* [PATCH 01/10] json-c: Fix function prototypes
@ 2022-08-14 22:20 Khem Raj
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
` (8 more replies)
0 siblings, 9 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
This is flagged with clang 15
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../json-c/0001-Fix-build-with-clang-15.patch | 34 +++++++++++++++++++
meta/recipes-devtools/json-c/json-c_0.16.bb | 2 +-
2 files changed, 35 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/json-c/json-c/0001-Fix-build-with-clang-15.patch
diff --git a/meta/recipes-devtools/json-c/json-c/0001-Fix-build-with-clang-15.patch b/meta/recipes-devtools/json-c/json-c/0001-Fix-build-with-clang-15.patch
new file mode 100644
index 00000000000..215f4d829a2
--- /dev/null
+++ b/meta/recipes-devtools/json-c/json-c/0001-Fix-build-with-clang-15.patch
@@ -0,0 +1,34 @@
+From 0145b575ac1fe6a77e00d639864f26fc91ceb12f Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 13 Aug 2022 20:37:03 -0700
+Subject: [PATCH] Fix build with clang-15+
+
+Fixes
+json_util.c:63:35: error: a function declaration without a prototype is deprecated in all versions of C [-We
+rror,-Wstrict-prototypes]
+const char *json_util_get_last_err()
+ ^
+ void
+
+Upstream-Status: Backport [https://github.com/json-c/json-c/pull/783]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ json_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/json_util.c b/json_util.c
+index 952770a..83d9c68 100644
+--- a/json_util.c
++++ b/json_util.c
+@@ -60,7 +60,7 @@ static int _json_object_to_fd(int fd, struct json_object *obj, int flags, const
+
+ static char _last_err[256] = "";
+
+-const char *json_util_get_last_err()
++const char *json_util_get_last_err(void)
+ {
+ if (_last_err[0] == '\0')
+ return NULL;
+--
+2.37.2
+
diff --git a/meta/recipes-devtools/json-c/json-c_0.16.bb b/meta/recipes-devtools/json-c/json-c_0.16.bb
index 50431081bba..3aba41dfcf6 100644
--- a/meta/recipes-devtools/json-c/json-c_0.16.bb
+++ b/meta/recipes-devtools/json-c/json-c_0.16.bb
@@ -6,9 +6,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2"
SRC_URI = " \
https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \
+ file://0001-Fix-build-with-clang-15.patch \
file://run-ptest \
"
-
SRC_URI[sha256sum] = "8e45ac8f96ec7791eaf3bb7ee50e9c2100bbbc87b8d0f1d030c5ba8a0288d96b"
UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 02/10] xmlto: Update to use upstream tip of trunk
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-15 6:54 ` [OE-core] " Alexander Kanavin
2022-08-14 22:20 ` [PATCH 03/10] zlib: Resolve CVE-2022-37434 Khem Raj
` (7 subsequent siblings)
8 siblings, 1 reply; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
There are several fixes which are done to fix builds with newer
compilers after 0.0.28 was releases in 2015 a long time ago.
Add a patch to fix manpages builds not trying to access network during
build
Regenerate xmlif from lex files, before configuring the build
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../0001-Skip-validating-xmlto-output.patch | 29 +++++++++++++++++++
...rop-the-test-of-xmllint-and-xsltproc.patch | 6 ++--
meta/recipes-devtools/xmlto/xmlto_0.0.28.bb | 16 +++++++---
3 files changed, 44 insertions(+), 7 deletions(-)
create mode 100644 meta/recipes-devtools/xmlto/xmlto/0001-Skip-validating-xmlto-output.patch
rename meta/recipes-devtools/xmlto/{xmlto-0.0.28 => xmlto}/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch (91%)
diff --git a/meta/recipes-devtools/xmlto/xmlto/0001-Skip-validating-xmlto-output.patch b/meta/recipes-devtools/xmlto/xmlto/0001-Skip-validating-xmlto-output.patch
new file mode 100644
index 00000000000..e1c24aba4ab
--- /dev/null
+++ b/meta/recipes-devtools/xmlto/xmlto/0001-Skip-validating-xmlto-output.patch
@@ -0,0 +1,29 @@
+From 3deb7a0eded04ab08a9cb2d88526cb1c7b440061 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 14 Aug 2022 00:23:29 -0700
+Subject: [PATCH] Skip validating xmlto output
+
+Avoids network access
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 50fa279..6a2da62 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -68,7 +68,7 @@ EXTRA_DIST = xmlto.spec \
+ doc/xmlif.xml \
+ xmlto.mak
+
+-GEN_MANPAGE = FORMAT_DIR=$(top_srcdir)/format $(BASH) ./xmlto -o $(@D) man $<
++GEN_MANPAGE = FORMAT_DIR=$(top_srcdir)/format $(BASH) ./xmlto --skip-validation -o $(@D) man $<
+ man/man1/xmlto.1: doc/xmlto.xml ; $(GEN_MANPAGE)
+ man/man1/xmlif.1: doc/xmlif.xml ; $(GEN_MANPAGE)
+
+--
+2.37.2
+
diff --git a/meta/recipes-devtools/xmlto/xmlto-0.0.28/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch b/meta/recipes-devtools/xmlto/xmlto/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch
similarity index 91%
rename from meta/recipes-devtools/xmlto/xmlto-0.0.28/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch
rename to meta/recipes-devtools/xmlto/xmlto/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch
index 6d547a6c994..7cc3cbe0fb2 100644
--- a/meta/recipes-devtools/xmlto/xmlto-0.0.28/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch
+++ b/meta/recipes-devtools/xmlto/xmlto/configure.in-drop-the-test-of-xmllint-and-xsltproc.patch
@@ -9,9 +9,9 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
configure.in | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/configure.in b/configure.in
---- a/configure.in
-+++ b/configure.in
+diff --git a/configure.ac b/configure.ac
+--- a/configure.ac
++++ b/configure.ac
@@ -42,10 +42,10 @@ AC_ARG_VAR([LOCALE], [Name and path of the `locale' program.])
AC_PATH_PROG([LOCALE], [locale], [locale])
diff --git a/meta/recipes-devtools/xmlto/xmlto_0.0.28.bb b/meta/recipes-devtools/xmlto/xmlto_0.0.28.bb
index 5cb9a4c57be..dcb760dd930 100644
--- a/meta/recipes-devtools/xmlto/xmlto_0.0.28.bb
+++ b/meta/recipes-devtools/xmlto/xmlto_0.0.28.bb
@@ -6,17 +6,21 @@ LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552"
-SRC_URI = "https://releases.pagure.org/xmlto/xmlto-${PV}.tar.gz \
+SRCREV = "6fa6a0e07644f20abf2596f78a60112713e11cbe"
+
+SRC_URI = "git://pagure.io/xmlto.git;protocol=https;branch=master \
file://configure.in-drop-the-test-of-xmllint-and-xsltproc.patch \
+ file://0001-Skip-validating-xmlto-output.patch \
"
-SRC_URI[md5sum] = "a1fefad9d83499a15576768f60f847c6"
-SRC_URI[sha256sum] = "2f986b7c9a0e9ac6728147668e776d405465284e13c74d4146c9cbc51fd8aad3"
+S = "${WORKDIR}/git"
+
+PV .= "+0.0.29+git${SRCPV}"
inherit autotools
CLEANBROKEN = "1"
-DEPENDS = "libxml2-native"
+DEPENDS = "libxml2-native libxslt-native flex-native docbook-xml-dtd4-native docbook-xsl-stylesheets-native"
RDEPENDS:${PN} = "docbook-xml-dtd4 \
docbook-xsl-stylesheets \
@@ -36,6 +40,10 @@ BBCLASSEXTEND = "native"
EXTRA_OECONF:append = " BASH=/bin/bash GCP=/bin/cp XMLLINT=xmllint XSLTPROC=xsltproc"
+do_configure:prepend() {
+ flex -o ${S}/xmlif/xmlif.c ${S}/xmlif/xmlif.l
+}
+
do_install:append:class-native() {
create_wrapper ${D}${bindir}/xmlto XML_CATALOG_FILES=${sysconfdir}/xml/catalog
}
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 03/10] zlib: Resolve CVE-2022-37434
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-15 2:32 ` [OE-core] " Paul Eggleton
2022-08-14 22:20 ` [PATCH 04/10] rsync: Backport fix to address CVE-2022-29154 Khem Raj
` (6 subsequent siblings)
8 siblings, 1 reply; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
This is only seen in development branch as per [1]
[1] https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1#commitcomment-80753451
CVE: CVE-2022-37434
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
meta/recipes-core/zlib/zlib_1.2.12.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-core/zlib/zlib_1.2.12.bb b/meta/recipes-core/zlib/zlib_1.2.12.bb
index 77e7a4937fa..d3e0f25295d 100644
--- a/meta/recipes-core/zlib/zlib_1.2.12.bb
+++ b/meta/recipes-core/zlib/zlib_1.2.12.bb
@@ -17,6 +17,10 @@ UPSTREAM_CHECK_URI = "http://zlib.net/"
SRC_URI[sha256sum] = "7db46b8d7726232a621befaab4a1c870f00a90805511c0e0090441dac57def18"
+# 1.2.12 or any other released zlib version does not have this issue see
+# https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1#commitcomment-80801182
+CVE_CHECK_IGNORE += "CVE-2022-37434"
+
CFLAGS += "-D_REENTRANT"
RDEPENDS:${PN}-ptest += "make"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 04/10] rsync: Backport fix to address CVE-2022-29154
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
2022-08-14 22:20 ` [PATCH 03/10] zlib: Resolve CVE-2022-37434 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 05/10] rsync: Upgrade to 3.2.5 Khem Raj
` (5 subsequent siblings)
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
CVE: CVE-2022-29154
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../rsync/files/CVE-2022-29154.patch | 372 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.4.bb | 1 +
2 files changed, 373 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch b/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
new file mode 100644
index 00000000000..e43b092ea89
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
@@ -0,0 +1,372 @@
+From b7231c7d02cfb65d291af74ff66e7d8c507ee871 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Sun, 31 Jul 2022 16:55:34 -0700
+Subject: [PATCH] Some extra file-list safety checks.
+
+Upstream-Status: Backport [https://github.com/WayneD/rsync/commit/b7231c7d02cfb65d291af74ff66e7d8c507ee871]
+CVE: CVE-2022-29154
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ exclude.c | 130 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ flist.c | 17 ++++++-
+ io.c | 4 ++
+ main.c | 7 ++-
+ receiver.c | 11 +++--
+ rsync.1.md | 44 ++++++++++++++++--
+ 6 files changed, 202 insertions(+), 11 deletions(-)
+
+--- a/exclude.c
++++ b/exclude.c
+@@ -27,16 +27,22 @@ extern int am_server;
+ extern int am_sender;
+ extern int eol_nulls;
+ extern int io_error;
++extern int xfer_dirs;
++extern int recurse;
+ extern int local_server;
+ extern int prune_empty_dirs;
+ extern int ignore_perishable;
++extern int old_style_args;
++extern int relative_paths;
+ extern int delete_mode;
+ extern int delete_excluded;
+ extern int cvs_exclude;
+ extern int sanitize_paths;
+ extern int protocol_version;
++extern int list_only;
+ extern int module_id;
+
++extern char *filesfrom_host;
+ extern char curr_dir[MAXPATHLEN];
+ extern unsigned int curr_dir_len;
+ extern unsigned int module_dirlen;
+@@ -44,8 +50,10 @@ extern unsigned int module_dirlen;
+ filter_rule_list filter_list = { .debug_type = "" };
+ filter_rule_list cvs_filter_list = { .debug_type = " [global CVS]" };
+ filter_rule_list daemon_filter_list = { .debug_type = " [daemon]" };
++filter_rule_list implied_filter_list = { .debug_type = " [implied]" };
+
+ int saw_xattr_filter = 0;
++int trust_sender_filter = 0;
+
+ /* Need room enough for ":MODS " prefix plus some room to grow. */
+ #define MAX_RULE_PREFIX (16)
+@@ -292,6 +300,125 @@ static void add_rule(filter_rule_list *l
+ }
+ }
+
++/* Each arg the client sends to the remote sender turns into an implied include
++ * that the receiver uses to validate the file list from the sender. */
++void add_implied_include(const char *arg)
++{
++ filter_rule *rule;
++ int arg_len, saw_wild = 0, backslash_cnt = 0;
++ int slash_cnt = 1; /* We know we're adding a leading slash. */
++ const char *cp;
++ char *p;
++ if (old_style_args || list_only || filesfrom_host != NULL)
++ return;
++ if (relative_paths) {
++ cp = strstr(arg, "/./");
++ if (cp)
++ arg = cp+3;
++ } else {
++ if ((cp = strrchr(arg, '/')) != NULL)
++ arg = cp + 1;
++ }
++ arg_len = strlen(arg);
++ if (arg_len) {
++ if (strpbrk(arg, "*[?")) {
++ /* We need to add room to escape backslashes if wildcard chars are present. */
++ cp = arg;
++ while ((cp = strchr(cp, '\\')) != NULL) {
++ arg_len++;
++ cp++;
++ }
++ saw_wild = 1;
++ }
++ arg_len++; /* Leave room for the prefixed slash */
++ rule = new0(filter_rule);
++ if (!implied_filter_list.head)
++ implied_filter_list.head = implied_filter_list.tail = rule;
++ else {
++ rule->next = implied_filter_list.head;
++ implied_filter_list.head = rule;
++ }
++ rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
++ p = rule->pattern = new_array(char, arg_len + 1);
++ *p++ = '/';
++ cp = arg;
++ while (*cp) {
++ switch (*cp) {
++ case '\\':
++ backslash_cnt++;
++ if (saw_wild)
++ *p++ = '\\';
++ *p++ = *cp++;
++ break;
++ case '/':
++ if (p[-1] == '/') /* This is safe because of the initial slash. */
++ break;
++ if (relative_paths) {
++ filter_rule const *ent;
++ int found = 0;
++ *p = '\0';
++ for (ent = implied_filter_list.head; ent; ent = ent->next) {
++ if (ent != rule && strcmp(ent->pattern, rule->pattern) == 0)
++ found = 1;
++ }
++ if (!found) {
++ filter_rule *R_rule = new0(filter_rule);
++ R_rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
++ R_rule->pattern = strdup(rule->pattern);
++ R_rule->u.slash_cnt = slash_cnt;
++ R_rule->next = implied_filter_list.head;
++ implied_filter_list.head = R_rule;
++ }
++ }
++ slash_cnt++;
++ *p++ = *cp++;
++ break;
++ default:
++ *p++ = *cp++;
++ break;
++ }
++ }
++ *p = '\0';
++ rule->u.slash_cnt = slash_cnt;
++ arg = (const char *)rule->pattern;
++ }
++
++ if (recurse || xfer_dirs) {
++ /* Now create a rule with an added "/" & "**" or "*" at the end */
++ rule = new0(filter_rule);
++ if (recurse)
++ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD | FILTRULE_WILD2;
++ else
++ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD;
++ /* A +4 in the len leaves enough room for / * * \0 or / * \0 \0 */
++ if (!saw_wild && backslash_cnt) {
++ /* We are appending a wildcard, so now the backslashes need to be escaped. */
++ p = rule->pattern = new_array(char, arg_len + backslash_cnt + 3 + 1);
++ cp = arg;
++ while (*cp) {
++ if (*cp == '\\')
++ *p++ = '\\';
++ *p++ = *cp++;
++ }
++ } else {
++ p = rule->pattern = new_array(char, arg_len + 3 + 1);
++ if (arg_len) {
++ memcpy(p, arg, arg_len);
++ p += arg_len;
++ }
++ }
++ if (p[-1] != '/')
++ *p++ = '/';
++ *p++ = '*';
++ if (recurse)
++ *p++ = '*';
++ *p = '\0';
++ rule->u.slash_cnt = slash_cnt + 1;
++ rule->next = implied_filter_list.head;
++ implied_filter_list.head = rule;
++ }
++}
++
+ /* This frees any non-inherited items, leaving just inherited items on the list. */
+ static void pop_filter_list(filter_rule_list *listp)
+ {
+@@ -718,7 +845,7 @@ static void report_filter_result(enum lo
+ : name_flags & NAME_IS_DIR ? "directory"
+ : "file";
+ rprintf(code, "[%s] %sing %s %s because of pattern %s%s%s\n",
+- w, actions[*w!='s'][!(ent->rflags & FILTRULE_INCLUDE)],
++ w, actions[*w=='g'][!(ent->rflags & FILTRULE_INCLUDE)],
+ t, name, ent->pattern,
+ ent->rflags & FILTRULE_DIRECTORY ? "/" : "", type);
+ }
+@@ -890,6 +1017,7 @@ static filter_rule *parse_rule_tok(const
+ }
+ switch (ch) {
+ case ':':
++ trust_sender_filter = 1;
+ rule->rflags |= FILTRULE_PERDIR_MERGE
+ | FILTRULE_FINISH_SETUP;
+ /* FALL THROUGH */
+--- a/flist.c
++++ b/flist.c
+@@ -73,6 +73,7 @@ extern int need_unsorted_flist;
+ extern int sender_symlink_iconv;
+ extern int output_needs_newline;
+ extern int sender_keeps_checksum;
++extern int trust_sender_filter;
+ extern int unsort_ndx;
+ extern uid_t our_uid;
+ extern struct stats stats;
+@@ -83,8 +84,7 @@ extern char curr_dir[MAXPATHLEN];
+
+ extern struct chmod_mode_struct *chmod_modes;
+
+-extern filter_rule_list filter_list;
+-extern filter_rule_list daemon_filter_list;
++extern filter_rule_list filter_list, implied_filter_list, daemon_filter_list;
+
+ #ifdef ICONV_OPTION
+ extern int filesfrom_convert;
+@@ -986,6 +986,19 @@ static struct file_struct *recv_file_ent
+ exit_cleanup(RERR_UNSUPPORTED);
+ }
+
++ if (*thisname != '.' || thisname[1] != '\0') {
++ int filt_flags = S_ISDIR(mode) ? NAME_IS_DIR : NAME_IS_FILE;
++ if (!trust_sender_filter /* a per-dir filter rule means we must trust the sender's filtering */
++ && filter_list.head && check_filter(&filter_list, FINFO, thisname, filt_flags) < 0) {
++ rprintf(FERROR, "ERROR: rejecting excluded file-list name: %s\n", thisname);
++ exit_cleanup(RERR_PROTOCOL);
++ }
++ if (implied_filter_list.head && check_filter(&implied_filter_list, FINFO, thisname, filt_flags) <= 0) {
++ rprintf(FERROR, "ERROR: rejecting unrequested file-list name: %s\n", thisname);
++ exit_cleanup(RERR_PROTOCOL);
++ }
++ }
++
+ if (inc_recurse && S_ISDIR(mode)) {
+ if (one_file_system) {
+ /* Room to save the dir's device for -x */
+--- a/io.c
++++ b/io.c
+@@ -419,6 +419,7 @@ static void forward_filesfrom_data(void)
+ while (s != eob) {
+ if (*s++ == '\0') {
+ ff_xb.len = s - sob - 1;
++ add_implied_include(sob);
+ if (iconvbufs(ic_send, &ff_xb, &iobuf.out, flags) < 0)
+ exit_cleanup(RERR_PROTOCOL); /* impossible? */
+ write_buf(iobuf.out_fd, s-1, 1); /* Send the '\0'. */
+@@ -450,9 +451,12 @@ static void forward_filesfrom_data(void)
+ char *f = ff_xb.buf + ff_xb.pos;
+ char *t = ff_xb.buf;
+ char *eob = f + len;
++ char *cur = t;
+ /* Eliminate any multi-'\0' runs. */
+ while (f != eob) {
+ if (!(*t++ = *f++)) {
++ add_implied_include(cur);
++ cur = t;
+ while (f != eob && *f == '\0')
+ f++;
+ }
+--- a/main.c
++++ b/main.c
+@@ -89,6 +89,7 @@ extern int backup_dir_len;
+ extern int basis_dir_cnt;
+ extern int default_af_hint;
+ extern int stdout_format_has_i;
++extern int trust_sender_filter;
+ extern struct stats stats;
+ extern char *stdout_format;
+ extern char *logfile_format;
+@@ -104,7 +105,7 @@ extern char curr_dir[MAXPATHLEN];
+ extern char backup_dir_buf[MAXPATHLEN];
+ extern char *basis_dir[MAX_BASIS_DIRS+1];
+ extern struct file_list *first_flist;
+-extern filter_rule_list daemon_filter_list;
++extern filter_rule_list daemon_filter_list, implied_filter_list;
+
+ uid_t our_uid;
+ gid_t our_gid;
+@@ -635,6 +636,7 @@ static pid_t do_cmd(char *cmd, char *mac
+ #ifdef ICONV_CONST
+ setup_iconv();
+ #endif
++ trust_sender_filter = 1;
+ } else if (local_server) {
+ /* If the user didn't request --[no-]whole-file, force
+ * it on, but only if we're not batch processing. */
+@@ -1500,6 +1502,8 @@ static int start_client(int argc, char *
+ char *dummy_host;
+ int dummy_port = rsync_port;
+ int i;
++ if (filesfrom_fd < 0)
++ add_implied_include(remote_argv[0]);
+ /* For remote source, any extra source args must have either
+ * the same hostname or an empty hostname. */
+ for (i = 1; i < remote_argc; i++) {
+@@ -1523,6 +1527,7 @@ static int start_client(int argc, char *
+ if (!rsync_port && !*arg) /* Turn an empty arg into a dot dir. */
+ arg = ".";
+ remote_argv[i] = arg;
++ add_implied_include(arg);
+ }
+ }
+
+--- a/receiver.c
++++ b/receiver.c
+@@ -593,10 +593,13 @@ int recv_files(int f_in, int f_out, char
+ if (DEBUG_GTE(RECV, 1))
+ rprintf(FINFO, "recv_files(%s)\n", fname);
+
+- if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')
+- && check_filter(&daemon_filter_list, FLOG, fname, 0) < 0) {
+- rprintf(FERROR, "attempt to hack rsync failed.\n");
+- exit_cleanup(RERR_PROTOCOL);
++ if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')) {
++ int filt_flags = S_ISDIR(file->mode) ? NAME_IS_DIR : NAME_IS_FILE;
++ if (check_filter(&daemon_filter_list, FLOG, fname, filt_flags) < 0) {
++ rprintf(FERROR, "ERROR: rejecting file transfer request for daemon excluded file: %s\n",
++ fname);
++ exit_cleanup(RERR_PROTOCOL);
++ }
+ }
+
+ #ifdef SUPPORT_XATTRS
+--- a/rsync.1.md
++++ b/rsync.1.md
+@@ -154,6 +154,33 @@ rsync daemon by leaving off the module n
+
+ See the following section for more details.
+
++## MULTI-HOST SECURITY
++
++Rsync takes steps to ensure that the file requests that are shared in a
++transfer are protected against various security issues. Most of the potential
++problems arise on the receiving side where rsync takes steps to ensure that the
++list of files being transferred remains within the bounds of what was
++requested.
++
++Toward this end, rsync 3.1.2 and later have aborted when a file list contains
++an absolute or relative path that tries to escape out of the top of the
++transfer. Also, beginning with version 3.2.5, rsync does two more safety
++checks of the file list to (1) ensure that no extra source arguments were added
++into the transfer other than those that the client requested and (2) ensure
++that the file list obeys the exclude rules that we sent to the sender.
++
++For those that don't yet have a 3.2.5 client rsync, it is safest to do a copy
++into a dedicated destination directory for the remote files rather than
++requesting the remote content get mixed in with other local content. For
++example, doing an rsync copy into your home directory is potentially unsafe on
++an older rsync if the remote rsync is being controlled by a bad actor:
++
++> rsync -aiv host1:dir1 ~
++
++A safer command would be:
++
++> rsync -aiv host1:dir1 ~/host1-files
++
+ ## ADVANCED USAGE
+
+ The syntax for requesting multiple files from a remote host is done by
+@@ -2323,6 +2350,12 @@ your home directory (remove the '=' for
+ behavior. The environment is always overridden by manually specified
+ positive or negative options (the negative is `--no-old-args`).
+
++ Note that this option also disables the extra safety check added in 3.2.5
++ that ensures that a remote sender isn't including extra top-level items in
++ the file-list that you didn't request. This side-effect is necessary
++ because we can't know for sure what names to expect when the remote shell
++ is interpreting the args.
++
+ This option conflicts with the [`--protect-args`](#opt) option.
+
+ 0. `--protect-args`, `-s`
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.4.bb b/meta/recipes-devtools/rsync/rsync_3.2.4.bb
index e6f917b5cdc..711e97002d2 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.4.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.4.bb
@@ -14,6 +14,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://rsyncd.conf \
file://makefile-no-rebuild.patch \
file://determism.patch \
+ file://CVE-2022-29154.patch \
"
SRC_URI[sha256sum] = "6f761838d08052b0b6579cf7f6737d93e47f01f4da04c5d24d3447b7f2a5fad1"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 05/10] rsync: Upgrade to 3.2.5
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (2 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 04/10] rsync: Backport fix to address CVE-2022-29154 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 06/10] connman: Backports for security fixes Khem Raj
` (4 subsequent siblings)
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
Changlog is here [1]
[1] https://download.samba.org/pub/rsync/NEWS#3.2.5
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../rsync/files/CVE-2022-29154.patch | 372 ------------------
.../rsync/{rsync_3.2.4.bb => rsync_3.2.5.bb} | 4 +-
2 files changed, 1 insertion(+), 375 deletions(-)
delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
rename meta/recipes-devtools/rsync/{rsync_3.2.4.bb => rsync_3.2.5.bb} (95%)
diff --git a/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch b/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
deleted file mode 100644
index e43b092ea89..00000000000
--- a/meta/recipes-devtools/rsync/files/CVE-2022-29154.patch
+++ /dev/null
@@ -1,372 +0,0 @@
-From b7231c7d02cfb65d291af74ff66e7d8c507ee871 Mon Sep 17 00:00:00 2001
-From: Wayne Davison <wayne@opencoder.net>
-Date: Sun, 31 Jul 2022 16:55:34 -0700
-Subject: [PATCH] Some extra file-list safety checks.
-
-Upstream-Status: Backport [https://github.com/WayneD/rsync/commit/b7231c7d02cfb65d291af74ff66e7d8c507ee871]
-CVE: CVE-2022-29154
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- exclude.c | 130 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
- flist.c | 17 ++++++-
- io.c | 4 ++
- main.c | 7 ++-
- receiver.c | 11 +++--
- rsync.1.md | 44 ++++++++++++++++--
- 6 files changed, 202 insertions(+), 11 deletions(-)
-
---- a/exclude.c
-+++ b/exclude.c
-@@ -27,16 +27,22 @@ extern int am_server;
- extern int am_sender;
- extern int eol_nulls;
- extern int io_error;
-+extern int xfer_dirs;
-+extern int recurse;
- extern int local_server;
- extern int prune_empty_dirs;
- extern int ignore_perishable;
-+extern int old_style_args;
-+extern int relative_paths;
- extern int delete_mode;
- extern int delete_excluded;
- extern int cvs_exclude;
- extern int sanitize_paths;
- extern int protocol_version;
-+extern int list_only;
- extern int module_id;
-
-+extern char *filesfrom_host;
- extern char curr_dir[MAXPATHLEN];
- extern unsigned int curr_dir_len;
- extern unsigned int module_dirlen;
-@@ -44,8 +50,10 @@ extern unsigned int module_dirlen;
- filter_rule_list filter_list = { .debug_type = "" };
- filter_rule_list cvs_filter_list = { .debug_type = " [global CVS]" };
- filter_rule_list daemon_filter_list = { .debug_type = " [daemon]" };
-+filter_rule_list implied_filter_list = { .debug_type = " [implied]" };
-
- int saw_xattr_filter = 0;
-+int trust_sender_filter = 0;
-
- /* Need room enough for ":MODS " prefix plus some room to grow. */
- #define MAX_RULE_PREFIX (16)
-@@ -292,6 +300,125 @@ static void add_rule(filter_rule_list *l
- }
- }
-
-+/* Each arg the client sends to the remote sender turns into an implied include
-+ * that the receiver uses to validate the file list from the sender. */
-+void add_implied_include(const char *arg)
-+{
-+ filter_rule *rule;
-+ int arg_len, saw_wild = 0, backslash_cnt = 0;
-+ int slash_cnt = 1; /* We know we're adding a leading slash. */
-+ const char *cp;
-+ char *p;
-+ if (old_style_args || list_only || filesfrom_host != NULL)
-+ return;
-+ if (relative_paths) {
-+ cp = strstr(arg, "/./");
-+ if (cp)
-+ arg = cp+3;
-+ } else {
-+ if ((cp = strrchr(arg, '/')) != NULL)
-+ arg = cp + 1;
-+ }
-+ arg_len = strlen(arg);
-+ if (arg_len) {
-+ if (strpbrk(arg, "*[?")) {
-+ /* We need to add room to escape backslashes if wildcard chars are present. */
-+ cp = arg;
-+ while ((cp = strchr(cp, '\\')) != NULL) {
-+ arg_len++;
-+ cp++;
-+ }
-+ saw_wild = 1;
-+ }
-+ arg_len++; /* Leave room for the prefixed slash */
-+ rule = new0(filter_rule);
-+ if (!implied_filter_list.head)
-+ implied_filter_list.head = implied_filter_list.tail = rule;
-+ else {
-+ rule->next = implied_filter_list.head;
-+ implied_filter_list.head = rule;
-+ }
-+ rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
-+ p = rule->pattern = new_array(char, arg_len + 1);
-+ *p++ = '/';
-+ cp = arg;
-+ while (*cp) {
-+ switch (*cp) {
-+ case '\\':
-+ backslash_cnt++;
-+ if (saw_wild)
-+ *p++ = '\\';
-+ *p++ = *cp++;
-+ break;
-+ case '/':
-+ if (p[-1] == '/') /* This is safe because of the initial slash. */
-+ break;
-+ if (relative_paths) {
-+ filter_rule const *ent;
-+ int found = 0;
-+ *p = '\0';
-+ for (ent = implied_filter_list.head; ent; ent = ent->next) {
-+ if (ent != rule && strcmp(ent->pattern, rule->pattern) == 0)
-+ found = 1;
-+ }
-+ if (!found) {
-+ filter_rule *R_rule = new0(filter_rule);
-+ R_rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
-+ R_rule->pattern = strdup(rule->pattern);
-+ R_rule->u.slash_cnt = slash_cnt;
-+ R_rule->next = implied_filter_list.head;
-+ implied_filter_list.head = R_rule;
-+ }
-+ }
-+ slash_cnt++;
-+ *p++ = *cp++;
-+ break;
-+ default:
-+ *p++ = *cp++;
-+ break;
-+ }
-+ }
-+ *p = '\0';
-+ rule->u.slash_cnt = slash_cnt;
-+ arg = (const char *)rule->pattern;
-+ }
-+
-+ if (recurse || xfer_dirs) {
-+ /* Now create a rule with an added "/" & "**" or "*" at the end */
-+ rule = new0(filter_rule);
-+ if (recurse)
-+ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD | FILTRULE_WILD2;
-+ else
-+ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD;
-+ /* A +4 in the len leaves enough room for / * * \0 or / * \0 \0 */
-+ if (!saw_wild && backslash_cnt) {
-+ /* We are appending a wildcard, so now the backslashes need to be escaped. */
-+ p = rule->pattern = new_array(char, arg_len + backslash_cnt + 3 + 1);
-+ cp = arg;
-+ while (*cp) {
-+ if (*cp == '\\')
-+ *p++ = '\\';
-+ *p++ = *cp++;
-+ }
-+ } else {
-+ p = rule->pattern = new_array(char, arg_len + 3 + 1);
-+ if (arg_len) {
-+ memcpy(p, arg, arg_len);
-+ p += arg_len;
-+ }
-+ }
-+ if (p[-1] != '/')
-+ *p++ = '/';
-+ *p++ = '*';
-+ if (recurse)
-+ *p++ = '*';
-+ *p = '\0';
-+ rule->u.slash_cnt = slash_cnt + 1;
-+ rule->next = implied_filter_list.head;
-+ implied_filter_list.head = rule;
-+ }
-+}
-+
- /* This frees any non-inherited items, leaving just inherited items on the list. */
- static void pop_filter_list(filter_rule_list *listp)
- {
-@@ -718,7 +845,7 @@ static void report_filter_result(enum lo
- : name_flags & NAME_IS_DIR ? "directory"
- : "file";
- rprintf(code, "[%s] %sing %s %s because of pattern %s%s%s\n",
-- w, actions[*w!='s'][!(ent->rflags & FILTRULE_INCLUDE)],
-+ w, actions[*w=='g'][!(ent->rflags & FILTRULE_INCLUDE)],
- t, name, ent->pattern,
- ent->rflags & FILTRULE_DIRECTORY ? "/" : "", type);
- }
-@@ -890,6 +1017,7 @@ static filter_rule *parse_rule_tok(const
- }
- switch (ch) {
- case ':':
-+ trust_sender_filter = 1;
- rule->rflags |= FILTRULE_PERDIR_MERGE
- | FILTRULE_FINISH_SETUP;
- /* FALL THROUGH */
---- a/flist.c
-+++ b/flist.c
-@@ -73,6 +73,7 @@ extern int need_unsorted_flist;
- extern int sender_symlink_iconv;
- extern int output_needs_newline;
- extern int sender_keeps_checksum;
-+extern int trust_sender_filter;
- extern int unsort_ndx;
- extern uid_t our_uid;
- extern struct stats stats;
-@@ -83,8 +84,7 @@ extern char curr_dir[MAXPATHLEN];
-
- extern struct chmod_mode_struct *chmod_modes;
-
--extern filter_rule_list filter_list;
--extern filter_rule_list daemon_filter_list;
-+extern filter_rule_list filter_list, implied_filter_list, daemon_filter_list;
-
- #ifdef ICONV_OPTION
- extern int filesfrom_convert;
-@@ -986,6 +986,19 @@ static struct file_struct *recv_file_ent
- exit_cleanup(RERR_UNSUPPORTED);
- }
-
-+ if (*thisname != '.' || thisname[1] != '\0') {
-+ int filt_flags = S_ISDIR(mode) ? NAME_IS_DIR : NAME_IS_FILE;
-+ if (!trust_sender_filter /* a per-dir filter rule means we must trust the sender's filtering */
-+ && filter_list.head && check_filter(&filter_list, FINFO, thisname, filt_flags) < 0) {
-+ rprintf(FERROR, "ERROR: rejecting excluded file-list name: %s\n", thisname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
-+ if (implied_filter_list.head && check_filter(&implied_filter_list, FINFO, thisname, filt_flags) <= 0) {
-+ rprintf(FERROR, "ERROR: rejecting unrequested file-list name: %s\n", thisname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
-+ }
-+
- if (inc_recurse && S_ISDIR(mode)) {
- if (one_file_system) {
- /* Room to save the dir's device for -x */
---- a/io.c
-+++ b/io.c
-@@ -419,6 +419,7 @@ static void forward_filesfrom_data(void)
- while (s != eob) {
- if (*s++ == '\0') {
- ff_xb.len = s - sob - 1;
-+ add_implied_include(sob);
- if (iconvbufs(ic_send, &ff_xb, &iobuf.out, flags) < 0)
- exit_cleanup(RERR_PROTOCOL); /* impossible? */
- write_buf(iobuf.out_fd, s-1, 1); /* Send the '\0'. */
-@@ -450,9 +451,12 @@ static void forward_filesfrom_data(void)
- char *f = ff_xb.buf + ff_xb.pos;
- char *t = ff_xb.buf;
- char *eob = f + len;
-+ char *cur = t;
- /* Eliminate any multi-'\0' runs. */
- while (f != eob) {
- if (!(*t++ = *f++)) {
-+ add_implied_include(cur);
-+ cur = t;
- while (f != eob && *f == '\0')
- f++;
- }
---- a/main.c
-+++ b/main.c
-@@ -89,6 +89,7 @@ extern int backup_dir_len;
- extern int basis_dir_cnt;
- extern int default_af_hint;
- extern int stdout_format_has_i;
-+extern int trust_sender_filter;
- extern struct stats stats;
- extern char *stdout_format;
- extern char *logfile_format;
-@@ -104,7 +105,7 @@ extern char curr_dir[MAXPATHLEN];
- extern char backup_dir_buf[MAXPATHLEN];
- extern char *basis_dir[MAX_BASIS_DIRS+1];
- extern struct file_list *first_flist;
--extern filter_rule_list daemon_filter_list;
-+extern filter_rule_list daemon_filter_list, implied_filter_list;
-
- uid_t our_uid;
- gid_t our_gid;
-@@ -635,6 +636,7 @@ static pid_t do_cmd(char *cmd, char *mac
- #ifdef ICONV_CONST
- setup_iconv();
- #endif
-+ trust_sender_filter = 1;
- } else if (local_server) {
- /* If the user didn't request --[no-]whole-file, force
- * it on, but only if we're not batch processing. */
-@@ -1500,6 +1502,8 @@ static int start_client(int argc, char *
- char *dummy_host;
- int dummy_port = rsync_port;
- int i;
-+ if (filesfrom_fd < 0)
-+ add_implied_include(remote_argv[0]);
- /* For remote source, any extra source args must have either
- * the same hostname or an empty hostname. */
- for (i = 1; i < remote_argc; i++) {
-@@ -1523,6 +1527,7 @@ static int start_client(int argc, char *
- if (!rsync_port && !*arg) /* Turn an empty arg into a dot dir. */
- arg = ".";
- remote_argv[i] = arg;
-+ add_implied_include(arg);
- }
- }
-
---- a/receiver.c
-+++ b/receiver.c
-@@ -593,10 +593,13 @@ int recv_files(int f_in, int f_out, char
- if (DEBUG_GTE(RECV, 1))
- rprintf(FINFO, "recv_files(%s)\n", fname);
-
-- if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')
-- && check_filter(&daemon_filter_list, FLOG, fname, 0) < 0) {
-- rprintf(FERROR, "attempt to hack rsync failed.\n");
-- exit_cleanup(RERR_PROTOCOL);
-+ if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')) {
-+ int filt_flags = S_ISDIR(file->mode) ? NAME_IS_DIR : NAME_IS_FILE;
-+ if (check_filter(&daemon_filter_list, FLOG, fname, filt_flags) < 0) {
-+ rprintf(FERROR, "ERROR: rejecting file transfer request for daemon excluded file: %s\n",
-+ fname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
- }
-
- #ifdef SUPPORT_XATTRS
---- a/rsync.1.md
-+++ b/rsync.1.md
-@@ -154,6 +154,33 @@ rsync daemon by leaving off the module n
-
- See the following section for more details.
-
-+## MULTI-HOST SECURITY
-+
-+Rsync takes steps to ensure that the file requests that are shared in a
-+transfer are protected against various security issues. Most of the potential
-+problems arise on the receiving side where rsync takes steps to ensure that the
-+list of files being transferred remains within the bounds of what was
-+requested.
-+
-+Toward this end, rsync 3.1.2 and later have aborted when a file list contains
-+an absolute or relative path that tries to escape out of the top of the
-+transfer. Also, beginning with version 3.2.5, rsync does two more safety
-+checks of the file list to (1) ensure that no extra source arguments were added
-+into the transfer other than those that the client requested and (2) ensure
-+that the file list obeys the exclude rules that we sent to the sender.
-+
-+For those that don't yet have a 3.2.5 client rsync, it is safest to do a copy
-+into a dedicated destination directory for the remote files rather than
-+requesting the remote content get mixed in with other local content. For
-+example, doing an rsync copy into your home directory is potentially unsafe on
-+an older rsync if the remote rsync is being controlled by a bad actor:
-+
-+> rsync -aiv host1:dir1 ~
-+
-+A safer command would be:
-+
-+> rsync -aiv host1:dir1 ~/host1-files
-+
- ## ADVANCED USAGE
-
- The syntax for requesting multiple files from a remote host is done by
-@@ -2323,6 +2350,12 @@ your home directory (remove the '=' for
- behavior. The environment is always overridden by manually specified
- positive or negative options (the negative is `--no-old-args`).
-
-+ Note that this option also disables the extra safety check added in 3.2.5
-+ that ensures that a remote sender isn't including extra top-level items in
-+ the file-list that you didn't request. This side-effect is necessary
-+ because we can't know for sure what names to expect when the remote shell
-+ is interpreting the args.
-+
- This option conflicts with the [`--protect-args`](#opt) option.
-
- 0. `--protect-args`, `-s`
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.4.bb b/meta/recipes-devtools/rsync/rsync_3.2.5.bb
similarity index 95%
rename from meta/recipes-devtools/rsync/rsync_3.2.4.bb
rename to meta/recipes-devtools/rsync/rsync_3.2.5.bb
index 711e97002d2..a1ba5ea44d1 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.4.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.5.bb
@@ -14,10 +14,8 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://rsyncd.conf \
file://makefile-no-rebuild.patch \
file://determism.patch \
- file://CVE-2022-29154.patch \
"
-
-SRC_URI[sha256sum] = "6f761838d08052b0b6579cf7f6737d93e47f01f4da04c5d24d3447b7f2a5fad1"
+SRC_URI[sha256sum] = "2ac4d21635cdf791867bc377c35ca6dda7f50d919a58be45057fd51600c69aba"
# -16548 required for v3.1.3pre1. Already in v3.1.3.
CVE_CHECK_IGNORE += " CVE-2017-16548 "
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 06/10] connman: Backports for security fixes
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (3 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 05/10] rsync: Upgrade to 3.2.5 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 07/10] libtirpc: Backport fix for CVE-2021-46828 Khem Raj
` (3 subsequent siblings)
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
Fixes
CVE: CVE-2022-32292, CVE-2022-32293
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../connman/connman/CVE-2022-32292.patch | 37 ++++
.../connman/connman/CVE-2022-32293_p1.patch | 174 ++++++++++++++++++
.../connman/connman/CVE-2022-32293_p2.patch | 141 ++++++++++++++
.../connman/connman_1.41.bb | 3 +
4 files changed, 355 insertions(+)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
new file mode 100644
index 00000000000..182c5ca29c2
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
@@ -0,0 +1,37 @@
+From d1a5ede5d255bde8ef707f8441b997563b9312bd Mon Sep 17 00:00:00 2001
+From: Nathan Crandall <ncrandall@tesla.com>
+Date: Tue, 12 Jul 2022 08:56:34 +0200
+Subject: gweb: Fix OOB write in received_data()
+
+There is a mismatch of handling binary vs. C-string data with memchr
+and strlen, resulting in pos, count, and bytes_read to become out of
+sync and result in a heap overflow. Instead, do not treat the buffer
+as an ASCII C-string. We calculate the count based on the return value
+of memchr, instead of strlen.
+
+Fixes: CVE-2022-32292
+
+CVE: CVE-2022-32292
+
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ gweb/gweb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gweb/gweb.c b/gweb/gweb.c
+index 12fcb1d8..13c6c5f2 100644
+--- a/gweb/gweb.c
++++ b/gweb/gweb.c
+@@ -918,7 +918,7 @@ static gboolean received_data(GIOChannel *channel, GIOCondition cond,
+ }
+
+ *pos = '\0';
+- count = strlen((char *) ptr);
++ count = pos - ptr;
+ if (count > 0 && ptr[count - 1] == '\r') {
+ ptr[--count] = '\0';
+ bytes_read--;
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
new file mode 100644
index 00000000000..56f8fc82de9
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
@@ -0,0 +1,174 @@
+From 416bfaff988882c553c672e5bfc2d4f648d29e8a Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <wagi@monom.org>
+Date: Tue, 5 Jul 2022 09:11:09 +0200
+Subject: wispr: Update portal context references
+
+Maintain proper portal context references to avoid UAF.
+
+Fixes: CVE-2022-32293
+CVE: CVE-2022-32293
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=72343929836de80727a27d6744c869dff045757c]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/wispr.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/src/wispr.c b/src/wispr.c
+index bde7e63b..84bed33f 100644
+--- a/src/wispr.c
++++ b/src/wispr.c
+@@ -105,8 +105,6 @@ static bool enable_online_to_ready_transition = false;
+
+ static void connman_wispr_message_init(struct connman_wispr_message *msg)
+ {
+- DBG("");
+-
+ msg->has_error = false;
+ msg->current_element = NULL;
+
+@@ -166,8 +164,6 @@ static void free_wispr_routes(struct connman_wispr_portal_context *wp_context)
+ static void free_connman_wispr_portal_context(
+ struct connman_wispr_portal_context *wp_context)
+ {
+- DBG("context %p", wp_context);
+-
+ if (wp_context->wispr_portal) {
+ if (wp_context->wispr_portal->ipv4_context == wp_context)
+ wp_context->wispr_portal->ipv4_context = NULL;
+@@ -483,9 +479,6 @@ static void portal_manage_status(GWebResult *result,
+ &str))
+ connman_info("Client-Timezone: %s", str);
+
+- if (!enable_online_to_ready_transition)
+- wispr_portal_context_unref(wp_context);
+-
+ __connman_service_ipconfig_indicate_state(service,
+ CONNMAN_SERVICE_STATE_ONLINE, type);
+
+@@ -546,14 +539,17 @@ static void wispr_portal_request_portal(
+ {
+ DBG("");
+
++ wispr_portal_context_ref(wp_context);
+ wp_context->request_id = g_web_request_get(wp_context->web,
+ wp_context->status_url,
+ wispr_portal_web_result,
+ wispr_route_request,
+ wp_context);
+
+- if (wp_context->request_id == 0)
++ if (wp_context->request_id == 0) {
+ wispr_portal_error(wp_context);
++ wispr_portal_context_unref(wp_context);
++ }
+ }
+
+ static bool wispr_input(const guint8 **data, gsize *length,
+@@ -618,13 +614,15 @@ static void wispr_portal_browser_reply_cb(struct connman_service *service,
+ return;
+
+ if (!authentication_done) {
+- wispr_portal_error(wp_context);
+ free_wispr_routes(wp_context);
++ wispr_portal_error(wp_context);
++ wispr_portal_context_unref(wp_context);
+ return;
+ }
+
+ /* Restarting the test */
+ __connman_service_wispr_start(service, wp_context->type);
++ wispr_portal_context_unref(wp_context);
+ }
+
+ static void wispr_portal_request_wispr_login(struct connman_service *service,
+@@ -700,11 +698,13 @@ static bool wispr_manage_message(GWebResult *result,
+
+ wp_context->wispr_result = CONNMAN_WISPR_RESULT_LOGIN;
+
++ wispr_portal_context_ref(wp_context);
+ if (__connman_agent_request_login_input(wp_context->service,
+ wispr_portal_request_wispr_login,
+- wp_context) != -EINPROGRESS)
++ wp_context) != -EINPROGRESS) {
+ wispr_portal_error(wp_context);
+- else
++ wispr_portal_context_unref(wp_context);
++ } else
+ return true;
+
+ break;
+@@ -753,6 +753,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ if (length > 0) {
+ g_web_parser_feed_data(wp_context->wispr_parser,
+ chunk, length);
++ wispr_portal_context_unref(wp_context);
+ return true;
+ }
+
+@@ -770,6 +771,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ switch (status) {
+ case 000:
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -781,11 +783,14 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ if (g_web_result_get_header(result, "X-ConnMan-Status",
+ &str)) {
+ portal_manage_status(result, wp_context);
++ wispr_portal_context_unref(wp_context);
+ return false;
+- } else
++ } else {
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->redirect_url, wp_context);
++ }
+
+ break;
+ case 300:
+@@ -798,6 +803,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ !g_web_result_get_header(result, "Location",
+ &redirect)) {
+
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -808,6 +814,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ wp_context->redirect_url = g_strdup(redirect);
+
++ wispr_portal_context_ref(wp_context);
+ wp_context->request_id = g_web_request_get(wp_context->web,
+ redirect, wispr_portal_web_result,
+ wispr_route_request, wp_context);
+@@ -820,6 +827,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ break;
+ case 505:
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -832,6 +840,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ wp_context->request_id = 0;
+ done:
+ wp_context->wispr_msg.message_type = -1;
++ wispr_portal_context_unref(wp_context);
+ return false;
+ }
+
+@@ -890,6 +899,7 @@ static void proxy_callback(const char *proxy, void *user_data)
+ xml_wispr_parser_callback, wp_context);
+
+ wispr_portal_request_portal(wp_context);
++ wispr_portal_context_unref(wp_context);
+ }
+
+ static gboolean no_proxy_callback(gpointer user_data)
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
new file mode 100644
index 00000000000..b2802035943
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
@@ -0,0 +1,141 @@
+From 72343929836de80727a27d6744c869dff045757c Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <wagi@monom.org>
+Date: Tue, 5 Jul 2022 08:32:12 +0200
+Subject: wispr: Add reference counter to portal context
+
+Track the connman_wispr_portal_context live time via a
+refcounter. This only adds the infrastructure to do proper reference
+counting.
+
+Fixes: CVE-2022-32293
+CVE: CVE-2022-32293
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=416bfaff988882c553c672e5bfc2d4f648d29e8a]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/wispr.c | 52 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/src/wispr.c b/src/wispr.c
+index a07896ca..bde7e63b 100644
+--- a/src/wispr.c
++++ b/src/wispr.c
+@@ -56,6 +56,7 @@ struct wispr_route {
+ };
+
+ struct connman_wispr_portal_context {
++ int refcount;
+ struct connman_service *service;
+ enum connman_ipconfig_type type;
+ struct connman_wispr_portal *wispr_portal;
+@@ -97,6 +98,11 @@ static char *online_check_ipv4_url = NULL;
+ static char *online_check_ipv6_url = NULL;
+ static bool enable_online_to_ready_transition = false;
+
++#define wispr_portal_context_ref(wp_context) \
++ wispr_portal_context_ref_debug(wp_context, __FILE__, __LINE__, __func__)
++#define wispr_portal_context_unref(wp_context) \
++ wispr_portal_context_unref_debug(wp_context, __FILE__, __LINE__, __func__)
++
+ static void connman_wispr_message_init(struct connman_wispr_message *msg)
+ {
+ DBG("");
+@@ -162,9 +168,6 @@ static void free_connman_wispr_portal_context(
+ {
+ DBG("context %p", wp_context);
+
+- if (!wp_context)
+- return;
+-
+ if (wp_context->wispr_portal) {
+ if (wp_context->wispr_portal->ipv4_context == wp_context)
+ wp_context->wispr_portal->ipv4_context = NULL;
+@@ -201,9 +204,38 @@ static void free_connman_wispr_portal_context(
+ g_free(wp_context);
+ }
+
++static struct connman_wispr_portal_context *
++wispr_portal_context_ref_debug(struct connman_wispr_portal_context *wp_context,
++ const char *file, int line, const char *caller)
++{
++ DBG("%p ref %d by %s:%d:%s()", wp_context,
++ wp_context->refcount + 1, file, line, caller);
++
++ __sync_fetch_and_add(&wp_context->refcount, 1);
++
++ return wp_context;
++}
++
++static void wispr_portal_context_unref_debug(
++ struct connman_wispr_portal_context *wp_context,
++ const char *file, int line, const char *caller)
++{
++ if (!wp_context)
++ return;
++
++ DBG("%p ref %d by %s:%d:%s()", wp_context,
++ wp_context->refcount - 1, file, line, caller);
++
++ if (__sync_fetch_and_sub(&wp_context->refcount, 1) != 1)
++ return;
++
++ free_connman_wispr_portal_context(wp_context);
++}
++
+ static struct connman_wispr_portal_context *create_wispr_portal_context(void)
+ {
+- return g_try_new0(struct connman_wispr_portal_context, 1);
++ return wispr_portal_context_ref(
++ g_new0(struct connman_wispr_portal_context, 1));
+ }
+
+ static void free_connman_wispr_portal(gpointer data)
+@@ -215,8 +247,8 @@ static void free_connman_wispr_portal(gpointer data)
+ if (!wispr_portal)
+ return;
+
+- free_connman_wispr_portal_context(wispr_portal->ipv4_context);
+- free_connman_wispr_portal_context(wispr_portal->ipv6_context);
++ wispr_portal_context_unref(wispr_portal->ipv4_context);
++ wispr_portal_context_unref(wispr_portal->ipv6_context);
+
+ g_free(wispr_portal);
+ }
+@@ -452,7 +484,7 @@ static void portal_manage_status(GWebResult *result,
+ connman_info("Client-Timezone: %s", str);
+
+ if (!enable_online_to_ready_transition)
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+
+ __connman_service_ipconfig_indicate_state(service,
+ CONNMAN_SERVICE_STATE_ONLINE, type);
+@@ -616,7 +648,7 @@ static void wispr_portal_request_wispr_login(struct connman_service *service,
+ return;
+ }
+
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+ return;
+ }
+
+@@ -952,7 +984,7 @@ static int wispr_portal_detect(struct connman_wispr_portal_context *wp_context)
+
+ if (wp_context->token == 0) {
+ err = -EINVAL;
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+ }
+ } else if (wp_context->timeout == 0) {
+ wp_context->timeout = g_idle_add(no_proxy_callback, wp_context);
+@@ -1001,7 +1033,7 @@ int __connman_wispr_start(struct connman_service *service,
+
+ /* If there is already an existing context, we wipe it */
+ if (wp_context)
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+
+ wp_context = create_wispr_portal_context();
+ if (!wp_context)
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman_1.41.bb b/meta/recipes-connectivity/connman/connman_1.41.bb
index 736b78eaebb..79542b2175d 100644
--- a/meta/recipes-connectivity/connman/connman_1.41.bb
+++ b/meta/recipes-connectivity/connman/connman_1.41.bb
@@ -5,6 +5,9 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
file://0001-connman.service-stop-systemd-resolved-when-we-use-co.patch \
file://connman \
file://no-version-scripts.patch \
+ file://CVE-2022-32293_p1.patch \
+ file://CVE-2022-32293_p2.patch \
+ file://CVE-2022-32292.patch \
"
SRC_URI:append:libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 07/10] libtirpc: Backport fix for CVE-2021-46828
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (4 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 06/10] connman: Backports for security fixes Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 08/10] libxml2: Ignore CVE-2016-3709 Khem Raj
` (2 subsequent siblings)
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
CVE: CVE-2021-46828
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../libtirpc/libtirpc/CVE-2021-46828.patch | 565 ++++++++++++++++++
.../libtirpc/libtirpc_1.3.2.bb | 4 +-
2 files changed, 568 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
diff --git a/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch b/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
new file mode 100644
index 00000000000..64dffb923b9
--- /dev/null
+++ b/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
@@ -0,0 +1,565 @@
+From 86529758570cef4c73fb9b9c4104fdc510f701ed Mon Sep 17 00:00:00 2001
+From: Dai Ngo <dai.ngo@oracle.com>
+Date: Sat, 21 Aug 2021 13:16:23 -0400
+Subject: [PATCH] Fix DoS vulnerability in libtirpc
+
+Currently svc_run does not handle poll timeout and rendezvous_request
+does not handle EMFILE error returned from accept(2 as it used to.
+These two missing functionality were removed by commit b2c9430f46c4.
+
+The effect of not handling poll timeout allows idle TCP conections
+to remain ESTABLISHED indefinitely. When the number of connections
+reaches the limit of the open file descriptors (ulimit -n) then
+accept(2) fails with EMFILE. Since there is no handling of EMFILE
+error this causes svc_run() to get in a tight loop calling accept(2).
+This resulting in the RPC service of svc_run is being down, it's
+no longer able to service any requests.
+
+RPC service rpcbind, statd and mountd are effected by this
+problem.
+
+Fix by enhancing rendezvous_request to keep the number of
+SVCXPRT conections to 4/5 of the size of the file descriptor
+table. When this thresold is reached, it destroys the idle
+TCP connections or destroys the least active connection if
+no idle connnction was found.
+
+Fixes: 44bf15b8 rpcbind: don't use obsolete svc_fdset interface of libtirpc
+
+CVE: CVE-2021-46828
+Upstream-Status: Backport [http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed]
+Signed-off-by: dai.ngo@oracle.com
+Signed-off-by: Steve Dickson <steved@redhat.com>
+---
+ INSTALL | 371 +----------------------------------------------------------
+ src/svc.c | 17 ++-
+ src/svc_vc.c | 62 +++++++++-
+ 3 files changed, 78 insertions(+), 372 deletions(-)
+ mode change 100644 => 120000 INSTALL
+
+diff --git a/INSTALL b/INSTALL
+deleted file mode 100644
+index 2099840..0000000
+--- a/INSTALL
++++ /dev/null
+@@ -1,370 +0,0 @@
+-Installation Instructions
+-*************************
+-
+-Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation,
+-Inc.
+-
+- Copying and distribution of this file, with or without modification,
+-are permitted in any medium without royalty provided the copyright
+-notice and this notice are preserved. This file is offered as-is,
+-without warranty of any kind.
+-
+-Basic Installation
+-==================
+-
+- Briefly, the shell command `./configure && make && make install'
+-should configure, build, and install this package. The following
+-more-detailed instructions are generic; see the `README' file for
+-instructions specific to this package. Some packages provide this
+-`INSTALL' file but do not implement all of the features documented
+-below. The lack of an optional feature in a given package is not
+-necessarily a bug. More recommendations for GNU packages can be found
+-in *note Makefile Conventions: (standards)Makefile Conventions.
+-
+- The `configure' shell script attempts to guess correct values for
+-various system-dependent variables used during compilation. It uses
+-those values to create a `Makefile' in each directory of the package.
+-It may also create one or more `.h' files containing system-dependent
+-definitions. Finally, it creates a shell script `config.status' that
+-you can run in the future to recreate the current configuration, and a
+-file `config.log' containing compiler output (useful mainly for
+-debugging `configure').
+-
+- It can also use an optional file (typically called `config.cache'
+-and enabled with `--cache-file=config.cache' or simply `-C') that saves
+-the results of its tests to speed up reconfiguring. Caching is
+-disabled by default to prevent problems with accidental use of stale
+-cache files.
+-
+- If you need to do unusual things to compile the package, please try
+-to figure out how `configure' could check whether to do them, and mail
+-diffs or instructions to the address given in the `README' so they can
+-be considered for the next release. If you are using the cache, and at
+-some point `config.cache' contains results you don't want to keep, you
+-may remove or edit it.
+-
+- The file `configure.ac' (or `configure.in') is used to create
+-`configure' by a program called `autoconf'. You need `configure.ac' if
+-you want to change it or regenerate `configure' using a newer version
+-of `autoconf'.
+-
+- The simplest way to compile this package is:
+-
+- 1. `cd' to the directory containing the package's source code and type
+- `./configure' to configure the package for your system.
+-
+- Running `configure' might take a while. While running, it prints
+- some messages telling which features it is checking for.
+-
+- 2. Type `make' to compile the package.
+-
+- 3. Optionally, type `make check' to run any self-tests that come with
+- the package, generally using the just-built uninstalled binaries.
+-
+- 4. Type `make install' to install the programs and any data files and
+- documentation. When installing into a prefix owned by root, it is
+- recommended that the package be configured and built as a regular
+- user, and only the `make install' phase executed with root
+- privileges.
+-
+- 5. Optionally, type `make installcheck' to repeat any self-tests, but
+- this time using the binaries in their final installed location.
+- This target does not install anything. Running this target as a
+- regular user, particularly if the prior `make install' required
+- root privileges, verifies that the installation completed
+- correctly.
+-
+- 6. You can remove the program binaries and object files from the
+- source code directory by typing `make clean'. To also remove the
+- files that `configure' created (so you can compile the package for
+- a different kind of computer), type `make distclean'. There is
+- also a `make maintainer-clean' target, but that is intended mainly
+- for the package's developers. If you use it, you may have to get
+- all sorts of other programs in order to regenerate files that came
+- with the distribution.
+-
+- 7. Often, you can also type `make uninstall' to remove the installed
+- files again. In practice, not all packages have tested that
+- uninstallation works correctly, even though it is required by the
+- GNU Coding Standards.
+-
+- 8. Some packages, particularly those that use Automake, provide `make
+- distcheck', which can by used by developers to test that all other
+- targets like `make install' and `make uninstall' work correctly.
+- This target is generally not run by end users.
+-
+-Compilers and Options
+-=====================
+-
+- Some systems require unusual options for compilation or linking that
+-the `configure' script does not know about. Run `./configure --help'
+-for details on some of the pertinent environment variables.
+-
+- You can give `configure' initial values for configuration parameters
+-by setting variables in the command line or in the environment. Here
+-is an example:
+-
+- ./configure CC=c99 CFLAGS=-g LIBS=-lposix
+-
+- *Note Defining Variables::, for more details.
+-
+-Compiling For Multiple Architectures
+-====================================
+-
+- You can compile the package for more than one kind of computer at the
+-same time, by placing the object files for each architecture in their
+-own directory. To do this, you can use GNU `make'. `cd' to the
+-directory where you want the object files and executables to go and run
+-the `configure' script. `configure' automatically checks for the
+-source code in the directory that `configure' is in and in `..'. This
+-is known as a "VPATH" build.
+-
+- With a non-GNU `make', it is safer to compile the package for one
+-architecture at a time in the source code directory. After you have
+-installed the package for one architecture, use `make distclean' before
+-reconfiguring for another architecture.
+-
+- On MacOS X 10.5 and later systems, you can create libraries and
+-executables that work on multiple system types--known as "fat" or
+-"universal" binaries--by specifying multiple `-arch' options to the
+-compiler but only a single `-arch' option to the preprocessor. Like
+-this:
+-
+- ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
+- CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
+- CPP="gcc -E" CXXCPP="g++ -E"
+-
+- This is not guaranteed to produce working output in all cases, you
+-may have to build one architecture at a time and combine the results
+-using the `lipo' tool if you have problems.
+-
+-Installation Names
+-==================
+-
+- By default, `make install' installs the package's commands under
+-`/usr/local/bin', include files under `/usr/local/include', etc. You
+-can specify an installation prefix other than `/usr/local' by giving
+-`configure' the option `--prefix=PREFIX', where PREFIX must be an
+-absolute file name.
+-
+- You can specify separate installation prefixes for
+-architecture-specific files and architecture-independent files. If you
+-pass the option `--exec-prefix=PREFIX' to `configure', the package uses
+-PREFIX as the prefix for installing programs and libraries.
+-Documentation and other data files still use the regular prefix.
+-
+- In addition, if you use an unusual directory layout you can give
+-options like `--bindir=DIR' to specify different values for particular
+-kinds of files. Run `configure --help' for a list of the directories
+-you can set and what kinds of files go in them. In general, the
+-default for these options is expressed in terms of `${prefix}', so that
+-specifying just `--prefix' will affect all of the other directory
+-specifications that were not explicitly provided.
+-
+- The most portable way to affect installation locations is to pass the
+-correct locations to `configure'; however, many packages provide one or
+-both of the following shortcuts of passing variable assignments to the
+-`make install' command line to change installation locations without
+-having to reconfigure or recompile.
+-
+- The first method involves providing an override variable for each
+-affected directory. For example, `make install
+-prefix=/alternate/directory' will choose an alternate location for all
+-directory configuration variables that were expressed in terms of
+-`${prefix}'. Any directories that were specified during `configure',
+-but not in terms of `${prefix}', must each be overridden at install
+-time for the entire installation to be relocated. The approach of
+-makefile variable overrides for each directory variable is required by
+-the GNU Coding Standards, and ideally causes no recompilation.
+-However, some platforms have known limitations with the semantics of
+-shared libraries that end up requiring recompilation when using this
+-method, particularly noticeable in packages that use GNU Libtool.
+-
+- The second method involves providing the `DESTDIR' variable. For
+-example, `make install DESTDIR=/alternate/directory' will prepend
+-`/alternate/directory' before all installation names. The approach of
+-`DESTDIR' overrides is not required by the GNU Coding Standards, and
+-does not work on platforms that have drive letters. On the other hand,
+-it does better at avoiding recompilation issues, and works well even
+-when some directory options were not specified in terms of `${prefix}'
+-at `configure' time.
+-
+-Optional Features
+-=================
+-
+- If the package supports it, you can cause programs to be installed
+-with an extra prefix or suffix on their names by giving `configure' the
+-option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
+-
+- Some packages pay attention to `--enable-FEATURE' options to
+-`configure', where FEATURE indicates an optional part of the package.
+-They may also pay attention to `--with-PACKAGE' options, where PACKAGE
+-is something like `gnu-as' or `x' (for the X Window System). The
+-`README' should mention any `--enable-' and `--with-' options that the
+-package recognizes.
+-
+- For packages that use the X Window System, `configure' can usually
+-find the X include and library files automatically, but if it doesn't,
+-you can use the `configure' options `--x-includes=DIR' and
+-`--x-libraries=DIR' to specify their locations.
+-
+- Some packages offer the ability to configure how verbose the
+-execution of `make' will be. For these packages, running `./configure
+---enable-silent-rules' sets the default to minimal output, which can be
+-overridden with `make V=1'; while running `./configure
+---disable-silent-rules' sets the default to verbose, which can be
+-overridden with `make V=0'.
+-
+-Particular systems
+-==================
+-
+- On HP-UX, the default C compiler is not ANSI C compatible. If GNU
+-CC is not installed, it is recommended to use the following options in
+-order to use an ANSI C compiler:
+-
+- ./configure CC="cc -Ae -D_XOPEN_SOURCE=500"
+-
+-and if that doesn't work, install pre-built binaries of GCC for HP-UX.
+-
+- HP-UX `make' updates targets which have the same time stamps as
+-their prerequisites, which makes it generally unusable when shipped
+-generated files such as `configure' are involved. Use GNU `make'
+-instead.
+-
+- On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
+-parse its `<wchar.h>' header file. The option `-nodtk' can be used as
+-a workaround. If GNU CC is not installed, it is therefore recommended
+-to try
+-
+- ./configure CC="cc"
+-
+-and if that doesn't work, try
+-
+- ./configure CC="cc -nodtk"
+-
+- On Solaris, don't put `/usr/ucb' early in your `PATH'. This
+-directory contains several dysfunctional programs; working variants of
+-these programs are available in `/usr/bin'. So, if you need `/usr/ucb'
+-in your `PATH', put it _after_ `/usr/bin'.
+-
+- On Haiku, software installed for all users goes in `/boot/common',
+-not `/usr/local'. It is recommended to use the following options:
+-
+- ./configure --prefix=/boot/common
+-
+-Specifying the System Type
+-==========================
+-
+- There may be some features `configure' cannot figure out
+-automatically, but needs to determine by the type of machine the package
+-will run on. Usually, assuming the package is built to be run on the
+-_same_ architectures, `configure' can figure that out, but if it prints
+-a message saying it cannot guess the machine type, give it the
+-`--build=TYPE' option. TYPE can either be a short name for the system
+-type, such as `sun4', or a canonical name which has the form:
+-
+- CPU-COMPANY-SYSTEM
+-
+-where SYSTEM can have one of these forms:
+-
+- OS
+- KERNEL-OS
+-
+- See the file `config.sub' for the possible values of each field. If
+-`config.sub' isn't included in this package, then this package doesn't
+-need to know the machine type.
+-
+- If you are _building_ compiler tools for cross-compiling, you should
+-use the option `--target=TYPE' to select the type of system they will
+-produce code for.
+-
+- If you want to _use_ a cross compiler, that generates code for a
+-platform different from the build platform, you should specify the
+-"host" platform (i.e., that on which the generated programs will
+-eventually be run) with `--host=TYPE'.
+-
+-Sharing Defaults
+-================
+-
+- If you want to set default values for `configure' scripts to share,
+-you can create a site shell script called `config.site' that gives
+-default values for variables like `CC', `cache_file', and `prefix'.
+-`configure' looks for `PREFIX/share/config.site' if it exists, then
+-`PREFIX/etc/config.site' if it exists. Or, you can set the
+-`CONFIG_SITE' environment variable to the location of the site script.
+-A warning: not all `configure' scripts look for a site script.
+-
+-Defining Variables
+-==================
+-
+- Variables not defined in a site shell script can be set in the
+-environment passed to `configure'. However, some packages may run
+-configure again during the build, and the customized values of these
+-variables may be lost. In order to avoid this problem, you should set
+-them in the `configure' command line, using `VAR=value'. For example:
+-
+- ./configure CC=/usr/local2/bin/gcc
+-
+-causes the specified `gcc' to be used as the C compiler (unless it is
+-overridden in the site shell script).
+-
+-Unfortunately, this technique does not work for `CONFIG_SHELL' due to
+-an Autoconf limitation. Until the limitation is lifted, you can use
+-this workaround:
+-
+- CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash
+-
+-`configure' Invocation
+-======================
+-
+- `configure' recognizes the following options to control how it
+-operates.
+-
+-`--help'
+-`-h'
+- Print a summary of all of the options to `configure', and exit.
+-
+-`--help=short'
+-`--help=recursive'
+- Print a summary of the options unique to this package's
+- `configure', and exit. The `short' variant lists options used
+- only in the top level, while the `recursive' variant lists options
+- also present in any nested packages.
+-
+-`--version'
+-`-V'
+- Print the version of Autoconf used to generate the `configure'
+- script, and exit.
+-
+-`--cache-file=FILE'
+- Enable the cache: use and save the results of the tests in FILE,
+- traditionally `config.cache'. FILE defaults to `/dev/null' to
+- disable caching.
+-
+-`--config-cache'
+-`-C'
+- Alias for `--cache-file=config.cache'.
+-
+-`--quiet'
+-`--silent'
+-`-q'
+- Do not print messages saying which checks are being made. To
+- suppress all normal output, redirect it to `/dev/null' (any error
+- messages will still be shown).
+-
+-`--srcdir=DIR'
+- Look for the package's source code in directory DIR. Usually
+- `configure' can determine that directory automatically.
+-
+-`--prefix=DIR'
+- Use DIR as the installation prefix. *note Installation Names::
+- for more details, including other options available for fine-tuning
+- the installation locations.
+-
+-`--no-create'
+-`-n'
+- Run the configure checks, but stop before creating any output
+- files.
+-
+-`configure' also accepts some other, not widely useful, options. Run
+-`configure --help' for more details.
+diff --git a/INSTALL b/INSTALL
+new file mode 120000
+index 0000000..e3f22c0
+--- /dev/null
++++ b/INSTALL
+@@ -0,0 +1 @@
++/usr/share/automake-1.16/INSTALL
+\ No newline at end of file
+diff --git a/src/svc.c b/src/svc.c
+index 6db164b..3a8709f 100644
+--- a/src/svc.c
++++ b/src/svc.c
+@@ -57,7 +57,7 @@
+
+ #define max(a, b) (a > b ? a : b)
+
+-static SVCXPRT **__svc_xports;
++SVCXPRT **__svc_xports;
+ int __svc_maxrec;
+
+ /*
+@@ -194,6 +194,21 @@ __xprt_do_unregister (xprt, dolock)
+ rwlock_unlock (&svc_fd_lock);
+ }
+
++int
++svc_open_fds()
++{
++ int ix;
++ int nfds = 0;
++
++ rwlock_rdlock (&svc_fd_lock);
++ for (ix = 0; ix < svc_max_pollfd; ++ix) {
++ if (svc_pollfd[ix].fd != -1)
++ nfds++;
++ }
++ rwlock_unlock (&svc_fd_lock);
++ return (nfds);
++}
++
+ /*
+ * Add a service program to the callout list.
+ * The dispatch routine will be called when a rpc request for this
+diff --git a/src/svc_vc.c b/src/svc_vc.c
+index f1d9f00..3dc8a75 100644
+--- a/src/svc_vc.c
++++ b/src/svc_vc.c
+@@ -64,6 +64,8 @@
+
+
+ extern rwlock_t svc_fd_lock;
++extern SVCXPRT **__svc_xports;
++extern int svc_open_fds();
+
+ static SVCXPRT *makefd_xprt(int, u_int, u_int);
+ static bool_t rendezvous_request(SVCXPRT *, struct rpc_msg *);
+@@ -82,6 +84,7 @@ static void svc_vc_ops(SVCXPRT *);
+ static bool_t svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in);
+ static bool_t svc_vc_rendezvous_control (SVCXPRT *xprt, const u_int rq,
+ void *in);
++static int __svc_destroy_idle(int timeout);
+
+ struct cf_rendezvous { /* kept in xprt->xp_p1 for rendezvouser */
+ u_int sendsize;
+@@ -313,13 +316,14 @@ done:
+ return (xprt);
+ }
+
++
+ /*ARGSUSED*/
+ static bool_t
+ rendezvous_request(xprt, msg)
+ SVCXPRT *xprt;
+ struct rpc_msg *msg;
+ {
+- int sock, flags;
++ int sock, flags, nfds, cnt;
+ struct cf_rendezvous *r;
+ struct cf_conn *cd;
+ struct sockaddr_storage addr;
+@@ -379,6 +383,16 @@ again:
+
+ gettimeofday(&cd->last_recv_time, NULL);
+
++ nfds = svc_open_fds();
++ if (nfds >= (_rpc_dtablesize() / 5) * 4) {
++ /* destroy idle connections */
++ cnt = __svc_destroy_idle(15);
++ if (cnt == 0) {
++ /* destroy least active */
++ __svc_destroy_idle(0);
++ }
++ }
++
+ return (FALSE); /* there is never an rpc msg to be processed */
+ }
+
+@@ -820,3 +834,49 @@ __svc_clean_idle(fd_set *fds, int timeout, bool_t cleanblock)
+ {
+ return FALSE;
+ }
++
++static int
++__svc_destroy_idle(int timeout)
++{
++ int i, ncleaned = 0;
++ SVCXPRT *xprt, *least_active;
++ struct timeval tv, tdiff, tmax;
++ struct cf_conn *cd;
++
++ gettimeofday(&tv, NULL);
++ tmax.tv_sec = tmax.tv_usec = 0;
++ least_active = NULL;
++ rwlock_wrlock(&svc_fd_lock);
++
++ for (i = 0; i <= svc_max_pollfd; i++) {
++ if (svc_pollfd[i].fd == -1)
++ continue;
++ xprt = __svc_xports[i];
++ if (xprt == NULL || xprt->xp_ops == NULL ||
++ xprt->xp_ops->xp_recv != svc_vc_recv)
++ continue;
++ cd = (struct cf_conn *)xprt->xp_p1;
++ if (!cd->nonblock)
++ continue;
++ if (timeout == 0) {
++ timersub(&tv, &cd->last_recv_time, &tdiff);
++ if (timercmp(&tdiff, &tmax, >)) {
++ tmax = tdiff;
++ least_active = xprt;
++ }
++ continue;
++ }
++ if (tv.tv_sec - cd->last_recv_time.tv_sec > timeout) {
++ __xprt_unregister_unlocked(xprt);
++ __svc_vc_dodestroy(xprt);
++ ncleaned++;
++ }
++ }
++ if (timeout == 0 && least_active != NULL) {
++ __xprt_unregister_unlocked(least_active);
++ __svc_vc_dodestroy(least_active);
++ ncleaned++;
++ }
++ rwlock_unlock(&svc_fd_lock);
++ return (ncleaned);
++}
+--
+1.8.3.1
+
diff --git a/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb b/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb
index 45b3d2befc3..cc87638c0f7 100644
--- a/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb
+++ b/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb
@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=f835cce8852481e4b2bbbdd23b5e47f3 \
PROVIDES = "virtual/librpc"
-SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BP}.tar.bz2"
+SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BP}.tar.bz2 \
+ file://CVE-2021-46828.patch \
+ "
UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/libtirpc/files/libtirpc/"
UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)/"
SRC_URI[sha256sum] = "e24eb88b8ce7db3b7ca6eb80115dd1284abc5ec32a8deccfed2224fc2532b9fd"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 08/10] libxml2: Ignore CVE-2016-3709
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (5 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 07/10] libtirpc: Backport fix for CVE-2021-46828 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 09/10] tiff: Backport a patch for CVE-2022-34526 Khem Raj
2022-08-14 22:20 ` [PATCH 10/10] libtirpc: Upgrade to 1.3.3 Khem Raj
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
This is fixed via a revert in 2.9.11 [1]
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
meta/recipes-core/libxml/libxml2_2.9.14.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 3081ebf92f0..e58298d3b01 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -29,6 +29,10 @@ SRC_URI[testtar.sha256sum] = "96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c
BINCONFIG = "${bindir}/xml2-config"
+# Fixed since 2.9.11 via
+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
+CVE_CHECK_IGNORE += "CVE-2016-3709"
+
PACKAGECONFIG ??= "python \
${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \
"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 09/10] tiff: Backport a patch for CVE-2022-34526
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (6 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 08/10] libxml2: Ignore CVE-2016-3709 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
2022-08-14 22:20 ` [PATCH 10/10] libtirpc: Upgrade to 1.3.3 Khem Raj
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../libtiff/files/CVE-2022-34526.patch | 32 +++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.4.0.bb | 4 ++-
2 files changed, 35 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch
new file mode 100644
index 00000000000..54c33457468
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch
@@ -0,0 +1,32 @@
+From 275735d0354e39c0ac1dc3c0db2120d6f31d1990 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Mon, 27 Jun 2022 16:09:43 +0200
+Subject: [PATCH] _TIFFCheckFieldIsValidForCodec(): return FALSE when passed a
+ codec-specific tag and the codec is not configured (fixes #433)
+
+This avoids crashes when querying such tags
+
+CVE: CVE-2022-34526
+Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ libtiff/tif_dirinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index c30f569b..3371cb5c 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -1191,6 +1191,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
+ default:
+ return 1;
+ }
++ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
++ return 0;
++ }
+ /* Check if codec specific tags are allowed for the current
+ * compression scheme (codec) */
+ switch (tif->tif_dir.td_compression) {
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
index 0af956a8f0f..e30df0b3e9e 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf"
CVE_PRODUCT = "libtiff"
SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
- file://0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch"
+ file://0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch \
+ file://CVE-2022-34526.patch \
+ "
SRC_URI[sha256sum] = "917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed"
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 10/10] libtirpc: Upgrade to 1.3.3
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
` (7 preceding siblings ...)
2022-08-14 22:20 ` [PATCH 09/10] tiff: Backport a patch for CVE-2022-34526 Khem Raj
@ 2022-08-14 22:20 ` Khem Raj
8 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-14 22:20 UTC (permalink / raw)
To: openembedded-core; +Cc: Khem Raj
In this release a large number of deadlocks in the
in the multi-thread code were fix. A number of
memory leaks were plugged and a DoS was eliminated.
As well as a large number of bug fixes.
Release notes:
http://sourceforge.net/projects/libtirpc/files/libtirpc/1.3.3/Release-1.3.3.txt
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
.../libtirpc/libtirpc/CVE-2021-46828.patch | 565 ------------------
.../{libtirpc_1.3.2.bb => libtirpc_1.3.3.bb} | 6 +-
2 files changed, 2 insertions(+), 569 deletions(-)
delete mode 100644 meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
rename meta/recipes-extended/libtirpc/{libtirpc_1.3.2.bb => libtirpc_1.3.3.bb} (80%)
diff --git a/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch b/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
deleted file mode 100644
index 64dffb923b9..00000000000
--- a/meta/recipes-extended/libtirpc/libtirpc/CVE-2021-46828.patch
+++ /dev/null
@@ -1,565 +0,0 @@
-From 86529758570cef4c73fb9b9c4104fdc510f701ed Mon Sep 17 00:00:00 2001
-From: Dai Ngo <dai.ngo@oracle.com>
-Date: Sat, 21 Aug 2021 13:16:23 -0400
-Subject: [PATCH] Fix DoS vulnerability in libtirpc
-
-Currently svc_run does not handle poll timeout and rendezvous_request
-does not handle EMFILE error returned from accept(2 as it used to.
-These two missing functionality were removed by commit b2c9430f46c4.
-
-The effect of not handling poll timeout allows idle TCP conections
-to remain ESTABLISHED indefinitely. When the number of connections
-reaches the limit of the open file descriptors (ulimit -n) then
-accept(2) fails with EMFILE. Since there is no handling of EMFILE
-error this causes svc_run() to get in a tight loop calling accept(2).
-This resulting in the RPC service of svc_run is being down, it's
-no longer able to service any requests.
-
-RPC service rpcbind, statd and mountd are effected by this
-problem.
-
-Fix by enhancing rendezvous_request to keep the number of
-SVCXPRT conections to 4/5 of the size of the file descriptor
-table. When this thresold is reached, it destroys the idle
-TCP connections or destroys the least active connection if
-no idle connnction was found.
-
-Fixes: 44bf15b8 rpcbind: don't use obsolete svc_fdset interface of libtirpc
-
-CVE: CVE-2021-46828
-Upstream-Status: Backport [http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed]
-Signed-off-by: dai.ngo@oracle.com
-Signed-off-by: Steve Dickson <steved@redhat.com>
----
- INSTALL | 371 +----------------------------------------------------------
- src/svc.c | 17 ++-
- src/svc_vc.c | 62 +++++++++-
- 3 files changed, 78 insertions(+), 372 deletions(-)
- mode change 100644 => 120000 INSTALL
-
-diff --git a/INSTALL b/INSTALL
-deleted file mode 100644
-index 2099840..0000000
---- a/INSTALL
-+++ /dev/null
-@@ -1,370 +0,0 @@
--Installation Instructions
--*************************
--
--Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation,
--Inc.
--
-- Copying and distribution of this file, with or without modification,
--are permitted in any medium without royalty provided the copyright
--notice and this notice are preserved. This file is offered as-is,
--without warranty of any kind.
--
--Basic Installation
--==================
--
-- Briefly, the shell command `./configure && make && make install'
--should configure, build, and install this package. The following
--more-detailed instructions are generic; see the `README' file for
--instructions specific to this package. Some packages provide this
--`INSTALL' file but do not implement all of the features documented
--below. The lack of an optional feature in a given package is not
--necessarily a bug. More recommendations for GNU packages can be found
--in *note Makefile Conventions: (standards)Makefile Conventions.
--
-- The `configure' shell script attempts to guess correct values for
--various system-dependent variables used during compilation. It uses
--those values to create a `Makefile' in each directory of the package.
--It may also create one or more `.h' files containing system-dependent
--definitions. Finally, it creates a shell script `config.status' that
--you can run in the future to recreate the current configuration, and a
--file `config.log' containing compiler output (useful mainly for
--debugging `configure').
--
-- It can also use an optional file (typically called `config.cache'
--and enabled with `--cache-file=config.cache' or simply `-C') that saves
--the results of its tests to speed up reconfiguring. Caching is
--disabled by default to prevent problems with accidental use of stale
--cache files.
--
-- If you need to do unusual things to compile the package, please try
--to figure out how `configure' could check whether to do them, and mail
--diffs or instructions to the address given in the `README' so they can
--be considered for the next release. If you are using the cache, and at
--some point `config.cache' contains results you don't want to keep, you
--may remove or edit it.
--
-- The file `configure.ac' (or `configure.in') is used to create
--`configure' by a program called `autoconf'. You need `configure.ac' if
--you want to change it or regenerate `configure' using a newer version
--of `autoconf'.
--
-- The simplest way to compile this package is:
--
-- 1. `cd' to the directory containing the package's source code and type
-- `./configure' to configure the package for your system.
--
-- Running `configure' might take a while. While running, it prints
-- some messages telling which features it is checking for.
--
-- 2. Type `make' to compile the package.
--
-- 3. Optionally, type `make check' to run any self-tests that come with
-- the package, generally using the just-built uninstalled binaries.
--
-- 4. Type `make install' to install the programs and any data files and
-- documentation. When installing into a prefix owned by root, it is
-- recommended that the package be configured and built as a regular
-- user, and only the `make install' phase executed with root
-- privileges.
--
-- 5. Optionally, type `make installcheck' to repeat any self-tests, but
-- this time using the binaries in their final installed location.
-- This target does not install anything. Running this target as a
-- regular user, particularly if the prior `make install' required
-- root privileges, verifies that the installation completed
-- correctly.
--
-- 6. You can remove the program binaries and object files from the
-- source code directory by typing `make clean'. To also remove the
-- files that `configure' created (so you can compile the package for
-- a different kind of computer), type `make distclean'. There is
-- also a `make maintainer-clean' target, but that is intended mainly
-- for the package's developers. If you use it, you may have to get
-- all sorts of other programs in order to regenerate files that came
-- with the distribution.
--
-- 7. Often, you can also type `make uninstall' to remove the installed
-- files again. In practice, not all packages have tested that
-- uninstallation works correctly, even though it is required by the
-- GNU Coding Standards.
--
-- 8. Some packages, particularly those that use Automake, provide `make
-- distcheck', which can by used by developers to test that all other
-- targets like `make install' and `make uninstall' work correctly.
-- This target is generally not run by end users.
--
--Compilers and Options
--=====================
--
-- Some systems require unusual options for compilation or linking that
--the `configure' script does not know about. Run `./configure --help'
--for details on some of the pertinent environment variables.
--
-- You can give `configure' initial values for configuration parameters
--by setting variables in the command line or in the environment. Here
--is an example:
--
-- ./configure CC=c99 CFLAGS=-g LIBS=-lposix
--
-- *Note Defining Variables::, for more details.
--
--Compiling For Multiple Architectures
--====================================
--
-- You can compile the package for more than one kind of computer at the
--same time, by placing the object files for each architecture in their
--own directory. To do this, you can use GNU `make'. `cd' to the
--directory where you want the object files and executables to go and run
--the `configure' script. `configure' automatically checks for the
--source code in the directory that `configure' is in and in `..'. This
--is known as a "VPATH" build.
--
-- With a non-GNU `make', it is safer to compile the package for one
--architecture at a time in the source code directory. After you have
--installed the package for one architecture, use `make distclean' before
--reconfiguring for another architecture.
--
-- On MacOS X 10.5 and later systems, you can create libraries and
--executables that work on multiple system types--known as "fat" or
--"universal" binaries--by specifying multiple `-arch' options to the
--compiler but only a single `-arch' option to the preprocessor. Like
--this:
--
-- ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
-- CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
-- CPP="gcc -E" CXXCPP="g++ -E"
--
-- This is not guaranteed to produce working output in all cases, you
--may have to build one architecture at a time and combine the results
--using the `lipo' tool if you have problems.
--
--Installation Names
--==================
--
-- By default, `make install' installs the package's commands under
--`/usr/local/bin', include files under `/usr/local/include', etc. You
--can specify an installation prefix other than `/usr/local' by giving
--`configure' the option `--prefix=PREFIX', where PREFIX must be an
--absolute file name.
--
-- You can specify separate installation prefixes for
--architecture-specific files and architecture-independent files. If you
--pass the option `--exec-prefix=PREFIX' to `configure', the package uses
--PREFIX as the prefix for installing programs and libraries.
--Documentation and other data files still use the regular prefix.
--
-- In addition, if you use an unusual directory layout you can give
--options like `--bindir=DIR' to specify different values for particular
--kinds of files. Run `configure --help' for a list of the directories
--you can set and what kinds of files go in them. In general, the
--default for these options is expressed in terms of `${prefix}', so that
--specifying just `--prefix' will affect all of the other directory
--specifications that were not explicitly provided.
--
-- The most portable way to affect installation locations is to pass the
--correct locations to `configure'; however, many packages provide one or
--both of the following shortcuts of passing variable assignments to the
--`make install' command line to change installation locations without
--having to reconfigure or recompile.
--
-- The first method involves providing an override variable for each
--affected directory. For example, `make install
--prefix=/alternate/directory' will choose an alternate location for all
--directory configuration variables that were expressed in terms of
--`${prefix}'. Any directories that were specified during `configure',
--but not in terms of `${prefix}', must each be overridden at install
--time for the entire installation to be relocated. The approach of
--makefile variable overrides for each directory variable is required by
--the GNU Coding Standards, and ideally causes no recompilation.
--However, some platforms have known limitations with the semantics of
--shared libraries that end up requiring recompilation when using this
--method, particularly noticeable in packages that use GNU Libtool.
--
-- The second method involves providing the `DESTDIR' variable. For
--example, `make install DESTDIR=/alternate/directory' will prepend
--`/alternate/directory' before all installation names. The approach of
--`DESTDIR' overrides is not required by the GNU Coding Standards, and
--does not work on platforms that have drive letters. On the other hand,
--it does better at avoiding recompilation issues, and works well even
--when some directory options were not specified in terms of `${prefix}'
--at `configure' time.
--
--Optional Features
--=================
--
-- If the package supports it, you can cause programs to be installed
--with an extra prefix or suffix on their names by giving `configure' the
--option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
--
-- Some packages pay attention to `--enable-FEATURE' options to
--`configure', where FEATURE indicates an optional part of the package.
--They may also pay attention to `--with-PACKAGE' options, where PACKAGE
--is something like `gnu-as' or `x' (for the X Window System). The
--`README' should mention any `--enable-' and `--with-' options that the
--package recognizes.
--
-- For packages that use the X Window System, `configure' can usually
--find the X include and library files automatically, but if it doesn't,
--you can use the `configure' options `--x-includes=DIR' and
--`--x-libraries=DIR' to specify their locations.
--
-- Some packages offer the ability to configure how verbose the
--execution of `make' will be. For these packages, running `./configure
----enable-silent-rules' sets the default to minimal output, which can be
--overridden with `make V=1'; while running `./configure
----disable-silent-rules' sets the default to verbose, which can be
--overridden with `make V=0'.
--
--Particular systems
--==================
--
-- On HP-UX, the default C compiler is not ANSI C compatible. If GNU
--CC is not installed, it is recommended to use the following options in
--order to use an ANSI C compiler:
--
-- ./configure CC="cc -Ae -D_XOPEN_SOURCE=500"
--
--and if that doesn't work, install pre-built binaries of GCC for HP-UX.
--
-- HP-UX `make' updates targets which have the same time stamps as
--their prerequisites, which makes it generally unusable when shipped
--generated files such as `configure' are involved. Use GNU `make'
--instead.
--
-- On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
--parse its `<wchar.h>' header file. The option `-nodtk' can be used as
--a workaround. If GNU CC is not installed, it is therefore recommended
--to try
--
-- ./configure CC="cc"
--
--and if that doesn't work, try
--
-- ./configure CC="cc -nodtk"
--
-- On Solaris, don't put `/usr/ucb' early in your `PATH'. This
--directory contains several dysfunctional programs; working variants of
--these programs are available in `/usr/bin'. So, if you need `/usr/ucb'
--in your `PATH', put it _after_ `/usr/bin'.
--
-- On Haiku, software installed for all users goes in `/boot/common',
--not `/usr/local'. It is recommended to use the following options:
--
-- ./configure --prefix=/boot/common
--
--Specifying the System Type
--==========================
--
-- There may be some features `configure' cannot figure out
--automatically, but needs to determine by the type of machine the package
--will run on. Usually, assuming the package is built to be run on the
--_same_ architectures, `configure' can figure that out, but if it prints
--a message saying it cannot guess the machine type, give it the
--`--build=TYPE' option. TYPE can either be a short name for the system
--type, such as `sun4', or a canonical name which has the form:
--
-- CPU-COMPANY-SYSTEM
--
--where SYSTEM can have one of these forms:
--
-- OS
-- KERNEL-OS
--
-- See the file `config.sub' for the possible values of each field. If
--`config.sub' isn't included in this package, then this package doesn't
--need to know the machine type.
--
-- If you are _building_ compiler tools for cross-compiling, you should
--use the option `--target=TYPE' to select the type of system they will
--produce code for.
--
-- If you want to _use_ a cross compiler, that generates code for a
--platform different from the build platform, you should specify the
--"host" platform (i.e., that on which the generated programs will
--eventually be run) with `--host=TYPE'.
--
--Sharing Defaults
--================
--
-- If you want to set default values for `configure' scripts to share,
--you can create a site shell script called `config.site' that gives
--default values for variables like `CC', `cache_file', and `prefix'.
--`configure' looks for `PREFIX/share/config.site' if it exists, then
--`PREFIX/etc/config.site' if it exists. Or, you can set the
--`CONFIG_SITE' environment variable to the location of the site script.
--A warning: not all `configure' scripts look for a site script.
--
--Defining Variables
--==================
--
-- Variables not defined in a site shell script can be set in the
--environment passed to `configure'. However, some packages may run
--configure again during the build, and the customized values of these
--variables may be lost. In order to avoid this problem, you should set
--them in the `configure' command line, using `VAR=value'. For example:
--
-- ./configure CC=/usr/local2/bin/gcc
--
--causes the specified `gcc' to be used as the C compiler (unless it is
--overridden in the site shell script).
--
--Unfortunately, this technique does not work for `CONFIG_SHELL' due to
--an Autoconf limitation. Until the limitation is lifted, you can use
--this workaround:
--
-- CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash
--
--`configure' Invocation
--======================
--
-- `configure' recognizes the following options to control how it
--operates.
--
--`--help'
--`-h'
-- Print a summary of all of the options to `configure', and exit.
--
--`--help=short'
--`--help=recursive'
-- Print a summary of the options unique to this package's
-- `configure', and exit. The `short' variant lists options used
-- only in the top level, while the `recursive' variant lists options
-- also present in any nested packages.
--
--`--version'
--`-V'
-- Print the version of Autoconf used to generate the `configure'
-- script, and exit.
--
--`--cache-file=FILE'
-- Enable the cache: use and save the results of the tests in FILE,
-- traditionally `config.cache'. FILE defaults to `/dev/null' to
-- disable caching.
--
--`--config-cache'
--`-C'
-- Alias for `--cache-file=config.cache'.
--
--`--quiet'
--`--silent'
--`-q'
-- Do not print messages saying which checks are being made. To
-- suppress all normal output, redirect it to `/dev/null' (any error
-- messages will still be shown).
--
--`--srcdir=DIR'
-- Look for the package's source code in directory DIR. Usually
-- `configure' can determine that directory automatically.
--
--`--prefix=DIR'
-- Use DIR as the installation prefix. *note Installation Names::
-- for more details, including other options available for fine-tuning
-- the installation locations.
--
--`--no-create'
--`-n'
-- Run the configure checks, but stop before creating any output
-- files.
--
--`configure' also accepts some other, not widely useful, options. Run
--`configure --help' for more details.
-diff --git a/INSTALL b/INSTALL
-new file mode 120000
-index 0000000..e3f22c0
---- /dev/null
-+++ b/INSTALL
-@@ -0,0 +1 @@
-+/usr/share/automake-1.16/INSTALL
-\ No newline at end of file
-diff --git a/src/svc.c b/src/svc.c
-index 6db164b..3a8709f 100644
---- a/src/svc.c
-+++ b/src/svc.c
-@@ -57,7 +57,7 @@
-
- #define max(a, b) (a > b ? a : b)
-
--static SVCXPRT **__svc_xports;
-+SVCXPRT **__svc_xports;
- int __svc_maxrec;
-
- /*
-@@ -194,6 +194,21 @@ __xprt_do_unregister (xprt, dolock)
- rwlock_unlock (&svc_fd_lock);
- }
-
-+int
-+svc_open_fds()
-+{
-+ int ix;
-+ int nfds = 0;
-+
-+ rwlock_rdlock (&svc_fd_lock);
-+ for (ix = 0; ix < svc_max_pollfd; ++ix) {
-+ if (svc_pollfd[ix].fd != -1)
-+ nfds++;
-+ }
-+ rwlock_unlock (&svc_fd_lock);
-+ return (nfds);
-+}
-+
- /*
- * Add a service program to the callout list.
- * The dispatch routine will be called when a rpc request for this
-diff --git a/src/svc_vc.c b/src/svc_vc.c
-index f1d9f00..3dc8a75 100644
---- a/src/svc_vc.c
-+++ b/src/svc_vc.c
-@@ -64,6 +64,8 @@
-
-
- extern rwlock_t svc_fd_lock;
-+extern SVCXPRT **__svc_xports;
-+extern int svc_open_fds();
-
- static SVCXPRT *makefd_xprt(int, u_int, u_int);
- static bool_t rendezvous_request(SVCXPRT *, struct rpc_msg *);
-@@ -82,6 +84,7 @@ static void svc_vc_ops(SVCXPRT *);
- static bool_t svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in);
- static bool_t svc_vc_rendezvous_control (SVCXPRT *xprt, const u_int rq,
- void *in);
-+static int __svc_destroy_idle(int timeout);
-
- struct cf_rendezvous { /* kept in xprt->xp_p1 for rendezvouser */
- u_int sendsize;
-@@ -313,13 +316,14 @@ done:
- return (xprt);
- }
-
-+
- /*ARGSUSED*/
- static bool_t
- rendezvous_request(xprt, msg)
- SVCXPRT *xprt;
- struct rpc_msg *msg;
- {
-- int sock, flags;
-+ int sock, flags, nfds, cnt;
- struct cf_rendezvous *r;
- struct cf_conn *cd;
- struct sockaddr_storage addr;
-@@ -379,6 +383,16 @@ again:
-
- gettimeofday(&cd->last_recv_time, NULL);
-
-+ nfds = svc_open_fds();
-+ if (nfds >= (_rpc_dtablesize() / 5) * 4) {
-+ /* destroy idle connections */
-+ cnt = __svc_destroy_idle(15);
-+ if (cnt == 0) {
-+ /* destroy least active */
-+ __svc_destroy_idle(0);
-+ }
-+ }
-+
- return (FALSE); /* there is never an rpc msg to be processed */
- }
-
-@@ -820,3 +834,49 @@ __svc_clean_idle(fd_set *fds, int timeout, bool_t cleanblock)
- {
- return FALSE;
- }
-+
-+static int
-+__svc_destroy_idle(int timeout)
-+{
-+ int i, ncleaned = 0;
-+ SVCXPRT *xprt, *least_active;
-+ struct timeval tv, tdiff, tmax;
-+ struct cf_conn *cd;
-+
-+ gettimeofday(&tv, NULL);
-+ tmax.tv_sec = tmax.tv_usec = 0;
-+ least_active = NULL;
-+ rwlock_wrlock(&svc_fd_lock);
-+
-+ for (i = 0; i <= svc_max_pollfd; i++) {
-+ if (svc_pollfd[i].fd == -1)
-+ continue;
-+ xprt = __svc_xports[i];
-+ if (xprt == NULL || xprt->xp_ops == NULL ||
-+ xprt->xp_ops->xp_recv != svc_vc_recv)
-+ continue;
-+ cd = (struct cf_conn *)xprt->xp_p1;
-+ if (!cd->nonblock)
-+ continue;
-+ if (timeout == 0) {
-+ timersub(&tv, &cd->last_recv_time, &tdiff);
-+ if (timercmp(&tdiff, &tmax, >)) {
-+ tmax = tdiff;
-+ least_active = xprt;
-+ }
-+ continue;
-+ }
-+ if (tv.tv_sec - cd->last_recv_time.tv_sec > timeout) {
-+ __xprt_unregister_unlocked(xprt);
-+ __svc_vc_dodestroy(xprt);
-+ ncleaned++;
-+ }
-+ }
-+ if (timeout == 0 && least_active != NULL) {
-+ __xprt_unregister_unlocked(least_active);
-+ __svc_vc_dodestroy(least_active);
-+ ncleaned++;
-+ }
-+ rwlock_unlock(&svc_fd_lock);
-+ return (ncleaned);
-+}
---
-1.8.3.1
-
diff --git a/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb b/meta/recipes-extended/libtirpc/libtirpc_1.3.3.bb
similarity index 80%
rename from meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb
rename to meta/recipes-extended/libtirpc/libtirpc_1.3.3.bb
index cc87638c0f7..bd13f6e95e9 100644
--- a/meta/recipes-extended/libtirpc/libtirpc_1.3.2.bb
+++ b/meta/recipes-extended/libtirpc/libtirpc_1.3.3.bb
@@ -9,12 +9,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=f835cce8852481e4b2bbbdd23b5e47f3 \
PROVIDES = "virtual/librpc"
-SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BP}.tar.bz2 \
- file://CVE-2021-46828.patch \
- "
+SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BP}.tar.bz2"
UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/libtirpc/files/libtirpc/"
UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)/"
-SRC_URI[sha256sum] = "e24eb88b8ce7db3b7ca6eb80115dd1284abc5ec32a8deccfed2224fc2532b9fd"
+SRC_URI[sha256sum] = "6474e98851d9f6f33871957ddee9714fdcd9d8a5ee9abb5a98d63ea2e60e12f3"
inherit autotools pkgconfig
--
2.37.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [OE-core] [PATCH 03/10] zlib: Resolve CVE-2022-37434
2022-08-14 22:20 ` [PATCH 03/10] zlib: Resolve CVE-2022-37434 Khem Raj
@ 2022-08-15 2:32 ` Paul Eggleton
2022-08-15 2:40 ` Khem Raj
0 siblings, 1 reply; 13+ messages in thread
From: Paul Eggleton @ 2022-08-15 2:32 UTC (permalink / raw)
To: Khem Raj; +Cc: openembedded-core
On Monday, 15 August 2022 10:20:30 NZST Khem Raj wrote:
> This is only seen in development branch as per [1]
>
> [1]
> https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166be
> ce1#commitcomment-80753451 CVE: CVE-2022-37434
It's a little confusing, but I think that CVE-2022-37434 does affect existing
zlib releases - at least the patch does apply. My reading was that the
upstream comment was referring to the *fix* (and thus the additional segfault
issue that it introduced) was not yet in any zlib release. A look around
suggests Ubuntu is treating CVE-2022-37434 as needing to be fixed at least.
Cheers
Paul
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [OE-core] [PATCH 03/10] zlib: Resolve CVE-2022-37434
2022-08-15 2:32 ` [OE-core] " Paul Eggleton
@ 2022-08-15 2:40 ` Khem Raj
0 siblings, 0 replies; 13+ messages in thread
From: Khem Raj @ 2022-08-15 2:40 UTC (permalink / raw)
To: Paul Eggleton; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 896 bytes --]
On Sun, Aug 14, 2022 at 7:32 PM Paul Eggleton <
bluelightning@bluelightning.org> wrote:
> On Monday, 15 August 2022 10:20:30 NZST Khem Raj wrote:
> > This is only seen in development branch as per [1]
> >
> > [1]
> >
> https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166be
> > ce1#commitcomment-80753451 CVE: CVE-2022-37434
>
> It's a little confusing, but I think that CVE-2022-37434 does affect
> existing
> zlib releases - at least the patch does apply. My reading was that the
> upstream comment was referring to the *fix* (and thus the additional
> segfault
> issue that it introduced) was not yet in any zlib release. A look around
> suggests Ubuntu is treating CVE-2022-37434 as needing to be fixed at least.
Yeah I think I missed the second last and last comments which clears it
So we still need those two fixes to address the CVE
>
> Cheers
> Paul
>
>
>
>
>
[-- Attachment #2: Type: text/html, Size: 1621 bytes --]
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [OE-core] [PATCH 02/10] xmlto: Update to use upstream tip of trunk
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
@ 2022-08-15 6:54 ` Alexander Kanavin
0 siblings, 0 replies; 13+ messages in thread
From: Alexander Kanavin @ 2022-08-15 6:54 UTC (permalink / raw)
To: Khem Raj; +Cc: OE-core
On Mon, 15 Aug 2022 at 00:20, Khem Raj <raj.khem@gmail.com> wrote:
> +Avoids network access
> +
> +Upstream-Status: Pending
> +Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please submit this upstream, there's no reason to make this pending.
> -SRC_URI = "https://releases.pagure.org/xmlto/xmlto-${PV}.tar.gz \
> +SRCREV = "6fa6a0e07644f20abf2596f78a60112713e11cbe"
> +
> +SRC_URI = "git://pagure.io/xmlto.git;protocol=https;branch=master \
> file://configure.in-drop-the-test-of-xmllint-and-xsltproc.patch \
> + file://0001-Skip-validating-xmlto-output.patch \
> "
> -SRC_URI[md5sum] = "a1fefad9d83499a15576768f60f847c6"
> -SRC_URI[sha256sum] = "2f986b7c9a0e9ac6728147668e776d405465284e13c74d4146c9cbc51fd8aad3"
> +S = "${WORKDIR}/git"
> +
> +PV .= "+0.0.29+git${SRCPV}"
Does the upstream version check still work with these changes? We
might want to switch to checking new commits rather than new tags.
Alex
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2022-08-15 6:54 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
2022-08-15 6:54 ` [OE-core] " Alexander Kanavin
2022-08-14 22:20 ` [PATCH 03/10] zlib: Resolve CVE-2022-37434 Khem Raj
2022-08-15 2:32 ` [OE-core] " Paul Eggleton
2022-08-15 2:40 ` Khem Raj
2022-08-14 22:20 ` [PATCH 04/10] rsync: Backport fix to address CVE-2022-29154 Khem Raj
2022-08-14 22:20 ` [PATCH 05/10] rsync: Upgrade to 3.2.5 Khem Raj
2022-08-14 22:20 ` [PATCH 06/10] connman: Backports for security fixes Khem Raj
2022-08-14 22:20 ` [PATCH 07/10] libtirpc: Backport fix for CVE-2021-46828 Khem Raj
2022-08-14 22:20 ` [PATCH 08/10] libxml2: Ignore CVE-2016-3709 Khem Raj
2022-08-14 22:20 ` [PATCH 09/10] tiff: Backport a patch for CVE-2022-34526 Khem Raj
2022-08-14 22:20 ` [PATCH 10/10] libtirpc: Upgrade to 1.3.3 Khem Raj
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.