* [OE-core][dunfell 0/9] Patch review
@ 2020-11-17 23:47 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2020-11-17 23:47 UTC (permalink / raw)
To: openembedded-core
PLease review this next set of patches for dunfell and have comments back by
end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/1603
The following changes since commit b4a92a20a683a74423fd5a833d5c016f63dba2b4:
freetype: fix CVE-2020-15999, backport from 2.10.4 (2020-11-13 05:57:16 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (2):
ptest-runner: fix upstream version check
glib-2.0: correct build with latest meson
Anibal Limon (1):
ptest-runner: Bump to 2.4.0
Joshua Watt (3):
classes/reproducible: Move to library code
lib/oe/reproducible: Fix error when no git HEAD
lib/oe/reproducible.py: Fix git HEAD check
Khem Raj (1):
ptest-runner: Backport patch to fix inappropriate ioctl error
Mark Jonas (1):
libbsd: Remove BSD-4-Clause from main package
Mingli Yu (1):
python3: add ldconfig rdepends for python3-ctypes
meta/classes/reproducible_build.bbclass | 90 +--------------
meta/lib/oe/reproducible.py | 104 ++++++++++++++++++
.../glib-2.0/meson.cross.d/common-linux | 2 +-
meta/recipes-devtools/python/python3_3.8.2.bb | 1 +
meta/recipes-support/libbsd/libbsd_0.10.0.bb | 3 +-
...-runner_2.3.2.bb => ptest-runner_2.4.0.bb} | 5 +-
6 files changed, 114 insertions(+), 91 deletions(-)
create mode 100644 meta/lib/oe/reproducible.py
rename meta/recipes-support/ptest-runner/{ptest-runner_2.3.2.bb => ptest-runner_2.4.0.bb} (87%)
--
2.17.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2020-12-07 14:12 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2020-12-07 14:12 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
Wednesday end of day.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/1648
The following changes since commit 071806feb195961e59069f778c9ae8f27a739d9a:
e2fsprogs: Fix a ptest permissions determinism issue (2020-11-30 12:05:57 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (8):
linux-yocto/5.4: update to v5.4.71
linux-yocto/5.4: update to v5.4.72
linux-yocto/5.4: update to v5.4.73
linux-yocto/5.4: config cleanup / warnings
linux-yocto/5.4: update to v5.4.75
linux-yocto/5.4: perf: Alias SYS_futex with SYS_futex_time64 on 32-bit
arches with 64bit time_t
linux-yocto/5.4: update to v5.4.78
lttng-modules: add post 2.11.6 patches
Lee Chee Yang (1):
go: update to 1.14.12
meta/recipes-devtools/go/go-1.14.inc | 5 +-
...t-CGO_LDFLAGS-to-appear-in-go-ldflag.patch | 98 ++++++
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
...ncpy-equals-destination-size-warning.patch | 42 +++
...jtool-Rename-frame.h-objtool.h-v5.10.patch | 88 +++++
...oints-output-proper-root-owner-for-t.patch | 316 ++++++++++++++++++
...rdered-extent-tracepoint-take-btrfs_.patch | 179 ++++++++++
...ext4-fast-commit-recovery-path-v5.10.patch | 91 +++++
...intr-vectoring-info-and-error-code-t.patch | 124 +++++++
...x86-mmu-Add-TDP-MMU-PF-handler-v5.10.patch | 82 +++++
...Return-unique-RET_PF_-values-if-the-.patch | 71 ++++
...int-Optimize-using-static_call-v5.10.patch | 155 +++++++++
...-fix-include-order-for-older-kernels.patch | 31 ++
.../0011-Add-release-maintainer-script.patch | 59 ++++
.../0012-Improve-the-release-script.patch | 173 ++++++++++
...fix-ext4-fast-commit-recovery-path-v.patch | 32 ++
...-fix-include-order-for-older-kernels.patch | 32 ++
...fix-tracepoint-Optimize-using-static.patch | 46 +++
...ion-range-for-trace_find_free_extent.patch | 30 ++
.../lttng/lttng-modules_2.11.6.bb | 16 +
22 files changed, 1686 insertions(+), 20 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/0010-cmd-go-permit-CGO_LDFLAGS-to-appear-in-go-ldflag.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-strncpy-equals-destination-size-warning.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0002-fix-objtool-Rename-frame.h-objtool.h-v5.10.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0003-fix-btrfs-tracepoints-output-proper-root-owner-for-t.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0004-fix-btrfs-make-ordered-extent-tracepoint-take-btrfs_.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0005-fix-ext4-fast-commit-recovery-path-v5.10.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0006-fix-KVM-x86-Add-intr-vectoring-info-and-error-code-t.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0007-fix-kvm-x86-mmu-Add-TDP-MMU-PF-handler-v5.10.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0008-fix-KVM-x86-mmu-Return-unique-RET_PF_-values-if-the-.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0009-fix-tracepoint-Optimize-using-static_call-v5.10.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0010-fix-include-order-for-older-kernels.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0011-Add-release-maintainer-script.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0012-Improve-the-release-script.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0013-fix-backport-of-fix-ext4-fast-commit-recovery-path-v.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0014-Revert-fix-include-order-for-older-kernels.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0015-fix-backport-of-fix-tracepoint-Optimize-using-static.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0016-fix-adjust-version-range-for-trace_find_free_extent.patch
--
2.17.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2021-09-10 14:07 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2021-09-10 14:07 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2570
The following changes since commit fcc609d3bafef2f63039dc54c0fd0eaf062710a1:
rt-tests: set branch name in SRC_URI (2021-09-08 04:50:47 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Armin Kuster (2):
xserver-xorg: Security fix for CVE-2020-14360/-25712
go: Several Security fixes
Ovidiu Panait (2):
dbus-test: Remove EXTRA_OECONF_X configs
dbus,dbus-test: Move common parts to dbus.inc
Richard Purdie (2):
flex: Add CVE-2019-6293 to exclusions for checks
go: Exclude CVE-2021-29923 from report list
Wang Mingyu (3):
dbus: upgrade 1.12.16 -> 1.12.18
dbus-test: upgrade 1.12.16 -> 1.12.18
dbus: upgrade 1.12.18 -> 1.12.20
.../distro/include/cve-extra-exclusions.inc | 4 -
...s-test_1.12.16.bb => dbus-test_1.12.20.bb} | 42 +----
meta/recipes-core/dbus/dbus.inc | 34 ++++
.../dbus/dbus/CVE-2020-12049.patch | 78 ---------
.../dbus/{dbus_1.12.16.bb => dbus_1.12.20.bb} | 40 +----
meta/recipes-devtools/flex/flex_2.6.4.bb | 5 +
meta/recipes-devtools/go/go-1.14.inc | 9 ++
.../go/go-1.14/CVE-2021-33196.patch | 124 ++++++++++++++
.../go/go-1.14/CVE-2021-33197.patch | 152 ++++++++++++++++++
.../go/go-1.14/CVE-2021-34558.patch | 51 ++++++
.../xserver-xorg/CVE-2020-14360.patch | 132 +++++++++++++++
.../xserver-xorg/CVE-2020-25712.patch | 102 ++++++++++++
.../xorg-xserver/xserver-xorg_1.20.8.bb | 2 +
13 files changed, 624 insertions(+), 151 deletions(-)
rename meta/recipes-core/dbus/{dbus-test_1.12.16.bb => dbus-test_1.12.20.bb} (51%)
create mode 100644 meta/recipes-core/dbus/dbus.inc
delete mode 100644 meta/recipes-core/dbus/dbus/CVE-2020-12049.patch
rename meta/recipes-core/dbus/{dbus_1.12.16.bb => dbus_1.12.20.bb} (75%)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2021-33196.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2021-33197.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2021-34558.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14360.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2022-04-20 21:51 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-04-20 21:51 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3552
except for a known intermittent issue (the infamous ping issue), which passed on
subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/63/builds/5054
The following changes since commit 8fd5133fc7f6bc84193ec6fcbc1746c59bfc8caf:
libxshmfence: Correct LICENSE to HPND (2022-04-18 12:13:17 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (5):
linux-yocto/5.4: update to v5.4.182
linux-yocto/5.4: update to v5.4.183
linux-yocto/5.4: update to v5.4.186
linux-yocto/5.4: update to v5.4.188
linux-yocto/5.4: update to v5.4.190
Peter Kjellerstedt (1):
u-boot: Correct the SRC_URI
Steve Sakoman (1):
git update from 2.24.3 to 2.24.4
wangmy (1):
linux-firmware: upgrade 20220310 -> 20220411
zhengruoqin (1):
wireless-regdb: upgrade 2022.02.18 -> 2022.04.08
meta/recipes-bsp/u-boot/u-boot-common.inc | 4 +-
.../git/files/CVE-2021-21300.patch | 305 ------------------
meta/recipes-devtools/git/git.inc | 1 -
.../git/{git_2.24.3.bb => git_2.24.4.bb} | 4 +-
...20220310.bb => linux-firmware_20220411.bb} | 4 +-
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
....02.18.bb => wireless-regdb_2022.04.08.bb} | 2 +-
9 files changed, 25 insertions(+), 331 deletions(-)
delete mode 100644 meta/recipes-devtools/git/files/CVE-2021-21300.patch
rename meta/recipes-devtools/git/{git_2.24.3.bb => git_2.24.4.bb} (51%)
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20220310.bb => linux-firmware_20220411.bb} (99%)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2022.02.18.bb => wireless-regdb_2022.04.08.bb} (94%)
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2022-05-02 23:02 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-02 23:02 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Wednesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3600
with the exception of the meta-virtualization test which was just added
to a-full:
https://autobuilder.yoctoproject.org/typhoon/#/builders/128/builds/19
Note that the test passed for qemuarm and qemuarm64, but failed for qemux86-64.
