[Buildroot] [PATCH 1/1] package/thttpd: security bump to version 2.29

[Buildroot] [PATCH 1/1] package/thttpd: security bump to version 2.29

[Fabrice Fontaine]

- Switch site to "real" upstream instead of debian as debian does not
  have latest version
- Drop patch (not needed anymore as getline was renamed in my_getline)
- Add hash for license file
- Fix CVE-2013-0348 and CVE-2017-17663

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/thttpd/0001-getline.patch | 26 --------------------------
 package/thttpd/thttpd.hash        |  6 +++---
 package/thttpd/thttpd.mk          | 16 ++--------------
 3 files changed, 5 insertions(+), 43 deletions(-)
 delete mode 100644 package/thttpd/0001-getline.patch

diff --git a/package/thttpd/0001-getline.patch b/package/thttpd/0001-getline.patch
deleted file mode 100644
index 35c366aef1..0000000000
--- a/package/thttpd/0001-getline.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Fix glibc/eglibc getline() conflicting functions.
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
----
-
-diff -Nura thttpd-2.25b.orig/extras/htpasswd.c thttpd-2.25b/extras/htpasswd.c
---- thttpd-2.25b.orig/extras/htpasswd.c	2001-12-18 21:08:08.000000000 -0300
-+++ thttpd-2.25b/extras/htpasswd.c	2011-11-25 11:42:47.198582812 -0300
-@@ -49,7 +49,7 @@
-     while((line[y++] = line[x++]));
- }
- 
--static int getline(char *s, int n, FILE *f) {
-+static int get_line(char *s, int n, FILE *f) {
-     register int i=0;
- 
-     while(1) {
-@@ -189,7 +189,7 @@
-     strcpy(user,argv[2]);
- 
-     found = 0;
--    while(!(getline(line,MAX_STRING_LEN,f))) {
-+    while(!(get_line(line,MAX_STRING_LEN,f))) {
-         if(found || (line[0] == '#') || (!line[0])) {
-             putline(tfp,line);
-             continue;
diff --git a/package/thttpd/thttpd.hash b/package/thttpd/thttpd.hash
index 2400f5bc8d..4bdd7fe74b 100644
--- a/package/thttpd/thttpd.hash
+++ b/package/thttpd/thttpd.hash
@@ -1,3 +1,3 @@
-# From http://snapshot.debian.org/archive/debian/20141023T043132Z/pool/main/t/thttpd/thttpd_2.25b-11.dsc
-sha256	07719b08b1cff6a21c08697a7bcb4395425b07ee753106262fb62a03a7d32360	thttpd_2.25b.orig.tar.gz
-sha256	4d213c18daf121d21412cc54864fbca250e1773a91df6573373e1d2273a2cec9	thttpd_2.25b-11.diff.gz
+# Locally calculated
+sha256	99c09f47da326b1e7b5295c45549d2b65534dce27c44812cf7eef1441681a397	thttpd-2.29.tar.gz
+sha256	be059e6b8219d5bb5480fa6a2864bbb34892f56951d03d08b356bc1fa8c81a01	thttpd.c
diff --git a/package/thttpd/thttpd.mk b/package/thttpd/thttpd.mk
index f1bee01345..29611fff2c 100644
--- a/package/thttpd/thttpd.mk
+++ b/package/thttpd/thttpd.mk
@@ -4,23 +4,11 @@
 #
 ################################################################################
 
-THTTPD_VERSION = 2.25b
-THTTPD_SOURCE = thttpd_$(THTTPD_VERSION).orig.tar.gz
-THTTPD_PATCH = thttpd_$(THTTPD_VERSION)-11.diff.gz
-THTTPD_SITE = http://snapshot.debian.org/archive/debian/20141023T043132Z/pool/main/t/thttpd
+THTTPD_VERSION = 2.29
+THTTPD_SITE = https://acme.com/software/thttpd
 THTTPD_LICENSE = BSD-2-Clause
 THTTPD_LICENSE_FILES = thttpd.c
 
-ifneq ($(THTTPD_PATCH),)
-define THTTPD_DEBIAN_PATCHES
-	if [ -d $(@D)/debian/patches ]; then \
-		$(APPLY_PATCHES) $(@D) $(@D)/debian/patches \*.patch; \
-	fi
-endef
-endif
-
-THTTPD_POST_PATCH_HOOKS = THTTPD_DEBIAN_PATCHES
-
 THTTPD_MAKE = $(MAKE1)
 
 define THTTPD_INSTALL_TARGET_CMDS
-- 
2.20.1

[Buildroot] [PATCH 1/1] package/thttpd: security bump to version 2.29

[Thomas Petazzoni]

On Sat, 30 Mar 2019 16:46:31 +0100
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:

> - Switch site to "real" upstream instead of debian as debian does not
>   have latest version
> - Drop patch (not needed anymore as getline was renamed in my_getline)
> - Add hash for license file
> - Fix CVE-2013-0348 and CVE-2017-17663
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
>  package/thttpd/0001-getline.patch | 26 --------------------------
>  package/thttpd/thttpd.hash        |  6 +++---
>  package/thttpd/thttpd.mk          | 16 ++--------------
>  3 files changed, 5 insertions(+), 43 deletions(-)
>  delete mode 100644 package/thttpd/0001-getline.patch

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[Buildroot] [PATCH 1/1] package/thttpd: security bump to version 2.29

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > - Switch site to "real" upstream instead of debian as debian does not
 >   have latest version
 > - Drop patch (not needed anymore as getline was renamed in my_getline)
 > - Add hash for license file
 > - Fix CVE-2013-0348 and CVE-2017-17663

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2019.02.x, thanks.

-- 
Bye, Peter Korsgaard