Commit Graph

75634 Commits

Author SHA1 Message Date
Julien Olivain
def91054e4 support/testing: new wget runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fefe7024a3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-04 15:30:02 +01:00
Julien Olivain
9362da70d3 support/testing: add libcurl runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 292631cd09)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-04 15:21:10 +01:00
Thomas Bonnefille
09c243a834 package/uemacs: fix call to cuserid
cuserid is deprecated and breaks the compilation on some new toolchains.
This patch fixes this issue.

Fixes:
    #81

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a141b117e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-04 15:17:15 +01:00
Gaël PORTAY
6be96dee22 DEVELOPERS: add myself as developer for raspberrypi
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 9a271f9646)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-04 15:14:52 +01:00
Akhilesh Nema
a28afd7d85 package/socat: security bump to version 1.8.0.2
It fixes an arbitrary file overwrite vulnerability in the readline.sh.
(CVE-2024-54661)

see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html

README hash changed due to version update.

Note: Buildroot is not impacted by this vulnerability as the
readline.sh is not installed on target.

Quoting changelog [1]:

    Mitigating factors: readline.sh is usually neither installed in a bin
    directory nor is it documented. Major Linux distributions install it in
    examples/ or doc/; however it is invoked by test.sh script.

[1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: add note that Buildroot is not impacted in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d70df3ab44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-02 23:28:09 +01:00
Baruch Siach
02e33e9617 package/socat: bump to version 1.8.0.1
For change log, see:
http://www.dest-unreach.org/socat/CHANGES

Update README hash for changes unrelated to license.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
[Julien: add change log URL]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c47dc84328)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-02 23:28:06 +01:00
Peter Korsgaard
99257a2d07 package/redis: security bump to version 7.2.7
Fixes the following security issues:

7.2.6:

- (CVE-2024-31449) Lua library commands may lead to stack overflow and
  potential RCE

- (CVE-2024-31227) Potential Denial-of-service due to malformed ACL
  selectors

- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern
  matching

7.2.7:

- (CVE-2024-46981) Lua script commands may lead to remote code execution

- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors

https://github.com/redis/redis/releases/tag/7.2.6
https://github.com/redis/redis/releases/tag/7.2.7

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f3e99436ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-02 23:25:39 +01:00
Waldemar Brodkorb
e8e24d1681 package/bind: security update to 9.18.33
See here for a changelog:
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33

Fixes:
https://kb.isc.org/docs/cve-2024-11187
https://kb.isc.org/docs/cve-2024-12705

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add direct links to CVEs]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bec79ce8bb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 16:14:28 +01:00
Christian Stewart
70df756ba7 package/go: security bump to version 1.23.5
go1.23.5 (released 2025-01-16) includes security fixes to the crypto/x509 and
net/http packages, as well as bug fixes to the compiler, the runtime, and the
net package.

https://go.dev/doc/devel/release#go1.23.5
https://github.com/golang/go/issues?q=milestone%3AGo1.23.5+label%3ACherryPickApproved

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6299f479d1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 16:13:37 +01:00
Peter Korsgaard
eb73d4662e package/nodejs: security bump to version 22.13.1
Fixes the following security vulnerabilities:

Worker permission bypass via InternalWorker leak in diagnostics
(CVE-2025-23083) - (high)

With the aid of the diagnostics_channel utility, an event can be hooked into
whenever a worker thread is created.  This is not limited only to workers
but also exposes internal workers, where an instance of them can be fetched,
and its constructor can be grabbed and reinstated for malicious usage.

This vulnerability affects Permission Model users (--permission) on Node.js
v20, v22, and v23.

GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)

A memory leak could occur when a remote peer abruptly closes the socket
without sending a GOAWAY notification.  Additionally, if an invalid header
was detected by nghttp2, causing the connection to be terminated by the
peer, the same leak was triggered.  This flaw could lead to increased memory
consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Update the LICENSE hash for a an addition of the (MIT licensed) nlohmann
JSON library:

27bcd103e7

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15891236db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 14:29:35 +01:00
Gaël PORTAY
aca397828d support/scripts/genimage.sh: add shell option -e
The commit 6889056f1e (support/scripts/genimage.sh) adds support for
creating bmap images.