I tried to refrain from commenting that the test was added by someone with an
arm.com address, but I couldn't help myself ;-) (looking at you Ross!)
I'm not going to hold up the review process on this, since this is a newly added test.
Any help fixing this for qemux86-64 would be much appreciated.
Steve
The following changes since commit bb3fc61f0d7f7bcd77ef194b76f4fdd8a7ff6aa5:
scripts/contrib/oe-build-perf-report-email.py: remove obsolete check for phantomjs and optipng (2022-04-27 05:00:00 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Chen Qi (1):
cases/buildepoxy.py: fix typo
Khem Raj (1):
busybox: Use base_bindir instead of hardcoding /bin path
Paul Gortmaker (1):
install/devshell: Introduce git intercept script due to fakeroot
issues
Peter Kjellerstedt (1):
devshell.bbclass: Allow devshell & pydevshell to use the network
Rahul Kumar (1):
neard: Switch SRC_URI to git repo
Richard Purdie (2):
base: Drop git intercept
uninative: Upgrade to 3.6 with gcc 12 support
Ross Burton (2):
python3: ignore CVE-2015-20107
bitbake.conf: mark all directories as safe for git to read
meta/classes/devshell.bbclass | 4 ++++
meta/conf/bitbake.conf | 8 ++++++++
meta/conf/distro/include/yocto-uninative.inc | 8 ++++----
meta/lib/oeqa/sdk/cases/buildepoxy.py | 2 +-
meta/recipes-connectivity/neard/neard_0.16.bb | 13 +++++++------
meta/recipes-core/busybox/busybox.inc | 2 +-
.../recipes-devtools/python/python3_3.8.13.bb | 3 +++
scripts/git-intercept/git | 19 +++++++++++++++++++
8 files changed, 47 insertions(+), 12 deletions(-)
create mode 100755 scripts/git-intercept/git
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2022-05-18 2:30 Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 1/9] vim: Upgrade 8.2.4681 -> 8.2.4912 Steve Sakoman
` (8 more replies)
0 siblings, 9 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by end
of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3677
The following changes since commit 0f6ae13d76129d96f788b7ede312cfc361ee2bda:
scripts/git: Ensure we don't have circular references (2022-05-10 08:23:12 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Dmitry Baryshkov (1):
linux-firmware: upgrade 20220411 -> 20220509
Konrad Weihmann (1):
linux-firmware: replace mkdir by install
Ranjitsinh Rathod (4):
tiff: Add patches to fix multiple CVEs
freetype: Fix CVEs for freetype
git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE
openssl: Minor security upgrade 1.1.1n to 1.1.1o
Richard Purdie (1):
vim: Upgrade 8.2.4681 -> 8.2.4912
Sana Kazi (1):
curl: Fix CVEs for curl
Steve Sakoman (1):
selftest: skip virgl test on alma 8.6
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
.../{openssl_1.1.1n.bb => openssl_1.1.1o.bb} | 2 +-
meta/recipes-devtools/git/git.inc | 2 +-
.../freetype/freetype/CVE-2022-27404.patch | 33 ++++
.../freetype/freetype/CVE-2022-27405.patch | 38 +++++
.../freetype/freetype/CVE-2022-27406.patch | 31 ++++
.../freetype/freetype_2.10.1.bb | 3 +
...01-Makefile-replace-mkdir-by-install.patch | 84 ++++++++++
...20220411.bb => linux-firmware_20220509.bb} | 9 +-
.../libtiff/files/CVE-2022-0865.patch | 39 +++++
.../libtiff/files/CVE-2022-0907.patch | 94 +++++++++++
.../libtiff/files/CVE-2022-0908.patch | 34 ++++
.../libtiff/files/CVE-2022-0909.patch | 37 +++++
.../libtiff/files/CVE-2022-0924.patch | 58 +++++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 5 +
.../curl/curl/CVE-2022-22576.patch | 148 ++++++++++++++++++
.../curl/curl/CVE-2022-27775.patch | 39 +++++
.../curl/curl/CVE-2022-27776.patch | 114 ++++++++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 3 +
meta/recipes-support/vim/vim.inc | 4 +-
20 files changed, 772 insertions(+), 7 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1n.bb => openssl_1.1.1o.bb} (98%)
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27404.patch
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27405.patch
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27406.patch
create mode 100644 meta/recipes-kernel/linux-firmware/files/0001-Makefile-replace-mkdir-by-install.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20220411.bb => linux-firmware_20220509.bb} (99%)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-22576.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-27775.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-27776.patch
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 1/9] vim: Upgrade 8.2.4681 -> 8.2.4912
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 2/9] curl: Fix CVEs for curl Steve Sakoman
` (7 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Includes fixes for CVE-2022-1381, CVE-2022-1420.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 77d745bd49c979de987c75fd7a3af116e99db82b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/vim/vim.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 5f01fc3bca..4b8f4d1dfb 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -21,8 +21,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://racefix.patch \
"
-PV .= ".4681"
-SRCREV = "15f74fab653a784548d5d966644926b47ba2cfa7"
+PV .= ".4912"
+SRCREV = "a7583c42cd6b64fd276a5d7bb0db5ce7bfafa730"
# Remove when 8.3 is out
UPSTREAM_VERSION_UNKNOWN = "1"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 2/9] curl: Fix CVEs for curl
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 1/9] vim: Upgrade 8.2.4681 -> 8.2.4912 Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 3/9] tiff: Add patches to fix multiple CVEs Steve Sakoman
` (6 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Sana Kazi <Sana.Kazi@kpit.com>
Fix below listed CVEs:
CVE-2022-22576
Link: https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425.patch
CVE-2022-27775
Link: https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705.patch
CVE-2022-27776
Link: https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258.patch
Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2022-22576.patch | 148 ++++++++++++++++++
.../curl/curl/CVE-2022-27775.patch | 39 +++++
.../curl/curl/CVE-2022-27776.patch | 114 ++++++++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 3 +
4 files changed, 304 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-22576.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-27775.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-27776.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2022-22576.patch b/meta/recipes-support/curl/curl/CVE-2022-22576.patch
new file mode 100644
index 0000000000..13479e7f0e
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-22576.patch
@@ -0,0 +1,148 @@
+From 852aa5ad351ea53e5f01d2f44b5b4370c2bf5425 Mon Sep 17 00:00:00 2001
+From: Patrick Monnerat <patrick@monnerat.net>
+Date: Mon, 25 Apr 2022 11:44:05 +0200
+Subject: [PATCH] url: check sasl additional parameters for connection reuse.
