Fixes:
CVE-2015-3152 - mysqlnd is vulnerable to BACKRONYM
And other security bugs with no CVE assigned yet:
Bug #69972 - Use-after-free vulnerability in
sqlite3SafetyCheckSickOrOk()
Bug # 69970 - Use-after-free vulnerability in
spl_recursive_it_move_forward_ex()
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Set CONFIGURE_FEATURE_FANCY_SLEEP and CONFIG_FEATURE_FLOAT_SLEEP so that sleep accept floating point arguments.
This add 492 bytes to the busybox binary compiled for arm or 2748 bytes when compiled for i386.
Signed-off-by: Sylvain Raybaud <sylvain.raybaud@green-communications.fr>
Reviewed-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
libfcgi uses frexp() and thus should link with libm, but fails to do
so. Thus link errors with programs that use libfcgi (the bug does
appear only with uClibc, because the GNU libc provides frexp()
directly in libc.so). Modify 0003-link-against-math.patch so libfcgi
links against math, instead of programs that need it.
Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
ZeroMQ doesn't require libsodium, but will enable CURVE security if it's
available. This patch adds the optional dependency.
[Thomas: pass --without-libsodium explicitly when libsodium is not
enabled, and to achieve this, backport a patch from upstream zeromq.]
Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Reviewed-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
With the update to uClibc-ng 1.0.3, this is no longer needed,
as the problem is fixed upstream.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Those issues were noticed by Thomas De Schampheleire during the
review, but they were forgotten when applying the patch.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[Thomas:
- Remove trailing whitespace everywhere
- Rewrap the Config.in help text
- Fix Config.in comment, the proper text for BR2_PREFER_STATIC_LIB is
"dynamic library", not "libdl library"
- Use a PID file in the init script
- Show OK / FAIL when stopping the service
- Remove the largefile/IPv6 handling in c-icap.mk, since they are now
mandatory. We therefore pass --enable-large-files and --enable-ipv6
unconditionally.
- Remove the reference to a non-existing
C_ICAP_INSTALL_TARGET_CONFIGS install target hook.
- Install the init script unconditionally.
- Remove unneeded example configuration files (*.default) from /etc,
and fixup the c-icap.conf so that the default values work with
Buildroot
- Properly handle the *-config scripts installed by c-icap.
- Add hash file.]
Signed-off-by: Guillaume GARDET <guillaume.gardet@oliseo.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Download it from the cvs repository because it is not availabe as a
downloadable file. Also because a tag isn't available use the date.
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Tested-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Even though ARC gcc understands "-pie" option and attempts to generate
PIE binaries as of today PIE is not really supported for user-space
applications.
So we disable PIE detection if building for ARC.
That first fixes http://autobuild.buildroot.net/results/57a/57a6180809bc51f7206280533f0b9898ce4cfbb4
and also prevents execution of non-supported PIE binary in runtime.
Interesting enough reported build failure is not directly related to PIE
it looks like if PIE is enabled then successful detection of explicit_bzero()
happens erroneously.
A simple test app that mentions explicit_bzero() while built with
"-pie" gives this output:
--------------------------------->8-----------------------------
arc-linux-gcc test.c -pie
/home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/../../../../arc-snps-linux-uclibc/bin/ld: /home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../arc-snps-linux-uclibc/sysroot/usr/lib/crt1.o: warning: unresolvable relocation against symbol `__uClibc_main' from .text section
/home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/../../../../arc-snps-linux-uclibc/bin/ld: /home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/crtbegin.o: warning: unresolvable relocation against symbol `__deregister_frame_info@@GCC_3.0' from .text section
/home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/../../../../arc-snps-linux-uclibc/bin/ld: /home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/crtbegin.o: warning: unresolvable relocation against symbol `__deregister_frame_info@@GCC_3.0' from .text section
/home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/../../../../arc-snps-linux-uclibc/bin/ld: /home/abrodkin/Tools/arc/gnu/2015.06-rc1-uclibc-archs/bin/../lib/gcc/arc-snps-linux-uclibc/4.8.4/crtbegin.o: warning: unresolvable relocation against symbol `__register_frame_info@@GCC_3.0' from .text section
--------------------------------->8-----------------------------
And what's really interesting exist status is 0!:
--------------------------------->8-----------------------------
$ echo $?
0
--------------------------------->8-----------------------------
With removal of "-pie" we're getting expected failure and exist status 1:
--------------------------------->8-----------------------------
$ arc-linux-gcc test.c
/tmp/ccaWbKwc.o: In function `main':
test.c:(.text+0x1c): undefined reference to `explicit_bzero'
collect2: error: ld returned 1 exit status
$ echo $?
1
--------------------------------->8-----------------------------
We'll look into that strange issue separately internally.
I filed internal STAR 9000925001 for that issue.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The dependency doesn't make sense now that the option only controls if the
built binary gets installed into the target or not, so drop it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
If configured with no-dso, the openssl binary still gets linked with
-ldl, while libdl is not available for static-only builds. The OpenSSL
framework does not support automatically dropping -ldl with no-dso, so
-ldl has to be removed from Makefile after calling ./Configure as
explained in PROBLEMS.
Fixes http://autobuild.buildroot.org/results/cbb35f2582f1cfeb3d11cb4952a80784ff660baf
[Peter: add reference to PROBLEMS file]
Signed-off-by: Benoît Thébaudeau <benoit@wsystem.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The first sed line for ltmain_version attempts to match whitespace before
VERSION with [ space_character tab_character ]. The second sed line used to
make ltmain_patchlevel has only space characters in the whitespace expression,
possibly due to a smart editor automatically converting tabs to spaces. Make
these lines consistent with each other and more resilient against accidental
loss of tab characters by replacing the tabs with '\t'.
Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
A random-seed from a read-only filesystem is useless.
Also, drop the check for /etc/random-seed existence; it must exist after a
touch.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Seeding the entropy pool with a known seed makes more harm than good. This is
especially bad for when /etc is not on a persistent writable storage, so the
entropy pool is seeded with the same value on every boot. Just drop it.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes:
CVE-2015-4620 - On servers configured to perform DNSSEC validation an
assertion failure could be triggered on answers from a specially
configured server.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
