15374. CVE-2019-5719
  https://www.wireshark.org/security/wnpa-sec-2019-04

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cd232aefc9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:34:00 +01:00
Peter Korsgaard
32ee7f9a7f package/wireshark: security bump to version 2.6.5
The following vulnerabilities have been fixed:

- wnpa-sec-2018-51 The Wireshark dissection engine could crash. Bug 14466. CVE-2018-19625.
- wnpa-sec-2018-52 The DCOM dissector could crash. Bug 15130. CVE-2018-19626.
- wnpa-sec-2018-53 The LBMPDM dissector could crash. Bug 15132. CVE-2018-19623.
- wnpa-sec-2018-54 The MMSE dissector could go into an infinite loop. Bug 15250. CVE-2018-19622.
- wnpa-sec-2018-55 The IxVeriWave file parser could crash. Bug 15279. CVE-2018-19627.
- wnpa-sec-2018-56 The PVFS dissector could crash. Bug 15280. CVE-2018-19624.
- wnpa-sec-2018-57 The ZigBee ZCL dissector could crash. Bug 15281. CVE-2018-19628.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2ec38321d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:33:49 +01:00
Trent Piepho
4d671f1f14 package/rauc: target rauc needs unsquashfs at runtime
In order to provide info about a bundle file, e.g. running "rauc info
bundle.raucb", rauc needs to use the unsquashfs progam from the squashfs
package.

This was not documented until upstream commit 10c501c12752 ("docs:
integration: document need for 'unsquashfs' tool for 'rauc info'"), but
is already present in rauc.

Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4a4dba21b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:31:45 +01:00
Peter Korsgaard
c129b06847 package/sqlite: security bump to version 3.25.3
Fixes CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is
enabled, encounters an integer overflow (and resultant buffer overflow) for
FTS3 queries that occur after crafted changes to FTS3 shadow tables,
allowing remote attackers to execute arbitrary code by leveraging the
ability to run arbitrary SQL statements (such as in certain WebSQL use
cases), aka Magellan.

For more details, see:
https://blade.tencent.com/magellan/index_en.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4475c0a57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:19:49 +01:00
Thomas Petazzoni
fa069b85b3 package/acpica: add missing dependencies for host variant
Just like the target acpica package needs host-flex and host-bison,
the host variant also needs the same dependencies. This allows to fix
the build of "make host-acpica", which was detected thanks to
per-package directory support.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8681430628)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 11:50:40 +01:00
Thomas Petazzoni
876d1660e2 package/docker-containerd: add missing dependency on host-pkgconf
When libsseccomp support is enabled, docker-containerd uses pkg-config
to find libsseccomp, so we must depend on host-pkconf.

Fixes the following build issue, detected with per-package directory
support:

pkg-config: exec: "pkg-config": executable file not found in $PATH

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 14cbcbe2d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 16:00:17 +01:00
Ryan Coe
dbce1c346c package/mariadb: security bump version to 10.3.11
Remove 0002-cmake-fix-ucontext-dection.path as it is now upstream.

Hash updated for README.md because upstream changed bug report links.

Release notes: https://mariadb.com/kb/en/mariadb-10311-release-notes/
Changelog: https://mariadb.com/kb/en/mariadb-10311-changelog/

Fixes the following security vulnerabilities:

CVE-2018-3282 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: Server: Storage Engines). Supported versions that are affected
are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
Easily exploitable vulnerability allows high privileged attacker with network
access via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of MySQL Server.

CVE-2016-9843 - The crc32_big function in crc32.c in zlib 1.2.8 might allow
context-dependent attackers to have unspecified impact via vectors involving
big-endian CRC calculation.

CVE-2018-3174 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: Client programs). Supported versions that are affected are
5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
Difficult to exploit vulnerability allows high privileged attacker with logon
to the infrastructure where MySQL Server executes to compromise MySQL Server.
While the vulnerability is in MySQL Server, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

CVE-2018-3143 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and
prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability
allows low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can result
in unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of MySQL Server.

CVE-2018-3156 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and
prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability
allows low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can result
in unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of MySQL Server.

CVE-2018-3251 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and
prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability
allows low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can result
in unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of MySQL Server.

CVE-2018-3185 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Easily exploitable vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server as well as unauthorized update, insert or delete access
to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity
and Availability impacts).

CVE-2018-3277 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Easily exploitable vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

CVE-2018-3162 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Easily exploitable vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

CVE-2018-3173 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Easily exploitable vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

CVE-2018-3200 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Easily exploitable vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

CVE-2018-3284 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and
prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high
privileged attacker with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash (complete
DOS) of MySQL Server.

Signed-off-by: Ryan Coe <bluemrp9@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 44755a82bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 15:56:36 +01:00
Yann E. MORIN
38d64b319f arch/arm: restrict more armv8a cores to aarch64
Since gcc-8, falkor and qdf24xx have been available only as
AArch64. Indeed, according to upstream commit [1], the released HW has
never supported AArch32.

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=96a411453d39e6583fa4d7008761a1977cdbe7fa

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Thomas: improve commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit d9e8c74f0f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 15:54:10 +01:00
Thomas Petazzoni
ab75d16840 DEVELOPERS: remove Sebastien Bourdelin
His e-mail address is no longer valid. Sending an e-mail to this
address says (yes, the actual text is in French):

Veuillez prendre note que cette adresse n'est plus valide à la suite du départ de l'employé.

which means:

Please take note that this address is no longer valid following the employee departure.

Therefore, it does not make sense to list Sebastien in our DEVELOPERS
file.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fb3a0cce03)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 15:53:19 +01:00
Baruch Siach
a60172f6b6 package/lm-sensors: make ISA tools depend on x86
The isadump and isaset tools are built for x86 targets only.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 31379277f7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:29:24 +01:00
James Hilliard
fbe3a5f485 package/meson: fix CPU familly
As explained in [0], meson recognises a certain set of CPU famillies,
whose names slightly differ from those we know them as.

If we don't pass the proper cpu_familly, meson whines:
    WARNING: Unknown CPU family 'i686', please report this at [...]

Subsequently, packages that use that to decide on what they should build
and how they should build it, fail to build. That is the case for the
upcoming systemd-boot, for example.

Fix that by using the list propvided by the meson documentation [0].

[0] https://mesonbuild.com/Reference-tables.html#cpu-families

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - split in its own patch
  - imnprove commit log
]
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit f3bacda0c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:22:38 +01:00
James Hilliard
ae31ce3cde package/meson: never try to run generated target binaries
As explained in [0], meson will try on its own to decide whether it can
run what it builds. If it happens that the host and target CPUs are
"compatible", that test may fail and meson may believe it can run what
it builds.

Override that test by using needs_exe_wrapper=true, and not defining an
actual exe_wrapper.

[0] https://mesonbuild.com/Cross-compilation.html

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - split in its own patch
  - improve commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit f112f2b991)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:21:17 +01:00
Thomas Petazzoni
833689db55 package/dhcpdump: fix build at -O2
Since commit aa556e2035
("utils/genrandconfig: test with BR2_OPTIMIZE_2=y"), we are doing
builds at -O2 instead of -Os. This has unveiled an issue in the
strsep.c file:

strsep.c:65:23: error: register name not specified for 'delim'
  register const char *delim;

This strsep.c compatibility code is compiled in if HAVE_STRSEP is not
defined, but dhcpdump does not use any kind of configure script to
detect the availability of strsep(). Therefore by default, it gets
compiled in, and the "register" specifier used for some variable
declarations in strsep.c cause build issues at -O2.

A previous commit in Buildroot from
c2a7f0d605 ("dhcpdump: Fix strsep()
feature test"), attempted to fix this problem by changing the test on
HAVE_STRSEP by a test on _BSD_SOURCE.

Unfortunately, _BSD_SOURCE is not meant to be tested: it's a feature
macro that is meant to be *defined* by some code to tell the C library
headers to expose (or not) some given functionality.

So instead, we basically revert commit
c2a7f0d605 by dropping the patch, and
pass -DHAVE_STRSEP in the CFLAGS when building dhcpdump.

Fixes:

  http://autobuild.buildroot.net/results/7231170d3d3e3637f02382c1a0a96009b0527618/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 136c8862cf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:13:04 +01:00
Thomas Petazzoni
538c691f03 package/x11r7/xapp_rgb: add missing host-pkgconf dependency
Building a minimal defconfig such as:

BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-2018.05.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_4_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_1=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XAPP_RGB=y

by running "make xapp_rgb" gives the following build failure:

checking for RGB... configure: error: in `/home/test/buildroot/output/build/xapp_rgb-1.0.6':
configure: error: The pkg-config script could not be found or is too old.  Make sure it
is in your PATH or set the PKG_CONFIG environment variable to the full
path to pkg-config.

Alternatively, you may set the environment variables RGB_CFLAGS
and RGB_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.

The configure script uses pkg-config, but host-pkgconf is missing in
the list of dependencies.

This issue was detected thanks to per-package directory support.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 401b7b94a3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:10:33 +01:00
David Lechner
c7261302b4 board/lego/ev3: fix max U-Boot flash size
The first stage bootloader on LEGO MINDSTORMS EV3 only loads the first
256K of the flash memory (this is hard-coded in an EEPROM). So, the
second stage bootloader (U-Boot) cannot exceed this size.

Signed-off-by: David Lechner <david@lechnology.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b2e5014af5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:08:46 +01:00
André Hentschel
8c6a3913a7 board/freescale/common/imx: fix typo
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f2c1e2e885)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:06:29 +01:00
André Hentschel
ac701ca85e package/freescale-imx/firmware-imx: fix typos
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 07d1c6a2ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-18 14:06:22 +01:00