+
+Also move static function safecmp() as non-static Curl_safecmp() since
+its purpose is needed at several places.
+
+Bug: https://curl.se/docs/CVE-2022-22576.html
+
+CVE-2022-22576
+
+Closes #8746
+---
+ lib/strcase.c | 10 ++++++++++
+ lib/strcase.h | 2 ++
+ lib/url.c | 13 ++++++++++++-
+ lib/urldata.h | 1 +
+ lib/vtls/vtls.c | 21 ++++++---------------
+ 5 files changed, 31 insertions(+), 16 deletions(-)
+
+CVE: CVE-2022-22576
+Upstream-Status: Backport [https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425.patch]
+Comment: Refreshed patch
+Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
+
+diff --git a/lib/strcase.c b/lib/strcase.c
+index dd46ca1ba0e5..692a3f14aee7 100644
+--- a/lib/strcase.c
++++ b/lib/strcase.c
+@@ -251,6 +251,16 @@
+ } while(*src++ && --n);
+ }
+
++/* Compare case-sensitive NUL-terminated strings, taking care of possible
++ * null pointers. Return true if arguments match.
++ */
++bool Curl_safecmp(char *a, char *b)
++{
++ if(a && b)
++ return !strcmp(a, b);
++ return !a && !b;
++}
++
+ /* --- public functions --- */
+
+ int curl_strequal(const char *first, const char *second)
+diff --git a/lib/strcase.h b/lib/strcase.h
+index b234d3815220..2635f5117e99 100644
+--- a/lib/strcase.h
++++ b/lib/strcase.h
+@@ -48,4 +48,6 @@
+ void Curl_strntoupper(char *dest, const char *src, size_t n);
+ void Curl_strntolower(char *dest, const char *src, size_t n);
+
++bool Curl_safecmp(char *a, char *b);
++
+ #endif /* HEADER_CURL_STRCASE_H */
+diff --git a/lib/url.c b/lib/url.c
+index 9a988b4d58d8..e1647b133854 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -730,6 +730,7 @@
+ Curl_safefree(conn->allocptr.host);
+ Curl_safefree(conn->allocptr.cookiehost);
+ Curl_safefree(conn->allocptr.rtsp_transport);
++ Curl_safefree(conn->oauth_bearer);
+ Curl_safefree(conn->trailer);
+ Curl_safefree(conn->host.rawalloc); /* host name buffer */
+ Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
+@@ -1251,7 +1252,9 @@
+ /* This protocol requires credentials per connection,
+ so verify that we're using the same name and password as well */
+ if(strcmp(needle->user, check->user) ||
+- strcmp(needle->passwd, check->passwd)) {
++ strcmp(needle->passwd, check->passwd) ||
++ !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) ||
++ !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
+ /* one of them was different */
+ continue;
+ }
+@@ -3392,6 +3395,14 @@
+ result = CURLE_OUT_OF_MEMORY;
+ goto out;
+ }
++ }
++
++ if(data->set.str[STRING_BEARER]) {
++ conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
++ if(!conn->oauth_bearer) {
++ result = CURLE_OUT_OF_MEMORY;
++ goto out;
++ }
+ }
+
+ #ifdef USE_UNIX_SOCKETS
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 07eb19b87034..1d89b8d7fa68 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -949,6 +949,8 @@
+
+ char *sasl_authzid; /* authorisation identity string, allocated */
+
++ char *oauth_bearer; /* OAUTH2 bearer, allocated */
++
+ int httpversion; /* the HTTP version*10 reported by the server */
+ int rtspversion; /* the RTSP version*10 reported by the server */
+
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 03b85ba065e5..a40ac06f684f 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -82,15 +82,6 @@
+ else \
+ dest->var = NULL;
+
+-static bool safecmp(char *a, char *b)
+-{
+- if(a && b)
+- return !strcmp(a, b);
+- else if(!a && !b)
+- return TRUE; /* match */
+- return FALSE; /* no match */
+-}
+-
+
+ bool
+ Curl_ssl_config_matches(struct ssl_primary_config* data,
+@@ -101,12 +101,12 @@
+ (data->verifypeer == needle->verifypeer) &&
+ (data->verifyhost == needle->verifyhost) &&
+ (data->verifystatus == needle->verifystatus) &&
+- safecmp(data->CApath, needle->CApath) &&
+- safecmp(data->CAfile, needle->CAfile) &&
+- safecmp(data->issuercert, needle->issuercert) &&
+- safecmp(data->clientcert, needle->clientcert) &&
+- safecmp(data->random_file, needle->random_file) &&
+- safecmp(data->egdsocket, needle->egdsocket) &&
++ Curl_safecmp(data->CApath, needle->CApath) &&
++ Curl_safecmp(data->CAfile, needle->CAfile) &&
++ Curl_safecmp(data->issuercert, needle->issuercert) &&
++ Curl_safecmp(data->clientcert, needle->clientcert) &&
++ Curl_safecmp(data->random_file, needle->random_file) &&
++ Curl_safecmp(data->egdsocket, needle->egdsocket) &&
+ Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
+ Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
+ Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key))
diff --git a/meta/recipes-support/curl/curl/CVE-2022-27775.patch b/meta/recipes-support/curl/curl/CVE-2022-27775.patch
new file mode 100644
index 0000000000..b3fe7b4494
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-27775.patch
@@ -0,0 +1,39 @@
+From 058f98dc3fe595f21dc26a5b9b1699e519ba5705 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 25 Apr 2022 11:48:00 +0200
+Subject: [PATCH] conncache: include the zone id in the "bundle" hashkey
+
+Make connections to two separate IPv6 zone ids create separate
+connections.
+
+Reported-by: Harry Sintonen
+Bug: https://curl.se/docs/CVE-2022-27775.html
+Closes #8747
+---
+ lib/conncache.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+CVE: CVE-2022-27775
+Upstream-Status: Backport [https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705.patch]
+Comment: Refreshed patch
+Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
+
+diff --git a/lib/conncache.c b/lib/conncache.c
+index ec669b971dc3..8948b53fa500 100644
+--- a/lib/conncache.c
++++ b/lib/conncache.c
+@@ -156,8 +156,12 @@
+ /* report back which name we used */
+ *hostp = hostname;
+
+- /* put the number first so that the hostname gets cut off if too long */
+- msnprintf(buf, len, "%ld%s", port, hostname);
++ /* put the numbers first so that the hostname gets cut off if too long */
++#ifdef ENABLE_IPV6
++ msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
++#else
++ msnprintf(buf, len, "%ld/%s", port, hostname);
++#endif
+ }
+
+ /* Returns number of connections currently held in the connection cache.
diff --git a/meta/recipes-support/curl/curl/CVE-2022-27776.patch b/meta/recipes-support/curl/curl/CVE-2022-27776.patch
new file mode 100644
index 0000000000..1a13df2d95
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2022-27776.patch
@@ -0,0 +1,114 @@
+From 6e659993952aa5f90f48864be84a1bbb047fc258 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 25 Apr 2022 13:05:40 +0200
+Subject: [PATCH] http: avoid auth/cookie on redirects same host diff port
+
+CVE-2022-27776
+
+Reported-by: Harry Sintonen
+Bug: https://curl.se/docs/CVE-2022-27776.html
+Closes #8749
+---
+ lib/http.c | 34 ++++++++++++++++++++++------------
+ lib/urldata.h | 16 +++++++++-------
+ 2 files changed, 31 insertions(+), 19 deletions(-)
+
+CVE: CVE-2022-27776
+Upstream-Status: Backport [https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258.patch]
+Comment: Refreshed patch
+Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
+
+diff --git a/lib/http.c b/lib/http.c
+index ce79fc4e31c8..f0476f3b9272 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -731,6 +731,21 @@
+ return CURLE_OK;
+ }
+
++/*
++ * allow_auth_to_host() tells if autentication, cookies or other "sensitive
++ * data" can (still) be sent to this host.