Since then, the script genimage.sh looses the error returned by the
genimage command.

As a consequence, the target-finalize target looses the error as well,
and so on up to make.

This adds the shell option -e to exit immediately if a command ends with
an error, so the error is not ignored.

Fixes:

	gportay@archlinux ~/src/rtone-br2-external $ make
	(...)
	>>>   Executing post-image script support/scripts/genimage.sh
	INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
	INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"/*" (stderr):
	INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
	INFO: cmd: "cp -a "/tmp/tmp.EclKGwtA4R" "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/root"" (stderr):
	INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/images"" (stderr):
	INFO: vfat(efi-part.vfat): cmd: "mkdosfs   '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat'" (stderr):
	INFO: vfat(efi-part.vfat): adding file 'efi-part/EFI' as 'EFI' ...
	INFO: vfat(efi-part.vfat): cmd: "MTOOLS_SKIP_CHECK=1 mcopy -sp -i '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat' '/home/gportay/src/rtone-br2-external/output/images/efi-part/EFI' '::EFI'" (stderr):
	Disk full
	INFO: vfat(efi-part.vfat): cmd: "rm -f "/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat"" (stderr):
	ERROR: vfat(efi-part.vfat): failed to generate efi-part.vfat
	INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/"" (stderr):
	make[1]: Leaving directory '/home/gportay/src/rtone-br2-external/buildroot'
	gportay@archlinux ~/src/rtone-br2-external $ echo $?
	0

Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 294d13bb85)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 14:24:00 +01:00
Waldemar Brodkorb
63b400f8f3 package/uclibc: deactivate time64 support for older kernel's
For Linux systems older then 5.1.0 we need to disable time64 support
in uClibc-ng to avoid compilation failure.

Fixes Buildroot's arcturus_ucp1020_defconfig:
https://gitlab.com/buildroot.org/buildroot/-/jobs/8925840027

Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Suggested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien:
 - fix check-package errors
 - add link to a build failure
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6a63051931)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 14:22:38 +01:00
Peter Korsgaard
9f057b8aa5 package/openjpeg: security bump to version 2.5.3
Fixes the following security issues:

- CVE-2024-56826: A flaw was found in the OpenJPEG project.  A heap buffer
  overflow condition may be triggered when certain options are specified
  while using the opj_decompress utility.  This can lead to an application
  crash or other undefined behavior.

  https://access.redhat.com/security/cve/CVE-2024-56826

- CVE-2024-56827: A flaw was found in the OpenJPEG project.  A heap buffer
  overflow condition may be triggered when certain options are specified
  while using the opj_decompress utility.  This can lead to an application
  crash or other undefined behavior.

  https://access.redhat.com/security/cve/CVE-2024-56827

Release notes: https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3bfa5ebcbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 13:32:58 +01:00
Vincent Stehlé
31d2e35cd6 package/xen: xen tools needs bash at runtime
When the Xen tools are built, a number of init scripts are installed to
the target.

Some of those Xen scripts require bash to run:
- /etc/init.d/S50xencommons
- /etc/init.d/S50xen-watchdog
- /etc/init.d/S60xendomains
- /etc/xen/scripts/launch-xenstore
- /usr/lib/xen/bin/xendomains

Make sure to select bash when the Xen tools are selected (we need to
select "busybox show others" for that, too).

Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf18fd4cd1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 13:18:02 +01:00
Julien Olivain
c4d2c13286 package/acpica: security bump to version 20241212
For change log since 20240927, see:
https://github.com/user-attachments/files/18117996/changes.txt

Note: the change log mention "Fix 2 critical CVE addressing memory
leaks" without providing actual CVE numbers. For reference, the
upstream commits for those security fixes are [1] and [2]. From the log
of those commits, it seems those memory leaks can only happen in old
Kernels <= 4.9 (which is end-of-life since January 2023). Technically
those leaks could happen in any program embedding the apcica code
files. The impact seems very low, if any, on the acpica standalone
tools.

[1] 987a3b5cf7
[2] 8829e70e13

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 892e1608f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:50:14 +01:00
Thomas Petazzoni
ea9b75f8c2 support/testing/tests/toolchain/test_external_synopsys.py: drop tests
The Synopsys external toolchain has been disabled in commit
11a8cdd2bb, causing the test cases
testing this toolchain to fail. Let's drop those tests for now, they
can always be re-added later on.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697531
  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697528
  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697524
  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697519
  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697517
  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892697516

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: remove the DEVELOPERS entry]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e3d74c76ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:47:44 +01:00
Thomas Petazzoni
d57bb0b6db support/testing/tests/package/test_gdb.py: fix ARC test
Since the disabling of the Synopsys ARC toolchain in
11a8cdd2bb, the test
tests.package.test_gdb.TestGdbArc was failing as it was relying on
this external toolchain.

Let's switch the test to use BR2_archs38, which allows to use a
Bootlin toolchain.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/8892696282

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d577c0208c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:44:13 +01:00
Akhilesh Nema
3710aef80e package/nettle: bump to version 3.10.1
Release notes:
https://lists.gnu.org/archive/html/info-gnu/2024-12/msg00008.html

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit eec9e14c64)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:24:06 +01:00
Bernd Kuhls
a86ade6082 package/apache: bump version to 2.4.63
Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.63

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: update hash source URL in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d5b3795e92)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:09:07 +01:00
Bernd Kuhls
e0a1772d27 package/clamav: security bump version to 1.0.8
Fixes CVE-2025-20128:
"This issue was introduced in version 1.0.0 and affects all currently
 supported versions."
https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit caa2fac892)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 12:06:57 +01:00
Bernd Kuhls
00118db48c {linux, linux-headers}: bump 5.15.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 27ee14ca4f)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-01 11:58:17 +01:00
Thomas Petazzoni
a6b1d9fd66 toolchain/toolchain-external/toolchain-external-synopsys-arc: mark as broken
The ARC toolchains from Synopsys unfortunately are not "pure"
toolchains: their sysroot no only contains the C library, but also
additional libraries, most notably libncurses and libexpat.

This confuses Buildroot, and causes build issues, and is anyway not a
supported situation. Until the toolchains get fixed, let's mark them
as broken.

Fixes:

  http://autobuild.buildroot.net/results/38766332c391ce97a566c6e2255a947e6074152b/
  (and possibly a number of others)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 11a8cdd2bb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 21:40:53 +01:00
James Hilliard
48230a4b79 package/python-django: security bump to version 5.1.5
Fixes the following vulnerability:

CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation

Lack of upper bound limit enforcement in strings passed when performing IPv6
validation could lead to a potential denial-of-service attack.  The
undocumented and private functions clean_ipv6_address and
is_valid_ipv6_address were vulnerable, as was the
django.forms.GenericIPAddressField form field, which has now been updated to
define a max_length of 39 characters.

The django.db.models.GenericIPAddressField model field was not affected.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c87726dd33)
[Peter: Mark as security bump, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 18:41:40 +01:00
Yann E. MORIN
4ad263555e package/pkg-generic: store real version in legal manifest
The legal manifest currently stores the $(PKG)_VERSION variable.
However, that variable undergoes a set of changes so that it is
suitable for creating files and Makefile rules; that new value
is purely a technical, internal detail of how Buildroot handles
things.

In the legal manifest, we need access to the real value for the
version, as this is what will allow actual references to the
upstream package. If the version string is mangled, like slashes
replaced with underscores, this introduces ambiguities as to what
exactly the version is.

In Buildroot, there is no package, with a constant version, that
exhibits that issue; for those packages where it is possible to
set a custom git tree and version, like linux or uboot, such a
custom tree can have tags with a slash (not a colon or a space,
forbidden by git); packages in a br2-external can also use such
version strings as well.

The packages that do have such versions are not legion, but they
do exist. For example, Apache's ant buildsystem does use a slash
in their reelase tags, like rel/1.10.15:
    https://github.com/apache/ant/tags

Change the legal manifest to include the actual, original value
as was set in the .mk file.

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 686694792b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 17:51:08 +01:00
Yann E. MORIN
fdcfa918c6 support/testing/utils: check patch on stdin to get-developers
Since commit d10d22221f (utils/get-developers: read patch from stdin
when it's not a tty), get-developers accepts to read a patch fromn its
stdin when it is not a tty.

