* [langdale 01/15] nss: fix cross-compilation error
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 02/15] python3-pillow: upgrade 9.2.0 -> 9.3.0 Armin Kuster
` (13 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Change OS_TEST to be soft assignment so that the cross-compilation
doens't fail with the errors like (note the difference in CPU tags):
| make[4]: *** No rule to make target
'../certhigh/Linux3.4_x86_64_glibc_PTH_64_OPT.OBJ/certhtml.o', needed by
'Linux3.4_aarch64_glibc_PTH_64_OPT.OBJ/libnss3.so'. Stop.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../nss/nss/0001-nss-fix-support-cross-compiling.patch | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch b/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
index eb6174a7b0..950fae667a 100644
--- a/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
+++ b/meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch
@@ -18,7 +18,12 @@ diff --git a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
index 2012d18..78fca62 100644
--- a/nss/coreconf/arch.mk
+++ b/nss/coreconf/arch.mk
-@@ -30,7 +30,7 @@ OS_TEST := $(shell uname -m)
+@@ -26,11 +26,11 @@ OS_ARCH := $(subst /,_,$(shell uname -s)
+ # Attempt to differentiate between sparc and x86 Solaris
+ #
+
+-OS_TEST := $(shell uname -m)
++OS_TEST ?= $(shell uname -m)
ifeq ($(OS_TEST),i86pc)
OS_RELEASE := $(shell uname -r)_$(OS_TEST)
else
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 02/15] python3-pillow: upgrade 9.2.0 -> 9.3.0
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
2023-02-16 12:27 ` [langdale 01/15] nss: fix cross-compilation error Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 03/15] python3-pillow: upgrade 9.3.0 -> 9.4.0 Armin Kuster
` (12 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Wang Mingyu <wangmy@fujitsu.com>
Changelog:
=========
Limit SAMPLESPERPIXEL to avoid runtime DOS #6700 [wiredfool]
Initialize libtiff buffer when saving #6699 [radarhere]
Inline fname2char to fix memory leak #6329 [nulano]
Fix memory leaks related to text features #6330 [nulano]
Use double quotes for version check on old CPython on Windows #6695 [hugovk]
Remove backup implementation of Round for Windows platforms #6693 [cgohlke]
Fixed set_variation_by_name offset #6445 [radarhere]
Fix malloc in _imagingft.c:font_setvaraxes #6690 [cgohlke]
Release Python GIL when converting images using matrix operations #6418 [hmaarrfk]
Added ExifTags enums #6630 [radarhere]
Do not modify previous frame when calculating delta in PNG #6683 [radarhere]
Added support for reading BMP images with RLE4 compression #6674 [npjg, radarhere]
Decode JPEG compressed BLP1 data in original mode #6678 [radarhere]
Added GPS TIFF tag info #6661 [radarhere]
Added conversion between RGB/RGBA/RGBX and LAB #6647 [radarhere]
Do not attempt normalization if mode is already normal #6644 [radarhere]
Fixed seeking to an L frame in a GIF #6576 [radarhere]
Consider all frames when selecting mode for PNG save_all #6610 [radarhere]
Don't reassign crc on ChunkStream close #6627 [wiredfool, radarhere]
Raise a warning if NumPy failed to raise an error during conversion #6594 [radarhere]
Show all frames in ImageShow #6611 [radarhere]
Allow FLI palette chunk to not be first #6626 [radarhere]
If first GIF frame has transparency for RGB_ALWAYS loading strategy, use RGBA mode #6592 [radarhere]
Round box position to integer when pasting embedded color #6517 [radarhere, nulano]
Removed EXIF prefix when saving WebP #6582 [radarhere]
Pad IM palette to 768 bytes when saving #6579 [radarhere]
Added DDS BC6H reading #6449 [ShadelessFox, REDxEYE, radarhere]
Added support for opening WhiteIsZero 16-bit integer TIFF images #6642 [JayWiz, radarhere]
Raise an error when allocating translucent color to RGB palette #6654 [jsbueno, radarhere]
Added reading of TIFF child images #6569 [radarhere]
Improved ImageOps palette handling #6596 [PososikTeam, radarhere]
Defer parsing of palette into colors #6567 [radarhere]
Apply transparency to P images in ImageTk.PhotoImage #6559 [radarhere]
Use rounding in ImageOps contain() and pad() #6522 [bibinhashley, radarhere]
Fixed GIF remapping to palette with duplicate entries #6548 [radarhere]
Allow remap_palette() to return an image with less than 256 palette entries #6543 [radarhere]
Corrected BMP and TGA palette size when saving #6500 [radarhere]
Do not call load() before draft() in Image.thumbnail #6539 [radarhere]
Copy palette when converting from P to PA #6497 [radarhere]
Allow RGB and RGBA values for PA image putpixel #6504 [radarhere]
Removed support for tkinter in PyPy before Python 3.6 #6551 [nulano]
Do not use CCITTFaxDecode filter if libtiff is not available #6518 [radarhere]
Fallback to not using mmap if buffer is not large enough #6510 [radarhere]
Fixed writing bytes as ASCII tag #6493 [radarhere]
Open 1 bit EPS in mode 1 #6499 [radarhere]
Removed support for tkinter before Python 1.5.2 #6549 [radarhere]
Allow default ImageDraw font to be set #6484 [radarhere, hugovk]
Save 1 mode PDF using CCITTFaxDecode filter #6470 [radarhere]
Added support for RGBA PSD images #6481 [radarhere]
Parse orientation from XMP tag contents #6463 [bigcat88, radarhere]
Added support for reading ATI1/ATI2 (BC4/BC5) DDS images #6457 [REDxEYE, radarhere]
Do not clear GIF tile when checking number of frames #6455 [radarhere]
Support saving multiple MPO frames #6444 [radarhere]
Do not double quote Pillow version for setuptools >= 60 #6450 [radarhere]
Added ABGR BMP mask mode #6436 [radarhere]
Fixed PSDraw rectangle #6429 [radarhere]
Raise ValueError if PNG sRGB chunk is truncated #6431 [radarhere]
Handle missing Python executable in ImageShow on macOS #6416 [bryant1410, radarhere]
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4e075c7dc81c4d2824094f9d3523cf16719be9a7)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../{python3-pillow_9.2.0.bb => python3-pillow_9.3.0.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta-python/recipes-devtools/python/{python3-pillow_9.2.0.bb => python3-pillow_9.3.0.bb} (86%)
diff --git a/meta-python/recipes-devtools/python/python3-pillow_9.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb
similarity index 86%
rename from meta-python/recipes-devtools/python/python3-pillow_9.2.0.bb
rename to meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb
index 454d61a48e..11f5451609 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_9.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb
@@ -5,7 +5,7 @@ HOMEPAGE = "https://pillow.readthedocs.io"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=ad081a0aede51e89f8da13333a8fb849"
-SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=9.2.x;protocol=https \
+SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https \
file://0001-support-cross-compiling.patch \
file://0001-explicitly-set-compile-options.patch \
"
@@ -39,4 +39,4 @@ RPROVIDES:${PN} += "python3-imaging"
BBCLASSEXTEND = "native"
-SRCREV = "58acec3312fb8671c9d84829197e1c8150085589"
+SRCREV = "d594f4cb8dc47fb0c69ae58d9fff86faae4515bd"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 03/15] python3-pillow: upgrade 9.3.0 -> 9.4.0
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
2023-02-16 12:27 ` [langdale 01/15] nss: fix cross-compilation error Armin Kuster
2023-02-16 12:27 ` [langdale 02/15] python3-pillow: upgrade 9.2.0 -> 9.3.0 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 04/15] python3-pillow: add ptest support Armin Kuster
` (11 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Wang Mingyu <wangmy@fujitsu.com>
License-Updated: copyright year updated to 2023
Changelog:
==========
Fixed null pointer dereference crash with malformed font #6846
Return from ImagingFill early if image has a zero dimension #6842
Reversed deprecations for Image constants, except for duplicate Resampling attributes #6830
Improve exception traceback readability #6836
Do not attempt to read IFD1 if absent #6840
Fixed writing int as ASCII tag #6800
If available, use wl-paste or xclip for grabclipboard() on Linux #6783
Added signed option when saving JPEG2000 images #6709
Patch OpenJPEG to include ARM64 fix #6718
Added support for I;16 modes in putdata() #6825
Added conversion from RGBa to RGB #6708
Added DDS support for uncompressed L and LA images #6820
Added LightSource tag values to ExifTags #6749
Fixed PyAccess after changing ICO size #6821
Do not use EXIF from info when saving PNG images #6819
Fixed saving EXIF data to MPO #6817
Added Exif hide_offsets() #6762
Only compare to previous frame when checking for duplicate GIF frames while saving #6787
Always initialize all plugins in registered_extensions() #6811
Ignore non-opaque WebP background when saving as GIF #6792
Only set tile in ImageFile __setstate__ #6793
When reading BLP, do not trust JPEG decoder to determine image is CMYK #6767
Added IFD enum to ExifTags #6748
Fixed bug combining GIF frame durations #6779
Support saving JPEG comments #6774
Added getxmp() to WebPImagePlugin #6758
Added "exact" option when saving WebP #6747
Use fractional coordinates when drawing text #6722
Fixed writing int as BYTE tag #6740
Added MP Format Version when saving MPO #6735
Added Interop to ExifTags #6724
CVE-2007-4559 patch when building on Windows #6704
Fix compiler warning: accessing 64 bytes in a region of size 48 #6714
Use verbose flag for pip install #6713
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b73867b9d77e8050c20dc28ec449572f2185cb2a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../{python3-pillow_9.3.0.bb => python3-pillow_9.4.0.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta-python/recipes-devtools/python/{python3-pillow_9.3.0.bb => python3-pillow_9.4.0.bb} (87%)
diff --git a/meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
similarity index 87%
rename from meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb
rename to meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
index 11f5451609..403a987d1e 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_9.3.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
@@ -3,7 +3,7 @@ Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and \
Contributors."