++ */
++static bool allow_auth_to_host(struct Curl_easy *data)
++{
++ struct connectdata *conn = data->conn;
++ return (!data->state.this_is_a_follow ||
++ data->set.allow_auth_to_other_hosts ||
++ (data->state.first_host &&
++ strcasecompare(data->state.first_host, conn->host.name) &&
++ (data->state.first_remote_port == conn->remote_port) &&
++ (data->state.first_remote_protocol == conn->handler->protocol)));
++}
++
+ /**
+ * Curl_http_output_auth() setups the authentication headers for the
+ * host/proxy and the correct authentication
+@@ -799,15 +799,12 @@
+ with it */
+ authproxy->done = TRUE;
+
+- /* To prevent the user+password to get sent to other than the original
+- host due to a location-follow, we do some weirdo checks here */
+- if(!data->state.this_is_a_follow ||
+- conn->bits.netrc ||
+- !data->state.first_host ||
+- data->set.allow_auth_to_other_hosts ||
+- strcasecompare(data->state.first_host, conn->host.name)) {
++ /* To prevent the user+password to get sent to other than the original host
++ due to a location-follow */
++ if(allow_auth_to_host(data)
++ || conn->bits.netrc
++ )
+ result = output_auth_headers(conn, authhost, request, path, FALSE);
+- }
+ else
+ authhost->done = TRUE;
+
+@@ -1879,10 +1891,7 @@
+ checkprefix("Cookie:", compare)) &&
+ /* be careful of sending this potentially sensitive header to
+ other hosts */
+- (data->state.this_is_a_follow &&
+- data->state.first_host &&
+- !data->set.allow_auth_to_other_hosts &&
+- !strcasecompare(data->state.first_host, conn->host.name)))
++ !allow_auth_to_host(data))
+ ;
+ else {
+ result = Curl_add_bufferf(&req_buffer, "%s\r\n", compare);
+@@ -2065,6 +2074,7 @@
+ return CURLE_OUT_OF_MEMORY;
+
+ data->state.first_remote_port = conn->remote_port;
++ data->state.first_remote_protocol = conn->handler->protocol;
+ }
+
+ if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 1d89b8d7fa68..ef2174d9e727 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1342,13 +1342,15 @@
+ char *ulbuf; /* allocated upload buffer or NULL */
+ curl_off_t current_speed; /* the ProgressShow() function sets this,
+ bytes / second */
+- char *first_host; /* host name of the first (not followed) request.
+- if set, this should be the host name that we will
+- sent authorization to, no else. Used to make Location:
+- following not keep sending user+password... This is
+- strdup() data.
+- */
+- int first_remote_port; /* remote port of the first (not followed) request */
++
++ /* host name, port number and protocol of the first (not followed) request.
++ if set, this should be the host name that we will sent authorization to,
++ no else. Used to make Location: following not keep sending user+password.
++ This is strdup()ed data. */
++ char *first_host;
++ int first_remote_port;
++ unsigned int first_remote_protocol;
++
+ struct curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
+ long sessionage; /* number of the most recent session */
+ unsigned int tempcount; /* number of entries in use in tempwrite, 0 - 3 */
diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb
index bc1b993e9e..e850376ff8 100644
--- a/meta/recipes-support/curl/curl_7.69.1.bb
+++ b/meta/recipes-support/curl/curl_7.69.1.bb
@@ -25,6 +25,9 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \
file://CVE-2021-22946-pre1.patch \
file://CVE-2021-22946.patch \
file://CVE-2021-22947.patch \
+ file://CVE-2022-27776.patch \
+ file://CVE-2022-27775.patch \
+ file://CVE-2022-22576.patch \
"
SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 3/9] tiff: Add patches to fix multiple CVEs
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 1/9] vim: Upgrade 8.2.4681 -> 8.2.4912 Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 2/9] curl: Fix CVEs for curl Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 4/9] freetype: Fix CVEs for freetype Steve Sakoman
` (5 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Add patches to fix below CVE issues
CVE-2022-0865
CVE-2022-0907
CVE-2022-0908
CVE-2022-0909
CVE-2022-0924
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libtiff/files/CVE-2022-0865.patch | 39 ++++++++
.../libtiff/files/CVE-2022-0907.patch | 94 +++++++++++++++++++
.../libtiff/files/CVE-2022-0908.patch | 34 +++++++
.../libtiff/files/CVE-2022-0909.patch | 37 ++++++++
.../libtiff/files/CVE-2022-0924.patch | 58 ++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 5 +
6 files changed, 267 insertions(+)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
new file mode 100644
index 0000000000..e2d136f587
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
@@ -0,0 +1,39 @@
+From a1c933dabd0e1c54a412f3f84ae0aa58115c6067 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Thu, 24 Feb 2022 22:26:02 +0100
+Subject: [PATCH] tif_jbig.c: fix crash when reading a file with multiple IFD
+ in memory-mapped mode and when bit reversal is needed (fixes #385)
+
+CVE: CVE-2022-0865
+Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0865.patch/]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+Comment: No change in any hunk
+
+---
+ libtiff/tif_jbig.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/libtiff/tif_jbig.c b/libtiff/tif_jbig.c
+index 74086338..8bfa4cef 100644
+--- a/libtiff/tif_jbig.c
++++ b/libtiff/tif_jbig.c
+@@ -208,6 +208,16 @@ int TIFFInitJBIG(TIFF* tif, int scheme)
+ */
+ tif->tif_flags |= TIFF_NOBITREV;
+ tif->tif_flags &= ~TIFF_MAPPED;
++ /* We may have read from a previous IFD and thus set TIFF_BUFFERMMAP and
++ * cleared TIFF_MYBUFFER. It is necessary to restore them to their initial
++ * value to be consistent with the state of a non-memory mapped file.
++ */
++ if (tif->tif_flags&TIFF_BUFFERMMAP) {
++ tif->tif_rawdata = NULL;
++ tif->tif_rawdatasize = 0;
++ tif->tif_flags &= ~TIFF_BUFFERMMAP;
++ tif->tif_flags |= TIFF_MYBUFFER;
++ }
+
+ /* Setup the function pointers for encode, decode, and cleanup. */
+ tif->tif_setupdecode = JBIGSetupDecode;
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
new file mode 100644
index 0000000000..da3ead5481
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
@@ -0,0 +1,94 @@
+From 40b00cfb32256d377608b4d4cd30fac338d0a0bc Mon Sep 17 00:00:00 2001
+From: Augustus <wangdw.augustus@qq.com>
+Date: Mon, 7 Mar 2022 18:21:49 +0800
+Subject: [PATCH] add checks for return value of limitMalloc (#392)
+
+CVE: CVE-2022-0907
+Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0907.patch/]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+Comment: No change in any hunk
+
+---
+ tools/tiffcrop.c | 33 +++++++++++++++++++++------------
+ 1 file changed, 21 insertions(+), 12 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index f2e5474a..9b8acc7e 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -7337,7 +7337,11 @@ createImageSection(uint32_t sectsize, unsigned char **sect_buff_ptr)
+ if (!sect_buff)
+ {
+ sect_buff = (unsigned char *)_TIFFmalloc(sectsize);
+- *sect_buff_ptr = sect_buff;
++ if (!sect_buff)
++ {
++ TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
++ return (-1);
++ }
+ _TIFFmemset(sect_buff, 0, sectsize);
+ }
+ else
+@@ -7353,15 +7357,15 @@ createImageSection(uint32_t sectsize, unsigned char **sect_buff_ptr)
+ else
+ sect_buff = new_buff;
+
++ if (!sect_buff)
++ {
++ TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
++ return (-1);
++ }
+ _TIFFmemset(sect_buff, 0, sectsize);
+ }
+ }
+
+- if (!sect_buff)
+- {
+- TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
+- return (-1);
+- }
+ prev_sectsize = sectsize;
+ *sect_buff_ptr = sect_buff;
+
+@@ -7628,7 +7632,11 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
+ if (!crop_buff)
+ {
+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
+- *crop_buff_ptr = crop_buff;
++ if (!crop_buff)
++ {
++ TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
++ return (-1);
++ }
+ _TIFFmemset(crop_buff, 0, cropsize);
+ prev_cropsize = cropsize;
+ }
+@@ -7644,15 +7652,15 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
+ }
+ else
+ crop_buff = new_buff;
++ if (!crop_buff)
++ {
++ TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
++ return (-1);
++ }
+ _TIFFmemset(crop_buff, 0, cropsize);
+ }
+ }
+
+- if (!crop_buff)
+- {
+- TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
+- return (-1);
+- }
+ *crop_buff_ptr = crop_buff;
+
+ if (crop->crop_mode & CROP_INVERT)
+@@ -9211,3 +9219,4 @@ invertImage(uint16_t photometric, uint16_t spp, uint16_t bps, uint32_t width, ui
+ * fill-column: 78
+ * End:
+ */
++
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
new file mode 100644
index 0000000000..e65af6c600
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
@@ -0,0 +1,34 @@
+From a95b799f65064e4ba2e2dfc206808f86faf93e85 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Thu, 17 Feb 2022 15:28:43 +0100
+Subject: [PATCH] TIFFFetchNormalTag(): avoid calling memcpy() with a null
+ source pointer and size of zero (fixes #383)
+
+CVE: CVE-2022-0908
+Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0908.patch/]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+Comment: No change in any hunk
+
+---
+ libtiff/tif_dirread.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index 50ebf8ac..2ec44a4f 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -5021,7 +5021,10 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
+ _TIFFfree(data);
+ return(0);
+ }
+- _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
++ if (dp->tdir_count > 0 )
++ {
++ _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
++ }
+ o[(uint32)dp->tdir_count]=0;
+ if (data!=0)
+ _TIFFfree(data);
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
new file mode 100644
index 0000000000..d487f1bd95
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
@@ -0,0 +1,37 @@
+From 32ea0722ee68f503b7a3f9b2d557acb293fc8cde Mon Sep 17 00:00:00 2001
+From: 4ugustus <wangdw.augustus@qq.com>
+Date: Tue, 8 Mar 2022 16:22:04 +0000
+Subject: [PATCH] fix the FPE in tiffcrop (#393)
+
+CVE: CVE-2022-0909
+Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0909.patch/]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+Comment: No change in any hunk
+
+---
+ libtiff/tif_dir.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 57055ca9..59b346ca 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -334,13 +334,13 @@ _TIFFVSetField(TIFF* tif, uint32_t tag, va_list ap)
+ break;
+ case TIFFTAG_XRESOLUTION:
+ dblval = va_arg(ap, double);
+- if( dblval < 0 )
++ if( dblval != dblval || dblval < 0 )
+ goto badvaluedouble;
+ td->td_xresolution = _TIFFClampDoubleToFloat( dblval );
+ break;
+ case TIFFTAG_YRESOLUTION:
+ dblval = va_arg(ap, double);
+- if( dblval < 0 )
++ if( dblval != dblval || dblval < 0 )
+ goto badvaluedouble;
+ td->td_yresolution = _TIFFClampDoubleToFloat( dblval );
+ break;
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
new file mode 100644
index 0000000000..ddb035c972
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
@@ -0,0 +1,58 @@
+From 88d79a45a31c74cba98c697892fed5f7db8b963a Mon Sep 17 00:00:00 2001
+From: 4ugustus <wangdw.augustus@qq.com>
+Date: Thu, 10 Mar 2022 08:48:00 +0000
+Subject: [PATCH] fix heap buffer overflow in tiffcp (#278)
+
+CVE: CVE-2022-0924
+Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0924.patch/]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+Comment: No change in any hunk
+
+---
+ tools/tiffcp.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 224583e0..aa32b118 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -1524,12 +1524,27 @@ DECLAREwriteFunc(writeBufferToSeparateSt
+ tdata_t obuf;
+ tstrip_t strip = 0;
+ tsample_t s;
++ uint16 bps = 0, bytes_per_sample;
+
+ obuf = _TIFFmalloc(stripsize);
+ if (obuf == NULL)
+ return (0);
+ _TIFFmemset(obuf, 0, stripsize);
+ (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
++ (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
++ if( bps == 0 )
++ {
++ TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
++ _TIFFfree(obuf);
++ return 0;
++ }
++ if( (bps % 8) != 0 )
++ {
++ TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
++ _TIFFfree(obuf);
++ return 0;
++ }
++ bytes_per_sample = bps/8;
+ for (s = 0; s < spp; s++) {
+ uint32 row;
+ for (row = 0; row < imagelength; row += rowsperstrip) {
+@@ -1539,7 +1539,7 @@ DECLAREwriteFunc(writeBufferToSeparateSt
+
+ cpContigBufToSeparateBuf(
+ obuf, (uint8*) buf + row*rowsize + s,
+- nrows, imagewidth, 0, 0, spp, 1);
++ nrows, imagewidth, 0, 0, spp, bytes_per_sample);
+ if (TIFFWriteEncodedStrip(out, strip++, obuf, stripsize) < 0) {
+ TIFFError(TIFFFileName(out),
+ "Error, can't write strip %u",
+--
+GitLab
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
index e3ffb12f9e..75bc20de78 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
@@ -18,7 +18,12 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch \
file://561599c99f987dc32ae110370cfdd7df7975586b.patch \
file://eecb0712f4c3a5b449f70c57988260a667ddbdef.patch \
+ file://CVE-2022-0865.patch \
+ file://CVE-2022-0908.patch \
+ file://CVE-2022-0907.patch \
+ file://CVE-2022-0909.patch \
file://CVE-2022-0891.patch \
+ file://CVE-2022-0924.patch \
"
SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424"
SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 4/9] freetype: Fix CVEs for freetype
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (2 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 3/9] tiff: Add patches to fix multiple CVEs Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 5/9] git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE Steve Sakoman
` (4 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Apply below patches to fix the CVEs for freetype:
CVE-2022-27404.patch
Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db.patch
CVE-2022-27405.patch
Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5.patch
CVE-2022-27406.patch
Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/0c2bdb01a2e1d24a3e592377a6d0822856e10df2.patch
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../freetype/freetype/CVE-2022-27404.patch | 33 ++++++++++++++++
.../freetype/freetype/CVE-2022-27405.patch | 38 +++++++++++++++++++
.../freetype/freetype/CVE-2022-27406.patch | 31 +++++++++++++++
.../freetype/freetype_2.10.1.bb | 3 ++
4 files changed, 105 insertions(+)
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27404.patch
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27405.patch
create mode 100644 meta/recipes-graphics/freetype/freetype/CVE-2022-27406.patch
diff --git a/meta/recipes-graphics/freetype/freetype/CVE-2022-27404.patch b/meta/recipes-graphics/freetype/freetype/CVE-2022-27404.patch
new file mode 100644
index 0000000000..e66400ddb1
--- /dev/null
+++ b/meta/recipes-graphics/freetype/freetype/CVE-2022-27404.patch
@@ -0,0 +1,33 @@
+From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Thu, 17 Mar 2022 19:24:16 +0100
+Subject: [PATCH] [sfnt] Avoid invalid face index.
+
+Fixes #1138.
+
+* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font):
+Check `face_index` before decrementing.
+
+CVE: CVE-2022-27404
+Upstream-Status: Backport [https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db.patch]
+Comment: Removed second hunk as sfwoff2.c file is not part of current v2.10.1 code
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+---
+ src/sfnt/sfobjs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c
+index f9d4d3858..9771c35df 100644
+--- a/src/sfnt/sfobjs.c
++++ b/src/sfnt/sfobjs.c
+@@ -566,7 +566,7 @@
+ face_index = FT_ABS( face_instance_index ) & 0xFFFF;
+
+ /* value -(N+1) requests information on index N */
+- if ( face_instance_index < 0 )
++ if ( face_instance_index < 0 && face_index > 0 )
+ face_index--;
+
+ if ( face_index >= face->ttc_header.count )
+--
+GitLab
diff --git a/meta/recipes-graphics/freetype/freetype/CVE-2022-27405.patch b/meta/recipes-graphics/freetype/freetype/CVE-2022-27405.patch
new file mode 100644
index 0000000000..08fccd5a3b
--- /dev/null
+++ b/meta/recipes-graphics/freetype/freetype/CVE-2022-27405.patch
@@ -0,0 +1,38 @@
+From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Sat, 19 Mar 2022 06:40:17 +0100
+Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard
+ `face_index`.
+We must ensure that the cast to `FT_Int` doesn't change the sign.
+Fixes #1139.
+
+CVE: CVE-2022-27405
+Upstream-Status: Backport [https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5]
+Comment: No Change in any hunk
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+---
+ src/base/ftobjs.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
+index 2c0f0e6c9..10952a6c6 100644
+--- a/src/base/ftobjs.c
++++ b/src/base/ftobjs.c
+@@ -2527,6 +2527,15 @@
+ #endif
+
+
++ /* only use lower 31 bits together with sign bit */
++ if ( face_index > 0 )
++ face_index &= 0x7FFFFFFFL;
++ else
++ {
++ face_index &= 0x7FFFFFFFL;
++ face_index = -face_index;
++ }
++
+ #ifdef FT_DEBUG_LEVEL_TRACE
+ FT_TRACE3(( "FT_Open_Face: " ));
+ if ( face_index < 0 )
+--
+GitLab
diff --git a/meta/recipes-graphics/freetype/freetype/CVE-2022-27406.patch b/meta/recipes-graphics/freetype/freetype/CVE-2022-27406.patch
new file mode 100644
index 0000000000..4b5e629f30
--- /dev/null
+++ b/meta/recipes-graphics/freetype/freetype/CVE-2022-27406.patch
@@ -0,0 +1,31 @@
+From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Sat, 19 Mar 2022 09:37:28 +0100
+Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`.
+
+Fixes #1140.
+
+CVE: CVE-2022-27406
+Upstream-Status: Backport [https://gitlab.freedesktop.org/freetype/freetype/-/commit/0c2bdb01a2e1d24a3e592377a6d0822856e10df2]
+Comment: No Change in any hunk
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+---
+ src/base/ftobjs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
+index 6492a1517..282c9121a 100644
+--- a/src/base/ftobjs.c
++++ b/src/base/ftobjs.c
+@@ -3409,6 +3409,9 @@
+ if ( !face )
+ return FT_THROW( Invalid_Face_Handle );
+
++ if ( !face->size )
++ return FT_THROW( Invalid_Size_Handle );
++
+ if ( !req || req->width < 0 || req->height < 0 ||
+ req->type >= FT_SIZE_REQUEST_TYPE_MAX )
+ return FT_THROW( Invalid_Argument );
+--
+GitLab
diff --git a/meta/recipes-graphics/freetype/freetype_2.10.1.bb b/meta/recipes-graphics/freetype/freetype_2.10.1.bb
index 2d444bbf19..72001c529a 100644
--- a/meta/recipes-graphics/freetype/freetype_2.10.1.bb
+++ b/meta/recipes-graphics/freetype/freetype_2.10.1.bb
@@ -15,6 +15,9 @@ LIC_FILES_CHKSUM = "file://docs/LICENSE.TXT;md5=4af6221506f202774ef74f64932878a1
SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/${BPN}/${BP}.tar.xz \
file://use-right-libtool.patch \
file://0001-sfnt-Fix-heap-buffer-overflow-59308.patch \
+ file://CVE-2022-27404.patch \
+ file://CVE-2022-27405.patch \
+ file://CVE-2022-27406.patch \
"
SRC_URI[md5sum] = "bd42e75127f8431923679480efb5ba8f"
SRC_URI[sha256sum] = "16dbfa488a21fe827dc27eaf708f42f7aa3bb997d745d31a19781628c36ba26f"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 5/9] git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (3 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 4/9] freetype: Fix CVEs for freetype Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 6/9] openssl: Minor security upgrade 1.1.1n to 1.1.1o Steve Sakoman
` (3 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Use CVE_CHECK_WHITELIST as CVE_CHECK_IGNORE is not valid on dunfell
branch
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/git/git.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/git/git.inc b/meta/recipes-devtools/git/git.inc
index 879920d97e..b5d0004712 100644
--- a/meta/recipes-devtools/git/git.inc
+++ b/meta/recipes-devtools/git/git.inc
@@ -22,7 +22,7 @@ CVE_PRODUCT = "git-scm:git"
# This is about a manpage not mentioning --mirror may "leak" information
# in mirrored git repos. Most OE users wouldn't build the docs and
# we don't see this as a major issue for our general users/usecases.
-CVE_CHECK_IGNORE += "CVE-2022-24975"
+CVE_CHECK_WHITELIST += "CVE-2022-24975"
PACKAGECONFIG ??= ""
PACKAGECONFIG[cvsserver] = ""
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 6/9] openssl: Minor security upgrade 1.1.1n to 1.1.1o
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (4 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 5/9] git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 7/9] linux-firmware: replace mkdir by install Steve Sakoman
` (2 subsequent siblings)
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
This security upgrade fixes CVE-2022-1292 as per below link
Link: https://www.openssl.org/news/cl111.txt
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../openssl/{openssl_1.1.1n.bb => openssl_1.1.1o.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1n.bb => openssl_1.1.1o.bb} (98%)
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1n.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1o.bb
similarity index 98%
rename from meta/recipes-connectivity/openssl/openssl_1.1.1n.bb
rename to meta/recipes-connectivity/openssl/openssl_1.1.1o.bb
index 8538bd5a18..c9cfc759c9 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1n.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.1o.bb
@@ -24,7 +24,7 @@ SRC_URI_append_class-nativesdk = " \
file://environment.d-openssl.sh \
"
-SRC_URI[sha256sum] = "40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a"
+SRC_URI[sha256sum] = "9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f"
inherit lib_package multilib_header multilib_script ptest
MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 7/9] linux-firmware: replace mkdir by install
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (5 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 6/9] openssl: Minor security upgrade 1.1.1n to 1.1.1o Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 8/9] linux-firmware: upgrade 20220411 -> 20220509 Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 9/9] selftest: skip virgl test on alma 8.6 Steve Sakoman
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Konrad Weihmann <kweihmann@outlook.com>
if a setup is using RPM for packaging and there are multiple
recipes that install to ${nonarch_base_libdir}/firmware by using
install -d ${nonarch_base_libdir}/firmware, it will create installation
clashes on image install, as linux-firmware in before this patch
used mkdir -p, which creates different file mode bits (depending
on the current user's settings).
In a particular example
linux-fimware created /lib/firmware with 0600
while other-firmware-package created it with 0644
making the combination not installable by rpm backend
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 98bf3f427702687bf81ed759e7cde5d6d15e77eb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...01-Makefile-replace-mkdir-by-install.patch | 84 +++++++++++++++++++
.../linux-firmware/linux-firmware_20220411.bb | 5 +-
2 files changed, 88 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-kernel/linux-firmware/files/0001-Makefile-replace-mkdir-by-install.patch
diff --git a/meta/recipes-kernel/linux-firmware/files/0001-Makefile-replace-mkdir-by-install.patch b/meta/recipes-kernel/linux-firmware/files/0001-Makefile-replace-mkdir-by-install.patch
new file mode 100644
index 0000000000..b1ac5a16ab
--- /dev/null
+++ b/meta/recipes-kernel/linux-firmware/files/0001-Makefile-replace-mkdir-by-install.patch
@@ -0,0 +1,84 @@
+From 71514e74f35f2b51ca24062573d6d913525b30db Mon Sep 17 00:00:00 2001
+From: Konrad Weihmann <kweihmann@outlook.com>
+Date: Mon, 9 May 2022 12:57:57 +0200
+Subject: [PATCH] Makefile: replace mkdir by install
+
+mkdir -p creates paths that are bound to user's settings and therefore
+can lead to different file mode bits of the base paths accross different
+machines.
+Use install instead, as this tool is not prone to such behavior.
+
+Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
+Upstream-Status: Submitted [https://lore.kernel.org/linux-firmware/PR2PR09MB310088EA719E6D7CA5C268F1A8C69@PR2PR09MB3100.eurprd09.prod.outlook.com/]
+---
+ Makefile | 2 +-
+ carl9170fw/toolchain/Makefile | 4 ++--
+ copy-firmware.sh | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index e1c362f..83a0ec6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -9,5 +9,5 @@ check:
+ @./check_whence.py
+
+ install:
+- mkdir -p $(DESTDIR)$(FIRMWAREDIR)
++ install -d $(DESTDIR)$(FIRMWAREDIR)
+ ./copy-firmware.sh $(DESTDIR)$(FIRMWAREDIR)
+diff --git a/carl9170fw/toolchain/Makefile b/carl9170fw/toolchain/Makefile
+index 2b25ffe..aaea8e8 100644
+--- a/carl9170fw/toolchain/Makefile
++++ b/carl9170fw/toolchain/Makefile
+@@ -46,14 +46,14 @@ src/gcc-$(GCC_VER): src/$(GCC_TAR) src/newlib-$(NEWLIB_VER)
+ ln -s $(BASEDIR)/src/newlib-$(NEWLIB_VER)/libgloss $@
+
+ binutils: src/binutils-$(BINUTILS_VER)
+- mkdir -p build/binutils
++ install -d build/binutils
+ cd build/binutils; \
+ $(BASEDIR)/$</configure --target=sh-elf --prefix=$(BASEDIR)/inst; \
+ $(MAKE) -j3; \
+ $(MAKE) install
+
+ gcc: src/gcc-$(GCC_VER) binutils
+- mkdir -p build/gcc
++ install -d build/gcc
+ cd build/gcc; \
+ $(BASEDIR)/$</configure --target=sh-elf --prefix=$(BASEDIR)/inst -enable-languages=c --without-pkgversion --with-newlib; \
+ $(MAKE) -j3; \
+diff --git a/copy-firmware.sh b/copy-firmware.sh
+index 9b46b63..bbacb92 100755
+--- a/copy-firmware.sh
++++ b/copy-firmware.sh
+@@ -34,7 +34,7 @@ done
+ grep '^File:' WHENCE | sed -e's/^File: *//g' -e's/"//g' | while read f; do
+ test -f "$f" || continue
+ $verbose "copying file $f"
+- mkdir -p $destdir/$(dirname "$f")
++ install -d $destdir/$(dirname "$f")
+ cp -d "$f" $destdir/"$f"
+ done
+
+@@ -42,7 +42,7 @@ grep -E '^Link:' WHENCE | sed -e's/^Link: *//g' -e's/-> //g' | while read f d; d
+ if test -L "$f"; then
+ test -f "$destdir/$f" && continue
+ $verbose "copying link $f"
+- mkdir -p $destdir/$(dirname "$f")
++ install -d $destdir/$(dirname "$f")
+ cp -d "$f" $destdir/"$f"
+
+ if test "x$d" != "x"; then
+@@ -63,7 +63,7 @@ grep -E '^Link:' WHENCE | sed -e's/^Link: *//g' -e's/-> //g' | while read f d; d
+ fi
+ else
+ $verbose "creating link $f -> $d"
+- mkdir -p $destdir/$(dirname "$f")
++ install -d $destdir/$(dirname "$f")
+ ln -sf "$d" "$destdir/$f"
+ fi
+ done
+--
+2.25.1
+
diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb
index ad8dbac17f..34ed0c04c4 100644
--- a/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb
+++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb
@@ -203,7 +203,10 @@ NO_GENERIC_LICENSE[WHENCE] = "WHENCE"
PE = "1"
-SRC_URI = "${KERNELORG_MIRROR}/linux/kernel/firmware/${BPN}-${PV}.tar.xz"
+SRC_URI = "\
+ ${KERNELORG_MIRROR}/linux/kernel/firmware/${BPN}-${PV}.tar.xz \
+ file://0001-Makefile-replace-mkdir-by-install.patch \
+"
SRC_URI[sha256sum] = "020b11f6412f4956f5a6f98de7d41867d2b30ea0ce81b1e2d206ec9840363849"
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 8/9] linux-firmware: upgrade 20220411 -> 20220509
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (6 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 7/9] linux-firmware: replace mkdir by install Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 9/9] selftest: skip virgl test on alma 8.6 Steve Sakoman
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
From: Dmitry Baryshkov <dbaryshkov@gmail.com>
License-Update: additional files
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 85b1fef733683be09a1efdb2d8b8ffe543053ace)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...{linux-firmware_20220411.bb => linux-firmware_20220509.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20220411.bb => linux-firmware_20220509.bb} (99%)
diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20220509.bb
similarity index 99%
rename from meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb
rename to meta/recipes-kernel/linux-firmware/linux-firmware_20220509.bb
index 34ed0c04c4..ec92cae2fa 100644
--- a/meta/recipes-kernel/linux-firmware/linux-firmware_20220411.bb
+++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20220509.bb
@@ -132,7 +132,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \
file://LICENCE.xc4000;md5=0ff51d2dc49fce04814c9155081092f0 \
file://LICENCE.xc5000;md5=1e170c13175323c32c7f4d0998d53f66 \
file://LICENCE.xc5000c;md5=12b02efa3049db65d524aeb418dd87ca \
- file://WHENCE;md5=4cf67d71a21887c682c3989a4318745e \
+ file://WHENCE;md5=d3eb82686904888f8bbbe8d865371404 \
"
# These are not common licenses, set NO_GENERIC_LICENSE for them
@@ -208,7 +208,7 @@ SRC_URI = "\
file://0001-Makefile-replace-mkdir-by-install.patch \
"
-SRC_URI[sha256sum] = "020b11f6412f4956f5a6f98de7d41867d2b30ea0ce81b1e2d206ec9840363849"
+SRC_URI[sha256sum] = "376e0b3d7b4f8aaa2abf7f5ab74803dcf14b06b94e3d841b1467cd9a2848255e"
inherit allarch
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 9/9] selftest: skip virgl test on alma 8.6
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
` (7 preceding siblings ...)
2022-05-18 2:30 ` [OE-core][dunfell 8/9] linux-firmware: upgrade 20220411 -> 20220509 Steve Sakoman
@ 2022-05-18 2:30 ` Steve Sakoman
8 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-05-18 2:30 UTC (permalink / raw)
To: openembedded-core
This test will fail any time the host has libdrm > 2.4.107
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/lib/oeqa/selftest/cases/runtime_test.py b/meta/lib/oeqa/selftest/cases/runtime_test.py
index 20dc1c9482..3f78a18603 100644
--- a/meta/lib/oeqa/selftest/cases/runtime_test.py
+++ b/meta/lib/oeqa/selftest/cases/runtime_test.py
@@ -175,6 +175,8 @@ class TestImage(OESelftestTestCase):
if "DISPLAY" not in os.environ:
self.skipTest("virgl gtk test must be run inside a X session")
distro = oe.lsb.distro_identifier()
+ if distro and distro == 'almalinux-8.6':
+ self.skipTest('virgl isn\'t working with Alma 8')
if distro and distro == 'debian-8':
self.skipTest('virgl isn\'t working with Debian 8')
if distro and distro == 'centos-7':
--
2.25.1
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2022-09-14 2:25 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-09-14 2:25 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4224
The following changes since commit c9a9d5a1f7fbe88422ccee542a89afbc4c5336e4:
vim: Upgrade 9.0.0242 -> 9.0.0341 (2022-09-07 04:40:43 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Chee Yang Lee (3):
connman: fix CVE-2022-32292
gnutls: fix CVE-2021-4209
virglrenderer: fix CVE-2022-0135
Florin Diaconescu (1):
binutils : CVE-2022-38533
Khan@kpit.com (1):
python3: Fix CVE-2021-28861 for python3
Virendra Thakur (1):
tiff: Fix for CVE-2022-2867/8/9
Yi Zhao (1):
tiff: Security fixes CVE-2022-1354 and CVE-2022-1355
niko.mauno@vaisala.com (2):
systemd: Fix unwritable /var/lock when no sysvinit handling
systemd: Add 'no-dns-fallback' PACKAGECONFIG option
.../connman/connman/CVE-2022-32292.patch | 37 +++
.../connman/connman_1.37.bb | 1 +
.../systemd/systemd/00-create-volatile.conf | 1 +
meta/recipes-core/systemd/systemd_244.5.bb | 1 +
.../binutils/binutils-2.34.inc | 1 +
.../binutils/binutils/CVE-2022-38533.patch | 37 +++
.../python/python3/CVE-2021-28861.patch | 135 +++++++++++
.../recipes-devtools/python/python3_3.8.13.bb | 1 +
.../virglrenderer/CVE-2022-0135.patch | 100 +++++++++
.../virglrenderer/virglrenderer_0.8.2.bb | 1 +
...022-2867-CVE-2022-2868-CVE-2022-2869.patch | 159 +++++++++++++
.../libtiff/tiff/CVE-2022-1354.patch | 212 ++++++++++++++++++
.../libtiff/tiff/CVE-2022-1355.patch | 62 +++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 3 +
.../gnutls/gnutls/CVE-2021-4209.patch | 37 +++
meta/recipes-support/gnutls/gnutls_3.6.14.bb | 1 +
16 files changed, 789 insertions(+)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2022-38533.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2021-28861.patch
create mode 100644 meta/recipes-graphics/virglrenderer/virglrenderer/CVE-2022-0135.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-1354.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-1355.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2021-4209.patch
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2022-10-13 16:36 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2022-10-13 16:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4330
The following changes since commit dbad46a0079843b380cf3dda6008b12ab9526688:
build-appliance-image: Update to dunfell head revision (2022-10-06 23:23:20 +0100)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Hitendra Prajapati (2):
dhcp: Fix CVE-2022-2928 & CVE-2022-2929
qemu: CVE-2021-3750 hcd-ehci: DMA reentrancy issue leads to
use-after-free
John Edward Broadbent (1):
externalsrc: git submodule--helper list unsupported
Michael Halstead (1):
uninative: Upgrade to 3.7 to work with glibc 2.36
Richard Purdie (1):
qemu: Avoid accidental librdmacm linkage
Steve Sakoman (3):
selftest: skip virgl test on ubuntu 22.04
qemu: Avoid accidental libvdeplug linkage
qemu: Add PACKAGECONFIG for rbd
Tim Orling (1):
python3: upgrade 3.8.13 -> 3.8.14
meta/classes/externalsrc.bbclass | 19 +-
meta/conf/distro/include/yocto-uninative.inc | 10 +-
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
.../dhcp/dhcp/CVE-2022-2928.patch | 120 ++++++++++++
.../dhcp/dhcp/CVE-2022-2929.patch | 40 ++++
meta/recipes-connectivity/dhcp/dhcp_4.4.2.bb | 2 +
.../python/python3/CVE-2021-28861.patch | 135 -------------
.../{python3_3.8.13.bb => python3_3.8.14.bb} | 5 +-
meta/recipes-devtools/qemu/qemu.inc | 4 +
.../qemu/qemu/CVE-2021-3750.patch | 180 ++++++++++++++++++
10 files changed, 365 insertions(+), 152 deletions(-)
create mode 100644 meta/recipes-connectivity/dhcp/dhcp/CVE-2022-2928.patch
create mode 100644 meta/recipes-connectivity/dhcp/dhcp/CVE-2022-2929.patch
delete mode 100644 meta/recipes-devtools/python/python3/CVE-2021-28861.patch
rename meta/recipes-devtools/python/{python3_3.8.13.bb => python3_3.8.14.bb} (98%)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-3750.patch
--
2.25.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2023-04-30 16:25 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2023-04-30 16:25 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5239
The following changes since commit d1943e6a0ec00653c81cd4c0bb0d6b7e0909094c:
go: fix CVE-2023-24537 Infinite loop in parsing (2023-04-21 04:15:45 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Christoph Lauer (1):
populate_sdk_base: add zip options
Nikhil R (1):
openssl: Fix CVE-2023-0464
Omkar Patil (2):
openssl: Fix CVE-2023-0465
openssl: Fix CVE-2023-0466
Shubham Kulkarni (1):
go: Ignore CVE-2022-1705
Vijay Anusuri (2):
sudo: Security fix for CVE-2023-28486 and CVE-2023-28487
curl: Security fix CVE-2023-27533, CVE-2023-27535 and CVE-2023-27536
Virendra Thakur (1):
qemu: Whitelist CVE-2023-0664
Vivek Kumbhar (1):
go: fix CVE-2023-24534 denial of service from excessive memory
allocation
meta/classes/populate_sdk_base.bbclass | 4 +-
.../openssl/openssl/CVE-2023-0464.patch | 226 ++++++
.../openssl/openssl/CVE-2023-0465.patch | 60 ++
.../openssl/openssl/CVE-2023-0466.patch | 82 +++
.../openssl/openssl_1.1.1t.bb | 3 +
meta/recipes-devtools/go/go-1.14.inc | 4 +
.../go/go-1.14/CVE-2023-24534.patch | 200 ++++++
meta/recipes-devtools/qemu/qemu.inc | 5 +
.../CVE-2023-28486_CVE-2023-28487-1.patch | 646 ++++++++++++++++++
.../CVE-2023-28486_CVE-2023-28487-2.patch | 26 +
meta/recipes-extended/sudo/sudo_1.8.32.bb | 2 +
.../curl/curl/CVE-2023-27533.patch | 59 ++
.../curl/curl/CVE-2023-27535-pre1.patch | 236 +++++++
.../curl/curl/CVE-2023-27535.patch | 170 +++++
.../curl/curl/CVE-2023-27536.patch | 55 ++
meta/recipes-support/curl/curl_7.69.1.bb | 4 +
16 files changed, 1781 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24534.patch
create mode 100644 meta/recipes-extended/sudo/sudo/CVE-2023-28486_CVE-2023-28487-1.patch
create mode 100644 meta/recipes-extended/sudo/sudo/CVE-2023-28486_CVE-2023-28487-2.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27533.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27535-pre1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27535.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27536.patch
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][dunfell 0/9] Patch review
@ 2024-02-22 14:30 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-02-22 14:30 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Monday, February 26
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6590
The following changes since commit 7ab6087536bc67c63094f08f863dcd3d5e35b8e7:
cmake: Unset CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES (2024-02-12 17:13:14 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (5):
linux-yocto/5.4: update to v5.4.264
linux-yocto/5.4: update to v5.4.265
linux-yocto/5.4: update to v5.4.266
linux-yocto/5.4: update to v5.4.267
linux-yocto/5.4: update to v5.4.268
Peter Marko (1):
gcc-shared-source: whitelist CVE-2023-4039
Richard Purdie (1):
sstatesig: Allow exclusion of the root directory for do_package
Steve Sakoman (1):
cve-exclusion_5.4.inc: update for 5.4.268
Tim Orling (1):
vim: upgrade v9.0.2130 -> v9.0.2190
meta/lib/oe/sstatesig.py | 5 +-
.../gcc/gcc-shared-source.inc | 3 +
.../linux/cve-exclusion_5.4.inc | 199 +++++++++++++++++-
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
meta/recipes-support/vim/vim.inc | 4 +-
7 files changed, 215 insertions(+), 32 deletions(-)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
end of thread, other threads:[~2024-02-22 14:30 UTC | newest]
Thread overview: 19+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-05-18 2:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 1/9] vim: Upgrade 8.2.4681 -> 8.2.4912 Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 2/9] curl: Fix CVEs for curl Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 3/9] tiff: Add patches to fix multiple CVEs Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 4/9] freetype: Fix CVEs for freetype Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 5/9] git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 6/9] openssl: Minor security upgrade 1.1.1n to 1.1.1o Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 7/9] linux-firmware: replace mkdir by install Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 8/9] linux-firmware: upgrade 20220411 -> 20220509 Steve Sakoman
2022-05-18 2:30 ` [OE-core][dunfell 9/9] selftest: skip virgl test on alma 8.6 Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2024-02-22 14:30 [OE-core][dunfell 0/9] Patch review Steve Sakoman
2023-04-30 16:25 Steve Sakoman
2022-10-13 16:36 Steve Sakoman
2022-09-14 2:25 Steve Sakoman
2022-05-02 23:02 Steve Sakoman
2022-04-20 21:51 Steve Sakoman
2021-09-10 14:07 Steve Sakoman
2020-12-07 14:12 Steve Sakoman
2020-11-17 23:47 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox