* [OE-core][dunfell 00/13] Patch review
@ 2022-03-21 22:29 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2022-03-21 22:29 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end of
day Wednesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3397
The following changes since commit ff90d0e91aec252d3f5986df9ce02293cddadbca:
build-appliance-image: Update to dunfell head revision (2022-03-14 14:45:29 +0000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
mobile-broadband-provider-info: upgrade 20201225 -> 20210805
Changhyeok Bae (1):
mobile-broadband-provider-info: upgrade 20210805 -> 20220315
Davide Gardenal (2):
re2c: backport fix for CVE-2018-21232
qemu: backport fix for CVE-2020-13253
Minjae Kim (1):
bluez5: fix CVE-2021-3658
Ovidiu Panait (1):
openssl: upgrade 1.1.1l -> 1.1.1n
Ralph Siemsen (2):
libxml2: backport fix for CVE-2022-23308
libxml2: move to gitlab.gnome.org
Richard Purdie (3):
python3targetconfig: Use for nativesdk too
oeqa/runtime/ping: Improve failure message to include more detail
oeqa/selftest/tinfoil: Improve tinfoil event test debugging
Tim Orling (1):
python3: upgrade 3.8.12 -> 3.8.13
wangmy (1):
linux-firmware: upgrade 20220209 -> 20220310
meta/classes/python3targetconfig.bbclass | 12 +
meta/lib/oeqa/runtime/cases/ping.py | 20 +-
meta/lib/oeqa/selftest/cases/tinfoil.py | 4 +-
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
.../bluez5/bluez5/CVE-2021-3658.patch | 95 +++++
.../mobile-broadband-provider-info_git.bb | 7 +-
.../openssl/openssl/CVE-2021-4160.patch | 145 --------
.../{openssl_1.1.1l.bb => openssl_1.1.1n.bb} | 4 +-
.../libxml/libxml2/CVE-2022-23308.patch | 204 ++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 11 +-
...-detection-of-mips-architecture-for-.patch | 42 ++-
.../{python3_3.8.12.bb => python3_3.8.13.bb} | 6 +-
meta/recipes-devtools/qemu/qemu.inc | 5 +
.../qemu/qemu/CVE-2020-13253_1.patch | 50 +++
.../qemu/qemu/CVE-2020-13253_2.patch | 112 ++++++
.../qemu/qemu/CVE-2020-13253_3.patch | 86 +++++
.../qemu/qemu/CVE-2020-13253_4.patch | 139 +++++++
.../qemu/qemu/CVE-2020-13253_5.patch | 54 +++
...20220209.bb => linux-firmware_20220310.bb} | 6 +-
.../re2c/re2c/CVE-2018-21232-1.patch | 347 ++++++++++++++++++
.../re2c/re2c/CVE-2018-21232-2.patch | 243 ++++++++++++
.../re2c/re2c/CVE-2018-21232-3.patch | 156 ++++++++
.../re2c/re2c/CVE-2018-21232-4.patch | 166 +++++++++
meta/recipes-support/re2c/re2c_1.0.1.bb | 6 +-
24 files changed, 1730 insertions(+), 191 deletions(-)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2021-3658.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2021-4160.patch
rename meta/recipes-connectivity/openssl/{openssl_1.1.1l.bb => openssl_1.1.1n.bb} (97%)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-23308.patch
rename meta/recipes-devtools/python/{python3_3.8.12.bb => python3_3.8.13.bb} (98%)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13253_1.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13253_2.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13253_3.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13253_4.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13253_5.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20220209.bb => linux-firmware_20220310.bb} (99%)
create mode 100644 meta/recipes-support/re2c/re2c/CVE-2018-21232-1.patch
create mode 100644 meta/recipes-support/re2c/re2c/CVE-2018-21232-2.patch
create mode 100644 meta/recipes-support/re2c/re2c/CVE-2018-21232-3.patch
create mode 100644 meta/recipes-support/re2c/re2c/CVE-2018-21232-4.patch
--
2.25.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][dunfell 00/13] Patch review
@ 2022-12-16 14:57 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2022-12-16 14:57 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back
by end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4633
The following changes since commit e44f0cda8176186d42a752631810c1cb5f1971eb:
kernel.bbclass: make KERNEL_DEBUG_TIMESTAMPS work at rebuild (2022-12-06 07:52:17 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexey Smirnov (1):
classes: make TOOLCHAIN more permissive for kernel
Chen Qi (1):
psplash: consider the situation of psplash not exist for systemd
Harald Seiler (1):
opkg: Set correct info_dir and status_file in opkg.conf
Hitendra Prajapati (3):
libarchive: CVE-2022-36227 NULL pointer dereference in archive_write.c
sysstat: fix CVE-2022-39377
golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing
regexps
Lee Chee Yang (1):
dropbear: fix CVE-2021-36369
Mathieu Dubois-Briand (1):
curl: Fix CVE CVE-2022-35260
Minjae Kim (1):
xserver-xorg: backport fixes for CVE-2022-3550, CVE-2022-3551 and
CVE-2022-3553
Pawan Badganchi (1):
python3: Fix CVE-2022-37454
Qiu, Zheng (1):
vim: upgrade 9.0.0820 -> 9.0.0947
Richard Purdie (1):
oeqa/selftest/tinfoil: Add test for separate config_data with
recipe_parse_file()
Riyaz Khan (1):
rpm: Fix rpm CVE CVE-2021-3521
meta/classes/kernel-arch.bbclass | 2 +-
meta/lib/oeqa/selftest/cases/tinfoil.py | 14 +
meta/recipes-core/dropbear/dropbear.inc | 1 +
.../dropbear/dropbear/CVE-2021-36369.patch | 145 ++++++++
.../psplash/files/psplash-start.service | 1 +
.../psplash/files/psplash-systemd.service | 1 +
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2022-41715.patch | 271 ++++++++++++++
meta/recipes-devtools/opkg/opkg_0.4.2.bb | 4 +-
.../python/python3/CVE-2022-37454.patch | 105 ++++++
.../recipes-devtools/python/python3_3.8.14.bb | 1 +
.../rpm/files/CVE-2021-3521-01.patch | 60 ++++
.../rpm/files/CVE-2021-3521-02.patch | 55 +++
.../rpm/files/CVE-2021-3521-03.patch | 34 ++
.../rpm/files/CVE-2021-3521.patch | 330 ++++++++++++++++++
meta/recipes-devtools/rpm/rpm_4.14.2.1.bb | 4 +
.../libarchive/CVE-2022-36227.patch | 43 +++
.../libarchive/libarchive_3.4.2.bb | 1 +
.../sysstat/sysstat/CVE-2022-39377.patch | 92 +++++
.../sysstat/sysstat_12.2.1.bb | 4 +-
.../xserver-xorg/CVE-2022-3550.patch | 40 +++
.../xserver-xorg/CVE-2022-3551.patch | 64 ++++
.../xserver-xorg/CVE-2022-3553.patch | 49 +++
.../xorg-xserver/xserver-xorg_1.20.14.bb | 3 +
.../curl/curl/CVE-2022-35260.patch | 68 ++++
meta/recipes-support/curl/curl_7.69.1.bb | 1 +
meta/recipes-support/vim/vim.inc | 4 +-
27 files changed, 1393 insertions(+), 5 deletions(-)
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2021-36369.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2022-41715.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2022-37454.patch
create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-01.patch
create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-02.patch
create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521-03.patch
create mode 100644 meta/recipes-devtools/rpm/files/CVE-2021-3521.patch
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch
create mode 100644 meta/recipes-extended/sysstat/sysstat/CVE-2022-39377.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3550.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3551.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-3553.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-35260.patch
--
2.25.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][dunfell 00/13] Patch review
@ 2023-07-18 16:00 Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 01/13] libx11: Fix CVE-2023-3138 for dunfell branch Steve Sakoman
` (12 more replies)
0 siblings, 13 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5614
The following changes since commit b3fc8ef9aba822b3d485242c8ebd0e0bff0ebfc8:
cve-update-nvd2-native: actually use API keys (2023-07-13 06:54:58 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (2):
linux-firmware: upgrade 20230404 -> 20230515
wireless-regdb: upgrade 2023.02.13 -> 2023.05.03
Anthony Bagwell (1):
kernel-fitimage: fix dtbo support for fit images
Ashish Sharma (1):
go: Fix CVE-2023-29400
Deepthi Hemraj (1):
glibc: stable 2.31 branch updates.
