Fix the following build failure raised since bump of libressl to version
3.5.2 in commit 8b216927db:
red-stream.cpp: In function 'RedStreamSslStatus red_stream_ssl_accept(RedStream*)':
red-stream.cpp:526:22: error: invalid use of incomplete type 'SSL' {aka 'struct ssl_st'}
526 | stream->priv->ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
| ^~
In file included from /home/buildroot/autobuild/instance-1/output-1/host/i686-buildroot-linux-gnu/sysroot/usr/include/openssl/err.h:120,
from red-stream.cpp:33:
/home/buildroot/autobuild/instance-1/output-1/host/i686-buildroot-linux-gnu/sysroot/usr/include/openssl/ossl_typ.h:173:16: note: forward declaration of 'SSL' {aka 'struct ssl_st'}
173 | typedef struct ssl_st SSL;
| ^~~~~~
Fixes:
- http://autobuild.buildroot.org/results/273eadf9e49af55e0932a8293ca65762fb43114f
- http://autobuild.buildroot.org/results/97601f321efc532de0c2ea6aa618ce11fad9e851
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4e5ea31630)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
poco needs C++17 and gcc >=8 since bump to version 1.13.2 in commit
433c4fd38b and
78234857bf10f41c06d9
resulting in the following build failure with gcc 7:
In file included from src/Thread.cpp:28:0:
src/Thread_POSIX.cpp: In member function 'void Poco::ThreadImpl::setNameImpl(const string&)':
src/Thread_POSIX.cpp:162:56: error: no matching function for call to 'std::__cxx11::basic_string<char>::append(const string&, std::__cxx11::basic_string<char>::size_type)'
truncName.append(threadName, threadName.size() - half);
^
Fixes: 433c4fd38b
- http://autobuild.buildroot.org/results/7b1c144f39a8be4ce8f964aa13a52d0bf62dd0aa
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 54dbd8e2c5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
bump to latest version because previous version did not work with python 3.11
Signed-off-by: Jeremy J. Peper <jeremy@jeremypeper.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 8a69af5fa4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
bump to latest version because previous version did not work with python 3.11
Signed-off-by: Jeremy J. Peper <jeremy@jeremypeper.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 0c27711002)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
bump to latest version because previous version did not work with python 3.11
corrected version mismatch with my first submission
Signed-off-by: Jeremy J. Peper <jeremy@jeremypeper.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 242781bb61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Without python-gobject, we get the following runtime error:
ModuleNotFoundError: No module named 'gi'
Add python-gobject and propagate its dependencies.
While we're at it, split the DEPENDENCIES over several line and sort
them alphabetically.
Signed-off-by: Jeremy J. Peper <jeremy@jeremypeper.com>
Reviewed-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Arnout: reorder everything alphabeticall, split DEPENDENCIES over
several lines.]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 945b9f8d8e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Remove patch applied upstream.
* Upstream fixed building inside the source tree, but still does not
recommend it, so keep LIBGIT2_SUPPORTS_IN_SOURCE_BUILD = NO
Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4aef53575b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Fix the license because libgit2 has been using some android code
without attribution. This explains the change of the hash in the
license file, which now includes the text of the BSD-2-Clause
license.
* Building in-source is accidentely broken in this release and upstream
recommends a separate build directory anyway, so use a separate build
directory.
* Some win32-specific declarations use wchar_t, add an upstreamed patch
to avoid a dependency to wchar_t elsewhere.
Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f32176a767)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cf_gen.cc is compiled by host compiler and unconditionally uses auto
since bump to version 6.6 in commit
c13199c932 and
09835feb25
resulting in the following build failure with host gcc < 8:
/usr/bin/g++ -O2 -I/home/buildroot/autobuild/run/instance-1/output-1/host/include -o cf_gen ./cf_gen.cc -I. -I../include/ -I../src
./cf_gen.cc: In function 'int main(int, char**)':
./cf_gen.cc:268:63: error: forming reference to void
auto &newEntry = entries.emplace_back(name);
^
So add a dependency on host gcc >= 8 and gcc >= 8 as advocated by
upstream in
9d3433c4ac/doc/release-notes/release-6.sgml.in:
This release adds a dependency on C++17 support in any compiler used to build Squid.
GCC 8+ and Clang 8+ support C++17.
While at it, drop BR2_TOOLCHAIN_HAS_GCC_BUG_64735 which is always false
with gcc >= 7
Fixes: c13199c932
- http://autobuild.buildroot.org/results/f1766d1a3b2ce7745fa23cdeae1101806cd97aea
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b8db5c4660)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
poco can't be built statically since commit
073a89196a. However, commit
add7c433d2 enabled static (and shared)
build with BR2_SHARED_STATIC_LIBS resulting in the following build
failure since at least version 1.11.1:
/home/buildroot/autobuild/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/mips-buildroot-linux-gnu/11.2.0/../../../../mips-buildroot-linux-gnu/bin/ld: /home/buildroot/autobuild/instance-1/output-1/build/poco-1.11.1/lib/Linux/mips/libPocoXML.a(ParserEngine.o): in function `Poco::XML::ParserEngine::handleStartElement(void*, char const*, char const**)':
ParserEngine.cpp:(.text+0x2f8): undefined reference to `XML_GetSpecifiedAttributeCount'
Fixes: add7c433d2
- http://autobuild.buildroot.org/results/afc434a13d5e7a8affa4abb4058d7bebc81aca29
- http://autobuild.buildroot.org/results/860b70a8c9c4a6a53247ac4bdb4fd0851b28c61a
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fd484c1f57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
strace needs headers >= 5.0 and
9966a05c7b
to avoid the following build failure on musl and aarch64 due to headers
conflict raised at least since bump to version 6.0 in commit
544806bfd8:
In file included from /home/autobuild/autobuild/instance-7/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include/signal.h:48,
from strace.c:17:
/home/autobuild/autobuild/instance-7/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include/bits/signal.h:18:16: error: redefinition of 'struct sigcontext'
18 | typedef struct sigcontext {
| ^~~~~~~~~~
In file included from /home/autobuild/autobuild/instance-7/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include/asm/ptrace.h:26,
from /home/autobuild/autobuild/instance-7/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include/linux/ptrace.h:107,
from ptrace.h:33,
from strace.c:16:
/home/autobuild/autobuild/instance-7/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include/asm/sigcontext.h:28:8: note: originally defined here
28 | struct sigcontext {
| ^~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/74a480aa76970b36dcd890d9bd7a9df1d49e8e16
- http://autobuild.buildroot.org/results/79ee8ae5fb9712fd874b56e836eca1b997c50cd9
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: fix architecture conditional]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2e8e655fe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
A vulnerability was found in obgm libcoap 4.3.4. It has been rated as
critical. Affected by this issue is the function get_split_entry of the
file src/coap_oscore.c of the component Configuration File Handler. The
manipulation leads to stack-based buffer overflow. The attack may be
launched remotely. The exploit has been disclosed to the public and may
be used. It is recommended to apply a patch to fix this issue.
VDB-252206 is the identifier assigned to this vulnerability.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9002b818be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2024-22667: Vim before 9.0.2142 has a stack-based buffer
overflow because did_set_langmap in map.c calls sprintf to write to the
error buffer that is passed down to the option callback functions.
Update hash of README.txt (version number updated with
b4ddc6c11e)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ef65c4f90b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and
2.12.x before 2.12.5. When using the XML Reader interface with DTD
validation and XInclude expansion enabled, processing crafted XML
documents can lead to an xmlValidatePopElement use-after-free.
https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.11.7/NEWS
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 2c5a82a29c (package/openssh: select linux-pam if refpolicy
upstream is selected) did not account for the linux-pam dependencies
before selecting it, causing unmet dependencies warnings (unfortunately,
not errors), such as:
$ KCONFIG_SEED=0xCF227CF4 make randconfig
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LINUX_PAM
Depends on [n]: BR2_ENABLE_LOCALE [=n] && BR2_USE_WCHAR [=n] && !BR2_STATIC_LIBS [=n] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y]
Selected by [y]:
- BR2_PACKAGE_OPENSSH [=y] && BR2_USE_MMU [=y] && BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION [=y]
2c5a82a29c made the choice of having openssl bear the responsibility
to select linux-pam when the upstream refpolicy version was enabled.
Semantically however, the responsibility really lies within refpolicy
itself, since that's what imposes linux-pam to openssh.
Move the select to refpolicy and drop it from openssh. Then, ensure that
linux-pam is only selected when it is available.
That means that one may get an openssh that is not linked against
linux-pam, when the linux-pam dependencies are not met; refpolicy (by
way of libsepol) also has a more stringent requirement on gcc version
than linux-pam, so most probably the missing dependencies would be
locale, wchar, or a static build. We consider that situation to be a
corner case that we do not want to address.
In the future, we may have more similar situations, whereby refpolicy
would impose other packages be linked with otherwise optional
dependencies. If (when) that were (will be) the case, then the proposed
mechanism would quickly become ugly; we could then re-assess a nicer way
to do that. Until then, this is good ebough.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Adam Duskett <adam.duskett@amarulasolutions.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c20b2ae4ec)
[Peter: drop gcc >= 4.9 dependency]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Currently, when the version string is "too long", it is arbitrarily
truncated.
This works well for commit hashes, because usually the truncation is
long enough to provide a short hash that is still unique in the
upstream VCS.
However, there are non-hash-like versions strings that get truncated
and wihch the discriminant part is toward the end.
Yet, adapting the version cell to the widest versions string (most
probably a git hash) is not very interesting; the table is already very
large.
Make the cell with the version string scrollable: we get to keep the
best of both worlds: a narrow version cell, and a full-length version
string that can be copy-pasted if needed.
Signed-off-by: Sen Hastings <sen@hastings.org>
[yann.morin.1998@free.fr: reword commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4533e42622)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
