Fixes the following security issue:
- CVE-2024-24680: Potential denial-of-service in intcomma template filter
The intcomma template filter was subject to a potential denial-of-service
attack when used with very long strings.
https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2024-0001.html
- CVE-2024-23222: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue may
have been exploited. Description: A type confusion issue was addressed
with improved checks.
- CVE-2024-23206: A maliciously crafted webpage may be able to fingerprint
the user. Description: An access issue was addressed with improved access
restrictions.
- CVE-2024-23213: Processing web content may lead to arbitrary code execution.
Description: The issue was addressed with improved memory handling.
- CVE-2023-40414: Processing web content may lead to arbitrary code
execution. Description: A use-after-free issue was addressed with
improved memory management.
- CVE-2023-42833: Processing web content may lead to arbitrary code execution.
Description: A correctness issue was addressed with improved checks.
- CVE-2014-1745: Processing a file may lead to a denial-of-service or
potentially disclose memory contents. Description: The issue was
addressed with improved checks.
https://webkitgtk.org/security/WSA-2023-0012.html
- CVE-2023-42883: Processing a SVG image may lead to a denial-of-service.
Description: The issue was addressed with improved memory handling.
- CVE-2023-42890: Processing web content may lead to arbitrary code
execution. Description: The issue was addressed with improved memory
handling.
https://webkitgtk.org/security/WSA-2023-0011.html
- CVE-2023-42916: Processing web content may disclose sensitive information.
Apple is aware of a report that this issue may have been actively
exploited. Description: An out-of-bounds read was addressed with improved
input validation.
- CVE-2023-42917: Processing web content may lead to arbitrary code
execution. Apple is aware of a report that this issue may have been
actively exploited. Description: A memory corruption vulnerability was
addressed with improved locking.
Add an upstream post-2.42.5 patch to fix an issue with an invalid backport
causing a build issue.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit de3684f57d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 1edb9d691d (package/v4l2loopback: add
V4L2LOOPBACK_CPE_ID_VENDOR) added that variable, but set to its default
value.
This is however not required to define a valid CPE ID, as it also
defines a non-default CPE_ID_PREFIX.
Drop V4L2LOOPBACK_CPE_ID_VENDOR now.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74682e07df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The symmetric encryption test can sometimes take longer than the default
timeout. This commit increase the timeout to 10 seconds for that
command.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f44c0807c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The petitboot UI looks much nicer in a Unicode locale:
* Items in the language selection submenu use multibyte Unicode
characters. In other locales, they say "Unable to display text in this
locale".
* The combination of TERM=linux with a UTF-8 locale is required to
trigger a special-case workaround in ncurses code[1]. Without
this, line-drawing characters in the menu look like q's.
Turn on wchar support in ncurses, and add a reminder that a UTF-8 locale
should be generated for things to look right.
[1] https://invisible-island.net/ncurses/ncurses.faq.html#no_line_drawing
Signed-off-by: Reza Arbab <arbab@linux.ibm.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 026338f66b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Normalize the order of arguments to $(INSTALL). Remove an unnecessary
pair of parentheses.
Signed-off-by: Reza Arbab <arbab@linux.ibm.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit de86cac61b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with aarch64 and BR2_OPTIMIZE_0 raised
since commit 0512910e49:
src/convert-neon-body-bayer8.inc.h: In function 'bayer2rgb_convert_neon':
src/convert-neon.c:233:17: error: third argument to '__builtin_prefetch' must be a constant
233 | __builtin_prefetch(((void const *)(_addr)) + 64, 0, (_lvl)); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/convert-neon-body-bayer8.inc.h:8:9: note: in expansion of macro 'do_prefetch'
8 | do_prefetch(&in[+1*stride - 1], (rows_per_loop) < 3 ? 3 : 0);
| ^~~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/307c1c448becd99dfba3a17b3ef816db0bb5cad6
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 13f8df8ed6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Libglib2 can compile without localization support, but still depends
on libiconv, which is selected in Config.in.
This fallback support was broken, and is fixed in this upstream commit:
a497d5be12,
which partially reverts commits that were brought through merge commit
4a8120ec22be0b63705c1ed28b47920b99388087, that landed in 2.74.0 (as
the first stable release).
The other patch is purely added to avoid merge conflicts while
cherry-picking.
Fixes:
http://autobuild.buildroot.org/results/04d9a17e64503e0bece7bad33549ef3ad4b237c9/
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3641347ff1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 6b2329bb80 ("configs/ti_am64x_sk: new defconfig") forgot to
specify the Linux kernel version, so do that now.
When the defconfig was added, the default version was 6.4.x, so use
version 6.4.16.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 820db039f2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit a7736afaca (package/opencv4-contrib: properly note dependencies
between modules) forgot to propagate the dependencies of selected
symbols, causing unmet dependencies warnings (unfortunately, not
errors), such as:
$ KCONFIG_SEED=0x9F66F854 make randconfig
WARNING: unmet direct dependencies detected for BR2_PACKAGE_OPENCV4_LIB_DNN
Depends on [n]: BR2_PACKAGE_OPENCV4 [=y] && !BR2_TOOLCHAIN_USES_UCLIBC [=y] && BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS [=y]
Selected by [y]:
- BR2_PACKAGE_OPENCV4_CONTRIB_LIB_DNN_OBJDETECT [=y] && BR2_PACKAGE_OPENCV4_CONTRIB [=y]
Propagate the dependencies and add associated comments.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Woodrow Douglass <wdouglass@carnegierobotics.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a2e01b23fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 719921bebe (package/kexec: bump to version 2.0.27) forgot to
propagate the new dependency on kernel headers to petitboot, which may
select kexec, causing unmet dependencies warnings (unfortunately, not
errors), such as:
$ KCONFIG_SEED=0x84462FFC make randconfig
WARNING: unmet direct dependencies detected for BR2_PACKAGE_KEXEC
Depends on [n]: BR2_PACKAGE_KEXEC_ARCH_SUPPORTS [=y] && BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_17 [=n]
Selected by [y]:
- BR2_PACKAGE_PETITBOOT [=y] && (BR2_PACKAGE_KEXEC_ARCH_SUPPORTS [=y] || BR2_PACKAGE_KEXEC_LITE_ARCH_SUPPORTS [=n]) && BR2_USE_MMU [=y] && BR2_USE_WCHAR [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_HAS_THREADS [=y] && BR2_PACKAGE_HAS_UDEV [=y] && !BR2_PACKAGE_KEXEC_LITE_ARCH_SUPPORTS [=n]
Propagate the dependency from kexec, and add comments about dependencies
also inherited from kexec-lite.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Laurent Vivier <laurent@vivier.eu>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c721a58379)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Currently, the comment about availability is between the package main
symbol and its suboptions, breaking the threading in menuconfig.
Invert the order, and move the comment last. Also enclose the suboptions
between an if-block, as it is more customary.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 06dcbdf8ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libressl dropped engine support since version 3.8.1 resulting in the
following build failure since bump of libressl to version 3.8.2 in
commit 21eca49ed5:
eng_front.c: In function 'IMPLEMENT_DYNAMIC_CHECK_FN':
eng_front.c:262:1: error: expected declaration specifiers before 'IMPLEMENT_DYNAMIC_BIND_FN'
262 | IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/389ed112f082a4917f777f3e236211059c4c6d6e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f622944bc8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Security fixes:
- CVE-2023-52425: Fix quadratic runtime issues with big tokens that can
cause denial of service, in partial where dealing with compressed XML
input. Applications that parsed a document in one go -- a single call
to functions XML_Parse or XML_ParseBuffer -- were not affected. The
smaller the chunks/buffers you use for parsing previously, the bigger
the problem prior to the fix.
- CVE-2023-52426: Fix billion laughs attacks for users compiling
*without* XML_DTD defined (which is not common). Users with XML_DTD
defined have been protected since Expat >=2.4.0 (and that was
CVE-2013-0340 back then).
https://blog.hartwork.org/posts/expat-2-6-0-released/
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9dad5e7d7f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The section of the manual describing the makedev syntax is not
up-to-date with the current features, and does not properly describe
existing ones.
- extend the list of types with the requirements on the existence of
the target file or directory; for 'c', 'b', and 'p', the existence
requirement is inherited from mknod(2):
ERRORS
...
ENOENT A directory component in pathname does not exist or is a
dangling symbolic link.
for the other types, the existence requirements are extracted from
the source of makedev.c;
- format the types flags, so they are rendered in monospace;
- extend the 'mode' description, as it can be set to -1 for 'f', 'd',
or 'r', so that only the uid and gid are set. This is most useful
for 'r', where setting the same mode recursively for all the
sub-directories and files alike does not really make sense; indeed
in this case, the modes are usually set correctly when the package
(or rootfs overlay) installs the files, and only the uid and gid are
interesting to set;
- extend and update the examples to show-case the -1 mode use-case.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 738fb6dfa4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cpe:2.3:a:green_end:sftpserver has been deprecated in favor of
cpe:2.3:a:greenend:sftpserver in December 2022:
<cpe-item name="cpe:/a:green_end:sftpserver:0.2.2" deprecated="true" deprecation_date="2022-12-30T17:53:22.797Z">
<reference href="https://github.com/ewxrjk/sftpserver/releases">Version</reference>
<reference href="http://www.greenend.org.uk/rjk/sftpserver/">Product</reference>
<cpe-23:cpe23-item name="cpe:2.3:a:green_end:sftpserver:0.2.2:*:*:*:*:*:*:*">
<cpe-23:deprecated-by name="cpe:2.3:a:greenend:sftpserver:0.2.2:*:*:*:*:*:*:*" type="NAME_CORRECTION"/>
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4adc8b3d24)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
While the list of licenses is present in the show-info output, the list
of license files and the redistributable status were missing. Add them.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5647d5c190)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Disable lua bindings to avoid the following build failure if host-lua
and lua are built before brltty raised since bump to version 6.5 in
commit 82c6e87d5e and
42bf48ca01:
configure: lua package: lua
configure: lua includes:
configure: lua libs: -L/home/autobuild/autobuild/instance-0/output-1/host/bin/../sparc64-buildroot-linux-gnu/sysroot/usr/lib -llua -lm -ldl
checking for lua5.4... no
checking for lua... /home/autobuild/autobuild/instance-0/output-1/host/bin/lua
configure: Lua shell: /home/autobuild/autobuild/instance-0/output-1/host/bin/lua
configure: Lua library directory: /home/autobuild/autobuild/instance-0/output-1/host/lib/lua/5.3
[...]
/usr/bin/install -c -d /home/autobuild/autobuild/instance-0/output-1/target/home/autobuild/autobuild/instance-0/output-1/host/lib/lua/5.3
/usr/bin/install -c -s --strip-program /bin/true brlapi.so /home/autobuild/autobuild/instance-0/output-1/target/home/autobuild/autobuild/instance-0/output-1/host/lib/lua/5.3
make[3]: Leaving directory '/home/autobuild/autobuild/instance-0/output-1/build/brltty-6.6/Bindings/Lua'
[...]
brltty: installs files in /home/autobuild/autobuild/instance-0/output-1/target//home/autobuild/autobuild/instance-0/output-1
While at it, disable emacs bindings which have also been added in
version 6.5 with
64a487e299
Fixes:
- http://autobuild.buildroot.org/results/f424e6727bbe61ea4b7703e93aae6fcab7506898
- http://autobuild.buildroot.org/results/bf4a161fc66fb99a24f08bea3436b13738f2e383
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 19f06441e8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/wlroots/0001-Add-feature-macros-to-more-C-files-.patch has been
rejected upstream, and the initial pull request was moved to the
freedesktop gitlab. Update the patch to reflect these changes.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 840849afff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Without the vulkan-loader package present, the configure step fails with the
following error message:
```
Run-time dependency vulkan found: NO (tried pkgconfig and system)
Message: Install "vulkan" or pass "-Dvulkan=disabled" to disable it.
```
The above error is due to the lack of the vulkan.pc file provided by the
vulkan-loader package. A search of autobuild failures containing
BR2_PACKAGE_WLROOTS=y and BR2_PACKAGE_MESA3D_VULKAN_DRIVER=y shows two build
failures. However, the failure reasons happened before wlroots could compile.
One for gerbera-1.10.0 and another for host-rust-1.64.0.
Add a dependency on the vulkan-loader package to resolve the above issue.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f27b0322a5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Before commit ca63464e37 (package/python-numpy: bump to version
1.25.0), numpy was using python distuils. Then, the default for BLAS and
LAPACK detection was to disable support if they were not found, even
when OPENBLAS is installed on the host system.
Commit ca63464e37 switched python-numpy to use the meson-package
infrastructure, where the default has changed, and now fails when the
host system does have OPENBLAS installed:
buildroot$ make
>>> host-python-numpy 1.25.0 Configuring
[...]
Run-time dependency openblas found: NO (tried pkgconfig and cmake)
WARNING: CMake Toolchain: Failed to determine CMake compilers state
Run-time dependency openblas found: YES 0.3.21
Dependency openblas found: YES 0.3.21 (cached)
Program _build_utils/process_src_template.py found: YES (/path/to/buildroot/output/host/bin/python3 /path/to/buildroot/output/build/host-python-numpy-1.25.0/numpy/_build_utils/process_src_template.py)
Program _build_utils/tempita.py found: YES (/path/to/buildroot/output/build/host-python-numpy-1.25.0/numpy/_build_utils/tempita.py)
output/build/host-python-numpy-1.25.0/numpy/meson.build:201:44: ERROR: Could not get cmake variable and no default provided for <CMakeDependency OpenBLAS: True None>
[...]
Two obvious ways to correct this:
- Add some kind of host-lapack / host-openblas dependency to
host-python-numpy, or
- Tell host-python-numpy not to look for (or rely on) external code.
Because the host numpy environment shouldn't be doing any numerical
heavy lifting, we opt for the latter here.
Signed-off-by: Graeme Smecher <gsmecher@threespeedlogic.com>
[yann.morin.1998@free.fr:
- explain why the issue was not found before
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f6c33f3e89)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Use pkg-config to find libnet and avoid the following build failure
raised since commit 100ba8351c if
libnet-config is found on the host:
/home/autobuild/autobuild/instance-4/output-1/host/bin/mips64el-buildroot-linux-gnu-gcc -s -o ngrep ngrep.o tcpkill.o -lpcap -lnet -lpcre -L/usr/lib -lnet
mips64el-buildroot-linux-gnu-gcc: ERROR: unsafe header/library path used in cross-compilation: '-L/usr/lib'
While at it, format Upstream tag of other patches
Fixes:
- http://autobuild.buildroot.org/results/05c916162b9c1027cf53f1699a1f5653151098ed
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 14c0c37eaf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Calling `setup.py` build builds and installs an empty package
after upstream changed their packaging. Calling setuptools via
`python -m build` builds the package correctly.
Signed-off-by: Marcus Hoffmann <bubu@bubu1.eu>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d7e45215a4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The http://pagesperso-orange.fr service being down,
http://pagesperso-orange.fr/sebastien.godard/ is no longer
accessible (or more precisely serves some HTML junk), meaning that we
currently cannot download the tarball of sysstat from the official
upstream location, and we always fallback to sources.buildroot.net.
This commit therefore updates to use the new upstream location on
github.io. The 12.6.1 release is available there, with the same hash,
so we can just point to the new upstream location.
Fixes:
ERROR: while checking hashes from package/sysstat//sysstat.hash
ERROR: sysstat-12.6.1.tar.xz has wrong sha1 hash:
ERROR: expected: a730982e0c2d4964a0022c1509f3ea0a345402bc
ERROR: got : d64a079729f2ff5b304294d68fbc041a46c4966d
ERROR: Incomplete download, or man-in-the-middle (MITM) attack
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 35a2cb0227)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