Nikhil R (1):
libpng: Add ptest for libpng
Poonam Jadhav (1):
libx11: Fix CVE-2023-3138 for dunfell branch
Priyal Doshi (1):
tzdata: upgrade to 2023c
Tom Hochstein (1):
cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDK
Trevor Gamblin (1):
vim: upgrade 9.0.1527 -> 9.0.1592
Vijay Anusuri (1):
qemu: backport Debian patch to fix CVE-2023-0330
Vivek Kumbhar (2):
curl: fix CVE-2023-28320 siglongjmp race condition may lead to crash
python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass
meta/classes/kernel-fitimage.bbclass | 2 +-
.../distro/include/ptest-packagelists.inc | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../cmake/cmake/OEToolchainConfig.cmake | 5 +-
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2023-29400.patch | 94 +++++++++
.../python/python3/CVE-2023-24329.patch | 80 +++++++
.../recipes-devtools/python/python3_3.8.17.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-0330.patch | 77 +++++++
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../xorg-lib/libx11/CVE-2023-3138.patch | 111 ++++++++++
.../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 1 +
...20230404.bb => linux-firmware_20230515.bb} | 4 +-
....02.13.bb => wireless-regdb_2023.05.03.bb} | 2 +-
.../recipes-multimedia/libpng/files/run-ptest | 29 +++
.../libpng/libpng_1.6.37.bb | 15 +-
.../curl/curl/CVE-2023-28320-fol1.patch | 197 ++++++++++++++++++
.../curl/curl/CVE-2023-28320.patch | 86 ++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 2 +
meta/recipes-support/vim/vim.inc | 4 +-
21 files changed, 705 insertions(+), 16 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29400.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2023-24329.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230404.bb => linux-firmware_20230515.bb} (99%)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2023.02.13.bb => wireless-regdb_2023.05.03.bb} (94%)
create mode 100644 meta/recipes-multimedia/libpng/files/run-ptest
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28320.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][dunfell 01/13] libx11: Fix CVE-2023-3138 for dunfell branch
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 02/13] go: Fix CVE-2023-29400 Steve Sakoman
` (11 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Poonam Jadhav <poonam.jadhav@kpit.com>
Add patch to fix CVE-2023-3138 for dunfell branch
Link: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c.patch
Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xorg-lib/libx11/CVE-2023-3138.patch | 111 ++++++++++++++++++
.../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 1 +
2 files changed, 112 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
new file mode 100644
index 0000000000..c724cf8fdd
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-3138.patch
@@ -0,0 +1,111 @@
+From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 10 Jun 2023 16:30:07 -0700
+Subject: [PATCH] InitExt.c: Add bounds checks for extension request, event, &
+ error codes
+
+Fixes CVE-2023-3138: X servers could return values from XQueryExtension
+that would cause Xlib to write entries out-of-bounds of the arrays to
+store them, though this would only overwrite other parts of the Display
+struct, not outside the bounds allocated for that structure.
+
+Reported-by: Gregory James DUCK <gjduck@gmail.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+CVE: CVE-2023-3138
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c.patch]
+Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
+---
+ src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+diff --git a/src/InitExt.c b/src/InitExt.c
+index 4de46f15..afc00a6b 100644
+--- a/src/InitExt.c
++++ b/src/InitExt.c
+@@ -33,6 +33,18 @@ from The Open Group.
+ #include <X11/Xos.h>
+ #include <stdio.h>
+
++/* The X11 protocol spec reserves events 64 through 127 for extensions */
++#ifndef LastExtensionEvent
++#define LastExtensionEvent 127
++#endif
++
++/* The X11 protocol spec reserves requests 128 through 255 for extensions */
++#ifndef LastExtensionRequest
++#define FirstExtensionRequest 128
++#define LastExtensionRequest 255
++#endif
++
++
+ /*
+ * This routine is used to link a extension in so it will be called
+ * at appropriate times.
+@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent(
+ WireToEventType proc) /* routine to call when converting event */
+ {
+ register WireToEventType oldproc;
++ if (event_number < 0 ||
++ event_number > LastExtensionEvent) {
++ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
++ event_number);
++ return (WireToEventType)_XUnknownWireEvent;
++ }
+ if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
+ LockDisplay (dpy);
+ oldproc = dpy->event_vec[event_number];
+@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie(
+ )
+ {
+ WireToEventCookieType oldproc;
++ if (extension < FirstExtensionRequest ||
++ extension > LastExtensionRequest) {
++ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
++ extension);
++ return (WireToEventCookieType)_XUnknownWireEventCookie;
++ }
+ if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
+ LockDisplay (dpy);
+ oldproc = dpy->generic_event_vec[extension & 0x7F];
+@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie(
+ )
+ {
+ CopyEventCookieType oldproc;
++ if (extension < FirstExtensionRequest ||
++ extension > LastExtensionRequest) {
++ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
++ extension);
++ return (CopyEventCookieType)_XUnknownCopyEventCookie;
++ }
+ if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
+ LockDisplay (dpy);
+ oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
+@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire(
+ EventToWireType proc) /* routine to call when converting event */
+ {
+ register EventToWireType oldproc;
++ if (event_number < 0 ||
++ event_number > LastExtensionEvent) {
++ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
++ event_number);
++ return (EventToWireType)_XUnknownNativeEvent;
++ }
+ if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
+ LockDisplay (dpy);
+ oldproc = dpy->wire_vec[event_number];
+@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError(
+ WireToErrorType proc) /* routine to call when converting error */
+ {
+ register WireToErrorType oldproc = NULL;
++ if (error_number < 0 ||
++ error_number > LastExtensionError) {
++ fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
++ error_number);
++ return (WireToErrorType)_XDefaultWireError;
++ }
+ if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
+ LockDisplay (dpy);
+ if (!dpy->error_vec) {
+--
+GitLab
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
index ad3fab1204..568162a911 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
@@ -18,6 +18,7 @@ SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \
file://CVE-2021-31535.patch \
file://CVE-2022-3554.patch \
file://CVE-2022-3555.patch \
+ file://CVE-2023-3138.patch \
"
SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 02/13] go: Fix CVE-2023-29400
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 01/13] libx11: Fix CVE-2023-3138 for dunfell branch Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 03/13] curl: fix CVE-2023-28320 siglongjmp race condition may lead to crash Steve Sakoman
` (10 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Ashish Sharma <asharma@mvista.com>
emit filterFailsafe for empty unquoted attr
value
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2023-29400.patch | 94 +++++++++++++++++++
2 files changed, 95 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29400.patch
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc
index ea7b9ea80f..33b53b1a34 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -67,6 +67,7 @@ SRC_URI += "\
file://CVE-2023-29405-2.patch \
file://CVE-2023-29402.patch \
file://CVE-2023-29404.patch \
+ file://CVE-2023-29400.patch \
"
SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-29400.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-29400.patch
new file mode 100644
index 0000000000..092c7aa0ff
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-29400.patch
@@ -0,0 +1,94 @@
+From 0d347544cbca0f42b160424f6bc2458ebcc7b3fc Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Thu, 13 Apr 2023 14:01:50 -0700
+Subject: [PATCH] html/template: emit filterFailsafe for empty unquoted attr
+ value
+
+An unquoted action used as an attribute value can result in unsafe
+behavior if it is empty, as HTML normalization will result in unexpected
+attributes, and may allow attribute injection. If executing a template
+results in a empty unquoted attribute value, emit filterFailsafe
+instead.
