mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
There have been a number of security fixes of mixed severity in libglib2 since 2.86.0, sorted by release: 2.87.1 * CVE-2025-13601: Incorrect calculation of buffer size in g_escape_uri_string() https://gitlab.gnome.org/GNOME/glib/-/work_items/3827 * CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via bytestring_parse() or string_parse() leads to OOB Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3834 * CVE-2025-14512: GIO: Integer overflow in file attribute escaping https://gitlab.gnome.org/GNOME/glib/-/work_items/3845 2.87.3 * CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through glib/gbase64.c via g_base64_encode_close() leads to OOB Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3870 * CVE-2026-1485: Buffer underflow on Glib through gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3871 * CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8() https://gitlab.gnome.org/GNOME/glib/-/work_items/3872 2.88.1 * CVE-2026-58010: Buffer Over-read on GLib through glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal() https://gitlab.gnome.org/GNOME/glib/-/work_items/3915 * CVE-2026-58011: OOB Read on GLib through glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime` https://gitlab.gnome.org/GNOME/glib/-/work_items/3917 * CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through glib/gregex.c:string_append() via g_utf8_next_char() https://gitlab.gnome.org/GNOME/glib/-/work_items/3918 * CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c via "g_io_channel_read_line_backend" https://gitlab.gnome.org/GNOME/glib/-/work_items/3925 * CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via "g_key_file_get_locale_string_list" https://gitlab.gnome.org/GNOME/glib/-/work_items/3930 * CVE-2026-58015: Path Traversal on GLib DBus through glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry, mechanism_client_data_receive (COOKIE_SHA1 Client Authentication) leads to Arbitrary File Read (sort of) https://gitlab.gnome.org/GNOME/glib/-/work_items/3931 2.88.3 * CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering https://gitlab.gnome.org/GNOME/glib/-/work_items/3985 Full upstream changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags Signed-off-by: Fiona Klute <fiona.klute@gmx.de> Signed-off-by: Julien Olivain <ju.o@free.fr>
169 lines
5.4 KiB
Makefile
169 lines
5.4 KiB
Makefile
################################################################################
|
|
#
|
|
# libglib2
|
|
#
|
|
################################################################################
|
|
|
|
LIBGLIB2_VERSION_MAJOR = 2.88
|
|
LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).3
|
|
LIBGLIB2_SOURCE = glib-$(LIBGLIB2_VERSION).tar.xz
|
|
LIBGLIB2_SITE = https://download.gnome.org/sources/glib/$(LIBGLIB2_VERSION_MAJOR)
|
|
LIBGLIB2_LICENSE = LGPL-2.1+
|
|
LIBGLIB2_LICENSE_FILES = COPYING
|
|
LIBGLIB2_CPE_ID_VENDOR = gnome
|
|
LIBGLIB2_CPE_ID_PRODUCT = glib
|
|
LIBGLIB2_INSTALL_STAGING = YES
|
|
|
|
LIBGLIB2_CFLAGS = $(TARGET_CFLAGS)
|
|
LIBGLIB2_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS)
|
|
|
|
# glib/valgrind.h contains inline asm not compatible with thumb1
|
|
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
|
|
LIBGLIB2_CFLAGS += -marm
|
|
endif
|
|
|
|
HOST_LIBGLIB2_CONF_OPTS = \
|
|
-Ddtrace=false \
|
|
-Dglib_debug=disabled \
|
|
-Dlibelf=disabled \
|
|
-Dselinux=disabled \
|
|
-Dsystemtap=false \
|
|
-Dxattr=false \
|
|
-Dtests=false \
|
|
-Doss_fuzz=disabled \
|
|
-Dsysprof=disabled
|
|
|
|
LIBGLIB2_DEPENDENCIES = \
|
|
host-pkgconf host-libglib2 \
|
|
libffi pcre2 zlib $(TARGET_NLS_DEPENDENCIES)
|
|
|
|
HOST_LIBGLIB2_DEPENDENCIES = \
|
|
host-gettext \
|
|
host-libffi \
|
|
host-pcre2 \
|
|
host-pkgconf \
|
|
host-util-linux \
|
|
host-zlib
|
|
|
|
ifeq ($(BR2_PACKAGE_HOST_GOBJECT_INTROSPECTION),y)
|
|
HOST_LIBGLIB2_CONF_OPTS += -Dintrospection=enabled
|
|
HOST_LIBGLIB2_DEPENDENCIES += host-gobject-introspection
|
|
else
|
|
HOST_LIBGLIB2_CONF_OPTS += -Dintrospection=disabled
|
|
endif
|
|
|
|
# We explicitly specify a giomodule-dir to avoid having a value
|
|
# containing ${libdir} in gio-2.0.pc. Indeed, a value depending on
|
|
# ${libdir} would be prefixed by the sysroot by pkg-config, causing a
|
|
# bogus installation path once combined with $(DESTDIR).
|
|
LIBGLIB2_CONF_OPTS = \
|
|
-Dglib_debug=disabled \
|
|
-Dlibelf=disabled \
|
|
-Dgio_module_dir=/usr/lib/gio/modules \
|
|
-Dtests=false \
|
|
-Doss_fuzz=disabled
|
|
|
|
LIBGLIB2_MESON_EXTRA_PROPERTIES = \
|
|
have_c99_vsnprintf=true \
|
|
have_c99_snprintf=true \
|
|
have_unix98_printf=true
|
|
|
|
ifeq ($(BR2_PACKAGE_GOBJECT_INTROSPECTION),y)
|
|
LIBGLIB2_CONF_OPTS += -Dintrospection=enabled
|
|
LIBGLIB2_DEPENDENCIES += gobject-introspection host-qemu
|
|
LIBGLIB2_MESON_EXTRA_BINARIES = exe_wrapper='$(@D)/libglib2-qemu-wrapper'
|
|
define LIBGLIB2_INSTALL_QEMUWARPPER
|
|
$(INSTALL) -D -m 755 $(LIBGLIB2_PKGDIR)/libglib2-qemu-wrapper.in \
|
|
$(@D)/libglib2-qemu-wrapper
|
|
$(SED) 's%@QEMU_USER@%$(QEMU_USER)%g; \
|
|
s%@TOOLCHAIN_HEADERS_VERSION@%$(BR2_TOOLCHAIN_HEADERS_AT_LEAST)%g; \
|
|
s%@QEMU_USERMODE_ARGS@%$(call qstrip,$(BR2_PACKAGE_HOST_QEMU_USER_MODE_ARGS))%g; \
|
|
' \
|
|
$(@D)/libglib2-qemu-wrapper
|
|
endef
|
|
LIBGLIB2_PRE_CONFIGURE_HOOKS += LIBGLIB2_INSTALL_QEMUWARPPER
|
|
else
|
|
LIBGLIB2_CONF_OPTS += -Dintrospection=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ELFUTILS),y)
|
|
LIBGLIB2_DEPENDENCIES += elfutils
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBICONV),y)
|
|
LIBGLIB2_DEPENDENCIES += libiconv
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
|
|
LIBGLIB2_CONF_OPTS += -Dselinux=enabled -Dxattr=true
|
|
LIBGLIB2_DEPENDENCIES += libselinux
|
|
else
|
|
LIBGLIB2_CONF_OPTS += -Dselinux=disabled -Dxattr=false
|
|
endif
|
|
|
|
# Purge gdb-related files
|
|
ifneq ($(BR2_PACKAGE_GDB),y)
|
|
define LIBGLIB2_REMOVE_GDB_FILES
|
|
rm -rf $(TARGET_DIR)/usr/share/glib-2.0/gdb
|
|
endef
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_UTIL_LINUX_LIBMOUNT),y)
|
|
LIBGLIB2_CONF_OPTS += -Dlibmount=enabled
|
|
ifeq ($(BR2_PACKAGE_UTIL_LINUX_LIBS),y)
|
|
LIBGLIB2_DEPENDENCIES += util-linux-libs
|
|
else
|
|
LIBGLIB2_DEPENDENCIES += util-linux
|
|
endif
|
|
else
|
|
LIBGLIB2_CONF_OPTS += -Dlibmount=disabled
|
|
endif
|
|
|
|
# Purge useless binaries from target
|
|
define LIBGLIB2_REMOVE_DEV_FILES
|
|
rm -rf $(TARGET_DIR)/usr/lib/glib-2.0
|
|
rm -rf $(addprefix $(TARGET_DIR)/usr/share/glib-2.0/,codegen gettext)
|
|
rm -f $(addprefix $(TARGET_DIR)/usr/bin/,gdbus-codegen glib-compile-schemas glib-compile-resources glib-genmarshal glib-gettextize glib-mkenums gobject-query gtester gtester-report)
|
|
$(LIBGLIB2_REMOVE_GDB_FILES)
|
|
endef
|
|
|
|
LIBGLIB2_POST_INSTALL_TARGET_HOOKS += LIBGLIB2_REMOVE_DEV_FILES
|
|
|
|
# Newer versions of libglib2 prefix glib-genmarshal, gobject-query,
|
|
# glib-mkenums, glib_compile_schemas, glib_compile_resources and gdbus-codegen
|
|
# with ${bindir}. Unfortunately, this will resolve to the host systems /bin/
|
|
# directory, which will cause compilation issues if the host does not have these
|
|
# programs. By removing the ${bindir}/ prefix, these programs are resolved in
|
|
# PATH instead.
|
|
define LIBGLIB2_REMOVE_BINDIR_PREFIX_FROM_PC_FILE
|
|
$(SED) 's%$${bindir}/%%g' $(addprefix $(STAGING_DIR)/usr/lib/pkgconfig/, glib-2.0.pc gio-2.0.pc)
|
|
endef
|
|
LIBGLIB2_POST_INSTALL_TARGET_HOOKS += LIBGLIB2_REMOVE_BINDIR_PREFIX_FROM_PC_FILE
|
|
|
|
# Remove schema sources/DTDs, we use staging ones to compile them.
|
|
# Do so at target finalization since other packages install additional
|
|
# ones and we want to deal with it in a single place.
|
|
define LIBGLIB2_REMOVE_TARGET_SCHEMAS
|
|
rm -f $(TARGET_DIR)/usr/share/glib-2.0/schemas/*.xml \
|
|
$(TARGET_DIR)/usr/share/glib-2.0/schemas/*.dtd
|
|
endef
|
|
|
|
# Compile schemas at target finalization since other packages install
|
|
# them as well, and better do it in a central place.
|
|
# It's used at run time so it doesn't matter deferring it.
|
|
define LIBGLIB2_COMPILE_SCHEMAS
|
|
$(HOST_DIR)/bin/glib-compile-schemas \
|
|
$(STAGING_DIR)/usr/share/glib-2.0/schemas \
|
|
--targetdir=$(TARGET_DIR)/usr/share/glib-2.0/schemas
|
|
endef
|
|
|
|
LIBGLIB2_TARGET_FINALIZE_HOOKS += LIBGLIB2_REMOVE_TARGET_SCHEMAS
|
|
LIBGLIB2_TARGET_FINALIZE_HOOKS += LIBGLIB2_COMPILE_SCHEMAS
|
|
|
|
$(eval $(meson-package))
|
|
$(eval $(host-meson-package))
|
|
|
|
LIBGLIB2_HOST_BINARY = $(HOST_DIR)/bin/glib-genmarshal
|
|
|
|
include package/libglib2/libglib2-bootstrap/libglib2-bootstrap.mk
|