Add a test for this.

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29e1af8430)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 17:47:28 +01:00
Yann E. MORIN
bc7e3a7abb support/testing/utils: fix get-developers test without a tty
get-developers will check its stdin to decide whether it is a tty or
not, and behave differently whether it is or not. So, when we run the
tests, we need an actual tty.

However, when running in a CI pipeline, like on Gitlab-CI, there is no
tty available on stdin.

Fake one. We don't need anything too fancy, so just a slave pty will
suffice.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/8830671800
Fixes: d10d22221f (utils/get-developers: read patch from stdin when
it's not a tty)

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3778f704cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 17:46:11 +01:00
Thomas Petazzoni
279673a337 package/gnu-efi: fix build due to short-wchar
The gnu-efi code base is so far built with -fshort-wchar:

‘-fshort-wchar’
     Override the underlying type for ‘wchar_t’ to be ‘short unsigned
     int’ instead of the default for the target.  This option is useful
     for building programs to run under WINE.

     *Warning:* the ‘-fshort-wchar’ switch causes GCC to generate code
     that is not binary compatible with code generated without that
     switch.  Use it to conform to a non-default application binary
     interface.

However, this is highly incompatible with the definitions of wchar_t
by musl, causing build issues:

/workdir/instance-0/output-1/build/gnu-efi-3.0.18//lib/console.c:84:68: error: passing argument 2 of 'ConOut->OutputString' from incompatible pointer type [-Werror=incompatible-pointer-types]
[...]
/workdir/instance-0/output-1/build/gnu-efi-3.0.18//lib/console.c:84:68: note: expected 'CHAR16 *' {aka 'int *'} but argument is of type 'short unsigned int *'

These have been addressed upstream by simply not using -fshort-wchar
anymore, so we backport the relevant patches.

The patch 0003-Use-char16_t-literals.patch was directly backported, it
was "redone" (it's a very mechanical patch) as backporting the patch
and fixing the conflicts was more effort than redoing the patch from
scratch. But in essence, it is the same patch as what is upstream.

Fixes:

  http://autobuild.buildroot.net/results/8b2f5b38284e70dde8c5619e5050e7f201a0bcc3/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: fix patch 0003 EOL modified by the mailing list]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4fa17f441)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 17:21:44 +01:00
Thomas Petazzoni
97aa1f9a9b boot/syslinux: add multiple patches fixing build issues with GCC >= 14
No autobuilder failures reported, but it fixes build issues that can
be reproduced with:

BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_TARGET_SYSLINUX=y
BR2_TARGET_SYSLINUX_EFI=y

First patch is backported from upstream. Last 3 patches are not from
upstream, and they have not been submitted as upstream is basically
dead (last release 10 years ago, last commit 5 years ago).

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a311245ff7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-31 17:18:34 +01:00
Bernd Kuhls
7457eb49fc package/ffmpeg: add optional dependency to libfribidi
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3181a1b572)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 21:49:33 +01:00
Bernd Kuhls
477c35f036 package/ffmpeg: add optional dependency to harfbuzz
Fixes https://bugs.busybox.net/show_bug.cgi?id=16279

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 201bf5346d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 21:35:15 +01:00
Bernd Kuhls
04dd89947e package/php: bump version to 8.3.16
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_3
Release notes: https://news-web.php.net/php.announce/450

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 26a328f8ef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:31:15 +01:00
Bernd Kuhls
74418bd5fc package/openvpn: bump version to 2.6.13
Release notes:
https://sourceforge.net/p/openvpn/mailman/message/59119248/

Changelog:
https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog
https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0aadb0b5dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:29:44 +01:00
Bernd Kuhls
2454bd20a3 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d9a9d76e97)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:28:17 +01:00
Akhilesh Nema
776cfff2e7 package/tzdata: bump version to 2025a
Release notes:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/MWII7R3HMCEDNUCIYQKSSTYYR7UWK4OQ/

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8867b238ef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:06:28 +01:00
Akhilesh Nema
c48a818c18 package/zic: bump version to 2025a
Release notes:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/MWII7R3HMCEDNUCIYQKSSTYYR7UWK4OQ/

Rebased the patch and updated the hash URL.

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d548949f2e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:06:15 +01:00
Vincent Stehlé
55a9825414 package/xen: fix build for gcc 14 and aarch64
Backport two commits from upstream Xen to fix the build for AArch64
with gcc 14.

This repairs the tests.package.test_xen.TestXen runtime test
introduced in [1], which uses an external AArch64 toolchain that has
been upgraded to gcc 14 in [2].

Fixes:
    utils/docker-run support/testing/run-tests \
        -d dl -o output_folder -s \
        tests.package.test_xen
    ...
    checking for openpty et al... configure: error: in '/build/xen-4.14.6/tools':
    configure: error: Unable to find library for openpty and login_tty

[1] 055f82ebbd
[2] e5a965a648

Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
[Julien:
  - fix "make check-package" errors
  - add info in the commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ea55aa2819)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 18:04:45 +01:00
Peter Korsgaard
38bebdea19 package/git: security bump to version 2.47.2
Fixes the following vulnerabilities:

 - CVE-2024-50349:

   Printing unsanitized URLs when asking for credentials made the
   user susceptible to crafted URLs (e.g. in recursive clones) that
   mislead the user into typing in passwords for trusted sites that
   would then be sent to untrusted sites instead.

 - CVE-2024-52006

   Git may pass on Carriage Returns via the credential protocol to
   credential helpers which use line-reading functions that
   interpret said Carriage Returns as line endings, even though Git
   did not intend that.

For more details, see the announcement:
https://lore.kernel.org/git/xmqq5xmh46oc.fsf@gitster.g/

Additionally, 2.47.1 contained a number of fixes:
https://lore.kernel.org/git/xmqq5xob6coo.fsf@gitster.g/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 17:56:16 +01:00
Peter Korsgaard
ffdb6fead2 package/asterisk: security bump to version 20.11.1
Fixes the following security issues:

CVE-2024-53566: Path traversal via AMI ListCategories allows access to
outside files

https://github.com/asterisk/asterisk/security/advisories/GHSA-33x6-fj46-6rfh

Release notes:
https://www.asterisk.org/asterisk-news/asterisk-security-release-20-11-1-now-available/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cfe0e945b3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:51:25 +01:00
James Hilliard
d4dcf36956 package/libxml2: fix segfault with python-lxml
Backport a patch fixing a segfault first introduced by
ca63c4409b in buildroot.

Fixes:
==4792== Invalid read of size 8
==4792==    at 0x4FE7661: __gconv_close (gconv_close.c:33)
==4792==    by 0x4FE70EE: iconv_close (iconv_close.c:34)
==4792==    by 0x5AED422: xmlCharEncCloseFunc (encoding.c:2678)
==4792==    by 0x587A78C: __pyx_f_4lxml_5etree__find_PyUCS4EncodingName (etree.c:126676)
==4792==    by 0x5888666: __pyx_pymod_exec_etree (etree.c:289773)
==4792==    by 0x4A06345: PyModule_ExecDef (moduleobject.c:440)
==4792==    by 0x4AE23A8: _imp_exec_dynamic_impl (import.c:3801)
==4792==    by 0x4AE23A8: _imp_exec_dynamic (import.c.h:534)
==4792==    by 0x4A046A3: cfunction_vectorcall_O (methodobject.c:509)
==4792==    by 0x4AAA203: _PyEval_EvalFrameDefault (bytecodes.c:3263)
==4792==    by 0x49B9D2B: _PyObject_VectorcallTstate (pycore_call.h:92)
==4792==    by 0x49B9D2B: object_vacall (call.c:850)
==4792==    by 0x49B9F44: PyObject_CallMethodObjArgs (call.c:911)
==4792==    by 0x4AE648A: import_find_and_load (import.c:2781)
==4792==    by 0x4AE648A: PyImport_ImportModuleLevelObject (import.c:2864)
==4792==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e2e152496a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:50:18 +01:00
Bernd Kuhls
54721e452c {linux, linux-headers}: bump 6.6.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83453910d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:47:26 +01:00
Julien Olivain
0615b31f02 Config.in: introduce the BR2_BROKEN hidden symbol
Commit [1]
"toolchain/toolchain-external/toolchain-external-synopsys-arc: mark
as broken" disabled BR2_TOOLCHAIN_EXTERNAL_SYNOPSYS_ARC by adding a
depends on BR2_BROKEN. This symbol does not exist and generates
check-symbol failures, see [2].

This commit fixes this issue by introducing the BR2_BROKEN hidden symbol
that will be used to track those known to be broken features. This
symbol will help to track features that were broken for too long and
remove them.

Fixes: [2]

[1] 11a8cdd2bb
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/8840476511

Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2ddc5808cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:19:40 +01:00
Thomas Bonnefille
e85f37c892 package/curlpp: add patch to fix build
curlpp is broken since the bump of libcurl to 8.10.0 in commit [1].
This patch backport a pull request from upstream from [2] to solve it.

Fixes:
    https://autobuild.buildroot.org/results/4a4d3b248898f0e73620fcb1a7a94dcfb6e6866e/

[1] d68b999787
[2] https://github.com/jpbarrette/curlpp/pull/178

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
[Julien:
  - reword patch title one liner
  - add link to commit which introduced the issue
  - add link to the upstream pull request
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f06c28d1af)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:11:47 +01:00
Peter Korsgaard
207c07d155 package/rsync: bump version to 3.4.1
Bugfix release fixing regressions in 3.4.0:

- fixed handling of -H flag with conflict in internal flag values
- fixed a use after free in logging of failed rename
- fixed build on systems without openat()
- removed dependency on alloca() in bundled popt

For more details, see:
https://download.samba.org/pub/rsync/NEWS#3.4.1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 593755f527)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:02:31 +01:00
Peter Korsgaard
caaed296b9 package/rsync: security bump to version 3.4.0
Release note:
https://download.samba.org/pub/rsync/NEWS#3.4.0

Fixes the following vulnerabilities:

CVE-2024-12084: Heap Buffer Overflow in Rsync due to Improper Checksum
Length Handling

Description: A heap-based buffer overflow flaw was found in the rsync
daemon. This issue is due to improper handling of attacker-controlled
checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the
fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the
sum2 buffer.

CVE-2024-12085: Info Leak via Uninitialized Stack Contents

Description: A flaw was found in the rsync daemon which could be triggered
when rsync compares file checksums. This flaw allows an attacker to
manipulate the checksum length (s2length) to cause a comparison between a
checksum and uninitialized memory and leak one byte of uninitialized stack
data at a time.

CVE-2024-12086: Rsync Server Leaks Arbitrary Client Files

Description: A flaw was found in rsync. It could allow a server to
enumerate the contents of an arbitrary file from the client's machine. This
issue occurs when files are being copied from a client to a server. During
this process, the rsync server will send checksums of local data to the
client to compare with in order to determine what data needs to be sent to
the server. By sending specially constructed checksum values for arbitrary
files, an attacker may be able to reconstruct the data of those files
byte-by-byte based on the responses from the client.

CVE-2024-12087: Path Traversal Vulnerability in Rsync

Description: A path traversal vulnerability exists in rsync. It stems from
behavior enabled by the `--inc-recursive` option, a default-enabled option
for many client options and can be enabled by the server even if not
explicitly enabled by the client. When using the `--inc-recursive` option,
a lack of proper symlink verification coupled with deduplication checks
occurring on a per-file-list basis could allow a server to write files
outside of the client's intended destination directory. A malicious server
could write malicious files to arbitrary locations named after valid
directories/paths on the client.

CVE-2024-12088: --safe-links Option Bypass Leads to Path Traversal

Description: A flaw was found in rsync. When using the `--safe-links`
option, rsync fails to properly verify if a symbolic link destination
contains another symbolic link within it. This results in a path traversal
vulnerability, which may lead to arbitrary file write outside the desired
directory.

CVE-2024-12747: Race Condition in Rsync Handling Symbolic Links

Description: A flaw was found in rsync. This vulnerability arises from a
race condition during rsync's handling of symbolic links. Rsync's default
behavior when encountering symbolic links is to skip them. If an attacker
replaced a regular file with a symbolic link at the right time, it was
possible to bypass the default behavior and traverse symbolic links.
Depending on the privileges of the rsync process, an attacker could leak
sensitive information, potentially leading to privilege escalation.

For more details, see the advisory:
https://www.openwall.com/lists/oss-security/2025/01/14/3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 017d74c943)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 16:02:24 +01:00
Romain Naour
5698a2b335 toolchain/toolchain-external/toolchain-external-arm-aarch64-be: fix BR2_ARCH_NEEDS_GCC_AT_LEAST_X guard
BR2_ARCH_NEEDS_GCC_AT_LEAST_X guards has been introduced by [1] to
prevent selecting an external toolchain that did not support the GCC
arch tuning the user had selected.

But it was not changed while updating to version 13.2-rel1.

Fixes: 50ae5ea963

[1] eed1670d8a

Cc: Antoine Coutant <antoine.coutant@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7ffc6ae7d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 15:47:28 +01:00
Romain Naour
2216fc1446 toolchain/toolchain-external/toolchain-external-arm-aarch64: fix BR2_ARCH_NEEDS_GCC_AT_LEAST_X guard
BR2_ARCH_NEEDS_GCC_AT_LEAST_X guards has been introduced by [1] to
prevent selecting an external toolchain that did not support the GCC
arch tuning the user had selected.

But it was not changed while updating to version 13.2-rel1.

Fixes: 7b4b3c2c78

[1] eed1670d8a

Cc: Antoine Coutant <antoine.coutant@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2999677233)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 15:47:05 +01:00
Romain Naour
399f75e636 toolchain/toolchain-external/toolchain-external-arm-arm: fix BR2_ARCH_NEEDS_GCC_AT_LEAST_X guard
BR2_ARCH_NEEDS_GCC_AT_LEAST_X guards has been introduced by [1] to
prevent selecting an external toolchain that did not support the GCC
arch tuning the user had selected.

But it was not updated while updating to version 13.2-rel1.

Fixes: 0dd599d171

[1] eed1670d8a

Cc: Antoine Coutant <antoine.coutant@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 203abefcf6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 15:44:33 +01:00
Vincent Stehlé
76666f8b69 support/testing: new xen runtime test
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
[Julien: switch to human readable genimage.cfg partition uuid]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 055f82ebbd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 15:04:00 +01:00
Thomas Bonnefille
bf7d413339 package/zxing-cpp: bump to version 2.3.0
This commit bumps the zxing-cpp version to 2.3.0.
For the release note, see:
https://github.com/zxing-cpp/zxing-cpp/releases/tag/v2.3.0

The compilation of this package has been broken since the bump to v2.2.1
when it is compiled with reader support, due to the added patch.

This patch was not added upstream, but another set of more generic
patches [1] that do not change the API were added instead. The error
that the Buildroot patch was fixing no longer exists in 2.3.0.

[1]:
    - d0c8f226e2
    - d979b765a1

Fixes:
    https://autobuild.buildroot.org/results/ba4573a1bcc0110d4d0b45642e07009ec949d66a/build-end.log

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Reviewed-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fb032bd34a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-22 10:27:04 +01:00
Thomas Petazzoni
5b9b37bf11 toolchain/toolchain-external/toolchain-external-synopsys-arc: fix condition
The option BR2_TOOLCHAIN_EXTERNAL_SYNOPSYS_ARC just depends on
BR2_arc, but the choice of toolchains that appears once
BR2_TOOLCHAIN_EXTERNAL_SYNOPSYS_ARC=y only has choices for:

	depends on BR2_arc750d || BR2_arc770d

and

	depends on BR2_archs38_64mpy || BR2_archs38_full || \
		BR2_archs4x_rel31 || BR2_archs4x

which means that if you have a BR2_archs38=y configuration, you end up
with no choice of toolchain, and the build fails with "No C library
selected". Fix this by making sure BR2_TOOLCHAIN_EXTERNAL_SYNOPSYS_ARC
can only be selected when an actual toolchain is available.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7f14af27d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-19 22:34:33 +01:00