HOMEPAGE = "https://pillow.readthedocs.io"
LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=ad081a0aede51e89f8da13333a8fb849"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=bc416d18f294943285560364be7cbec1"
SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https \
file://0001-support-cross-compiling.patch \
@@ -39,4 +39,4 @@ RPROVIDES:${PN} += "python3-imaging"
BBCLASSEXTEND = "native"
-SRCREV = "d594f4cb8dc47fb0c69ae58d9fff86faae4515bd"
+SRCREV = "a5bbab1c1e63b439de191ef2040173713b26d2da"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 04/15] python3-pillow: add ptest support
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (2 preceding siblings ...)
2023-02-16 12:27 ` [langdale 03/15] python3-pillow: upgrade 9.3.0 -> 9.4.0 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 05/15] python3-pillow: Add distutils, unixadmin for ptest Armin Kuster
` (10 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Randy MacLeod <Randy.MacLeod@windriver.com>
Add initial pillow ptest support.
The ptest result is:
====== 3600 passed 324 skipped, 2 xfailed, 1 xpassed in 62.41s (0:01:02) ======
for qemux86-64 with 2 GB RAM.
The skipped tests as summarized with:
# ptest-runner python3-pillow | tee log
# grep SKIPP log | cut -d"(" -f2- | cut -d")" -f1 | cut -d" " -f1 | sort | uniq -c| sort -n | tail -4
12 webp
13 Tk
14 Qt
84 raqm
Webp was explicityly disabled in 2018 in:
6cb4e90fc python3-pillow: add 5.4.1
I didn't test Tk or Qt and there isn't yet a recipe for libraqm:
https://github.com/HOST-Oman/libraqm
a library that encapsulates the logic for complex text layout.
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7b0e71e00ce1b003c96ef38ead72a9e02555afbe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../python/python3-pillow/run-ptest | 3 +++
.../python/python3-pillow_9.4.0.bb | 22 ++++++++++++++++++-
2 files changed, 24 insertions(+), 1 deletion(-)
create mode 100644 meta-python/recipes-devtools/python/python3-pillow/run-ptest
diff --git a/meta-python/recipes-devtools/python/python3-pillow/run-ptest b/meta-python/recipes-devtools/python/python3-pillow/run-ptest
new file mode 100644
index 0000000000..3385d68939
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/run-ptest
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+pytest -o log_cli=true -o log_cli_level=INFO | sed -e 's/\[...%\]//g'| sed -e 's/PASSED/PASS/g'| sed -e 's/FAILED/FAIL/g'|sed -e 's/SKIPED/SKIP/g'| awk '{if ($NF=="PASS" || $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || $NF=="XPASS"){printf "%s: %s\n", $NF, $0}else{print}}'| awk '{if ($NF=="PASS" || $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || $NF=="XPASS") {$NF="";print $0}else{print}}'
diff --git a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
index 403a987d1e..68c81029c0 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
@@ -8,10 +8,11 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=bc416d18f294943285560364be7cbec1"
SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https \
file://0001-support-cross-compiling.patch \
file://0001-explicitly-set-compile-options.patch \
+ file://run-ptest \
"
SRCREV ?= "82541b6dec8452cb612067fcebba1c5a1a2bfdc8"
-inherit setuptools3
+inherit setuptools3 ptest
PIP_INSTALL_PACKAGE = "Pillow"
PIP_INSTALL_DIST_PATH = "${S}/dist"
@@ -31,12 +32,31 @@ RDEPENDS:${PN} += " \
${PYTHON_PN}-numbers \
"
+RDEPENDS:${PN}-ptest += " \
+ bash \
+ ghostscript \
+ jpeg-tools \
+ libwebp \
+ ${PYTHON_PN}-core \
+ ${PYTHON_PN}-image \
+ ${PYTHON_PN}-mmap \
+ ${PYTHON_PN}-pytest \
+ ${PYTHON_PN}-pytest-timeout \
+ ${PYTHON_PN}-resource \
+ tk \
+"
+
CVE_PRODUCT = "pillow"
S = "${WORKDIR}/git"
RPROVIDES:${PN} += "python3-imaging"
+do_install_ptest() {
+ install -d ${D}${PTEST_PATH}/Tests
+ cp -rf ${S}/Tests ${D}${PTEST_PATH}/
+}
+
BBCLASSEXTEND = "native"
SRCREV = "a5bbab1c1e63b439de191ef2040173713b26d2da"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 05/15] python3-pillow: Add distutils, unixadmin for ptest
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (3 preceding siblings ...)
2023-02-16 12:27 ` [langdale 04/15] python3-pillow: add ptest support Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 06/15] freeradius: Security fixes for CVE-2022-41860 CVE-2022-41861 Armin Kuster
` (9 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Randy MacLeod <randy.macleod@windriver.com>
ptest results:
====== 3600 passed, 324 skipped, 2 xfailed, 1 xpassed in 74.41s (0:01:14) ======
for qemux86-64 with 2 GB RAM which is the same as seen on master.
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
index 68c81029c0..5a466778c0 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb
@@ -38,11 +38,13 @@ RDEPENDS:${PN}-ptest += " \
jpeg-tools \
libwebp \
${PYTHON_PN}-core \
+ ${PYTHON_PN}-distutils \
${PYTHON_PN}-image \
${PYTHON_PN}-mmap \
${PYTHON_PN}-pytest \
${PYTHON_PN}-pytest-timeout \
${PYTHON_PN}-resource \
+ ${PYTHON_PN}-unixadmin\
tk \
"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 06/15] freeradius: Security fixes for CVE-2022-41860 CVE-2022-41861
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (4 preceding siblings ...)
2023-02-16 12:27 ` [langdale 05/15] python3-pillow: Add distutils, unixadmin for ptest Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 07/15] apache2: upgrade 2.4.54 -> 2.4.55 Armin Kuster
` (8 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Yi Zhao <yi.zhao@eng.windriver.com>
CVE-2022-41860:
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option,
the server will try to look that option up in the internal dictionaries.
This lookup will fail, but the SIM code will not check for that failure.
Instead, it will dereference a NULL pointer, and cause the server to
crash.