+
+Thanks to Juho Nurminen of Mattermost for reporting this issue.
+
+Fixes #59722
+Fixes CVE-2023-29400
+
+Change-Id: Ia38d1b536ae2b4af5323a6c6d861e3c057c2570a
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1826631
+Reviewed-by: Julie Qiu <julieqiu@google.com>
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/491617
+Run-TryBot: Carlos Amedee <carlos@golang.org>
+Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+TryBot-Result: Gopher Robot <gobot@golang.org>
+
+Upstream-Status: Backport from [https://github.com/golang/go/commit/0d347544cbca0f42b160424f6bc2458ebcc7b3fc]
+CVE: CVE-2023-29400
+Signed-off-by: Ashish Sharma <asharma@mvista.com>
+---
+ src/html/template/escape.go | 5 ++---
+ src/html/template/escape_test.go | 15 +++++++++++++++
+ src/html/template/html.go | 3 +++
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/src/html/template/escape.go b/src/html/template/escape.go
+index 4ba1d6b31897e..a62ef159f0dcd 100644
+--- a/src/html/template/escape.go
++++ b/src/html/template/escape.go
+@@ -382,9 +382,8 @@ func normalizeEscFn(e string) string {
+ // for all x.
+ var redundantFuncs = map[string]map[string]bool{
+ "_html_template_commentescaper": {
+- "_html_template_attrescaper": true,
+- "_html_template_nospaceescaper": true,
+- "_html_template_htmlescaper": true,
++ "_html_template_attrescaper": true,
++ "_html_template_htmlescaper": true,
+ },
+ "_html_template_cssescaper": {
+ "_html_template_attrescaper": true,
+diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
+index 3dd212bac9406..f8b2b448f2dfa 100644
+--- a/src/html/template/escape_test.go
++++ b/src/html/template/escape_test.go
+@@ -678,6 +678,21 @@ func TestEscape(t *testing.T) {
+ `<img srcset={{",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"}}>`,
+ `<img srcset=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,>`,
+ },
++ {
++ "unquoted empty attribute value (plaintext)",
++ "<p name={{.U}}>",
++ "<p name=ZgotmplZ>",
++ },
++ {
++ "unquoted empty attribute value (url)",
++ "<p href={{.U}}>",
++ "<p href=ZgotmplZ>",
++ },
++ {
++ "quoted empty attribute value",
++ "<p name=\"{{.U}}\">",
++ "<p name=\"\">",
++ },
+ }
+
+ for _, test := range tests {
+diff --git a/src/html/template/html.go b/src/html/template/html.go
+index bcca0b51a0ef9..a181699a5bda8 100644
+--- a/src/html/template/html.go
++++ b/src/html/template/html.go
+@@ -14,6 +14,9 @@ import (
+ // htmlNospaceEscaper escapes for inclusion in unquoted attribute values.
+ func htmlNospaceEscaper(args ...interface{}) string {
+ s, t := stringify(args...)
++ if s == "" {
++ return filterFailsafe
++ }
+ if t == contentTypeHTML {
+ return htmlReplacer(stripTags(s), htmlNospaceNormReplacementTable, false)
+ }
+
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 03/13] curl: fix CVE-2023-28320 siglongjmp race condition may lead to crash
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 01/13] libx11: Fix CVE-2023-3138 for dunfell branch Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 02/13] go: Fix CVE-2023-29400 Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 04/13] python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass Steve Sakoman
` (9 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Vivek Kumbhar <vkumbhar@mvista.com>
Introduced by: https://github.com/curl/curl/commit/3c49b405de4fbf1fd7127f91908261268640e54f (curl-7_9_8)
Fixed by: https://github.com/curl/curl/commit/13718030ad4b3209a7583b4f27f683cd3a6fa5f2 (curl-8_1_0)
Follow-up: https://github.com/curl/curl/commit/f446258f0269a62289cca0210157cb8558d0edc3 (curl-8_1_0)
https://curl.se/docs/CVE-2023-28320.html
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2023-28320-fol1.patch | 197 ++++++++++++++++++
.../curl/curl/CVE-2023-28320.patch | 86 ++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 2 +
3 files changed, 285 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28320.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch b/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch
new file mode 100644
index 0000000000..eaa6fdc327
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28320-fol1.patch
@@ -0,0 +1,197 @@
+From f446258f0269a62289cca0210157cb8558d0edc3 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 16 May 2023 23:40:42 +0200
+Subject: [PATCH] hostip: include easy_lock.h before using
+ GLOBAL_INIT_IS_THREADSAFE
+
+Since that header file is the only place that define can be defined.
+
+Reported-by: Marc Deslauriers
+
+Follow-up to 13718030ad4b3209
+
+Closes #11121
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/f446258f0269a62289cca0210157cb8558d0edc3]
+CVE: CVE-2023-28320
+Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
+---
+ lib/easy_lock.h | 109 ++++++++++++++++++++++++++++++++++++++++++++++++
+ lib/hostip.c | 10 ++---
+ lib/hostip.h | 9 ----
+ 3 files changed, 113 insertions(+), 15 deletions(-)
+ create mode 100644 lib/easy_lock.h
+
+diff --git a/lib/easy_lock.h b/lib/easy_lock.h
+new file mode 100644
+index 0000000..6399a39
+--- /dev/null
++++ b/lib/easy_lock.h
+@@ -0,0 +1,109 @@
++#ifndef HEADER_CURL_EASY_LOCK_H
++#define HEADER_CURL_EASY_LOCK_H
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++
++#include "curl_setup.h"
++
++#define GLOBAL_INIT_IS_THREADSAFE
++
++#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
++
++#ifdef __MINGW32__
++#ifndef __MINGW64_VERSION_MAJOR
++#if (__MINGW32_MAJOR_VERSION < 5) || \
++ (__MINGW32_MAJOR_VERSION == 5 && __MINGW32_MINOR_VERSION == 0)
++/* mingw >= 5.0.1 defines SRWLOCK, and slightly different from MS define */
++typedef PVOID SRWLOCK, *PSRWLOCK;
++#endif
++#endif
++#ifndef SRWLOCK_INIT
++#define SRWLOCK_INIT NULL
++#endif
++#endif /* __MINGW32__ */
++
++#define curl_simple_lock SRWLOCK
++#define CURL_SIMPLE_LOCK_INIT SRWLOCK_INIT
++
++#define curl_simple_lock_lock(m) AcquireSRWLockExclusive(m)
++#define curl_simple_lock_unlock(m) ReleaseSRWLockExclusive(m)
++
++#elif defined(HAVE_ATOMIC) && defined(HAVE_STDATOMIC_H)
++#include <stdatomic.h>
++#if defined(HAVE_SCHED_YIELD)
++#include <sched.h>
++#endif
++
++#define curl_simple_lock atomic_int
++#define CURL_SIMPLE_LOCK_INIT 0
++
++/* a clang-thing */
++#ifndef __has_builtin
++#define __has_builtin(x) 0
++#endif
++
++#ifndef __INTEL_COMPILER
++/* The Intel compiler tries to look like GCC *and* clang *and* lies in its
++ __has_builtin() function, so override it. */
++
++/* if GCC on i386/x86_64 or if the built-in is present */
++#if ( (defined(__GNUC__) && !defined(__clang__)) && \
++ (defined(__i386__) || defined(__x86_64__))) || \
++ __has_builtin(__builtin_ia32_pause)
++#define HAVE_BUILTIN_IA32_PAUSE
++#endif
++
++#endif
++
++static inline void curl_simple_lock_lock(curl_simple_lock *lock)
++{
++ for(;;) {
++ if(!atomic_exchange_explicit(lock, true, memory_order_acquire))
++ break;
++ /* Reduce cache coherency traffic */
++ while(atomic_load_explicit(lock, memory_order_relaxed)) {
++ /* Reduce load (not mandatory) */
++#ifdef HAVE_BUILTIN_IA32_PAUSE
++ __builtin_ia32_pause();
++#elif defined(__aarch64__)
++ __asm__ volatile("yield" ::: "memory");
++#elif defined(HAVE_SCHED_YIELD)
++ sched_yield();
++#endif
++ }
++ }
++}
++
++static inline void curl_simple_lock_unlock(curl_simple_lock *lock)
++{
++ atomic_store_explicit(lock, false, memory_order_release);
++}
++
++#else
++
++#undef GLOBAL_INIT_IS_THREADSAFE
++
++#endif
++
++#endif /* HEADER_CURL_EASY_LOCK_H */
+diff --git a/lib/hostip.c b/lib/hostip.c
+index 5231a74..d5bf881 100644
+--- a/lib/hostip.c
++++ b/lib/hostip.c
+@@ -68,6 +68,8 @@
+ #include "curl_memory.h"
+ #include "memdebug.h"
+
++#include "easy_lock.h"
++
+ #if defined(CURLRES_SYNCH) && \
+ defined(HAVE_ALARM) && \
+ defined(SIGALRM) && \
+@@ -77,10 +79,6 @@
+ #define USE_ALARM_TIMEOUT
+ #endif
+
+-#ifdef USE_ALARM_TIMEOUT
+-#include "easy_lock.h"
+-#endif
+-
+ #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
+
+ /*
+@@ -259,8 +257,8 @@ void Curl_hostcache_prune(struct Curl_easy *data)
+ /* Beware this is a global and unique instance. This is used to store the
+ return address that we can jump back to from inside a signal handler. This
+ is not thread-safe stuff. */
+-sigjmp_buf curl_jmpenv;
+-curl_simple_lock curl_jmpenv_lock;
++static sigjmp_buf curl_jmpenv;
++static curl_simple_lock curl_jmpenv_lock;
+ #endif
+
+ /* lookup address, returns entry if found and not stale */
+diff --git a/lib/hostip.h b/lib/hostip.h
+index baf1e58..d7f73d9 100644
+--- a/lib/hostip.h
++++ b/lib/hostip.h
+@@ -196,15 +196,6 @@ Curl_cache_addr(struct Curl_easy *data, Curl_addrinfo *addr,
+ #define CURL_INADDR_NONE INADDR_NONE
+ #endif
+
+-#ifdef HAVE_SIGSETJMP
+-/* Forward-declaration of variable defined in hostip.c. Beware this
+- * is a global and unique instance. This is used to store the return
+- * address that we can jump back to from inside a signal handler.
+- * This is not thread-safe stuff.
+- */
+-extern sigjmp_buf curl_jmpenv;
+-#endif
+-
+ /*
+ * Function provided by the resolver backend to set DNS servers to use.
+ */
+--
+2.25.1
+
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28320.patch b/meta/recipes-support/curl/curl/CVE-2023-28320.patch
new file mode 100644
index 0000000000..0c9b67440a
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28320.patch
@@ -0,0 +1,86 @@
+From 13718030ad4b3209a7583b4f27f683cd3a6fa5f2 Mon Sep 17 00:00:00 2001
+From: Harry Sintonen <sintonen@iki.fi>
+Date: Tue, 25 Apr 2023 09:22:26 +0200
+Subject: [PATCH] hostip: add locks around use of global buffer for alarm()
+
+When building with the sync name resolver and timeout ability we now
+require thread-safety to be present to enable it.
+
+Closes #11030
+
+Upstream-Status: Backport [https://github.com/curl/curl/commit/13718030ad4b3209a7583b4f27f683cd3a6fa5f2]
+CVE: CVE-2023-28320
+Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
+---
+ lib/hostip.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/lib/hostip.c b/lib/hostip.c
+index f5bb634..5231a74 100644
+--- a/lib/hostip.c
++++ b/lib/hostip.c
+@@ -68,12 +68,19 @@
+ #include "curl_memory.h"
+ #include "memdebug.h"
+
+-#if defined(CURLRES_SYNCH) && \
+- defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
++#if defined(CURLRES_SYNCH) && \
++ defined(HAVE_ALARM) && \
++ defined(SIGALRM) && \
++ defined(HAVE_SIGSETJMP) && \
++ defined(GLOBAL_INIT_IS_THREADSAFE)
+ /* alarm-based timeouts can only be used with all the dependencies satisfied */
+ #define USE_ALARM_TIMEOUT
+ #endif
+
++#ifdef USE_ALARM_TIMEOUT
++#include "easy_lock.h"
++#endif
++
+ #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
+
+ /*
+@@ -248,11 +255,12 @@ void Curl_hostcache_prune(struct Curl_easy *data)
+ Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
+ }
+
+-#ifdef HAVE_SIGSETJMP
++#ifdef USE_ALARM_TIMEOUT
+ /* Beware this is a global and unique instance. This is used to store the
+ return address that we can jump back to from inside a signal handler. This
+ is not thread-safe stuff. */
+ sigjmp_buf curl_jmpenv;
++curl_simple_lock curl_jmpenv_lock;
+ #endif
+
+ /* lookup address, returns entry if found and not stale */
+@@ -614,7 +622,6 @@ enum resolve_t Curl_resolv(struct connectdata *conn,
+ static
+ RETSIGTYPE alarmfunc(int sig)
+ {
+- /* this is for "-ansi -Wall -pedantic" to stop complaining! (rabe) */
+ (void)sig;
+ siglongjmp(curl_jmpenv, 1);
+ }
+@@ -695,6 +702,8 @@ enum resolve_t Curl_resolv_timeout(struct connectdata *conn,
+ This should be the last thing we do before calling Curl_resolv(),
+ as otherwise we'd have to worry about variables that get modified
+ before we invoke Curl_resolv() (and thus use "volatile"). */
++ curl_simple_lock_lock(&curl_jmpenv_lock);
++
+ if(sigsetjmp(curl_jmpenv, 1)) {
+ /* this is coming from a siglongjmp() after an alarm signal */
+ failf(data, "name lookup timed out");
+@@ -763,6 +772,8 @@ clean_up:
+ #endif
+ #endif /* HAVE_SIGACTION */
+
++ curl_simple_lock_unlock(&curl_jmpenv_lock);
++
+ /* switch back the alarm() to either zero or to what it was before minus
+ the time we spent until now! */
+ if(prev_alarm) {
+--
+2.25.1
+
diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb
index 13ec117099..ce81df0f05 100644
--- a/meta/recipes-support/curl/curl_7.69.1.bb
+++ b/meta/recipes-support/curl/curl_7.69.1.bb
@@ -50,6 +50,8 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \
file://CVE-2023-27535-pre1.patch \
file://CVE-2023-27535.patch \
file://CVE-2023-27536.patch \
+ file://CVE-2023-28320.patch \
+ file://CVE-2023-28320-fol1.patch \
"
SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 04/13] python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 03/13] curl: fix CVE-2023-28320 siglongjmp race condition may lead to crash Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 05/13] qemu: backport Debian patch to fix CVE-2023-0330 Steve Sakoman
` (8 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../python/python3/CVE-2023-24329.patch | 80 +++++++++++++++++++
.../recipes-devtools/python/python3_3.8.17.bb | 1 +
2 files changed, 81 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2023-24329.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2023-24329.patch b/meta/recipes-devtools/python/python3/CVE-2023-24329.patch
new file mode 100644
index 0000000000..23dec65602
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2023-24329.patch
@@ -0,0 +1,80 @@
+From 72d356e3584ebfb8e813a8e9f2cd3dccf233c0d9 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Sun, 13 Nov 2022 11:00:25 -0800
+Subject: [PATCH] gh-99418: Make urllib.parse.urlparse enforce that a scheme
+ must begin with an alphabetical ASCII character. (GH-99421)
+
+Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.
+
+RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
+RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`
+
+The WHATWG URL spec defines a scheme like this:
+`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
+(cherry picked from commit 439b9cfaf43080e91c4ad69f312f21fa098befc7)
+
+Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
+
+Upstream-Status: Backport [https://github.com/python/cpython/commit/72d356e3584ebfb8e813a8e9f2cd3dccf233c0d9]
+CVE: CVE-2023-24329
+Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
+---
+ Lib/test/test_urlparse.py | 18 ++++++++++++++++++
+ Lib/urllib/parse.py | 2 +-
+ ...22-11-12-15-45-51.gh-issue-99418.FxfAXS.rst | 2 ++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 0ad3bf1..e1aa913 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -735,6 +735,24 @@ class UrlParseTestCase(unittest.TestCase):
+ with self.assertRaises(ValueError):
+ p.port
+
++ def test_attributes_bad_scheme(self):
++ """Check handling of invalid schemes."""
++ for bytes in (False, True):
++ for parse in (urllib.parse.urlsplit, urllib.parse.urlparse):
++ for scheme in (".", "+", "-", "0", "http&", "६http"):
++ with self.subTest(bytes=bytes, parse=parse, scheme=scheme):
++ url = scheme + "://www.example.net"
++ if bytes:
++ if url.isascii():
++ url = url.encode("ascii")
++ else:
++ continue
++ p = parse(url)
++ if bytes:
++ self.assertEqual(p.scheme, b"")
++ else:
++ self.assertEqual(p.scheme, "")
++
+ def test_attributes_without_netloc(self):
+ # This example is straight from RFC 3261. It looks like it
+ # should allow the username, hostname, and port to be filled
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index 979e6d2..2e7a3e2 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -452,7 +452,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+ clear_cache()
+ netloc = query = fragment = ''
+ i = url.find(':')
+- if i > 0:
++ if i > 0 and url[0].isascii() and url[0].isalpha():
+ if url[:i] == 'http': # optimize the common case
+ url = url[i+1:]
+ if url[:2] == '//':
+diff --git a/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+new file mode 100644
+index 0000000..0a06e7c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+@@ -0,0 +1,2 @@
++Fix bug in :func:`urllib.parse.urlparse` that causes URL schemes that begin
++with a digit, a plus sign, or a minus sign to be parsed incorrectly.
+--
+2.25.1
diff --git a/meta/recipes-devtools/python/python3_3.8.17.bb b/meta/recipes-devtools/python/python3_3.8.17.bb
index ba5f564d8e..8c00d65794 100644
--- a/meta/recipes-devtools/python/python3_3.8.17.bb
+++ b/meta/recipes-devtools/python/python3_3.8.17.bb
@@ -34,6 +34,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \
file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \
file://makerace.patch \
+ file://CVE-2023-24329.patch \
"
SRC_URI_append_class-native = " \
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 05/13] qemu: backport Debian patch to fix CVE-2023-0330
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 04/13] python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 06/13] tzdata: upgrade to 2023c Steve Sakoman
` (7 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
import patch from ubuntu to fix
CVE-2023-0330
Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches?h=ubuntu/focal-security
Upstream commit
https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-0330.patch | 77 +++++++++++++++++++
2 files changed, 78 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 8d6c4050f7..352277573b 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -137,6 +137,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2021-3409-4.patch \
file://CVE-2021-3409-5.patch \
file://hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch \
+ file://CVE-2023-0330.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch
new file mode 100644
index 0000000000..26e22b4c31
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-0330.patch
@@ -0,0 +1,77 @@
+[Ubuntu note: remove fuzz-lsi53c895a-test.c changes since the file does not
+ exist for this release]
+From b987718bbb1d0eabf95499b976212dd5f0120d75 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Mon, 22 May 2023 11:10:11 +0200
+Subject: [PATCH] hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI
+ controller (CVE-2023-0330)
+
+We cannot use the generic reentrancy guard in the LSI code, so
+we have to manually prevent endless reentrancy here. The problematic
+lsi_execute_script() function has already a way to detect whether
+too many instructions have been executed - we just have to slightly
+change the logic here that it also takes into account if the function
+has been called too often in a reentrant way.
+
+The code in fuzz-lsi53c895a-test.c has been taken from an earlier
+patch by Mauro Matteo Cascella.
+
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563
+Message-Id: <20230522091011.1082574-1-thuth@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Reference: https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.27
+
+Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches/CVE-2023-0330.patch?h=ubuntu/focal-security
+Upstream commit https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75]
+CVE: CVE-2023-0330
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ hw/scsi/lsi53c895a.c | 23 +++++++++++++++------
+ tests/qtest/fuzz-lsi53c895a-test.c | 33 ++++++++++++++++++++++++++++++
+ 2 files changed, 50 insertions(+), 6 deletions(-)
+
+--- qemu-4.2.orig/hw/scsi/lsi53c895a.c
++++ qemu-4.2/hw/scsi/lsi53c895a.c
+@@ -1135,15 +1135,24 @@ static void lsi_execute_script(LSIState
+ uint32_t addr, addr_high;
+ int opcode;
+ int insn_processed = 0;
++ static int reentrancy_level;
++
++ reentrancy_level++;
+
+ s->istat1 |= LSI_ISTAT1_SRUN;
+ again:
+- if (++insn_processed > LSI_MAX_INSN) {
+- /* Some windows drivers make the device spin waiting for a memory
+- location to change. If we have been executed a lot of code then
+- assume this is the case and force an unexpected device disconnect.
+- This is apparently sufficient to beat the drivers into submission.
+- */
++ /*
++ * Some windows drivers make the device spin waiting for a memory location
++ * to change. If we have executed more than LSI_MAX_INSN instructions then
++ * assume this is the case and force an unexpected device disconnect. This
++ * is apparently sufficient to beat the drivers into submission.
++ *
++ * Another issue (CVE-2023-0330) can occur if the script is programmed to
++ * trigger itself again and again. Avoid this problem by stopping after
++ * being called multiple times in a reentrant way (8 is an arbitrary value
++ * which should be enough for all valid use cases).
++ */
++ if (++insn_processed > LSI_MAX_INSN || reentrancy_level > 8) {
+ if (!(s->sien0 & LSI_SIST0_UDC)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "lsi_scsi: inf. loop with UDC masked");
+@@ -1597,6 +1606,8 @@ again:
+ }
+ }
+ trace_lsi_execute_script_stop();
++
++ reentrancy_level--;
+ }
+
+ static uint8_t lsi_reg_readb(LSIState *s, int offset)
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 06/13] tzdata: upgrade to 2023c
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 05/13] qemu: backport Debian patch to fix CVE-2023-0330 Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 07/13] glibc: stable 2.31 branch updates Steve Sakoman
` (6 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/timezone/timezone.inc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index 1834665a1e..2960bfefe3 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -6,7 +6,7 @@ SECTION = "base"
LICENSE = "PD & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
-PV = "2022g"
+PV = "2023c"
SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \
http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \
@@ -14,5 +14,5 @@ SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
-SRC_URI[tzcode.sha256sum] = "9610bb0b9656ff404c361a41f3286da53064b5469d84f00c9cb2314c8614da74"
-SRC_URI[tzdata.sha256sum] = "4491db8281ae94a84d939e427bdd83dc389f26764d27d9a5c52d782c16764478"
+SRC_URI[tzcode.sha256sum] = "46d17f2bb19ad73290f03a203006152e0fa0d7b11e5b71467c4a823811b214e7"
+SRC_URI[tzdata.sha256sum] = "3f510b5d1b4ae9bb38e485aa302a776b317fb3637bdb6404c4adf7b6cadd965c"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 07/13] glibc: stable 2.31 branch updates.
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (5 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 06/13] tzdata: upgrade to 2023c Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 08/13] linux-firmware: upgrade 20230404 -> 20230515 Steve Sakoman
` (5 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Below commits on glibc-2.31 stable branch are updated.
2d4f26e5cf x86: Fix wcsnlen-avx2 page cross length comparison
Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 5414297ba1..95e2bba301 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.31/master"
PV = "2.31+git${SRCPV}"
-SRCREV_glibc ?= "d4b75594574ab8a9c2c41209cd8c62aac76b5a04"
+SRCREV_glibc ?= "2d4f26e5cfda682f9ce61444b81533b83f6381af"
SRCREV_localedef ?= "cd9f958c4c94a638fa7b2b4e21627364f1a1a655"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 08/13] linux-firmware: upgrade 20230404 -> 20230515
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (6 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 07/13] glibc: stable 2.31 branch updates Steve Sakoman
@ 2023-07-18 16:00 ` Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 09/13] wireless-regdb: upgrade 2023.02.13 -> 2023.05.03 Steve Sakoman
` (4 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:00 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
License-Update: additional firmwares
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 64603f602d00999220fe5bafeed996ddcb56d36b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...{linux-firmware_20230404.bb => linux-firmware_20230515.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230404.bb => linux-firmware_20230515.bb} (99%)
diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20230404.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20230515.bb
similarity index 99%
rename from meta/recipes-kernel/linux-firmware/linux-firmware_20230404.bb
rename to meta/recipes-kernel/linux-firmware/linux-firmware_20230515.bb
index 9ac70b2a3a..a367a9fd01 100644
--- a/meta/recipes-kernel/linux-firmware/linux-firmware_20230404.bb
+++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20230515.bb
@@ -134,7 +134,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \
"
# WHENCE checksum is defined separately to ease overriding it if
# class-devupstream is selected.
-WHENCE_CHKSUM = "0782deea054d4b1b7f10c92c3a245da4"
+WHENCE_CHKSUM = "a0997fc7a9af4e46d96529d6ef13b58a"
# These are not common licenses, set NO_GENERIC_LICENSE for them
# so that the license files will be copied from fetched source
@@ -212,7 +212,7 @@ SRC_URI:class-devupstream = "git://git.kernel.org/pub/scm/linux/kernel/git/firmw
# Pin this to the 20220509 release, override this in local.conf
SRCREV:class-devupstream ?= "b19cbdca78ab2adfd210c91be15a22568e8b8cae"
-SRC_URI[sha256sum] = "c3f9ad2bb5311cce2490f37a8052f836703d6936aabd840246b6576f1f71f607"
+SRC_URI[sha256sum] = "8b1acfa16f1ee94732a6acb50d9d6c835cf53af11068bd89ed207bbe04a1e951"
inherit allarch
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 09/13] wireless-regdb: upgrade 2023.02.13 -> 2023.05.03
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (7 preceding siblings ...)
2023-07-18 16:00 ` [OE-core][dunfell 08/13] linux-firmware: upgrade 20230404 -> 20230515 Steve Sakoman
@ 2023-07-18 16:01 ` Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 10/13] vim: upgrade 9.0.1527 -> 9.0.1592 Steve Sakoman
` (3 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:01 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 47438402fa430499864a4b1f1a13eaac66aa21c0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...ireless-regdb_2023.02.13.bb => wireless-regdb_2023.05.03.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2023.02.13.bb => wireless-regdb_2023.05.03.bb} (94%)
diff --git a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.02.13.bb b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.05.03.bb
similarity index 94%
rename from meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.02.13.bb
rename to meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.05.03.bb
index 295510225a..f3c3cd78e9 100644
--- a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.02.13.bb
+++ b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2023.05.03.bb
@@ -5,7 +5,7 @@ LICENSE = "ISC"
LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "fe81e8a8694dc4753a45087a1c4c7e1b48dee5a59f5f796ce374ea550f0b2e73"
+SRC_URI[sha256sum] = "f254d08ab3765aeae2b856222e11a95d44aef519a6663877c71ef68fae4c8c12"
inherit bin_package allarch
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 10/13] vim: upgrade 9.0.1527 -> 9.0.1592
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (8 preceding siblings ...)
2023-07-18 16:01 ` [OE-core][dunfell 09/13] wireless-regdb: upgrade 2023.02.13 -> 2023.05.03 Steve Sakoman
@ 2023-07-18 16:01 ` Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 11/13] kernel-fitimage: fix dtbo support for fit images Steve Sakoman
` (2 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:01 UTC (permalink / raw)
To: openembedded-core
From: Trevor Gamblin <tgamblin@baylibre.com>
Fixes:
https://nvd.nist.gov/vuln/detail/CVE-2023-2609
d1ae836 patch 9.0.1531: crash when register contents ends up being invalid
https://nvd.nist.gov/vuln/detail/CVE-2023-2610
ab9a2d8 patch 9.0.1532: crash when expanding "~" in substitute causes very long text
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1e4b4dfb4145bc00eb6937b5f54a41170e9a5b4c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/vim/vim.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 800ee40f92..bbafa170f4 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -19,8 +19,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://no-path-adjust.patch \
"
-PV .= ".1527"
-SRCREV = "c28e7a2b2f23dbd246a1ad7ad7aaa6f7ab2e5887"
+PV .= ".1592"
+SRCREV = "29b4c513b11deb37f0e0538df53d195f602fa42c"
# Remove when 8.3 is out
UPSTREAM_VERSION_UNKNOWN = "1"
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 11/13] kernel-fitimage: fix dtbo support for fit images
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (9 preceding siblings ...)
2023-07-18 16:01 ` [OE-core][dunfell 10/13] vim: upgrade 9.0.1527 -> 9.0.1592 Steve Sakoman
@ 2023-07-18 16:01 ` Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 12/13] libpng: Add ptest for libpng Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 13/13] cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDK Steve Sakoman
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:01 UTC (permalink / raw)
To: openembedded-core
From: Anthony Bagwell <aj.bagwell@gmail.com>
8a2f4e143 added support for u-boot boot script but missed adding the
extra parameter to fitimage_emit_section_config on the dtbo branch
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 22bac8aea0d5d28cc5a3bf20edf638225cce2f88)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/kernel-fitimage.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass
index b88d7dbe4b..7c7bcd3fc0 100644
--- a/meta/classes/kernel-fitimage.bbclass
+++ b/meta/classes/kernel-fitimage.bbclass
@@ -519,7 +519,7 @@ fitimage_assemble() {
for DTB in ${DTBS}; do
dtb_ext=${DTB##*.}
if [ "${dtb_ext}" = "dtbo" ]; then
- fitimage_emit_section_config ${1} "" "${DTB}" "" "" "`expr ${i} = ${dtbcount}`"
+ fitimage_emit_section_config ${1} "" "${DTB}" "" "${bootscr_id}" "" "`expr ${i} = ${dtbcount}`"
else
fitimage_emit_section_config ${1} "${kernelcount}" "${DTB}" "${ramdiskcount}" "${bootscr_id}" "${setupcount}" "`expr ${i} = ${dtbcount}`"
fi
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 12/13] libpng: Add ptest for libpng
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (10 preceding siblings ...)
2023-07-18 16:01 ` [OE-core][dunfell 11/13] kernel-fitimage: fix dtbo support for fit images Steve Sakoman
@ 2023-07-18 16:01 ` Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 13/13] cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDK Steve Sakoman
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:01 UTC (permalink / raw)
To: openembedded-core
From: Nikhil R <nikhilar2410@gmail.com>
libpng is a platform-independent library which
supports all PNG features.
This ptest executes the below binaries, parses
the png image and prints the image features.
1. pngfix - provides information about PNG image
copyrights details.
2. pngtest - tests, optimizes and optionally fixes
the zlib header in PNG files.
3. pngstest - verifies the integrity of PNG image by
dumping chunk level information.
4. timepng - provides details about PNG image chunks.
Signed-off-by: Nikhil R <nikhil.r@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../distro/include/ptest-packagelists.inc | 1 +
.../recipes-multimedia/libpng/files/run-ptest | 29 +++++++++++++++++++
.../libpng/libpng_1.6.37.bb | 15 ++++++++--
3 files changed, 43 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-multimedia/libpng/files/run-ptest
diff --git a/meta/conf/distro/include/ptest-packagelists.inc b/meta/conf/distro/include/ptest-packagelists.inc
index badfd69325..3fb7ec2657 100644
--- a/meta/conf/distro/include/ptest-packagelists.inc
+++ b/meta/conf/distro/include/ptest-packagelists.inc
@@ -26,6 +26,7 @@ PTESTS_FAST = "\
liberror-perl-ptest \
libmodule-build-perl-ptest \
libpcre-ptest \
+ libpng-ptest \
libtimedate-perl-ptest \
libtest-needs-perl-ptest \
liburi-perl-ptest \
diff --git a/meta/recipes-multimedia/libpng/files/run-ptest b/meta/recipes-multimedia/libpng/files/run-ptest
new file mode 100644
index 0000000000..9ab5d0c1f4
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/run-ptest
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -eux
+
+./pngfix pngtest.png &> log.txt 2>&1
+
+if grep -i "OK" log.txt 2>&1 ; then
+ echo "PASS: pngfix passed"
+else
+ echo "FAIL: pngfix failed"
+fi
+rm -f log.txt
+
+./pngtest pngtest.png &> log.txt 2>&1
+
+if grep -i "PASS" log.txt 2>&1 ; then
+ echo "PASS: pngtest passed"
+else
+ echo "FAIL: pngtest failed"
+fi
+rm -f log.txt
+
+for i in pngstest timepng; do
+ if "./${i}" pngtest.png 2>&1; then
+ echo "PASS: $i"
+ else
+ echo "FAIL: $i"
+ fi
+done
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.37.bb b/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
index 3c46fa3302..9387fc8e2e 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
@@ -10,7 +10,10 @@ DEPENDS = "zlib"
LIBV = "16"
-SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz"
+SRC_URI = "\
+ ${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
+ file://run-ptest \
+ "
SRC_URI[md5sum] = "015e8e15db1eecde5f2eb9eb5b6e59e9"
SRC_URI[sha256sum] = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca"
@@ -20,7 +23,7 @@ UPSTREAM_CHECK_URI = "http://libpng.org/pub/png/libpng.html"
BINCONFIG = "${bindir}/libpng-config ${bindir}/libpng16-config"
-inherit autotools binconfig-disabled pkgconfig
+inherit autotools binconfig-disabled pkgconfig ptest
# Work around missing symbols
EXTRA_OECONF_append_class-target = " ${@bb.utils.contains("TUNE_FEATURES", "neon", "--enable-arm-neon=on", "--enable-arm-neon=off" ,d)}"
@@ -33,3 +36,11 @@ BBCLASSEXTEND = "native nativesdk"
# CVE-2019-17371 is actually a memory leak in gif2png 2.x
CVE_CHECK_WHITELIST += "CVE-2019-17371"
+
+do_install_ptest() {
+ install -m644 "${S}/pngtest.png" "${D}${PTEST_PATH}"
+ install -m755 "${B}/.libs/pngfix" "${D}${PTEST_PATH}"
+ install -m755 "${B}/.libs/pngtest" "${D}${PTEST_PATH}"
+ install -m755 "${B}/.libs/pngstest" "${D}${PTEST_PATH}"
+ install -m755 "${B}/.libs/timepng" "${D}${PTEST_PATH}"
+}
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 13/13] cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDK
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
` (11 preceding siblings ...)
2023-07-18 16:01 ` [OE-core][dunfell 12/13] libpng: Add ptest for libpng Steve Sakoman
@ 2023-07-18 16:01 ` Steve Sakoman
12 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-07-18 16:01 UTC (permalink / raw)
To: openembedded-core
From: Tom Hochstein <tom.hochstein@nxp.com>
When building using an SDK, cmake complains that the target
architecture 'cortexa53-crypto' is unknown. The same build in bitbake
uses the target architecture 'aarch64'.
Set CMAKE_SYSTEM_PROCESSOR the same as for bitbake.
Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d32a6225eefce2073a1cd401034b5b4c68351bfe)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake b/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake
index f8af79ddd5..a7020da9c7 100644
--- a/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake
+++ b/meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake
@@ -12,10 +12,7 @@ set( CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY )
set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "$ENV{OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX}")
-# Set CMAKE_SYSTEM_PROCESSOR from the sysroot name (assuming processor-distro-os).
-if ($ENV{SDKTARGETSYSROOT} MATCHES "/sysroots/([a-zA-Z0-9_-]+)-.+-.+")
- set(CMAKE_SYSTEM_PROCESSOR ${CMAKE_MATCH_1})
-endif()
+set( CMAKE_SYSTEM_PROCESSOR $ENV{OECORE_TARGET_ARCH} )
# Include the toolchain configuration subscripts
file( GLOB toolchain_config_files "${CMAKE_TOOLCHAIN_FILE}.d/*.cmake" )
--
2.34.1
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [OE-core][dunfell 00/13] Patch review
@ 2023-09-30 19:39 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-09-30 19:39 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Tuesday, October 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5966
The following changes since commit a9d194f21a3bdebca8aaff204804a5fdc67c76d1:
vim: Upgrade 9.0.1664 -> 9.0.1894 (2023-09-25 07:03:13 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
nasm: update 2.15.03 -> 2.15.05
Archana Polampalli (1):
nasm: fix CVE-2022-44370
Ashish Sharma (1):
mdadm: Backport fix for CVE-2023-28736
Bruce Ashfield (4):
linux-yocto/5.4: update to v5.4.252
linux-yocto/5.4: update to v5.4.254
linux-yocto/5.4: update to v5.4.256
linux-yocto/5.4: update to v5.4.257
Colin McAllister (1):
libwebp: Fix CVE-2023-5129
Lee Chee Yang (3):
libxpm: fix CVE-2022-46285
qemu: fix CVE-2020-24165
python3: update to 3.8.18
Siddharth Doshi (1):
go: Fix CVE-2023-39318 and CVE-2023-39319
Vijay Anusuri (1):
ghostscript: fix CVE-2023-36664
meta/recipes-devtools/go/go-1.14.inc | 2 +
.../go/go-1.14/CVE-2023-39318.patch | 238 ++++++++++++
.../go/go-1.14/CVE-2023-39319.patch | 230 +++++++++++
.../0002-Add-debug-prefix-map-option.patch | 42 +-
.../nasm/nasm/CVE-2022-44370.patch | 104 +++++
.../nasm/{nasm_2.15.03.bb => nasm_2.15.05.bb} | 5 +-
.../{python3_3.8.17.bb => python3_3.8.18.bb} | 4 +-
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2020-24165.patch | 94 +++++
.../ghostscript/CVE-2023-36664-1.patch | 145 +++++++
.../ghostscript/CVE-2023-36664-2.patch | 60 +++
.../ghostscript/CVE-2023-36664-pre1.patch | 62 +++
.../ghostscript/ghostscript_9.52.bb | 3 +
.../mdadm/files/CVE-2023-28736.patch | 77 ++++
meta/recipes-extended/mdadm/mdadm_4.1.bb | 1 +
.../xorg-lib/libxpm/CVE-2022-46285.patch | 40 ++
.../xorg-lib/libxpm_3.5.13.bb | 2 +
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
.../webp/files/CVE-2023-5129.patch | 364 ++++++++++++++++++
meta/recipes-multimedia/webp/libwebp_1.1.0.bb | 1 +
22 files changed, 1467 insertions(+), 44 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-39318.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-39319.patch
create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch
rename meta/recipes-devtools/nasm/{nasm_2.15.03.bb => nasm_2.15.05.bb} (80%)
rename meta/recipes-devtools/python/{python3_3.8.17.bb => python3_3.8.18.bb} (99%)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-24165.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-1.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-2.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-pre1.patch
create mode 100644 meta/recipes-extended/mdadm/files/CVE-2023-28736.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch
create mode 100644 meta/recipes-multimedia/webp/files/CVE-2023-5129.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
* [OE-core][dunfell 00/13] Patch review
@ 2023-11-28 22:52 Steve Sakoman
0 siblings, 0 replies; 18+ messages in thread
From: Steve Sakoman @ 2023-11-28 22:52 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Thursday, November 30
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6252
The following changes since commit ff7dbcc0206203e2ece68ca91a37050a4bc822a2:
selftest: skip virgl test on all fedora (2023-11-14 06:35:38 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Archana Polampalli (1):
vim: Upgrade 9.0.2048 -> 9.0.2068
Etienne Cordonnier (1):
vim: update obsolete comment
Hitendra Prajapati (1):
grub: fix CVE-2023-4692 & CVE-2023-4693
Lee Chee Yang (3):
wayland: fix CVE-2021-3782
python3-setuptools: fix CVE-2022-40897
curl: fix CVE-2023-28321 CVE-2023-28322
Richard Purdie (1):
vim: Improve locale handling
Steve Sakoman (1):
vim: use upstream generated .po files
Vijay Anusuri (5):
libx11: Fix for CVE-2023-43785 CVE-2023-43786 and CVE-2023-43787
shadow: backport patch to fix CVE-2023-29383
bind: Backport fix for CVE-2023-3341
avahi: backport Debian patches to fix multiple CVE's
tiff: backport Debian patch to fix CVE-2022-40090
.../grub/files/CVE-2023-4692.patch | 97 ++++
.../grub/files/CVE-2023-4693.patch | 62 ++
meta/recipes-bsp/grub/grub2.inc | 2 +
meta/recipes-connectivity/avahi/avahi.inc | 9 +
.../avahi/files/CVE-2023-1981.patch | 60 ++
.../avahi/files/CVE-2023-38469-1.patch | 48 ++
.../avahi/files/CVE-2023-38469-2.patch | 65 +++
.../avahi/files/CVE-2023-38470-1.patch | 57 ++
.../avahi/files/CVE-2023-38470-2.patch | 53 ++
.../avahi/files/CVE-2023-38471-1.patch | 73 +++
.../avahi/files/CVE-2023-38471-2.patch | 52 ++
.../avahi/files/CVE-2023-38472.patch | 45 ++
.../avahi/files/CVE-2023-38473.patch | 109 ++++
.../bind/bind/CVE-2023-3341.patch | 175 ++++++
.../recipes-connectivity/bind/bind_9.11.37.bb | 1 +
.../python/python-setuptools.inc | 2 +
.../python3-setuptools/CVE-2022-40897.patch | 29 +
.../files/0001-Overhaul-valid_field.patch | 66 +++
.../shadow/files/CVE-2023-29383.patch | 54 ++
meta/recipes-extended/shadow/shadow.inc | 2 +
.../wayland/wayland/CVE-2021-3782.patch | 111 ++++
.../wayland/wayland_1.18.0.bb | 1 +
.../xorg-lib/libx11/CVE-2023-43785.patch | 63 ++
.../xorg-lib/libx11/CVE-2023-43786-1.patch | 42 ++
.../xorg-lib/libx11/CVE-2023-43786-2.patch | 46 ++
.../xorg-lib/libx11/CVE-2023-43787-1.patch | 52 ++
.../xorg-lib/libx11/CVE-2023-43787-2.patch | 64 ++
.../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 5 +
.../libtiff/files/CVE-2022-40090.patch | 548 ++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 1 +
.../curl/curl/CVE-2023-28321.patch | 272 +++++++++
.../curl/curl/CVE-2023-28322.patch | 380 ++++++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 2 +
meta/recipes-support/vim/vim.inc | 25 +-
34 files changed, 2658 insertions(+), 15 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2023-4692.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2023-4693.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-1981.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38469-1.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38469-2.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38470-1.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38470-2.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38471-1.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38471-2.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38473.patch
create mode 100644 meta/recipes-connectivity/bind/bind/CVE-2023-3341.patch
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2022-40897.patch
create mode 100644 meta/recipes-extended/shadow/files/0001-Overhaul-valid_field.patch
create mode 100644 meta/recipes-extended/shadow/files/CVE-2023-29383.patch
create mode 100644 meta/recipes-graphics/wayland/wayland/CVE-2021-3782.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-1.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-2.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787-1.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787-2.patch
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2022-40090.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28321.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-28322.patch
--
2.34.1
^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2023-11-28 22:52 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-18 16:00 [OE-core][dunfell 00/13] Patch review Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 01/13] libx11: Fix CVE-2023-3138 for dunfell branch Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 02/13] go: Fix CVE-2023-29400 Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 03/13] curl: fix CVE-2023-28320 siglongjmp race condition may lead to crash Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 04/13] python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 05/13] qemu: backport Debian patch to fix CVE-2023-0330 Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 06/13] tzdata: upgrade to 2023c Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 07/13] glibc: stable 2.31 branch updates Steve Sakoman
2023-07-18 16:00 ` [OE-core][dunfell 08/13] linux-firmware: upgrade 20230404 -> 20230515 Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 09/13] wireless-regdb: upgrade 2023.02.13 -> 2023.05.03 Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 10/13] vim: upgrade 9.0.1527 -> 9.0.1592 Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 11/13] kernel-fitimage: fix dtbo support for fit images Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 12/13] libpng: Add ptest for libpng Steve Sakoman
2023-07-18 16:01 ` [OE-core][dunfell 13/13] cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDK Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-11-28 22:52 [OE-core][dunfell 00/13] Patch review Steve Sakoman
2023-09-30 19:39 Steve Sakoman
2022-12-16 14:57 Steve Sakoman
2022-03-21 22:29 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox