igh-ethercat is failing while attempting to apply patches,
with error:
Applying 0002-Linux-6.19.0-support.patch using patch:
patching file devices/generic.c
Reversed (or previously applied) patch detected! Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file devices/generic.c.rej
The package patch 0002 was added in [1] in branch "master" while it
was in release client cycle. It was cherry-picked in [2] in branch
"next" to apply the bump [3] (which removes the package patches 0001
and 0002). When the branch "next" was merged in "master" in commit [4],
the patch 0002 was kept.
This commit removes this stale patch.
[1] e4cf512c39
[2] 8a5fc970b4
[3] 0a91e760f4
[4] 5f26877955
Fixes:
- https://autobuild.buildroot.org/results/4f509f1f788c1b8dc5a840ffa2e435c5ed7b6eea/
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d071817969)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libde265/releases/tag/v1.1.2
Security fixes:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free
in multi-threaded (WPP) decoding. A crafted stream whose slice segments
repeat or rewind their slice_segment_address within a picture re-ran
CTB rows that were already marked finished, so the CABAC context handoff
between rows was no longer ordered and the shared context table was
released twice. Slice segments that do not follow the previous one in
tile-scan order are now rejected with the new warning
DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row
progress is reset for each slice segment. (medium)
CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after
de265_reset(): the pointer to the previous slice header was left
dangling when the DPB was cleared, and a dependent slice pushed after
the reset copied from freed memory. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55cb31085)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.3
Fixes the following CVEs:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-x8r2-mggj-j6wr) Heap buffer overflow (write) in the
uncompressed (unci) mixed-interleave decoder when the two chroma
components declare different bit depths. Both the written bytes and the
overflow length are controlled by the file. (critical)
CVE-2026-XXXXX (GHSA-8fmq-r4pf-7m57) Permanent decoder deadlock through
a reference cycle between an image and its alpha auxiliary image. The
alpha edge was not covered by the cycle guard and re-entered a held
mutex. (high)
CVE-2026-XXXXX (GHSA-w7mc-p8jc-p853) Heap out-of-bounds read in the
YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma
planes have a lower bit depth than luma. Heap memory could end up in
the decoded image. YCbCr conversions with mismatched luma and chroma
bit depths are now rejected. (high)
CVE-2026-XXXXX (GHSA-4jqm-2x34-6f6r) Heap buffer overflow in the SVT-AV1
encoder plugin when encoding a high-bit-depth alpha channel, and a
double free on its send-picture error path. (high)
CVE-2026-84451 (GHSA-hh47-fhqr-cj2r) Incomplete fix for
GHSA-73p7-m7gg-w2jv: the tile range check of the unci decoder (without
icef) could still overflow, allowing an out-of-bounds read. (medium)
CVE-2026-XXXXX (GHSA-4h82-g446-83fm) Heap out-of-bounds read when
converting odd-height 4:2:0 frames of an uncompressed (uncv) image
sequence to RGB. (medium)
CVE-2026-XXXXX (GHSA-9rj8-5mp5-26c9) Out-of-bounds read in the RGB to
YCbCr identity-matrix color conversion when the R, G, and B planes
have different bit depths. (medium)
CVE-2026-84450 (GHSA-gh5q-69gg-c964) A clap property combined with an
oversized ispe reached an assert() in the Fraction arithmetic and
aborted the process (incomplete fix for GHSA-jc8f-p23p-5hjg). An error
is returned instead. (medium)
(GHSA-mw6f-29j3-76f4) Several smaller findings:
heif_image_handle_get_depth_image_handle() and
heif_image_handle_get_depth_image_representation_info() dereferenced a
null pointer on files without a depth image; the TIFF input decoder of
the example tools had an unbounded EXIF tag allocation and a division
by zero on zero YCbCr subsampling; assert()s in the PNG input decoder
are now error returns; integer overflow in the Go binding's
ImageAccess.GetPlane(); heif-view now verifies the decoded frame size
before display. (medium)
(GHSA-8857-r8x5-7499) Undefined behavior (negative shift) in the HDR
bit-depth up-conversion for target bit depths above 16. Such
conversions are now rejected. (low)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d148168e20)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot 262a7f6d2f added the package but
forgot to provide the hash for LICENSE.GPL3-EXCEPT, instead a hash for
a non-existing file was added to qt5knx.hash.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d2b7199dea)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig and test configurations using
support/scripts/gen-bootlin-toolchains.
This adds BR2_USE_MMU to the affected uClibc entries and to the
architecture support conditions, and updates the generated tests.
The glibc and musl changes only reorder their existing BR2_USE_MMU
dependencies.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9c6eed9ec0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The Bootlin uClibc toolchains for m68k-68xxx, riscv32-ilp32d, and
xtensa-lx60 require an MMU. However, their generated Kconfig entries
lack a BR2_USE_MMU dependency, allowing them to be selected for noMMU
configurations. External toolchain validation then fails with:
MMU support available in C library, please enable BR2_USE_MMU
Add the missing BR2_USE_MMU dependencies for these architectures to
prevent them from being selected for noMMU targets.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3469c6793c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig file with
support/scripts/gen-bootlin-toolchains to remove duplicate
BR2_TOOLCHAIN_HAS_THREADS selections.
Commit 184d47a7ad ("support/scripts/gen-bootlin-toolchains: add new
script to support Bootlin toolchains") initially introduced this issue.
Although commit a33e1af4a0 ("support/scripts/gen-bootlin-toolchains:
avoid selecting _HAS_THREADS multiple times") fixed the generator script,
the Config.in.options file was not regenerated accordingly.
This is a non-functional cleanup, as repeated Kconfig select statements
are harmless.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9556895e78)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
DEJAVU_LICENSE is primarily BitstreamVera. The license file also
specifies that DejaVu-specific changes and certain math extensions are
in the Public Domain. This matches the licensing logic used by
OpenEmbedded/Yocto.
Signed-off-by: Martin Bachmann <martin.bachmann@designwerk.com>
[Fiona: wrap lines in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit df61b7e9bb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
See the changelogs:
- https://www.erlang.org/patches/OTP-26.2.5.16
- https://www.erlang.org/patches/OTP-26.2.5.17
- https://www.erlang.org/patches/OTP-26.2.5.18
- https://www.erlang.org/patches/OTP-26.2.5.19
- https://www.erlang.org/patches/OTP-26.2.5.20
- https://www.erlang.org/patches/OTP-26.2.5.21
This fixes the following vulnerabilities:
- CVE-2026-21620:
Relative Path Traversal, Improper Isolation or Compartmentalization
vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp
inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows
Relative Path Traversal. This vulnerability is associated with program
files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-21620
- CVE-2026-23941:
Inconsistent Interpretation of HTTP Requests ('HTTP Request
Smuggling') vulnerability in Erlang OTP (inets httpd module) allows
HTTP Request Smuggling. This vulnerability is associated with program
files lib/inets/src/http_server/httpd_request.erl and program routines
httpd_request:parse_headers/7. The server does not reject or
normalize duplicate Content-Length headers. The earliest Content-
Length in the request is used for body parsing while common reverse
proxies (nginx, Apache httpd, Envoy) honor the last Content-Length
value. This violates RFC 9112 Section 6.3 and allows front-end/back-
end desynchronization, leaving attacker-controlled bytes queued as the
start of the next request.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23941
- CVE-2026-23942:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
Traversal. This vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines
ssh_sftpd:is_within_root/2. The SFTP server uses string prefix
matching via lists:prefix/2 rather than proper path component
validation when checking if a path is within the configured root
directory. This allows authenticated users to access sibling
directories that share a common name prefix with the configured root
directory. For example, if root is set to /home/user1, paths like
/home/user10 or /home/user1_backup would incorrectly be considered
within the root.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23942
- CVE-2026-23943:
Improper Handling of Highly Compressed Data (Compression Bomb)
vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial
of Service via Resource Depletion. The SSH transport layer advertises
legacy zlib compression by default and inflates attacker-controlled
payloads pre-authentication without any size limit, enabling reliable
memory exhaustion DoS. Two compression algorithms are affected: *
zlib: Activates immediately after key exchange, enabling
unauthenticated attacks * zlib@openssh.com: Activates post-
authentication, enabling authenticated attacks Each SSH packet can
decompress ~255 MB from 256 KB of wire data (1029:1 amplification
ratio). Multiple packets can rapidly exhaust available memory, causing
OOM kills in memory-constrained environments. This vulnerability is
associated with program files lib/ssh/src/ssh_transport.erl and
program routines ssh_transport:decompress/2,
ssh_transport:handle_packet_part/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23943
- CVE-2026-28810:
Generation of Predictable Numbers or Identifiers vulnerability in
Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache
Poisoning. The built-in DNS resolver (inet_res) uses a sequential,
process-global 16-bit transaction ID for UDP queries and does not
implement source port randomization. Response validation relies almost
entirely on this ID, making DNS cache poisoning practical for an
attacker who can observe one query or predict the next ID. This
conflicts with RFC 5452 recommendations for mitigating forged DNS
answers. inet_res is intended for use in trusted network environments
and with trusted recursive resolvers. Earlier documentation did not
clearly state this deployment assumption, which could lead users to
deploy the resolver in environments where spoofed DNS responses are
possible. This vulnerability is associated with program files
lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-28810
- CVE-2026-32147:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows
an authenticated SFTP user to modify file attributes outside the
configured chroot directory. The SFTP daemon (ssh_sftpd) stores the
raw, user-supplied path in file handles instead of the chroot-resolved
path. When SSH_FXP_FSETSTAT is issued on such a handle, file
attributes (permissions, ownership, timestamps) are modified on the
real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root
option can modify file attributes of files outside the intended chroot
boundary. The prerequisite is that a target file must exist on the
real filesystem at the same relative path. Note that this
vulnerability only allows modification of file attributes; file
contents cannot be read or altered through this attack vector. If the
SSH daemon runs as root, this enables direct privilege escalation: an
attacker can set the setuid bit on any binary, change ownership of
sensitive files, or make system configuration world-writable. This
vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and
ssh_sftpd:handle_op/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32147
- CVE-2026-42789:
Improper Following of a Certificate's Chain of Trust vulnerability in
Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate
to be accepted as an intermediate issuer, enabling certificate chain
forgery. In lib/public_key/src/pubkey_cert.erl,
pubkey_cert:validate_extensions/7 contains two flaws that together
allow a certificate with basicConstraints cA:false and no keyUsage
extension to be used as an intermediate issuer in a chain passed to
public_key:pkix_path_validation/3: the cA:false clause recurses into
the remaining extensions without rejecting the certificate when it is
in issuer position, and the keyUsage check only fires when the
extension is present, so a certificate lacking keyUsage entirely
bypasses the keyCertSign enforcement. Any party holding an end-entity
certificate with basicConstraints cA:false and no keyUsage extension,
issued by any CA in the victim's trust store, can use that
certificate's private key to sign forged leaf certificates for
arbitrary identities. public_key:pkix_path_validation/3 accepts the
resulting chain, and by extension every TLS or mTLS endpoint built on
the OTP ssl application that relies on the default verifier is
affected, including server identity verification on the client side
and client certificate verification on mTLS servers.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42789
- CVE-2026-42790:
Improper Certificate Validation vulnerability in Erlang OTP public_key
(pubkey_cert and public_key modules) allows a DNS nameConstraints
bypass via subject CommonName fallback in TLS hostname verification.
Two flaws combine to allow a subordinate CA whose DNS nameConstraints
are restricted (e.g. permitted;DNS:allowed.example.com) to issue a
leaf certificate that an OTP TLS client accepts as a valid identity
for an out-of-scope hostname (e.g. victim.example.com): First,
pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl
only checks SAN DNS entries against nameConstraints. Per RFC 5280, a
permitted DNS subtree only restricts certificates that contain a DNS-
typed name. A leaf with no subjectAltName therefore trivially
satisfies any permitted;DNS:... constraint regardless of its subject
commonName. Second, public_key:pkix_verify_hostname/3 in
lib/public_key/src/public_key.erl falls back to the subject commonName
when no subjectAltName is present, extracting id-at-commonName
attributes as presented IDs and matching them against the reference
hostname. The strict pkix_verify_hostname_match_fun(https) matcher
does not suppress this fallback. The result is that path validation
accepts a CN-only leaf under a DNS-constrained intermediate (no SAN
means the nameConstraints are not triggered), and hostname
verification then accepts it via the CN fallback. The bypass is
reachable from stock ssl:connect with verify_peer, a trusted CA, SNI,
and the canonical strict https hostname matcher.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42790
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dfc909b1cd)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This patch fixes a build error with OpenSSL-enabled libcurl which was
detected by the Gitlab pipelines:
checking for openssl options with pkg-config... found
configure: pkg-config: SSL_LIBS: "-lssl -lcrypto -pthread"
configure: pkg-config: SSL_LDFLAGS: "-L/builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib"
configure: pkg-config: SSL_CPPFLAGS: ""
checking for HMAC_Update in -lcrypto... no
checking for HMAC_Init_ex in -lcrypto... no
checking OpenSSL linking with -ldl... no
checking OpenSSL linking with -ldl and -lpthread... no
checking for SSL_set_quic_use_legacy_codepoint... no
checking for SSL_set_quic_tls_cbs... no
configure: OpenSSL version does not speak any known QUIC API
configure: OPT_OPENSSL: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/m68k-buildroot-uclinux-uclibc/sysroot/usr
configure: OPENSSL_ENABLED:
configure: error: --with-openssl was given but OpenSSL could not be detected
make[1]: *** [package/pkg-generic.mk:263: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/build/libcurl-8.21.0/.stamp_configured] Error 1
Although OpenSSL was found using pkg-config the build tests fail.
A local build shows the concrete error in config.log, for example:
configure:27577: checking for HMAC_Update in -lcrypto
configure:27599: /home/bernd/buildroot/output/host/bin/m68k-linux-gcc
-o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-D_FILE_OFFSET_BITS=64 -O2 -g0 -fno-dwarf2-cfi-asm -Wl,-elf2flt=-r
-static -Werror-implicit-function-declaration -Wno-system-headers
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
-D_GNU_SOURCE -Wl,-elf2flt=-r -static
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
conftest.c -lcrypto -lssl -lcrypto -lz -pthread -lz >&5
/home/bernd/buildroot/output/host/opt/ext-toolchain/m68k-buildroot-uclinux-uclibc/bin/ld.real:
/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib/libcrypto.a(libcrypto-lib-threads_pthread.o):
in function `ossl_rcu_read_lock':
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
This error occurs many times for various atomic operations:
$ grep "undefined reference to \`__atomic" output/build/libcurl-8.20.0/config.log | sort -u | grep -v real
threads_pthread.c:(.text+0x28a): undefined reference to `__atomic_fetch_sub_8'
threads_pthread.c:(.text+0x3b4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0x9c8): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0xa9c): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xb66): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xc30): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xcdc): undefined reference to `__atomic_is_lock_free'
The build error can be reproduced with the current buildroot tree using
this defconfig:
BR2_m68k=y
BR2_m68k_cf5208=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_M68K_COLDFIRE_UCLIBC_STABLE=y
BR2_PACKAGE_OPENSSL=y
BR2_PACKAGE_LIBCURL=y
Although the toolchain lacks atomics support
$ grep ATOMIC .config
$
it emits atomic-related defines, for example:
$ echo | output/host/bin/m68k-linux-gcc -dM -E - | grep __ATOMIC_ACQ_REL
#define __ATOMIC_ACQ_REL 4
$
This specific define __ATOMIC_ACQ_REL is used in OpenSSL to enable
atomic support at various places:
https://github.com/openssl/openssl/blob/openssl-3.6.3/crypto/threads_pthread.c
causing the build errors we see with the mentioned defconfig.
To fix the problem we use an OpenSSL-provided define to forcefully
disable the usage of atomic intrinsics.
The misdetection of atomic intrinsics for m68k coldfire is not a new
problem:
https://lists.buildroot.org/pipermail/buildroot/2017-May/180841.htmlhttps://lists.buildroot.org/pipermail/buildroot/2026-May/803110.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5f8d0b78ec)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The mdnsd runtime test can randomly fail on slow runners.
It's hard to reproduce locally (only one failure after a few attempts)
but we can reproduce it easily by removing the while loop entirely.
It turns out that mdnsd is started by S50mdnsd before the
emulator.login() change the system date:
[BRTEST# date -s @1788032864
Sat Aug 29 19:47:44 UTC 2026
Since the minimal rootfs.cpio generated for TestMdnsd doesn't have any
ntp client installed, it start with "January 1, 1970".
The date change may cause some issue to the mdnsd daemon which blocks
any response from mquery command.
When the problem occurs, "mquery -T _http._tcp" reply is empty:
# mquery -T _http._tcp
Querying _http._tcp.local. for PTR (12) ... press Ctrl-C to stop
To workaround the issue, restart mdnsd manually.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948555
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45636d67c9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Dracut-internal executables were linked against system libraries,
instead of Buildroot host packages. For example:
$ ldd host/lib/dracut/dracut-install
linux-vdso.so.1 (0x00007f578cf06000)
libc.so.6 => /usr/lib/x86_64-linux-gnu/libc.so.6 (0x00007f578cccd000)
libkmod.so.2 => /usr/lib/x86_64-linux-gnu/libkmod.so.2 (0x00007f578ccb1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f578cf08000)
libcrypto.so.3 => /usr/lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f578c600000)
libz.so.1 => /usr/lib/x86_64-linux-gnu/libz.so.1 (0x00007f578cc92000)
libzstd.so.1 => /usr/lib/x86_64-linux-gnu/libzstd.so.1 (0x00007f578c536000)
The reason is that Dracut is not a "real" autoconf package, and the
hand-written ./configure script does not preserve LDFLAGS for
make. Pass the environment variables directly to fix this.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
[Julien: add comment in dracut.mk]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45acb281ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
examples/vm_power_manager/meson.build in DPDK detects the presence of
libvirt:
opt_dep = cc.find_library('virt', required : false)
and then builds some examples or not depending on the availability of
libvirt. Let's make this optional dependency explicit in dpdk.mk, even
if there's no explicit enable/disable option for it.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 55a7ece9e5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When libvirt is present before DPDK is built, some additional examples
are compiled. One of them fails to build due to a missing <stdlib.h>
include. Let's import a patch from OpenSuse, that we have submitted
upstream, to fix this issue.
We couldn't find any autobuilder failure for this issue, but the
following defconfig allows to reproduce the failure:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_DPDK=y
BR2_PACKAGE_DPDK_EXAMPLES=y
BR2_PACKAGE_LIBVIRT=y
The problem exists since DPDK v19.11, so it has been in Buildroot
since DPDK was introduced in commit
d17d1b6bde.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit db3d0d44ac)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/perl: fix build issue with musl)
introduced a patch that is meant to be applied on top of perl-cross,
which is extracted on top of perl only in the target variant.
Since the patch was introduced as a normal package patch, the Buildroot
infra is trying to always apply it, even for the host package variant.
Since perl-cross is not extracted for the host variant, some patched
files are missing. In that case, the host-perl is failing with error:
>>> host-perl 5.42.3 Patching
Applying 0001-configure-keep-_GNU_SOURCE-in-build-flags.patch using patch:
can't find file to patch at input line 46
This commit fixes the issue by moving the package patch in a dedicated
"perl-cross" subdirectory, to make sure it will no longer be applied by
the infra. We apply the patch only for the target package variant using
a _POST_PATCH_HOOKS hook.
Fixes:
- [1]
- https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948610 (TestPerlXMLLibXML)
- ...and few other tests requiring host-perl
[1] d950fff290
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8dea6e7c08)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When OpenSSL is enabled, if DES support is enabled, OpenSSH uses
DES_crypt. However, without OpenSSL or its DES support, there is no
available crypt() implementation for OpenSSH libopenbsd-compat xcrypt()
function, resulting in the following error:
.../host/bin/i686-buildroot-linux-gnu-gcc -o sshd-auth sshd-auth.o
auth2-methods.o auth-rhosts.o auth-passwd.o sshpty.o sshlogin.o
servconf.o serverloop.o auth.o auth2.o auth-options.o session.o
auth2-chall.o groupaccess.o auth-bsdauth.o auth2-hostbased.o
auth2-kbdint.o auth2-none.o auth2-passwd.o auth2-pubkey.o
auth2-pubkeyfile.o auth2-gss.o gss-serv.o gss-serv-krb5.o
monitor_wrap.o auth-krb5.o audit.o audit-bsm.o audit-linux.o
platform.o loginrec.o auth-pam.o auth-shadow.o auth-sia.o
sandbox-null.o sandbox-rlimit.o sandbox-darwin.o
sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-solaris.o
sftp-server.o sftp-common.o uidswap.o ssh-pkcs11-client.o
ssh-sk-client.o -L. -Lopenbsd-compat/ -D_LARGEFILE_SOURCE
-D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0
-D_FORTIFY_SOURCE=1 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-fstack-protector-strong -pie -lssh -lopenbsd-compat
-L.../host/bin/../i686-buildroot-linux-gnu/sysroot/usr/lib
-lssl -lcrypto -lcrypto -lz
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt'
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt' collect2: error:
ld returned 1 exit status make[2]: *** [Makefile:233: sshd-auth] Error
1 make[2]: *** Waiting for unfinished jobs.... collect2: error: ld
returned 1 exit status make[2]: *** [Makefile:230: sshd-session] Error
1 make[1]: *** [package/pkg-generic.mk:273:
.../build/openssh-10.4p1/.stamp_built]
Error 2 make: *** [Makefile:83: _all] Error 2
This commit enables BR2_PACKAGE_LIBXCRYPT with OpenSSH as long as
glibc is used. Since "sshd-auth" is compiled regardless of
BR2_PACKAGE_OPENSSH_SERVER, we need to enable it with BR2_PACKAGE_OPENSSH.
Signed-off-by: Jimmy Durand Wesolowski <jimmy.wesolowski@mobileye.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 913512e302)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the website accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2eefcb245f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the manual accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2d7d9d8200)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This fixes the following known vulnerabilities:
- CVE-2026-19499
- CVE-2026-77117
- CVE-2026-80489
(alternative to commit be382f6061)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When BR2_PACKAGE_OPENCV4_WITH_WEBP=y we need to enable mux and demux
support in webp, otherwise the build of OpenCV fails as follows:
CMake Error: The following variables are used in this project,
but they are set to NOTFOUND.
Please set them or make sure they are set and tested correctly
in the CMake files:
WEBP_DEMUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
WEBP_MUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
The issue already exists in 2025.02.x.
Fixes:
https://autobuild.buildroot.net/results/d3e0446a87d32469267e241866c4224143170f31/
Signed-off-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e1ec936cf7)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Even though it's only documentation, the form of the names of the
post-image.sh and post-build.sh scripts should be consistent with the
names of those scripts used in the code base, using hyphen, not
underscore.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c529a2c286)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
host-erlang build can fail with the following error:
make[5]: Nothing to be done for 'opt'.
MAKE opt
CC ../priv/bin/x86_64-pc-linux-gnu/odbcserver
/usr/bin/ld: ../priv/obj/x86_64-pc-linux-gnu/odbcserver.o: in function `encode_column_dyn':
odbcserver.c:(.text+0x6b4): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6c2): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6d4): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6e7): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6fa): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x708): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x71b): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x72e): undefined reference to `ei_x_encode_ulong'
[...]
This can be reproduced with the following minimal defconfig (and
libei.so present on host, see details below):
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_ERLANG=y
Those missing symbols are part of the erl_interface, exposed by libei.a.
host-erlang builds correctly libei.a _before_ odbcserver.c (it can be
found in lib/erl_interface/obj/x86_64-pc-linux-gnu/libei.a), but the
failure is actually due to the build command generated and used for
odbcserver.c, especially the link arguments:
/usr/bin/gcc \
[...]
-o ../priv/bin/x86_64-pc-linux-gnu/odbcserver \
../priv/obj/x86_64-pc-linux-gnu/odbcserver.o \
-L/usr/lib64 \
-lodbc \
-L/home/alexis/src/buildroot/erlang-master/build/host-erlang-custom/lib/erl_interface/obj/x86_64-pc-linux-gnu \
-lpthread -lei
/usr/lib64 is searched before the path where libei.a has been built, so
if whether a valid libei.a or libei.so is found there, it shadows the
expected libei.a. In the build from which the logs above come, the
notable point is that the host system indeed have a valid libei.so, but
is completely unrelated to erl_interface; it rather exposes the Emulated
Input protocol aimed at Wayland stack; and so it obviously contains none
of the expected ei_* symbols.
Upstream has already identified and fixed the issue, the fix is already
released in versions >= 27.x.y. Erlang 26 (the version currently
packaged in buildroot), isn't supported anymore (only the three latest
releases are supported, see
https://github.com/erlang/otp/blob/master/SECURITY.md), so there won't
be any new minor update that will release this fix.
Pick and backport the fixing patch so that the current version packaged
in buildroot can still build.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ea2135a56)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.2
Fixes the following CVEs:
(CVE numbers will be added upstream when assigned.)
CVE-2026-XXXXX (GHSA-g89c-p67h-r497)
Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha
planes from nested iden/auxl items. (critical)
(GHSA-2jg2-4ch7-h545)
Out-of-bounds read and write in derived-item and pixel-plane handling.
Through iden and auxl item chains, a crafted file could attach pixel
planes whose size differs from the image geometry; crop, scale, and
plane-extraction code then indexed those planes with the wrong size.
A working code-execution exploit was confirmed. Plane sizes are now
validated wherever they are consumed. (critical)
CVE-2026-XXXXX (GHSA-24wx-9w62-c96w)
brotli/zlib decompression of mime metadata and unci image data had no
effective output-size limit, so a decompression bomb could exhaust
memory. Decompressed output is now bounded by the security limits.
(high)
CVE-2026-XXXXX (GHSA-x8xm-cm2c-cfc8)
Chains of derived-image references (grid, iovl, iden) bypassed decode
caching and memory limits, causing CPU and memory amplification. (high)
CVE-2026-XXXXX (GHSA-xw34-mjcp-jqh8)
Sequence sample-timing initialization could produce non-terminating
decode loops and unbounded memory, bypassing max_sequence_frames.
(high)
CVE-2026-XXXXX (GHSA-j264-xvrp-5v7q)
Out-of-bounds write in the unci encoder when
heif_context_add_image_tile() is given a tile whose planes do not match
its declared size. (high)
CVE-2026-XXXXX (GHSA-p58j-h3vm-3fp5)
Heap out-of-bounds read in the inline-mask region API when
mask_data_len does not match the region geometry. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0fe2d74ffd)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since the bump of libxml2 from 2.13.8 to 2.15.0 in Buildroot commit
d81922c1ef, the "virt" plugin of
collectd no longer builds:
src/virt.c:2208:49: error: expected ';', ',' or ')' before 'ATTRIBUTE_UNUSED'
2208 | static void virt_eventloop_timeout_cb(int timer ATTRIBUTE_UNUSED,
| ^~~~~~~~~~~~~~~~
src/virt.c: In function 'register_event_impl':
src/virt.c:2221:26: error: 'virt_eventloop_timeout_cb' undeclared (first use in this function)
2221 | virt_eventloop_timeout_cb, NULL, NULL) < 0) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
src/virt.c:2221:26: note: each undeclared identifier is reported only once for each function it appears in
This is due to the fact that the virt plugin code was incorrectly
using the ATTRIBUTE_UNUSED define, which was supposed to be an
internal define of libxml2. But it turns out that up to libxml2 2.14.0
and its commit 208f27f9641a59863ce1f7d4992df77f7eb0ea9d, this define
had been made publicly available. It could therefore mistakenly be
used by collectd's virt plugin... until libxml2 was upgraded.
We backport an upstream patch from collectd that fixes the issue.
Fixes:
https://autobuild.buildroot.net/results/4c8463f0372560f4c3a20b0f67854460f0d1c400/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83fc4aa55e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit adds a simple bpftrace test that ensures that not only it
builds fine, but it also runs properly on a minimal test scenario.
Assisted-by: GPT-5.6
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien:
- reindent emulator.boot() options
- add a call to "bpftrace --version"
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e06cfae9cb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since Buildroot commit 25cb3813e7 which
bumped LLVM from 21.x to 22.x, the build of bpftrace is broken as
bpftrace 0.24.2 only supports LLVM up to 21.
We tried backporting the bpftrace patch that allows using LLVM up to
version 22 but the patch didn't apply cleanly but more importantly it
wasn't clear if this patch was sufficient. Therefore, we opt for
bumping bpftrace entirely to fix the issue.
Packaging changes:
- The new version of bpftrace no longer needs host-bison/host-flex,
because bpftrace is now using a handwritten parser.
- Pass -DUSE_SYSTEM_LIBBPF:BOOL=ON to ensure the system libbpf version
is used, and not the bundled version
- Now depends on kernel headers >= 5.10 because it needs CAP_BPF and
CAP_PERFMON
Upstream changelog:
https://github.com/bpftrace/bpftrace/blob/v0.26.1/CHANGELOG.md
Fixes:
https://autobuild.buildroot.net/results/a3e3fd696685864977c688aa11c2653357cf6207/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: add link to upstream changelog]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc25888c88)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
bpftrace often needs very recent kernel headers, more recent than the
runtime version actually needed. We already had a workaround in
libbpf making sure that if the kernel headers are older than 6.1, we
would install the libbpf provided headers instead.
As we are about to update bpftrace to a newer version that uses
BPF_TRACE_KPROBE_SESSION, which was introduced in Linux 6.10, we need
to update this workaround accordingly and ensure that the libbpf
header is installed if the kernel headers are older than 6.10.
This is necessary for the update of bpftrace to 0.26.1.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e9c540ddd2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Based on the lighttpd test case. Verify that we can download index.html
from haproxy in front of lighttpd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 211cfafa16)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
haproxy has a runtime test to verify that it is built with -fwrapv:
haproxy
FATAL ERROR: invalid code detected -- cannot go further, please recompile!
The source code was miscompiled by the compiler, which usually indicates that
some of the CFLAGS needed to work around overzealous compiler optimizations
were overwritten at build time. Please do not force CFLAGS, and read Makefile
and INSTALL files to decide on the best way to pass your local build options.
Build options :
TARGET = custom
CPU = generic
CC = /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
CFLAGS = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1
OPTIONS = USE_THREAD=1 USE_DL=1
DEBUG = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
Which comes from:
https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
So build it with -fwrapv to fix that.
Notice that this message also embeds the build path (through CC), breaking
reproducible builds.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 94aa7f40b5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since upstream commit
e42e3193137d1b21e84b499336e7a8887b8a8689 ("intel: add Jay"), a C23
construct is used in the intel driver code:
enum jay_predication : uint8_t
This causes a build issue with GCC < 13:
In file included from ../src/intel/compiler/jay/jay_builder.h:12,
from ../src/intel/compiler/jay/jay_from_nir.c:23:
../src/intel/compiler/jay/jay_ir.h:582:22: error: expected identifier or ‘(’ before ‘:’ token
582 | enum jay_predication : uint8_t {
| ^
../src/intel/compiler/jay/jay_ir.h:637:25: error: field ‘predication’ has incomplete type
637 | enum jay_predication predication;
| ^~~~~~~~~~~
We fix that by integrating a patch already available in
OpenEmbedded. It changes the code to not use the C23 construct.
This build issue was encountered on host-mesa3d while building an
allyespackageconfig configuration inside our standard Docker
container.
Buildroot commit
c073c97617 ("package/{mesa3d,
mesa3d-headers}: bump version to 26.1.0") that switched to mesa3d
26.1.0, which contains the problematic commit. Therefore 2026.05 is
affected, but not earlier Buildroot versions.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 79554a4520)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
perl does not build with musl due to memrchr() being unavailable. This
is caused by a perl-cross bug, which does function availability
detection with _GNU_SOURCE defined, but then does the build without
_GNU_SOURCE defined. At least OpenEmbedded and NixOS have faced the
same issue, and worked it around in slightly different ways.
On our side, we create a patch, which was submitted upstream, to solve
the issue.
This issue has been introduced in perl-cross commit b40c560f5d5e,
which was first merged in perl-cross release 1.4.1. From a Buildroot
perspective, we bumped from perl-cross 1.4 to 1.4.1 in commit
8a289667f5, which was merged
2023.05. And indeed the build failure can be reproduced even on our
LTS 2025.02.x, so the fix needs to be backported there.
It should be noted that even if the patch is against perl-cross, we
add it to package/perl/ directly, as patches in perl are applied after
perl has been extracted *and* perl-cross has been extracted on top.
Fixes:
https://autobuild.buildroot.net/results/3e47ade0963642988fd8e1be9a6e8042700619ec/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d950fff290)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The BR2_PACKAGE_QT6DECLARATIVE_QUICK option has some logic to select
network support in host-qt6base if network support is enabled in
qt6base. However, it turns out that this is actually required at the
top level BR2_PACKAGE_QT6DECLARATIVE option: as soon as network
support is available in qt6base, the qt6declarative build will assume
that qmlprofiler is available... but that requires network support in
host-qt6base.
This fixes the following build failure:
CMake Error at /home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:784 (message):
Failed to find the host tool "Qt6::qmlprofiler". It is part of the
Qt6QmlTools package, but the package did not contain the tool. Make sure
that the host module Qml was built with all features enabled (no explicitly
disabled tools).
Call Stack (most recent call first):
/home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:83 (qt_internal_find_tool)
tools/qmlprofiler/CMakeLists.txt:11 (qt_internal_add_tool)
Fixes:
https://autobuild.buildroot.net/results/72c956fdf982382d2981c649c456d1edc2c9d6b2/
We did not trace back exactly since when the problem exists, but we
verified that the problem exists in 2025.02.x. It can be reproduced
with the following defconfig:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_NETWORK=y
BR2_PACKAGE_QT6DECLARATIVE=y
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50a1dd2676)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The commit "Enable host test module to ensure that qmltestrunner is
built" in qt6declarative's Config.in feels lonely under
BR2_PACKAGE_QT6DECLARATIVE. It's because it's actually related to a
select done in the sub-option BR2_PACKAGE_QT6DECLARATIVE_QUICK, so
move it there.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29add67666)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/apache: use "Debian" filesystem
layout to fix read-only rootfs) changed the filesystem layout.
This had the effect of installing files to different locations
and breaking the test_php runtime test.
This commit fixes the issue by updating the file paths to their
right locations. The "httpd.conf" was updated by following the
same recipe described in the comment (starting from a config
file as installed by the apache Buildroot package).
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152979
[1] 1006666f67
Signed-off-by: Julien Olivain <ju.o@free.fr>
Tested-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 23fd881bdb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit 54f96add94 ("package/bind:
security bump version to 9.20.24") the depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL was incorrectly downgraded to
BR2_TOOLCHAIN_HAS_THREADS:
- depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # libuv
+ depends on BR2_TOOLCHAIN_HAS_THREADS # liburcu, libuv
This is wrong because libuv depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL. This causes unmet dependencies:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LIBUV
Depends on [n]: BR2_TOOLCHAIN_HAS_THREADS_NPTL [=n] && BR2_USE_MMU [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y]
Selected by [y]:
- BR2_PACKAGE_BIND [=y] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y] && BR2_INSTALL_LIBSTDCPP [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y] && BR2_PACKAGE_LIBURCU_ARCH_SUPPORTS [=y]
Fix that by switching back to the BR2_TOOLCHAIN_HAS_THREADS_NPTL
dependency.
Fixes: 54f96add94 ("package/bind: security bump version to 9.20.24")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d8dde961bc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
- CVE-2026-19654:
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw
in the optional imptcp module. A crafted input sequence during
oversize-frame recovery can cause an invalid internal message length
and terminate rsyslogd. No confidentiality or integrity impact,
privilege escalation, or code execution has been identified. imtcp and
the default imptcp framing modes are not affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-19654
- 07b3c40a5a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 52ae04257a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
See the changelog:
- https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2
It fixes the following vulnerabilities:
- CVE-2026-14586: Assertion in libngtcp2 when under pressure in high
concurrency DNS-over-QUIC environments.
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to
`quic-size` budget bypass.
- CVE-2026-40691: Packet of death for DNSCrypt over TCP.
- CVE-2026-41637 Degradation of resolution service from improperly
accounted client-terminated DNS-over-QUIC queries.
- CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of
A/AAAA records disallowing a one-time 'ghost domain' delegation
renewal via glue records.
- CVE-2026-44621: Libunbound applications configured with
'unwanted-reply-threshold' could eventually be abruptly terminated.
- CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain' logic can
shadow a stub/forward zone by a legitimate parent's NXDOMAIN.
- CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels
manipulation.
- CVE-2026-46582: A wildcard replay, as another piece of data, triggers
poisoning in the serve expired reply path.
- CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation
restarts.
- CVE-2026-50046: Possible heap use-after-free in an error path when a
DoT forwarded query is jostled out.
- CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead
of returning SERVFAIL.
- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in
auth/rpz zones.
- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers
defensive full-cache flush.
- CVE-2026-50252: Possible cache poisoning attack by mapping source port
population per thread.
- CVE-2026-52863: Memory corruption could lead to crash and denial of
service.
- CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol
use.
- CVE-2026-55708: Privacy/configuration issue when adding local data in
views through 'unbound-control'.
- CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip' CNAME
redirect could lead to a crash.
- CVE-2026-55973: 'dns-error-reporting: yes' leads to stack buffer
overflow.
- CVE-2026-55990: Packet of death for a DNSCrypt misconfigured Unbound.
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion
failure in libngtcp2.
- CVE-2026-56416: Possible heap buffer overflow when validator
canonicalizes RDATA that contains domain name.
- CVE-2026-56444: Degradation of resolution service when
'discard-timeout' and 'serve-expired-client-timeout' are combined in
unusual configuration.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d0619dfc6b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This release includes a broad round of hardening against malformed and
adversarial input across the Python SDK (bounding allocations and enforcing
decompression limits before trusting size fields read from the input).
See the release notes https://avro.apache.org/blog/2026/08/12/avro-1.12.2/
Also update the download url, because www-eu.apache.org/dist/...
is a redirection to downloads.apache.org/...
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 02d8a41f09)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/openssl/openssl/releases/tag/openssl-3.6.4
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 198317785a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In some situations (old Linux <3.17 or glibc <2.25), expat fail at
compilation time with the error:
xmlparse.c:150:4: error: #error You do not have support for any sources of high quality entropy enabled.
For end user security, that is probably not what you want. Your options include:
* Linux >=3.17 + glibc >=2.25 (getrandom): HAVE_GETRANDOM,
* Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM,
* BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF,
* BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM,
* BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY,
* Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM,
* Windows >=Vista (rand_s): _WIN32.
If you insist on not using any of these, bypass this error by defining XML_POOR_ENTROPY and be vulnerable to hash flooding;
you have been warned. If you have reasons to patch this detection code away or need changes to the build system, please open a bug. Thank you!
This is caused by the upstream commit [1] "Autotools: Stop using
/dev/urandom by default", first included in expat 2.8.2. The
Buildroot expat package was bumped to that version in commit [2].
But since all Linux systems have /dev/urandom, we can just enable
it by default.
Note: this commit does not globally switch the entropy source to
/dev/urandom. It is rather enabling it in the list of available
sources. On more recent Linux systems (linux >= 3.17, glibc >= 2.25),
other sources will be chosen. The entropy source preference order
amongst the enabled sources is defined in [3].
This commit also changes the _CONF_OPTS to multiline layout to fit
within the 80 characters.
[1] d30eca113a
[2] 6b1f6f7a48
[3] https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/lib/xmlparse.c#L1115-L1142
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add extra info in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c22fc74f2b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since gdb 9.x, gdb can optionally use the xxhash library. Since we
currently don't do anything about it, it's a potential "silent"
dependency.
In particular, for host-gdb, this means host-gdb might end up being
linked with the system-provided xxhash library if available.
This patch handles this dependency:
- For the target package, by looking at the value of
BR2_PACKAGE_XXHASH
- For the host package, by looking at the value of a newly introduced
BR2_PACKAGE_HOST_GDB_XXHASH
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9dc567aa78)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
For target gdb, we properly enable/disable lzma support depending on
BR2_PACKAGE_XZ.
However, for host-gdb we don't do anything, which can lead the gdb
configure script to detect and use a system-provided xz library, which
is not desired.
Instead, add an explicit option BR2_PACKAGE_HOST_GDB_LZMA, which when
enabled pulls in host-xz, but also when disabled ensures gdb doesn't
try to use a system-provided xz library.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c3adba81d1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit a2380157f6 ("toolchain: enable
libquadmath for PowerPC with VSX"), the definition of
BR2_TOOLCHAIN_HAS_LIBQUADMATH has been extended to also be true when
BR2_POWERPC_CPU_HAS_VSX.
However, practical experiments show that when 64-bit VSX-capable cores
are used in 32-bit mode, libquadmath is not built by GCC, causing
build failures:
cp: cannot stat '/home/autobuild/autobuild/instance-3/output-1/host/powerpc-buildroot-linux-musl/lib*/libquadmath*': No such file or directory
We did an extensive testing, building the 27 combinations of:
- GCC versions: 14, 15, 16
- C library: glibc, uclibc, musl
- PowerPC 32-bit, PowerPC 64-bit, PowerPC 64-bit little endian
This testing provides the following results:
| gcc14 | powerpc64 | glibc | OK |
| gcc14 | powerpc64le | glibc | OK |
| gcc14 | powerpc64le | musl | OK |
| gcc14 | powerpc64le | uclibc | SKIPPED |
| gcc14 | powerpc64 | musl | OK |
| gcc14 | powerpc64 | uclibc | SKIPPED |
| gcc14 | powerpc | glibc | FAILED |
| gcc14 | powerpc | musl | FAILED |
| gcc14 | powerpc | uclibc | FAILED |
| gcc15 | powerpc64 | glibc | OK |
| gcc15 | powerpc64le | glibc | OK |
| gcc15 | powerpc64le | musl | OK |
| gcc15 | powerpc64le | uclibc | SKIPPED |
| gcc15 | powerpc64 | musl | OK |
| gcc15 | powerpc64 | uclibc | SKIPPED |
| gcc15 | powerpc | glibc | FAILED |
| gcc15 | powerpc | musl | FAILED |
| gcc15 | powerpc | uclibc | FAILED |
| gcc16 | powerpc64 | glibc | OK |
| gcc16 | powerpc64le | glibc | OK |
| gcc16 | powerpc64le | musl | OK |
| gcc16 | powerpc64le | uclibc | SKIPPED |
| gcc16 | powerpc64 | musl | OK |
| gcc16 | powerpc64 | uclibc | SKIPPED |
| gcc16 | powerpc | glibc | FAILED |
| gcc16 | powerpc | musl | FAILED |
| gcc16 | powerpc | uclibc | FAILED |
The "SKIPPED" are when the configuration is not possible: uClibc
doesn't support powerpc64 or powerpc64le.
Then, as we can see, the build fails for all "powerpc"
configuration. Our conclusion is therefore that libquadmath is not
supported on PowerPC 32-bit. While we were not able to find direct
evidence in the gcc code base, this practical experiment shows that is
simply doesn't work on PowerPC 32-bit.
So, we take the logical action of adjusting
BR2_TOOLCHAIN_HAS_LIBQUADMATH so that it is true only on
powerpc64/powerpc64le.
Fixes:
https://autobuild.buildroot.org/results/46d435c9f5086a8695f4f6cd4026bb0d194de13c/
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 06426297c4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes a build error caught by the Gitlab pipelines:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/taglib-2.3/taglib/mpeg/mpegfile.cpp:113:10:
error: expected primary-expression before ‘const’
if(const Header header(&file, headerOffset + i, true); header.isValid()) {
which was introduced by code format changes in upstream commit
dfe2aa5253
which was first released with taglib 2.0, added to buildroot with commit
9cd3464afa.
This "init-statement" C++17 language feature was described in proposal
P0305R1, and according to
https://en.cppreference.com/cpp/compiler_support/17, this feature was
only supported in gcc starting from gcc 7.x.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d16e4939ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
host-libxml-parser-perl compiles XS modules against the system perl
headers, which #include <crypt.h>. On build hosts without libcrypt-dev
installed, the build fails:
.../CORE/reentr.h:126:16: fatal error: crypt.h: No such file or directory
Declaring host-libxcrypt ensures crypt.h is present in the per-package
host sysroot before the build.
This can for example be reproduced on a minimal Debian Forky system,
where libc6-dev no longer pulls libxcrypt-dev.
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7e036c739f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit bb38f6f720 bumped the
package to 3.2.0. This version first included upstream commit
ed00e0f4b3
which removed the dependency to libm causing build errors detected by
the autobuilders.
Disabling the build of tests by the previous patch of this series is not
enough because the build will fail on other tools like
[ 98%] Linking C executable djpeg-static
/home/bernd/buildroot/output/per-package/jpeg-turbo/host/bin/../lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
src/spng/CMakeFiles/spng-static.dir/spng.c.o: in function
`spng_decode_image':
spng.c:(.text+0x4c62): undefined reference to `__fpclassifyf'
Add upstream commit to fix the problem.
Fixes:
https://autobuild.buildroot.net/results/981/98114d4ea7afe62bb4cef934a06bf289d863ad3f/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c0a51767a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit c531fe6520 bumped the
package to 3.1.2. This version first included upstream commit
942ac87e47
which added configure options to disable the build of command-line
tools and tests.
This patch replaces the current _POST_INSTALL_TARGET_HOOK with the new
configure option and disables the build of tests.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d74a065a16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 8b1d8dd25d bumped the
package from 1.4.3 to 1.5.1 which includes upstream commit
8d485b9bfd
that adds the usage of the OpenSSL crate from rust.
This crate depends on DES and causes build errors when missing:
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb8'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cbc'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb64'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ofb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_cbc'
Fixes:
https://autobuild.buildroot.net/results/b93/b9359c5c177f3e4bcef991cde3c2dcf412dee5de/https://autobuild.buildroot.net/results/300/300721a882f3410528878db730aaff1aa6822986/https://autobuild.buildroot.net/results/a16/a163a9229c04f638a46e6250dc135c475e5d1576/https://autobuild.buildroot.net/results/7e8/7e88cba9974f6f5acd125b69b95b7269d8128886/
A backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c4f41f4f3f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Commit 713d63b "package/webkitgtk: add option to enable MiniBrowser",
added support to select BR2_PACKAGE_WEBKITGTK_MINIBROWSER, but forgot
to drop the default -DENABLE_MINIBROWSER=ON entry.
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9f292bb7a1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
For change log since v2.4.7, see:
https://github.com/FluidSynth/fluidsynth/releases
According to:
https://github.com/FluidSynth/fluidsynth/blob/master/doc/wiki/ChangeLog.md
FluidSynth 2.5.6 fixes:
CVE-2026-58264 - a heap-based buffer overrun in command handler (GHSA-mqmq-w63q-cj94)
CVE-2026-61714 - a heap-based buffer overflow in MIDI player (GHSA-976m-35rw-h3m6)
CVE-2026-61721 - a heap-based buffer overrun for DLS samples (GHSA-59ph-rx8r-8p4j)
CVE-2026-61723 - a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47)
CVE-2026-61722 - a DLS articulation chunk integer overflow (GHSA-hp72-35pr-6h6r)
CVE-2026-61720 - a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w)
FluidSynth 2.5.2 fixes:
CVE-2025-68617 - a heap-based use-after-free involving DLS files (GHSA-ffw2-xvvp-39ch)
SDL2 audio support was removed upstream in commit:
89145b004a
It was replaced by the newer SDL3. This commit reflects that change
(update option name and comments, add legacy option entry).
Also, dynamic library dependency was added in Buildroot commit:
111a1c7091
This commot removes the duplicate dependency for SDL3.
FluidSynth also added a native DLS soundfont support in:
c959f8d208
It is enabled by default and uses C++17. This commit adds a new
option with a dependency on gcc >= 7.
The license option hash is also updated, after the FSF address
update in:
db42fa333b
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 566bdcb97f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
In both start() and stop(), ret is only assigned on failure. When
hypervkvpd starts or stops successfully, return "$ret" expands to an
empty string and causes:
/etc/init.d/S10hyperv: return: line 31: Illegal number:
Those double quotes were added in Buildroot commit [1], to fix a
new ShellCheck warning at that time. This was not a complete fix.
Only removing the double quote would reintroduce the ShellCheck
warning. This would also reintroduce a check-package error.
Since a bare return is equivalent to a "return 0", this commit
also initializes with ret=0. Doing so will tell ShellCheck "ret" is
an integer. Therefore, the ShellCheck warning will no longer be
reported.
This commit fixes the invalid return value by removing the double
quotes and initialzing "ret=0".
[1] c4173d8b08
Signed-off-by: Benjamin DeCamp <benjamin8532@protonmail.com>
[Julien:
- add "ret=0" initialization in script to fix check-package error
- add extra info in the commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 667335cd18)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
enscript currently fails to build with musl with gcc >= 15. In order
to fix this, we need to bring a number of patches from upstream, and
add 2 others that were submitted upstream.
From upstream, we bring
0002-Add-CFLAG-std-c89-so-it-compiles-with-the-old-standa.patch, which
switches to -std=c89 to get the compiler back to "old" behavior.
However, as this commit patches configure.ac, we need to autoreconf,
but autoreconf is broken, so we also take
0003-Automake-1.12-and-up-no-longer-supports-pre-ANSI.patch from
upstream, which drops a problematic autoconf macro.
However, once you drop this problematic autoconf macro, the PROTOTYPES
define is never set by anything, causing the __P macro to no longer be
defined properly. This is fixed by
0004-Fix-prototype-detection-when-__STDC__-is-defined-but.patch that
we have submitted upstream.
Once you're there, you realize that switching to -std=c89 has the side
effect that musl's <limits.h> no longer defines PATH_MAX, because it
needs one of:
#if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
|| defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
and a side effect of -std=c89 is that none of these is defined
anymore. So we introduce 0005-Use-std-gnu89-instead-of-std-c89.patch,
which switches to -std=gnu89. This patch has also been submitted
upstream.
With all of these efforts, we get a successful build on musl with gcc
>= 15.
This commit needs to be backported to Buildroot versions that support
gcc 15.x, so that means the currently maintained 2026.x branches, but
not 2025.02 as only up to gcc 14.x was supported then.
Fixes:
https://autobuild.buildroot.org/results/d39d14bbbb3a51d67fe962b877c7f66ff1204ecf/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit edffc0bc50)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66035.
The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 03757abfce)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66034.
The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 58581deeca)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66033.
The OpenSSL AES-GCM cipher path lacks runtime bounds checks around the
input block size. A malformed packet can therefore lead to an
out-of-bounds read or write.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6755a00cd2)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66032.
A SFTP error path can leave a dangling pointer after freeing the
response buffer, which may result in a double free on subsequent error
handling.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 05c13e87e9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the SFTP symlink bounds checking fix for CVE-2025-15661.
The initial fix requires the LIBSSH2_UNCONST compatibility backport on
libssh2 1.11.1. Also include the upstream follow-up fixing
SSH_FXP_STATUS handling introduced by the initial security fix.
The patches are based on the upstream fixes and Debian's libssh2 1.11.1
backports.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 546fd31c70)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since upstream commit 89a86dcb0a3248606824de50f5c63f61cfe0369c (first
release: 106) if cargo exists on PATH the Dracut configure script
enables building dracut-cpio by default, and calls "cargo --version"
to check if cargo works. This fails on the autobuilders:
error: rustup could not choose a version of cargo to run, because one wasn't specified explicitly, and no default is configured.
help: run 'rustup default stable' to download the latest stable release of Rust and set it as your default toolchain.
dracut couldn't find cargo for dracut-cpio build
The affected configs either don't have BR2_PACKAGE_HOST_RUSTC enabled,
or build-time.log.gz shows host-rustc was not installed before the
host-dracut build, so presumably the "cargo" that produces the rustup
error is an external one already installed on the autobuilders.
To fix this, enable dracut-cpio only if BR2_PACKAGE_HOST_RUSTC=y, and
add a dependency on host-rustc in that case. According to the
documentation [1, see "enhanced_cpio"] dracut-cpio is supposed to
optimize archive creation for copy-on-write filesystems, so it should
not matter much for Buildroot. The --disable-dracut-cpio option was
added in upstream commit 4a4ab928a49e81e02104ec5466160664e59c3965
(same release).
Fixes: https://autobuild.buildroot.org/results/5f557d708cce997e7f039f17e30640b02ba9180a/
Fixes: https://autobuild.buildroot.org/results/f04ca3c4598f62a7e87d84bc111eb8b161b34a70/
(and more)
[1] https://dracut-ng.github.io/dracut/man/dracut.conf.5.html#_configuration_options
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ff7f973a16)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for a heap buffer overflow in
convert_fname() when growing the iconv output buffer.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e991fa0716)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for integer overflows while parsing
Content-Range headers, together with the follow-up fix using
strtoll() for wgint values.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 89485adb29)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for a buffer underflow in
clean_metalink_string(), together with the two required follow-up
fixes for the inverted whitespace check and missing ctype.h include.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 937e33237e)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The Arc specific gdb version was removed by commit [1]
but we still have the TestGdbArc that was testing this
version of gdb.
We can now safely remove TestGdbArc.
[1] 0b3d526226
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f6b34f851)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
When a package defines $(PKG)_FLAT_STACKSIZE, ELF2FLT_FLAGS contains
-Wl,-elf2flt="-r -s<stack-size>". The embedded quotes are needed to
keep both elf2flt options in single linker argument.
However, many package Makefiles wrap $(TARGET_CFLAGS) in double quotes,
for example:
CFLAGS="$(TARGET_CFLAGS)"
After expansion, the embedded quote terminates the outer CFLAGS quote.
As a result, the shell interprets "-s<stack-size> ..." as a command
instead of passing it to the compiler.
Pass -r and -s<stack-size> in separate -Wl arguments instead. This
avoids embedded quotes; GCC forwards both -elf2flt options to
ld-elf2flt, which collects them before invoking elf2flt.
This got broken by commit
04d7ea4720 ("package: Makefile.in: fix
elf2flt invocation options"), which by adding -r as an elf2flt
argument, did not correctly handle -s$($(PKG)_FLAT_STACKSIZE).
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
[Thomas: improve commit message]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e913afbeb1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wine.mk passes --with-wayland whenever BR2_PACKAGE_WAYLAND is enabled,
but nothing guarantees the rest of what wine's Wayland test needs is in
the configuration. That test is:
WINE_NOTICE_WITH(wayland, [test -z "$WAYLAND_CLIENT_LIBS" \
-o -z "$WAYLAND_SCANNER" -o -z "$XKBCOMMON_LIBS" \
-o -z "$XKBREGISTRY_LIBS" -o "$ac_cv_header_linux_input_h" = "no"], ...)
and because --with-wayland is passed explicitly, WINE_NOTICE_WITH turns
into AC_MSG_ERROR rather than a notice.
So wine needs libxkbcommon, and it needs the libxkbregistry part of it,
which is only built when libxml2 is available. Select both when Wayland
support is enabled, and add libxkbcommon to the build dependencies.
Note that libxml2 is not a direct dependency of wine, it only has to be
in the configuration so that libxkbcommon builds libxkbregistry; the
build ordering is handled by libxkbcommon's own dependency on libxml2.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a5e7f7af9f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
libxkbregistry is the keyboard layout catalogue half of the library. It
parses the XML layout registry and so needs libxml2, which is presumably
why it was disabled unconditionally rather than wired to a dependency.
wine needs it. Its configure.ac requires XKBREGISTRY_LIBS alongside
wayland-client, wayland-scanner, xkbcommon and linux/input.h before it
will build the Wayland driver, and wine.mk passes --with-wayland for any
build with BR2_PACKAGE_WAYLAND - which turns that notice into a hard
error:
checking for wayland-client.h... yes
checking for wl_display_connect in -lwayland-client... yes
checking for wayland-scanner... .../host/bin/wayland-scanner
checking for xkb_context_new in -lxkbcommon... yes
checking for wayland-egl.h... yes
checking for wl_egl_window_create in -lwayland-egl... yes
configure: error: Wayland development files not found, the Wayland
driver won't be supported.
This is an error since --with-wayland was requested.
Every other term of that test passes; only XKBREGISTRY_LIBS is empty, so
wine and wayland together could not be built on any architecture.
Gated on BR2_PACKAGE_LIBXML2 rather than turned on outright, because
meson.build takes dependency('libxml-2.0') unconditionally once
enable-xkbregistry is set, so a target without libxml2 would fail to
configure.
Regarding since when this is broken, three pieces had to come together:
- libxkbcommon has passed -Denable-xkbregistry=false since commit
1791bc30a5 ("package/libxkbcommon: bump version to 1.0.1", Sep 2020),
i.e. Buildroot 2020.11. libxkbregistry has therefore never been built
in Buildroot.
- wine's configure gained the XKBREGISTRY_LIBS term in its Wayland
test in wine 9.0, with upstream commit d64ea8e4a6c9
("winewayland.drv: Enumerate Xkb layouts and create matching HKL.",
Nov 2023).
- wine.mk started passing --with-wayland in commit 7cb49e7712
("package/wine: bump to version 9.19", Oct 2024), which is what turns
the missing XKBREGISTRY_LIBS from a notice into a hard error.
The breakage therefore dates from Buildroot 2024.11, and every branch
since is affected, including the LTS one: 2025.02.x carries wine 10.0,
whose configure has the XKBREGISTRY_LIBS check, together with
libxkbcommon 1.9.2 built with -Denable-xkbregistry=false, and its wine.mk
passes --with-wayland. 2025.05.x and 2025.08.x are in the same state.
A backport to 2025.02.x is thus needed.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4349b22b91)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Fixes the following security issues:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging up to two sumdb
tiles that allow for a requested module to bypass the GOSUMDB check and
persist attacker-controlled module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve malicious module
content that cannot be detected by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary module content not
contained within the transparency log.
This attack allows for a coordinating GOPROXY and GOSUMDB to serve a
client malicious module content that cannot be detected by evaluating
the transparency log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter causing it to
never fire; this could lead to stack exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
- net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a few
bytes from each new connection to see if they contain the HTTP/2 client
preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..)
segments performed string conversions and buffer rewrites on each step,
resulting in quadratic time complexity and high memory allocation
overhead.
Now, path resolution operates on a byte buffer using index-based
backtracking for .. segments, eliminating the quadratic time complexity
and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when the size of a
parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an unescaped / early,
allowing for attack-controlled data to inject arbitrary content,
potentially leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded
labels that decode to an ASCII-only label. For example,
ToUnicode("xn--example-.com") incorrectly returned the name "example.com"
rather than an error.
The idna package implements the processing algorithm from UTS 46. Older
versions of UTS 46 included a specification bug which permitted multiple
ASCII labels to decode to the same Unicode label. UTS 46 revision 33
fixed the specification bug. The idna package now implements the updated
specification.
This behavior can lead to privilege escalation in programs using the idna
package. For example, a program which performs privilege checks on the
ASCII hostname may reject "example.com" but permit "xn--example-.com".
If that program subsequently converts the ASCII hostname to Unicode, it
will inadvertently permits access to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e9110bf23)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Bugfix release with large number of (security) fixes.
HAProxy 2.6.32 was released on 2026/07/29. It added 33 new commits
after version 2.6.31.
As for the 2.8.27, the announce is an expurgated copy-paste of the 3.4.3
announce:
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf: buffer overflows after pointer-shift converters, reported
by Red Hat/AISLE Research and Charles Vosburgh, were fixed.
Several converters (protobuf/ungrpc field extraction, ltrim())
move the sample's data pointer forward on success but did not shrink the
sample's recorded buffer capacity accordingly. A converter chained
afterwards that relies on that capacity (e.g. padding via memset()) could
then write past the end of the buffer, leading to heap corruption or a
worker crash. All the affected converters now adjust the capacity
together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails cleanly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http-ana/http-htx: Few out-of-bounds reads were fixed.
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This
case is now properly handled.
* sample: An edge case in be2hex() was fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47353.html
Signed-off-by: Fred Lefranc <fred.lefranc.evs@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 335a57525f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
$(warning WARNING: You are compiling firmware into voicebus.ko which is not available under the terms of the GPL. It may be a violation of the GPL to distribute the resulting image since it combines both GPL and non-GPL work. You should consult a lawyer of your own before distributing such an image.)
../examples/vm_power_manager/guest_cli/vm_power_cli_guest.c: In function ‘cmd_query_freq_list_parsed’:
../examples/vm_power_manager/guest_cli/vm_power_cli_guest.c:208:42: error: implicit declaration of function ‘strtol’; did you mean ‘strtok’? [-Wimplicit-function-declaration]
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