CVE-2022-41861:
A flaw was found in freeradius. A malicious RADIUS client or home server
can send a malformed abinary attribute which can cause the server to
crash.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-41860
https://nvd.nist.gov/vuln/detail/CVE-2022-41861
Patches from:
CVE-2022-41860:
https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a32e107d4d02f936051c708
CVE-2022-41861:
https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e08e4c3464f6b95005821dc559c62
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../freeradius/files/CVE-2022-41860.patch | 118 ++++++++++++++++++
.../freeradius/files/CVE-2022-41861.patch | 53 ++++++++
.../freeradius/freeradius_3.0.21.bb | 2 +
3 files changed, 173 insertions(+)
create mode 100644 meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41860.patch
create mode 100644 meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41861.patch
diff --git a/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41860.patch b/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41860.patch
new file mode 100644
index 0000000000..4ea519c752
--- /dev/null
+++ b/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41860.patch
@@ -0,0 +1,118 @@
+From f1cdbb33ec61c4a64a32e107d4d02f936051c708 Mon Sep 17 00:00:00 2001
+From: "Alan T. DeKok" <aland@freeradius.org>
+Date: Mon, 7 Feb 2022 22:26:05 -0500
+Subject: [PATCH] it's probably wrong to be completely retarded. Let's fix
+ that.
+
+CVE: CVE-2022-41860
+
+Upstream-Status: Backport
+[https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a32e107d4d02f936051c708]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/modules/rlm_eap/libeap/eapsimlib.c | 69 +++++++++++++++++++-------
+ 1 file changed, 52 insertions(+), 17 deletions(-)
+
+diff --git a/src/modules/rlm_eap/libeap/eapsimlib.c b/src/modules/rlm_eap/libeap/eapsimlib.c
+index cf1e8a7dd9..e438a844ea 100644
+--- a/src/modules/rlm_eap/libeap/eapsimlib.c
++++ b/src/modules/rlm_eap/libeap/eapsimlib.c
+@@ -307,42 +307,77 @@ int unmap_eapsim_basictypes(RADIUS_PACKET *r,
+ newvp->vp_length = 1;
+ fr_pair_add(&(r->vps), newvp);
+
++ /*
++ * EAP-SIM has a 1 octet of subtype, and 2 octets
++ * reserved.
++ */
+ attr += 3;
+ attrlen -= 3;
+
+- /* now, loop processing each attribute that we find */
+- while(attrlen > 0) {
++ /*
++ * Loop over each attribute. The format is:
++ *
++ * 1 octet of type
++ * 1 octet of length (value 1..255)
++ * ((4 * length) - 2) octets of data.
++ */
++ while (attrlen > 0) {
+ uint8_t *p;
+
+- if(attrlen < 2) {
++ if (attrlen < 2) {
+ fr_strerror_printf("EAP-Sim attribute %d too short: %d < 2", es_attribute_count, attrlen);
+ return 0;
+ }
+
++ if (!attr[1]) {
++ fr_strerror_printf("EAP-Sim attribute %d (no.%d) has no data", eapsim_attribute,
++ es_attribute_count);
++ return 0;
++ }
++
+ eapsim_attribute = attr[0];
+ eapsim_len = attr[1] * 4;
+
++ /*
++ * The length includes the 2-byte header.
++ */
+ if (eapsim_len > attrlen) {
+ fr_strerror_printf("EAP-Sim attribute %d (no.%d) has length longer than data (%d > %d)",
+ eapsim_attribute, es_attribute_count, eapsim_len, attrlen);
+ return 0;
+ }
+
+- if(eapsim_len > MAX_STRING_LEN) {
+- eapsim_len = MAX_STRING_LEN;
+- }
+- if (eapsim_len < 2) {
+- fr_strerror_printf("EAP-Sim attribute %d (no.%d) has length too small", eapsim_attribute,
+- es_attribute_count);
+- return 0;
+- }
++ newvp = fr_pair_afrom_num(r, eapsim_attribute + PW_EAP_SIM_BASE, 0);
++ if (!newvp) {
++ /*
++ * RFC 4186 Section 8.1 says 0..127 are
++ * "non-skippable". If one such
++ * attribute is found and we don't
++ * understand it, the server has to send:
++ *
++ * EAP-Request/SIM/Notification packet with an
++ * (AT_NOTIFICATION code, which implies general failure ("General
++ * failure after authentication" (0), or "General failure" (16384),
++ * depending on the phase of the exchange), which terminates the
++ * authentication exchange.
++ */
++ if (eapsim_attribute <= 127) {
++ fr_strerror_printf("Unknown mandatory attribute %d, failing",
++ eapsim_attribute);
++ return 0;
++ }
+
+- newvp = fr_pair_afrom_num(r, eapsim_attribute+PW_EAP_SIM_BASE, 0);
+- newvp->vp_length = eapsim_len-2;
+- newvp->vp_octets = p = talloc_array(newvp, uint8_t, newvp->vp_length);
+- memcpy(p, &attr[2], eapsim_len-2);
+- fr_pair_add(&(r->vps), newvp);
+- newvp = NULL;
++ } else {
++ /*
++ * It's known, ccount for header, and
++ * copy the value over.
++ */
++ newvp->vp_length = eapsim_len - 2;
++
++ newvp->vp_octets = p = talloc_array(newvp, uint8_t, newvp->vp_length);
++ memcpy(p, &attr[2], newvp->vp_length);
++ fr_pair_add(&(r->vps), newvp);
++ }
+
+ /* advance pointers, decrement length */
+ attr += eapsim_len;
+--
+2.25.1
+
diff --git a/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41861.patch b/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41861.patch
new file mode 100644
index 0000000000..352c02137a
--- /dev/null
+++ b/meta-networking/recipes-connectivity/freeradius/files/CVE-2022-41861.patch
@@ -0,0 +1,53 @@
+From 0ec2b39d260e08e4c3464f6b95005821dc559c62 Mon Sep 17 00:00:00 2001
+From: "Alan T. DeKok" <aland@freeradius.org>
+Date: Mon, 28 Feb 2022 10:34:15 -0500
+Subject: [PATCH] manual port of commit 5906bfa1
+
+CVE: CVE-2022-41861
+
+Upstream-Status: Backport
+[https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e08e4c3464f6b95005821dc559c62]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/lib/filters.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/filters.c b/src/lib/filters.c
+index 4868cd385d..3f3b63daee 100644
+--- a/src/lib/filters.c
++++ b/src/lib/filters.c
+@@ -1205,13 +1205,19 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in
+ }
+ }
+ } else if (filter->type == RAD_FILTER_GENERIC) {
+- int count;
++ size_t count, masklen;
++
++ masklen = ntohs(filter->u.generic.len);
++ if (masklen >= sizeof(filter->u.generic.mask)) {
++ *p = '\0';
++ return;
++ }
+
+ i = snprintf(p, outlen, " %u ", (unsigned int) ntohs(filter->u.generic.offset));
+ p += i;
+
+ /* show the mask */
+- for (count = 0; count < ntohs(filter->u.generic.len); count++) {
++ for (count = 0; count < masklen; count++) {
+ i = snprintf(p, outlen, "%02x", filter->u.generic.mask[count]);
+ p += i;
+ outlen -= i;
+@@ -1222,7 +1228,7 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in
+ outlen--;
+
+ /* show the value */
+- for (count = 0; count < ntohs(filter->u.generic.len); count++) {
++ for (count = 0; count < masklen; count++) {
+ i = snprintf(p, outlen, "%02x", filter->u.generic.value[count]);
+ p += i;
+ outlen -= i;
+--
+2.25.1
+
diff --git a/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.21.bb b/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.21.bb
index b459412e04..d18c387798 100644
--- a/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.21.bb
+++ b/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.21.bb
@@ -33,6 +33,8 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.0.x;lfs=0
file://radiusd-volatiles.conf \
file://check-openssl-cmds-in-script-bootstrap.patch \
file://0001-version.c-don-t-print-build-flags.patch \
+ file://CVE-2022-41860.patch \
+ file://CVE-2022-41861.patch \
"
raddbdir="${sysconfdir}/${MLPREFIX}raddb"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 07/15] apache2: upgrade 2.4.54 -> 2.4.55
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (5 preceding siblings ...)
