>From http://www.openwall.com/lists/oss-security/2017/02/16/4
The latest dbus release 1.10.16 fixes two symlink attacks in
non-production-suitable configurations. I am treating these as bugs
rather than practical vulnerabilities, and very much hope neither of
these is going to affect any real users, but I'm reporting them to
oss-security in case there's an attack vector that I've missed.
No CVEs assigned so far.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Drop upstream patch.
Update ioctl patch since it's still required to build for musl.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Prior to glibc 2.18, definitions like SIZE_MAX or INT_FAST32_MAX from
<stdint.h> were only made available for C code, or in C++ if
__STDC_LIMIT_MACROS was defined.
The code from jasper uses such definitions, without defining
__STDC_LIMIT_MACROS. Unfortunately, defining __STDC_LIMIT_MACROS in
the jasper headers doesn't work, since <stdint.h> has already been
included before, at a point where __STDC_LIMIT_MACROS was not defined.
So to solve this problem, we simply pass -D__STDC_LIMIT_MACROS in
CXXFLAGS when building libraw with jasper support.
Fixes:
http://autobuild.buildroot.net/results/908aef6c82d56060933713df217b6b2ba21a01b0/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The raptor package installs some libraries, which will be useful for
upcoming packages parts of librdf.org, such as rasqal and redland.
Signed-off-by: Erwan Gautron <erwan.gautron@yahoo.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The generic code now knows how to extract .tar.lz archives. Remove the local
extract code.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit teaches the generic package handling code how to extract .tar.lz
archives. When lzip is not installed on the host, host-lzip gets built
automatically.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Don't special case $(XZCAT) when constructing DL_TOOLS_DEPENDENCIES. The next
commit will introduce another extractor that automatically builds when not
installed. Introduce EXTRACTOR_DEPENDENCY_PRECHECKED_EXTENSIONS that lists
archive extensions for which the extractor is already checked in
support/dependencies/check-host-foo.mk. Use this in the newly introduced
extractor-dependency to populate DL_TOOLS_DEPENDENCIES.
Cc: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
[Thomas: add missing space after "firstword", as noticed by Thomas DS.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
MPD version 0.20 being affected by GCC PR libstdc++/64735 means no mpd package
available in Buildroot for the architectures NIOSII, ARMv4, ARMv5 and SPARCv8
until GCC 7 is released.
As the next Buildroot release is in 2017.02, which is before GCC 7 is expected
to be finished we add hidden config symbols to select the version branch to use.
Note, that we bumped the version from 0.19 to 0.20 quite recently within the
current Buildroot release cycle. This way we can keep the support for mpd on
the affected architectures, like ARMv5, until GCC 7 is out.
Note, that for the version 0.19 MPD requires libglib2.
Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Drop all patches since they're upstream, yay!
Switch to the gnome mirror since it's more handy than github, and it
also allows to drop autoreconf since it's a distribution tarball with
the configure script is already generated.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Release 0.1.2 claimed to fix an issue with requesting both types of
line events, but actually didn't. This time it's really fixed.
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
cups configure script checks for a pkg-config program. If host-pkgconf
has not been built prior to cups, it uses the system pkg-config, which
might potentially lead to bogus results:
checking for i586-buildroot-linux-musl-pkg-config... no
checking for pkg-config... /usr/bin/pkg-config
With this patch applied:
checking for i586-buildroot-linux-musl-pkg-config... no
checking for pkg-config... /home/thomas/projets/buildroot/output/host/usr/bin/pkg-config
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cbootimage uses non-standard u_intXX_t types instead of the C99 types
uintXX_t types, which prevents it from building with the musl C library.
A patch to fix this has been submitted upstream, but since there are
many many occurences of such types, the patch is a bit large to carry in
Buildroot, especially compared to the fact that having this package
building against musl is probably not a top priority.
So for now, simply disable this package on musl, until upstream fixes
the issue and releases a new version.
Fixes:
http://autobuild.buildroot.net/results/61bdfb7e0ff9628190d9eb86e40c4c90e768b8e2
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When GCC_COLORS is set, ccache passes '-fdiagnostics-color' to GCC but
this flag requires GCC v4.9 or later. Older versions complain about the
unrecognized command line option.
Using GCC_COLORS in the context of Buildroot is seldom useful, so we
just unexport GCC_COLORS altogether.
Reported-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Jann Horn, Project Zero (Google) discovered that ntfs-3g, a read-write
NTFS driver for FUSE does not not scrub the environment before
executing modprobe to load the fuse module. This influence the behavior
of modprobe (MODPROBE_OPTIONS environment variable, --config and
--dirname options) potentially allowing for local root privilege
escalation if ntfs-3g is installed setuid.
Notice that Buildroot does NOT install netfs-3g setuid root, but custom
permission tables might be used, causing it to vulnerable to the above.
ntfs-3g does not seem to have a publicly available version control system
and no new releases have been made, so instead grab the patch from Debian.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