2023-02-16 12:27 ` [langdale 06/15] freeradius: Security fixes for CVE-2022-41860 CVE-2022-41861 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 08/15] python3-django: upgrade 4.1 -> 4.1.3 Armin Kuster
` (7 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Wang Mingyu <wangmy@fujitsu.com>
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.55
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cba6df61c7cbc4446aab09eb11673bcb6c581307)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../apache2/{apache2_2.4.54.bb => apache2_2.4.55.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.54.bb => apache2_2.4.55.bb} (99%)
diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.55.bb
similarity index 99%
rename from meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb
rename to meta-webserver/recipes-httpd/apache2/apache2_2.4.55.bb
index 4f30eca59e..88cef0ef83 100644
--- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb
+++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.55.bb
@@ -27,7 +27,7 @@ SRC_URI:append:class-target = " \
"
LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3"
-SRC_URI[sha256sum] = "eb397feeefccaf254f8d45de3768d9d68e8e73851c49afd5b7176d1ecf80c340"
+SRC_URI[sha256sum] = "11d6ba19e36c0b93ca62e47e6ffc2d2f2884942694bce0f23f39c71bdc5f69ac"
S = "${WORKDIR}/httpd-${PV}"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 08/15] python3-django: upgrade 4.1 -> 4.1.3
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (6 preceding siblings ...)
2023-02-16 12:27 ` [langdale 07/15] apache2: upgrade 2.4.54 -> 2.4.55 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 09/15] python3-django: upgrade 4.1.3 -> 4.1.6 Armin Kuster
` (6 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1e4fd5514d2daf4b9b233bed42683aebc78d9fcf)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../python/{python3-django_4.1.bb => python3-django_4.1.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-django_4.1.bb => python3-django_4.1.3.bb} (58%)
diff --git a/meta-python/recipes-devtools/python/python3-django_4.1.bb b/meta-python/recipes-devtools/python/python3-django_4.1.3.bb
similarity index 58%
rename from meta-python/recipes-devtools/python/python3-django_4.1.bb
rename to meta-python/recipes-devtools/python/python3-django_4.1.3.bb
index 44ea5394da..6d800982af 100644
--- a/meta-python/recipes-devtools/python/python3-django_4.1.bb
+++ b/meta-python/recipes-devtools/python/python3-django_4.1.3.bb
@@ -1,7 +1,7 @@
require python-django.inc
inherit setuptools3
-SRC_URI[sha256sum] = "032f8a6fc7cf05ccd1214e4a2e21dfcd6a23b9d575c6573cacc8c67828dbe642"
+SRC_URI[sha256sum] = "678bbfc8604eb246ed54e2063f0765f13b321a50526bdc8cb1f943eda7fa31f1"
RDEPENDS:${PN} += "\
${PYTHON_PN}-sqlparse \
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 09/15] python3-django: upgrade 4.1.3 -> 4.1.6
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (7 preceding siblings ...)
2023-02-16 12:27 ` [langdale 08/15] python3-django: upgrade 4.1 -> 4.1.3 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 10/15] net-snmp: Fix build with clang16 Armin Kuster
` (5 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c3b0591ddd0c65bc9a75a06dc599a7e90c760dbb)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../python/{python3-django_4.1.3.bb => python3-django_4.1.6.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-django_4.1.3.bb => python3-django_4.1.6.bb} (58%)
diff --git a/meta-python/recipes-devtools/python/python3-django_4.1.3.bb b/meta-python/recipes-devtools/python/python3-django_4.1.6.bb
similarity index 58%
rename from meta-python/recipes-devtools/python/python3-django_4.1.3.bb
rename to meta-python/recipes-devtools/python/python3-django_4.1.6.bb
index 6d800982af..e54398c456 100644
--- a/meta-python/recipes-devtools/python/python3-django_4.1.3.bb
+++ b/meta-python/recipes-devtools/python/python3-django_4.1.6.bb
@@ -1,7 +1,7 @@
require python-django.inc
inherit setuptools3
-SRC_URI[sha256sum] = "678bbfc8604eb246ed54e2063f0765f13b321a50526bdc8cb1f943eda7fa31f1"
+SRC_URI[sha256sum] = "bceb0fe1a386781af0788cae4108622756cd05e7775448deec04a71ddf87685d"
RDEPENDS:${PN} += "\
${PYTHON_PN}-sqlparse \
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 10/15] net-snmp: Fix build with clang16
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (8 preceding siblings ...)
2023-02-16 12:27 ` [langdale 09/15] python3-django: upgrade 4.1.3 -> 4.1.6 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 11/15] net-snmp: CVE-2022-44792 & CVE-2022-44793 Fix NULL Pointer Exception Armin Kuster
` (4 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ee0de616df82937191613c85f9df7e872b99ed6f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
...eturn-attribute-to-netsnmp_pci_error.patch | 32 +++++++++++++++++++
.../net-snmp/net-snmp_5.9.3.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta-networking/recipes-protocols/net-snmp/net-snmp/0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch b/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch
new file mode 100644
index 0000000000..6fbace75a5
--- /dev/null
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch
@@ -0,0 +1,32 @@
+From 5719f40db65a72624a0b0f08e546d12bf823bd1e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 18 Jan 2023 14:38:44 -0800
+Subject: [PATCH] Add noreturn attribute to netsnmp_pci_error()
+
+Fixes build with clang16
+| mibgroup/if-mib/data_access/interface_linux.c:152:23: error: incompatible function pointer types assigning to 'void (*)(char *, ...) __attribute__((noreturn))' from 'void (char *, ...)' [-Wincompatible-function-pointer-types]
+| pci_access->error = netsnmp_pci_error;
+| ^ ~~~~~~~~~~~~~~~~~
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ agent/mibgroup/if-mib/data_access/interface_linux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/agent/mibgroup/if-mib/data_access/interface_linux.c b/agent/mibgroup/if-mib/data_access/interface_linux.c
+index c6cc54e..12eb865 100644
+--- a/agent/mibgroup/if-mib/data_access/interface_linux.c
++++ b/agent/mibgroup/if-mib/data_access/interface_linux.c
+@@ -31,7 +31,7 @@ static struct pci_access *pci_access;
+ /* Avoid letting libpci call exit(1) when no PCI bus is available. */
+ static int do_longjmp =0;
+ static jmp_buf err_buf;
+-static void
++__attribute__((noreturn)) static void
+ netsnmp_pci_error(char *msg, ...)
+ {
+ va_list args;
+--
+2.39.1
+
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
index 7af5147566..78d711fbfd 100644
--- a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
@@ -26,6 +26,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/net-snmp/net-snmp-${PV}.tar.gz \
file://net-snmp-fix-for-disable-des.patch \
file://reproducibility-have-printcap.patch \
file://0001-ac_add_search_path.m4-keep-consistent-between-32bit.patch \
+ file://0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch \
"
SRC_URI[sha256sum] = "2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 11/15] net-snmp: CVE-2022-44792 & CVE-2022-44793 Fix NULL Pointer Exception
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (9 preceding siblings ...)
2023-02-16 12:27 ` [langdale 10/15] net-snmp: Fix build with clang16 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 12/15] phoronix-test-suite: fix CVE-2022-40704 Armin Kuster
` (3 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Narpat Mali <narpat.mali@windriver.com>
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-44792
https://nvd.nist.gov/vuln/detail/CVE-2022-44793
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5ae6f9434f44a57389a3f52dce17da6fe5928e1f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../CVE-2022-44792-CVE-2022-44793.patch | 121 ++++++++++++++++++
.../net-snmp/net-snmp_5.9.3.bb | 1 +
2 files changed, 122 insertions(+)
create mode 100644 meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2022-44792-CVE-2022-44793.patch
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2022-44792-CVE-2022-44793.patch b/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2022-44792-CVE-2022-44793.patch
new file mode 100644
index 0000000000..b18d4dc292
--- /dev/null
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2022-44792-CVE-2022-44793.patch
@@ -0,0 +1,121 @@
+From d13302656d9ff0807c5defe18623adc947f43a2b Mon Sep 17 00:00:00 2001
+From: Narpat Mali <narpat.mali@windriver.com>
+Date: Wed, 8 Feb 2023 13:15:39 +0000
+Subject: [PATCH] agent: Disallow SET requests with any NULL varbind Merge pull
+ request #490 from fenner/set-null
+
+fixes: #474 and #475
+
+CVE: CVE-2022-44792, CVE-2022-44793
+
+Upstream-Status: Backport [https://github.com/net-snmp/net-snmp/commit/be804106fd0771a7d05236cff36e199af077af57]
+
+Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
+---
+ agent/snmp_agent.c | 32 +++++++++++++++++++
+ apps/snmpset.c | 1 +
+ .../default/T0142snmpv2csetnull_simple | 31 ++++++++++++++++++
+ 3 files changed, 64 insertions(+)
+ create mode 100644 testing/fulltests/default/T0142snmpv2csetnull_simple
+
+diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
+index 867d0c1..3f678fe 100644
+--- a/agent/snmp_agent.c
++++ b/agent/snmp_agent.c
+@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status)
+ return 1;
+ }
+
++static int
++check_set_pdu_for_null_varbind(netsnmp_agent_session *asp)
++{
++ int i;
++ netsnmp_variable_list *v = NULL;
++
++ for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) {
++ if (v->type == ASN_NULL) {
++ /*
++ * Protect SET implementations that do not protect themselves
++ * against wrong type.
++ */
++ DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i));
++ asp->index = i;
++ return SNMP_ERR_WRONGTYPE;
++ }
++ }
++ return SNMP_ERR_NOERROR;
++}
++
+ int
+ handle_pdu(netsnmp_agent_session *asp)
+ {
+ int status, inclusives = 0;
+ netsnmp_variable_list *v = NULL;
+
++#ifndef NETSNMP_NO_WRITE_SUPPORT
++ /*
++ * Check for ASN_NULL in SET request
++ */
++ if (asp->pdu->command == SNMP_MSG_SET) {
++ status = check_set_pdu_for_null_varbind(asp);
++ if (status != SNMP_ERR_NOERROR) {
++ return status;
++ }
++ }
++#endif /* NETSNMP_NO_WRITE_SUPPORT */
++
+ /*
+ * for illegal requests, mark all nodes as ASN_NULL
+ */
+diff --git a/apps/snmpset.c b/apps/snmpset.c
+index 48e14bd..d542713 100644
+--- a/apps/snmpset.c
++++ b/apps/snmpset.c
+@@ -182,6 +182,7 @@ main(int argc, char *argv[])
+ case 'x':
+ case 'd':
+ case 'b':
++ case 'n': /* undocumented */
+ #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES
+ case 'I':
+ case 'U':
+diff --git a/testing/fulltests/default/T0142snmpv2csetnull_simple b/testing/fulltests/default/T0142snmpv2csetnull_simple
+new file mode 100644
+index 0000000..0f1b8f3
+--- /dev/null
++++ b/testing/fulltests/default/T0142snmpv2csetnull_simple
+@@ -0,0 +1,31 @@
++#!/bin/sh
++
++. ../support/simple_eval_tools.sh
++
++HEADER SNMPv2c set of system.sysContact.0 with NULL varbind
++
++SKIPIF NETSNMP_DISABLE_SET_SUPPORT
++SKIPIF NETSNMP_NO_WRITE_SUPPORT
++SKIPIF NETSNMP_DISABLE_SNMPV2C
++SKIPIFNOT USING_MIBII_SYSTEM_MIB_MODULE
++
++#
++# Begin test
++#
++
++# standard V2C configuration: testcomunnity
++snmp_write_access='all'
++. ./Sv2cconfig
++STARTAGENT
++
++CAPTURE "snmpget -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0"
++
++CHECK ".1.3.6.1.2.1.1.4.0 = STRING:"
++
++CAPTURE "snmpset -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0 n x"
++
++CHECK "Reason: wrongType"
++
++STOPAGENT
++
++FINISHED
+--
+2.34.1
+
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
index 78d711fbfd..f40fb8bbd6 100644
--- a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
@@ -27,6 +27,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/net-snmp/net-snmp-${PV}.tar.gz \
file://reproducibility-have-printcap.patch \
file://0001-ac_add_search_path.m4-keep-consistent-between-32bit.patch \
file://0001-Add-noreturn-attribute-to-netsnmp_pci_error.patch \
+ file://CVE-2022-44792-CVE-2022-44793.patch \
"
SRC_URI[sha256sum] = "2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 12/15] phoronix-test-suite: fix CVE-2022-40704
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (10 preceding siblings ...)
2023-02-16 12:27 ` [langdale 11/15] net-snmp: CVE-2022-44792 & CVE-2022-44793 Fix NULL Pointer Exception Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 13/15] tinyproxy: fix CVE-2022-40468 Armin Kuster
` (2 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Joe Slater <joe.slater@windriver.com>
CVE fix added after latest release (10.8.4).
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 32a0ff55166ae67931d48825e669893718663040)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../files/CVE-2022-40704.patch | 46 +++++++++++++++++++
.../phoronix-test-suite_10.8.4.bb | 5 +-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 meta-oe/recipes-benchmark/phoronix-test-suite/files/CVE-2022-40704.patch
diff --git a/meta-oe/recipes-benchmark/phoronix-test-suite/files/CVE-2022-40704.patch b/meta-oe/recipes-benchmark/phoronix-test-suite/files/CVE-2022-40704.patch
new file mode 100644
index 0000000000..8b6405b4ad
--- /dev/null
+++ b/meta-oe/recipes-benchmark/phoronix-test-suite/files/CVE-2022-40704.patch
@@ -0,0 +1,46 @@
+From d3880d9d3ba795138444da83f1153c3c3ac27640 Mon Sep 17 00:00:00 2001
+From: Michael Larabel <michael@phoronix.com>
+Date: Sat, 23 Jul 2022 07:32:43 -0500
+Subject: [PATCH] phoromatic: Explicitly check both $_GET abd $_POST in
+ phoromatic_quit_if_invalid_input_found()
+
+Fixes: https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650#issuecomment-1193116678
+
+Upstream-Status: Backport
+CVE: CVE-2022-40704
+
+Reference to upstream patch:
+https://github.com/phoronix-test-suite/phoronix-test-suite/commit/d3880d9d3ba795138444da83f1153c3c3ac27640
+
+Signed-off-by: Li Wang <li.wang@windriver.com>
+---
+ pts-core/phoromatic/phoromatic_functions.php | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/pts-core/phoromatic/phoromatic_functions.php b/pts-core/phoromatic/phoromatic_functions.php
+index 74ccc5444c..c2313dcdea 100644
+--- a/pts-core/phoromatic/phoromatic_functions.php
++++ b/pts-core/phoromatic/phoromatic_functions.php
+@@ -37,9 +37,20 @@ function phoromatic_quit_if_invalid_input_found($input_keys = null)
+ {
+ foreach($input_keys as $key)
+ {
+- if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
++ if(isset($_GET[$key]) && !empty($_GET[$key]))
+ {
+- foreach(pts_arrays::to_array($_REQUEST[$key]) as $val_to_check)
++ foreach(pts_arrays::to_array($_GET[$key]) as $val_to_check)
++ {
++ if(stripos($val_to_check, $invalid_string) !== false)
++ {
++ echo '<strong>Exited due to invalid input ( ' . $invalid_string . ') attempted:</strong> ' . htmlspecialchars($val_to_check);
++ exit;
++ }
++ }
++ }
++ if(isset($_POST[$key]) && !empty($_POST[$key]))
++ {
++ foreach(pts_arrays::to_array($_POST[$key]) as $val_to_check)
+ {
+ if(stripos($val_to_check, $invalid_string) !== false)
+ {
diff --git a/meta-oe/recipes-benchmark/phoronix-test-suite/phoronix-test-suite_10.8.4.bb b/meta-oe/recipes-benchmark/phoronix-test-suite/phoronix-test-suite_10.8.4.bb
index be9756d9a7..8de3314b3c 100644
--- a/meta-oe/recipes-benchmark/phoronix-test-suite/phoronix-test-suite_10.8.4.bb
+++ b/meta-oe/recipes-benchmark/phoronix-test-suite/phoronix-test-suite_10.8.4.bb
@@ -5,7 +5,10 @@ LICENSE = "GPL-3.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
SECTION = "console/tests"
-SRC_URI = "http://www.phoronix-test-suite.com/releases/${BP}.tar.gz"
+SRC_URI = "http://www.phoronix-test-suite.com/releases/${BP}.tar.gz \
+ file://CVE-2022-40704.patch \
+ "
+
SRC_URI[sha256sum] = "1f2092d536c0a3193efc53e4a50f3cee65c0ef1a78d31e5404f1c663fff7b7f4"
S = "${WORKDIR}/phoronix-test-suite"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 13/15] tinyproxy: fix CVE-2022-40468
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (11 preceding siblings ...)
2023-02-16 12:27 ` [langdale 12/15] phoronix-test-suite: fix CVE-2022-40704 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 14/15] exiv2: fix SRC_URI Armin Kuster
2023-02-16 12:27 ` [langdale 15/15] mdns: use git fetcher Armin Kuster
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 795ccdd86cad05c425adae15af27797f42f33c56)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../tinyproxy/tinyproxy/CVE-2022-40468.patch | 33 +++++++++++++++++++
.../tinyproxy/tinyproxy_1.11.1.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2022-40468.patch
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2022-40468.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2022-40468.patch
new file mode 100644
index 0000000000..4e2157ca75
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2022-40468.patch
@@ -0,0 +1,33 @@
+From 3764b8551463b900b5b4e3ec0cd9bb9182191cb7 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Thu, 8 Sep 2022 15:18:04 +0000
+Subject: [PATCH] prevent junk from showing up in error page in invalid
+ requests
+
+fixes #457
+
+https://github.com/tinyproxy/tinyproxy/commit/3764b8551463b900b5b4e3ec0cd9bb9182191cb7
+Upstream-Status: Backport
+CVE: CVE-2022-40468
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+---
+ src/reqs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index bce69819..45db118d 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -343,8 +343,12 @@ static struct request_s *process_request (struct conn_s *connptr,
+ goto fail;
+ }
+
++ /* zero-terminate the strings so they don't contain junk in error page */
++ request->method[0] = url[0] = request->protocol[0] = 0;
++
+ ret = sscanf (connptr->request_line, "%[^ ] %[^ ] %[^ ]",
+ request->method, url, request->protocol);
++
+ if (ret == 2 && !strcasecmp (request->method, "GET")) {
+ request->protocol[0] = 0;
+
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.1.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.1.bb
index 86f57d88ff..999deff4de 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.1.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.1.bb
@@ -7,6 +7,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://disable-documentation.patch \
file://tinyproxy.service \
file://tinyproxy.conf \
+ file://CVE-2022-40468.patch \
"
SRC_URI[sha256sum] = "1574acf7ba83c703a89e98bb2758a4ed9fda456f092624b33cfcf0ce2d3b2047"
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 14/15] exiv2: fix SRC_URI
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (12 preceding siblings ...)
2023-02-16 12:27 ` [langdale 13/15] tinyproxy: fix CVE-2022-40468 Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
2023-02-16 12:27 ` [langdale 15/15] mdns: use git fetcher Armin Kuster
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Martin Jansa <Martin.Jansa@gmail.com>
* https://exiv2.org/releases returns 404 now, use github releases
* it's already fixed in master with upgrade to 0.27.6 in:
https://git.openembedded.org/meta-openembedded/commit/?id=00a7d4b284c1afccfa26021111384d2184b82e5b
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb b/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb
index 1380638ba7..64b132e006 100644
--- a/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb
+++ b/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb
@@ -4,7 +4,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=625f055f41728f84a8d7938acc35bdc2"
DEPENDS = "zlib expat"
-SRC_URI = "https://exiv2.org/releases/${BPN}-${PV}-Source.tar.gz"
+SRC_URI = "https://github.com/Exiv2/${BPN}/releases/download/v${PV}/${BP}-Source.tar.gz"
SRC_URI[sha256sum] = "a79f5613812aa21755d578a297874fb59a85101e793edc64ec2c6bd994e3e778"
# Once patch is obsolete (project should be aware due to PRs), dos2unix can be removed either
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [langdale 15/15] mdns: use git fetcher
2023-02-16 12:27 [langdale 00/15] Patch review Feb 16th Armin Kuster
` (13 preceding siblings ...)
2023-02-16 12:27 ` [langdale 14/15] exiv2: fix SRC_URI Armin Kuster
@ 2023-02-16 12:27 ` Armin Kuster
14 siblings, 0 replies; 16+ messages in thread
From: Armin Kuster @ 2023-02-16 12:27 UTC (permalink / raw)
To: openembedded-devel
From: Martin Jansa <Martin.Jansa@gmail.com>
* https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-${PV}.tar.gz
is just redirect to unsafe github archives which are regenerated from time to
time.
* We do have src-uri-bad QA check which prevents to use github archives in SRC_URI
since 2019:
https://github.com/openembedded/openembedded-core/commit/21f84fcdd659544437fe393285c407e1e9432043
but this cannot catch such redirects, see:
$ wget https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-878.30.4.tar.gz
--2023-01-31 10:06:02-- https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-878.30.4.tar.gz
Resolving opensource.apple.com (opensource.apple.com)... 17.253.73.203, 17.253.73.206, 2a01:b740:a26:f000::5, ...
Connecting to opensource.apple.com (opensource.apple.com)|17.253.73.203|:443... connected.
HTTP request sent, awaiting response... 302 Redirect
Location: https://github.com/apple-oss-distributions/mDNSResponder/archive/refs/tags/mDNSResponder-878.30.4.tar.gz [following]
--2023-01-31 10:06:02-- https://github.com/apple-oss-distributions/mDNSResponder/archive/refs/tags/mDNSResponder-878.30.4.tar.gz
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/apple-oss-distributions/mDNSResponder/tar.gz/refs/tags/mDNSResponder-878.30.4 [following]
--2023-01-31 10:06:02-- https://codeload.github.com/apple-oss-distributions/mDNSResponder/tar.gz/refs/tags/mDNSResponder-878.30.4
Resolving codeload.github.com (codeload.github.com)... 140.82.121.10
Connecting to codeload.github.com (codeload.github.com)|140.82.121.10|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-gzip]
Saving to: ?mDNSResponder-878.30.4.tar.gz?
* The tarball was regenerated recently as discussed in:
https://github.com/orgs/community/discussions/45830
* Use top-level directory in S to fix DEBUG_PREFIX_MAP usage
like the version in master does, the only exception here is that
there still was top-level Makefile (which fails to set VER with:
Makefile:26: *** missing separator. Stop.
so use the simple one like newer version in master)
* it's already included in master as part of version upgrade in:
https://github.com/openembedded/meta-openembedded/commit/ec96eb577bd518b89e2e7834bd569ba269df458f
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
...utine-for-cleaning-recent-interfaces.patch | 0
| 0
.../0001-mdns-include-stddef.h-for-NULL.patch | 0
...outine-for-tearing-down-an-interface.patch | 0
...-cross-compilation-fixes-for-bitbake.patch | 0
.../0003-Track-interface-socket-family.patch | 0
...0004-Use-list-for-changed-interfaces.patch | 0
.../0006-Remove-unneeded-function.patch | 0
.../0006-make-Add-top-level-Makefile.patch | 175 ++++++++++++++++++
...-deleted-interfaces-as-being-changed.patch | 0
.../0009-Fix-possible-NULL-dereference.patch | 0
...0010-Handle-errors-from-socket-calls.patch | 0
...ic-allocation-to-file-scope-variable.patch | 0
.../mdns/{files => mdns}/mdns.service | 0
.../recipes-protocols/mdns/mdns_1310.140.1.bb | 44 +++--
15 files changed, 203 insertions(+), 16 deletions(-)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0001-Create-subroutine-for-cleaning-recent-interfaces.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0001-dns-sd-Include-missing-headers.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0001-mdns-include-stddef.h-for-NULL.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0002-Create-subroutine-for-tearing-down-an-interface.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0002-mdns-cross-compilation-fixes-for-bitbake.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0003-Track-interface-socket-family.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0004-Use-list-for-changed-interfaces.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0006-Remove-unneeded-function.patch (100%)
create mode 100644 meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0008-Mark-deleted-interfaces-as-being-changed.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0009-Fix-possible-NULL-dereference.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0010-Handle-errors-from-socket-calls.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/0011-Change-a-dynamic-allocation-to-file-scope-variable.patch (100%)
rename meta-networking/recipes-protocols/mdns/{files => mdns}/mdns.service (100%)
diff --git a/meta-networking/recipes-protocols/mdns/files/0001-Create-subroutine-for-cleaning-recent-interfaces.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-Create-subroutine-for-cleaning-recent-interfaces.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0001-Create-subroutine-for-cleaning-recent-interfaces.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0001-Create-subroutine-for-cleaning-recent-interfaces.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0001-dns-sd-Include-missing-headers.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0001-dns-sd-Include-missing-headers.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0001-mdns-include-stddef.h-for-NULL.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-mdns-include-stddef.h-for-NULL.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0001-mdns-include-stddef.h-for-NULL.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0001-mdns-include-stddef.h-for-NULL.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0002-Create-subroutine-for-tearing-down-an-interface.patch b/meta-networking/recipes-protocols/mdns/mdns/0002-Create-subroutine-for-tearing-down-an-interface.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0002-Create-subroutine-for-tearing-down-an-interface.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0002-Create-subroutine-for-tearing-down-an-interface.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0002-mdns-cross-compilation-fixes-for-bitbake.patch b/meta-networking/recipes-protocols/mdns/mdns/0002-mdns-cross-compilation-fixes-for-bitbake.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0002-mdns-cross-compilation-fixes-for-bitbake.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0002-mdns-cross-compilation-fixes-for-bitbake.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0003-Track-interface-socket-family.patch b/meta-networking/recipes-protocols/mdns/mdns/0003-Track-interface-socket-family.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0003-Track-interface-socket-family.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0003-Track-interface-socket-family.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0004-Use-list-for-changed-interfaces.patch b/meta-networking/recipes-protocols/mdns/mdns/0004-Use-list-for-changed-interfaces.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0004-Use-list-for-changed-interfaces.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0004-Use-list-for-changed-interfaces.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0006-Remove-unneeded-function.patch b/meta-networking/recipes-protocols/mdns/mdns/0006-Remove-unneeded-function.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0006-Remove-unneeded-function.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0006-Remove-unneeded-function.patch
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch b/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
new file mode 100644
index 0000000000..b7d9ad5bba
--- /dev/null
+++ b/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
@@ -0,0 +1,175 @@
+From 177abf68e5ac5f82c6261af63528f8b6160bca0f Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Tue, 6 Dec 2022 13:28:31 +0000
+Subject: [PATCH] make: Add top-level Makefile
+
+Simple top level Makefile that just delegates to mDNSPosix.
+
+Upstream-Status: Inappropriate [oe-specific]
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ Makefile | 154 +------------------------------------------------------
+ 1 file changed, 2 insertions(+), 152 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 8b6fa77..feb6ac6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,152 +1,2 @@
+-#
+-# Copyright (c) 2003-2018 Apple Inc. All rights reserved.
+-#
+-# Top level makefile for Build & Integration (B&I).
+-#
+-# This file is used to facilitate checking the mDNSResponder project directly from git and submitting to B&I at Apple.
+-#
+-# The various platform directories contain makefiles or projects specific to that platform.
+-#
+-# B&I builds must respect the following target:
+-# install:
+-# installsrc:
+-# installhdrs:
+-# installapi:
+-# clean:
+-#
+-
+-include $(MAKEFILEPATH)/pb_makefiles/platform.make
+-
+-MVERS = "mDNSResponder-1310.140.1"
+-
+-VER =
+-ifneq ($(strip $(GCC_VERSION)),)
+- VER = -- GCC_VERSION=$(GCC_VERSION)
+-endif
+-echo "VER = $(VER)"
+-
+-projectdir := $(SRCROOT)/mDNSMacOSX
+-buildsettings := OBJROOT=$(OBJROOT) SYMROOT=$(SYMROOT) DSTROOT=$(DSTROOT) MVERS=$(MVERS) SDKROOT=$(SDKROOT)
+-
+-.PHONY: install installSome installEmpty installExtras SystemLibraries installhdrs installapi installsrc java clean
+-
+-# Sanitizer support
+-# Disable Sanitizer instrumentation in LibSystem contributors. See rdar://problem/29952210.
+-UNSUPPORTED_SANITIZER_PROJECTS := mDNSResponderSystemLibraries mDNSResponderSystemLibraries_Sim
+-PROJECT_SUPPORTS_SANITIZERS := 1
+-ifneq ($(words $(filter $(UNSUPPORTED_SANITIZER_PROJECTS), $(RC_ProjectName))), 0)
+- PROJECT_SUPPORTS_SANITIZERS := 0
+-endif
+-ifeq ($(RC_ENABLE_ADDRESS_SANITIZATION),1)
+- ifeq ($(PROJECT_SUPPORTS_SANITIZERS),1)
+- $(info Enabling Address Sanitizer)
+- buildsettings += -enableAddressSanitizer YES
+- else
+- $(warning WARNING: Address Sanitizer not supported for project $(RC_ProjectName))
+- endif
+-endif
+-ifeq ($(RC_ENABLE_THREAD_SANITIZATION),1)
+- ifeq ($(PROJECT_SUPPORTS_SANITIZERS),1)
+- $(info Enabling Thread Sanitizer)
+- buildsettings += -enableThreadSanitizer YES
+- else
+- $(warning WARNING: Thread Sanitizer not supported for project $(RC_ProjectName))
+- endif
+-endif
+-ifeq ($(RC_ENABLE_UNDEFINED_BEHAVIOR_SANITIZATION),1)
+- ifeq ($(PROJECT_SUPPORTS_SANITIZERS),1)
+- $(info Enabling Undefined Behavior Sanitizer)
+- buildsettings += -enableUndefinedBehaviorSanitizer YES
+- else
+- $(warning WARNING: Undefined Behavior Sanitizer not supported for project $(RC_ProjectName))
+- endif
+-endif
+-
+-# B&I install build targets
+-#
+-# For the mDNSResponder build alias, the make target used by B&I depends on the platform:
+-#
+-# Platform Make Target
+-# -------- -----------
+-# osx install
+-# ios installSome
+-# atv installSome
+-# watch installSome
+-#
+-# For the mDNSResponderSystemLibraries and mDNSResponderSystemLibraries_sim build aliases, B&I uses the SystemLibraries
+-# target for all platforms.
+-
+-install:
+-ifeq ($(RC_ProjectName), mDNSResponderServices)
+-ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), osx)
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Services-macOS' $(VER)
+-else
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Services' $(VER)
+-endif
+-else ifeq ($(RC_ProjectName), mDNSResponderServices_Sim)
+- mkdir -p $(DSTROOT)/AppleInternal
+-else
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) $(VER)
+-endif
+-
+-installSome:
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) $(VER)
+-
+-installEmpty:
+- mkdir -p $(DSTROOT)/AppleInternal
+-
+-installExtras:
+-ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), osx)
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Extras-macOS' $(VER)
+-else ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), ios)
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Extras-iOS' $(VER)
+-else ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), atv)
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Extras-tvOS' $(VER)
+-else
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target 'Build Extras' $(VER)
+-endif
+-
+-SystemLibraries:
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target SystemLibraries $(VER)
+-
+-# B&I installhdrs build targets
+-
+-installhdrs::
+-ifeq ($(RC_ProjectName), mDNSResponderServices)
+-ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), osx)
+- cd '$(projectdir)'; xcodebuild installhdrs $(buildsettings) -target 'Build Services-macOS' $(VER)
+-else
+- cd '$(projectdir)'; xcodebuild installhdrs $(buildsettings) -target 'Build Services' $(VER)
+-endif
+-else ifeq ($(RC_ProjectName), mDNSResponderServices_Sim)
+- mkdir -p $(DSTROOT)/AppleInternal
+-else ifneq ($(findstring SystemLibraries,$(RC_ProjectName)),)
+- cd '$(projectdir)'; xcodebuild installhdrs $(buildsettings) -target SystemLibraries $(VER)
+-endif
+-
+-# B&I installapi build targets
+-
+-installapi:
+-ifeq ($(RC_ProjectName), mDNSResponderServices)
+-ifeq ($(RC_PROJECT_COMPILATION_PLATFORM), osx)
+- cd '$(projectdir)'; xcodebuild installapi $(buildsettings) -target 'Build Services-macOS' $(VER)
+-else
+- cd '$(projectdir)'; xcodebuild installapi $(buildsettings) -target 'Build Services' $(VER)
+-endif
+-else ifeq ($(RC_ProjectName), mDNSResponderServices_Sim)
+- mkdir -p $(DSTROOT)/AppleInternal
+-else ifneq ($(findstring SystemLibraries,$(RC_ProjectName)),)
+- cd '$(projectdir)'; xcodebuild installapi $(buildsettings) -target SystemLibrariesDynamic $(VER)
+-endif
+-
+-# Misc. targets
+-
+-installsrc:
+- ditto . '$(SRCROOT)'
+- rm -rf '$(SRCROOT)/mDNSWindows' '$(SRCROOT)/Clients/FirefoxExtension'
+-
+-java:
+- cd '$(projectdir)'; xcodebuild install $(buildsettings) -target libjdns_sd.jnilib $(VER)
+-
+-clean::
+- echo clean
++all clean:
++ cd mDNSPosix && $(MAKE) $@
+--
+2.38.1
+
diff --git a/meta-networking/recipes-protocols/mdns/files/0008-Mark-deleted-interfaces-as-being-changed.patch b/meta-networking/recipes-protocols/mdns/mdns/0008-Mark-deleted-interfaces-as-being-changed.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0008-Mark-deleted-interfaces-as-being-changed.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0008-Mark-deleted-interfaces-as-being-changed.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0009-Fix-possible-NULL-dereference.patch b/meta-networking/recipes-protocols/mdns/mdns/0009-Fix-possible-NULL-dereference.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0009-Fix-possible-NULL-dereference.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0009-Fix-possible-NULL-dereference.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0010-Handle-errors-from-socket-calls.patch b/meta-networking/recipes-protocols/mdns/mdns/0010-Handle-errors-from-socket-calls.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0010-Handle-errors-from-socket-calls.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0010-Handle-errors-from-socket-calls.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/0011-Change-a-dynamic-allocation-to-file-scope-variable.patch b/meta-networking/recipes-protocols/mdns/mdns/0011-Change-a-dynamic-allocation-to-file-scope-variable.patch
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/0011-Change-a-dynamic-allocation-to-file-scope-variable.patch
rename to meta-networking/recipes-protocols/mdns/mdns/0011-Change-a-dynamic-allocation-to-file-scope-variable.patch
diff --git a/meta-networking/recipes-protocols/mdns/files/mdns.service b/meta-networking/recipes-protocols/mdns/mdns/mdns.service
similarity index 100%
rename from meta-networking/recipes-protocols/mdns/files/mdns.service
rename to meta-networking/recipes-protocols/mdns/mdns/mdns.service
diff --git a/meta-networking/recipes-protocols/mdns/mdns_1310.140.1.bb b/meta-networking/recipes-protocols/mdns/mdns_1310.140.1.bb
index 205dc929be..65f4847d8f 100644
--- a/meta-networking/recipes-protocols/mdns/mdns_1310.140.1.bb
+++ b/meta-networking/recipes-protocols/mdns/mdns_1310.140.1.bb
@@ -2,28 +2,31 @@ SUMMARY = "Publishes & browses available services on a link according to the Zer
DESCRIPTION = "Bonjour, also known as zero-configuration networking, enables automatic discovery of computers, devices, and services on IP networks."
HOMEPAGE = "http://developer.apple.com/networking/bonjour/"
LICENSE = "Apache-2.0 & BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://../LICENSE;md5=31c50371921e0fb731003bbc665f29bf"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=31c50371921e0fb731003bbc665f29bf"
DEPENDS:append:libc-musl = " musl-nscd"
RPROVIDES:${PN} += "libdns_sd.so"
-SRC_URI = "https://opensource.apple.com/tarballs/mDNSResponder/mDNSResponder-${PV}.tar.gz \
+# matches annotated tag mDNSResponder-1310.140.1
+SRCREV = "1d1de95b98fba2077d34c9d78b839a96aa0e1c77"
+BRANCH = "rel/mDNSResponder-1310"
+SRC_URI = "git://github.com/apple-oss-distributions/mDNSResponder;protocol=https;branch=${BRANCH} \
file://mdns.service \
- file://0001-mdns-include-stddef.h-for-NULL.patch;patchdir=.. \
- file://0002-mdns-cross-compilation-fixes-for-bitbake.patch;patchdir=.. \
- file://0001-Create-subroutine-for-cleaning-recent-interfaces.patch;patchdir=.. \
- file://0002-Create-subroutine-for-tearing-down-an-interface.patch;patchdir=.. \
- file://0003-Track-interface-socket-family.patch;patchdir=.. \
- file://0004-Use-list-for-changed-interfaces.patch;patchdir=.. \
- file://0006-Remove-unneeded-function.patch;patchdir=.. \
- file://0008-Mark-deleted-interfaces-as-being-changed.patch;patchdir=.. \
- file://0009-Fix-possible-NULL-dereference.patch;patchdir=.. \
- file://0010-Handle-errors-from-socket-calls.patch;patchdir=.. \
- file://0011-Change-a-dynamic-allocation-to-file-scope-variable.patch;patchdir=.. \
- file://0001-dns-sd-Include-missing-headers.patch;patchdir=.. \
+ file://0001-mdns-include-stddef.h-for-NULL.patch \
+ file://0002-mdns-cross-compilation-fixes-for-bitbake.patch \
+ file://0001-Create-subroutine-for-cleaning-recent-interfaces.patch \
+ file://0002-Create-subroutine-for-tearing-down-an-interface.patch \
+ file://0003-Track-interface-socket-family.patch \
+ file://0004-Use-list-for-changed-interfaces.patch \
+ file://0006-Remove-unneeded-function.patch \
+ file://0008-Mark-deleted-interfaces-as-being-changed.patch \
+ file://0009-Fix-possible-NULL-dereference.patch \
+ file://0010-Handle-errors-from-socket-calls.patch \
+ file://0011-Change-a-dynamic-allocation-to-file-scope-variable.patch \
+ file://0001-dns-sd-Include-missing-headers.patch \
+ file://0006-make-Add-top-level-Makefile.patch \
"
-SRC_URI[sha256sum] = "040f6495c18b9f0557bcf9e00cbcfc82b03405f5ba6963dc147730ca0ca90d6f"
CVE_PRODUCT = "apple:mdnsresponder"
@@ -42,13 +45,22 @@ CVE_CHECK_IGNORE += "CVE-2007-0613"
PARALLEL_MAKE = ""
-S = "${WORKDIR}/mDNSResponder-${PV}/mDNSPosix"
+# We install a stub Makefile in the top directory so that the various checks
+# in base.bbclass pass their tests for a Makefile, this ensures (that amongst
+# other things) the sstate checks will clean the build directory when the
+# task hashes changes.
+#
+# We can't use the approach of setting ${S} to mDNSPosix as we need
+# DEBUG_PREFIX_MAP to cover files which come from the Clients directory too.
+S = "${WORKDIR}/git"
EXTRA_OEMAKE += "os=linux DEBUG=0 'CC=${CC}' 'LD=${CCLD} ${LDFLAGS}'"
TARGET_CC_ARCH += "${LDFLAGS}"
do_install () {
+ cd mDNSPosix
+
install -d ${D}${sbindir}
install -m 0755 build/prod/mdnsd ${D}${sbindir}
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread