* [OE-core][blacksail 01/17] python3-click: depend on python3-shell for shlex
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 02/17] python3-mako: upgrade 1.4.1 -> 1.4.3 Yoann Congal
` (15 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
Click 8.5.0 imports shlex when loading _termui_impl. OE packages
shlex.py in python3-shell, so add it to the main package's runtime
dependencies. Confirmed module ownership in python3-manifest.json.
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8dded0894fdb2c17ab8f8cb2f13f9f95638d493e)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-click_8.5.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-devtools/python/python3-click_8.5.0.bb b/meta/recipes-devtools/python/python3-click_8.5.0.bb
index 05a8fb343a7..d6017e3d7b7 100644
--- a/meta/recipes-devtools/python/python3-click_8.5.0.bb
+++ b/meta/recipes-devtools/python/python3-click_8.5.0.bb
@@ -28,6 +28,7 @@ do_install_ptest:append() {
RDEPENDS:${PN} += "\
python3-io \
python3-threading \
+ python3-shell \
"
RDEPENDS:${PN}-ptest += "coreutils less"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 02/17] python3-mako: upgrade 1.4.1 -> 1.4.3
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 01/17] python3-click: depend on python3-shell for shlex Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 03/17] popt: patch CVE-2026-18743 Yoann Congal
` (14 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
.. changelog::
:version: 1.4.3
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 441
Fixed regression caused in 1.4.2 where tests added to the suite were
unable to run directly on Windows, due to posix mechanics: the tests
force ``os.path`` to ``posixpath``, whereas
:meth:`.TemplateLookup.get_template` converts the configured directory
using ``os.path.sep``. These tests are now skipped on that platform,
where the traversal check is instead exercised against ``ntpath``
natively.
.. changelog::
:version: 1.4.2
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 440
Adjusted the test suite to accommodate for a change in Pygments 2.21.0
where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters
literally rather than as HTML entities, which caused failures in tests
that assert against the rendered output of
:func:`.html_error_template`.
.. change::
:tags: bug, template
:tickets: 441
Fixed issue in :class:`.TemplateLookup` where a URI beginning with a
drive designator (e.g. ``C:/../../secret.txt``) could bypass the directory
traversal check on Windows, allowing reads of arbitrary files outside of
the template directory. The check in :class:`.Template` normalized the
URI using ``os.path``, which on Windows is ``ntpath``; as ``ntpath`` splits
the drive designator off and treats the remainder as rooted, the ``..``
segments were absorbed before the check could inspect them.
Normalization
is now performed with ``posixpath``, which is the same module used by
:meth:`.TemplateLookup.get_template` to resolve the URI to a file.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c56742b717ab1279923698d0cf680bae53711a48)
This (two version) upgrade contains only single code change commit,
fix for CVE-2026-102991. All other commits and maintenance and tests.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: See: https://github.com/sqlalchemy/mako/compare/rel_1_4_1...rel_1_4_3 ]
---
.../python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} (88%)
diff --git a/meta/recipes-devtools/python/python3-mako_1.4.1.bb b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
similarity index 88%
rename from meta/recipes-devtools/python/python3-mako_1.4.1.bb
rename to meta/recipes-devtools/python/python3-mako_1.4.3.bb
index 367a65271f5..41bccec9ebc 100644
--- a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
+++ b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c79ceff89df0a72f29bb0e1b6f0e36ed"
inherit pypi python_setuptools_build_meta ptest-python-pytest
-SRC_URI[sha256sum] = "d7904710b662996425a21627710c4777c45053146942cf8a7aebf757c92b8c27"
+SRC_URI[sha256sum] = "cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a"
CVE_PRODUCT = "makotemplates:mako sqlalchemy:mako"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 03/17] popt: patch CVE-2026-18743
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 01/17] python3-click: depend on python3-shell for shlex Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 02/17] python3-mako: upgrade 1.4.1 -> 1.4.3 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 04/17] popt: patch CVE-2026-18739 Yoann Congal
` (13 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 6a47df77d4dda066f6c3651480546a79fd445ae6)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../popt/popt/CVE-2026-18743.patch | 97 +++++++++++++++++++
meta/recipes-support/popt/popt_1.19.bb | 1 +
2 files changed, 98 insertions(+)
create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18743.patch
diff --git a/meta/recipes-support/popt/popt/CVE-2026-18743.patch b/meta/recipes-support/popt/popt/CVE-2026-18743.patch
new file mode 100644
index 00000000000..d57a39b4705
--- /dev/null
+++ b/meta/recipes-support/popt/popt/CVE-2026-18743.patch
@@ -0,0 +1,97 @@
+From ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 11 Aug 2026 11:45:44 +0300
+Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in
+ poptConfigFileToString()
+
+Fix the reallocation logic thinko, repeated twice in the function:
+if we need to reallocate, the current maximum value is not interesting
+in any way. Just allocate double the required size instead.
+
+The reproducer test is obviously closely tied to the initial buffer
+size of 480 and wouldn't work with other sizes, but with the current
+default this reliably crashes popt under ASAN prior to this fix.
+Also , the reproducer only exercises the first of these flaws.
+
+Fixes: CVE-2026-18743
+
+CVE: CVE-2026-18743
+Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/poptparse.c | 10 ++++------
+ tests/test3-data/05.answer | 5 +++++
+ tests/test3-data/05.input | 2 ++
+ tests/testit.sh | 1 +
+ 4 files changed, 12 insertions(+), 6 deletions(-)
+ create mode 100644 tests/test3-data/05.answer
+ create mode 100644 tests/test3-data/05.input
+
+diff --git a/src/poptparse.c b/src/poptparse.c
+index f405081..c2a5435 100644
+--- a/src/poptparse.c
++++ b/src/poptparse.c
+@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ char * p;
+ char * q;
+ char * x;
+- size_t t;
+ size_t argvlen = 0;
+ size_t maxlinelen = sizeof(line);
+ size_t linelen;
+@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ if (*q == '\0') {
+ /* single command line option (ie, no name=val, just name) */
+ q[-1] = '\0'; /* kill off newline from fgets() call */
+- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1);
++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1);
+ if (argvlen >= maxargvlen) {
+- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++ maxargvlen = argvlen * 2;
+ argstr_tmp = realloc(argstr, maxargvlen);
+ if (argstr_tmp == NULL) {
+ free(argstr);
+@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ *x = '\0'; /* null out last char if space (including fgets() NL) */
+
+ /* rest of line accept */
+- t = (size_t)(x - p);
+- argvlen += t + (sizeof("' --='")-1);
++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1);
+ if (argvlen >= maxargvlen) {
+- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++ maxargvlen = argvlen * 2;
+ argstr_tmp = realloc(argstr, maxargvlen);
+ if (argstr_tmp == NULL) {
+ free(argstr);
+diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer
+new file mode 100644
+index 0000000..37b7fb8
+--- /dev/null
++++ b/tests/test3-data/05.answer
+@@ -0,0 +1,5 @@
++single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
++popt array: size=2
++'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
++'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
++
+diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input
+new file mode 100644
+index 0000000..2508292
+--- /dev/null
++++ b/tests/test3-data/05.input
+@@ -0,0 +1,2 @@
++aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
++bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+diff --git a/tests/testit.sh b/tests/testit.sh
+index 26724d6..4078f51 100755
+--- a/tests/testit.sh
++++ b/tests/testit.sh
+@@ -179,6 +179,7 @@ fi
+ run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer
+ run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer
+ run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer
++run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer
+
+ echo ""
+ echo "Passed."
diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb
index 525bf553b10..3e9137c156a 100644
--- a/meta/recipes-support/popt/popt_1.19.bb
+++ b/meta/recipes-support/popt/popt_1.19.bb
@@ -10,6 +10,7 @@ DEPENDS = "virtual/libiconv"
SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \
file://run-ptest \
+ file://CVE-2026-18743.patch \
"
SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 04/17] popt: patch CVE-2026-18739
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 03/17] popt: patch CVE-2026-18743 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 05/17] libpng: upgrade 1.6.58 -> 1.6.59 Yoann Congal
` (12 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Convert change in cmake file to autotools/makefile.
Install the new test in recipe.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c211972ad21e1801abc7dd15951093316c5528f4)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: backport translated cmake to automake
(the project migrated in between) ]
---
.../popt/popt/CVE-2026-18739.patch | 92 +++++++++++++++++++
meta/recipes-support/popt/popt_1.19.bb | 3 +-
2 files changed, 94 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18739.patch
diff --git a/meta/recipes-support/popt/popt/CVE-2026-18739.patch b/meta/recipes-support/popt/popt/CVE-2026-18739.patch
new file mode 100644
index 00000000000..0a1e8f35907
--- /dev/null
+++ b/meta/recipes-support/popt/popt/CVE-2026-18739.patch
@@ -0,0 +1,92 @@
+From 14c42b415ba0c11640f7d4ee80920452d0287058 Mon Sep 17 00:00:00 2001
+From: Yao Zhang <294772273@qq.com>
+Date: Wed, 5 Aug 2026 14:52:10 +0800
+Subject: [PATCH] Fix CVE-2026-18739: off-by-one error in poptStuffArgs()
+
+The poptStuffArgs function only checks whether (con->os - con->optionStack)
+is equal to POPT_OPTION_DEPTH (10) before incrementing con->os, and does
+not increment the value by 1 to perform boundary pre-checking, as
+handleAlias does.
+
+Add a new test program as a reproducer for this case.
+
+Co-authored-by: Panu Matilainen <pmatilai@redhat.com>
+
+Fixes: CVE-2026-18739
+
+CVE: CVE-2026-18743
+Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/14c42b415ba0c11640f7d4ee80920452d0287058]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/popt.c | 2 +-
+ tests/Makefile.am | 5 ++++-
+ tests/testit.sh | 2 ++
+ tests/tstuff.c | 17 +++++++++++++++++
+ 4 files changed, 24 insertions(+), 2 deletions(-)
+ create mode 100644 tests/tstuff.c
+
+diff --git a/src/popt.c b/src/popt.c
+index 9ea3dfe..458aadc 100644
+--- a/src/popt.c
++++ b/src/popt.c
+@@ -1668,7 +1668,7 @@ int poptStuffArgs(poptContext con, const char ** argv)
+ int argc;
+ int rc;
+
+- if ((con->os - con->optionStack) == POPT_OPTION_DEPTH)
++ if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH)
+ return POPT_ERROR_OPTSTOODEEP;
+
+ for (argc = 0; argv[argc]; argc++)
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index c410389..99fbf64 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -11,7 +11,10 @@ EXTRA_DIST = testit.sh \
+
+ AM_CPPFLAGS = -I. -I$(top_srcdir)/src
+
+-noinst_PROGRAMS = test1 test2 tdict test3
++noinst_PROGRAMS = test1 test2 tdict test3 tstuff
++tstuff_SOURCES = tstuff.c
++tstuff_LDFLAGS =
++tstuff_LDADD = $(top_builddir)/src/libpopt.la
+ test1_SOURCES = test1.c
+ test1_LDFLAGS =
+ test1_LDADD = $(top_builddir)/src/libpopt.la
+diff --git a/tests/testit.sh b/tests/testit.sh
+index 4078f51..d26be3a 100755
+--- a/tests/testit.sh
++++ b/tests/testit.sh
+@@ -172,6 +172,8 @@ run test1 "test1 - 61" "" -x=f1
+
+ run test1 "test1 - 62" "arg1: 0 arg2: (none) aInt: 1" --randint=-1
+
++run tstuff "tstuff - 1" "-13"
++
+ if ! [ -e test3-data ]; then
+ # create symlink for running during 'make distcheck'
+ ln -s "${srcdir}/test3-data" test3-data
+diff --git a/tests/tstuff.c b/tests/tstuff.c
+new file mode 100644
+index 0000000..b820c7b
+--- /dev/null
++++ b/tests/tstuff.c
+@@ -0,0 +1,17 @@
++#include <stdio.h>
++#include <popt.h>
++
++int main(int argc, char *argv[])
++{
++ poptContext ctx = poptGetContext(argv[0], argc, (const char **)argv, NULL, 0);
++ int rc = 0;
++ for (int i = 0; i < 100; ++i) {
++ const char *ea[] = { "a", NULL };
++ if ((rc = poptStuffArgs(ctx, ea)))
++ break;
++ }
++ printf("%d\n", rc);
++
++ poptFreeContext(ctx);
++ return rc;
++}
diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb
index 3e9137c156a..10c4b4b0af7 100644
--- a/meta/recipes-support/popt/popt_1.19.bb
+++ b/meta/recipes-support/popt/popt_1.19.bb
@@ -11,6 +11,7 @@ DEPENDS = "virtual/libiconv"
SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \
file://run-ptest \
file://CVE-2026-18743.patch \
+ file://CVE-2026-18739.patch \
"
SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9"
@@ -23,7 +24,7 @@ do_compile_ptest() {
}
do_install_ptest() {
- for f in test1 test2 tdict test3 testit.sh test-poptrc; do
+ for f in test1 test2 tdict test3 tstuff testit.sh test-poptrc; do
${B}/libtool --mode=install install ${B}/tests/$f ${D}/${PTEST_PATH}
done
}
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 05/17] libpng: upgrade 1.6.58 -> 1.6.59
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 04/17] popt: patch CVE-2026-18739 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 06/17] expat: patch CVE-2026-102633 Yoann Congal
` (11 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Release notes [1]:
Version 1.6.59 [September 28, 2026]
Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL@users.noreply.github.com>.)
Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
Applied fixes and updates to the CMake build.
Adopted the REUSE Specification for licensing the CI files.
[1] https://github.com/pnggroup/libpng/blob/v1.6.59/CHANGES#L6388
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 907c6fa2d0c4f8a8f765cde004c55fb2dd2c402d)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../files/0001-tests-stream-per-test-results-to-stdout.patch | 2 +-
.../libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-multimedia/libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} (97%)
diff --git a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
index 139495d211d..2bedb607f65 100644
--- a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
+++ b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
@@ -50,7 +50,7 @@ index eb7078158..a2e64fbe6 100644
endif
# man pages
-@@ -165,7 +171,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc
+@@ -216,7 +222,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.pc
# not done in the source directory!
EXTRA_DIST= \
ANNOUNCE AUTHORS CHANGES INSTALL LICENSE README TODO TRADEMARK \
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
similarity index 97%
rename from meta/recipes-multimedia/libpng/libpng_1.6.58.bb
rename to meta/recipes-multimedia/libpng/libpng_1.6.59.bb
index 928b010c9c8..4dbd769cf73 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
@@ -15,7 +15,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
file://0001-tests-stream-per-test-results-to-stdout.patch \
"
-SRC_URI[sha256sum] = "28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775"
+SRC_URI[sha256sum] = "d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389"
MIRRORS += "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/ ${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/older-releases/"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 06/17] expat: patch CVE-2026-102633
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 05/17] libpng: upgrade 1.6.58 -> 1.6.59 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 07/17] expat: patch CVE-2026-77214 Yoann Congal
` (10 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-102633
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++
meta/recipes-core/expat/expat_2.8.5.bb | 1 +
2 files changed, 69 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch b/meta/recipes-core/expat/expat/CVE-2026-102633.patch
new file mode 100644
index 00000000000..e3a3013a9a9
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch
@@ -0,0 +1,68 @@
+From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001
+From: Filippo Tedeschi <filippotedeschi98@gmail.com>
+Date: Thu, 24 Sep 2026 21:14:23 +0200
+Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in
+ expat_realloc
+
+In expat_realloc, the size passed to realloc_fcn is calculated as
+sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc
+relied on an assertion:
+assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
+under the assumption that preceding accounting checks and parser
+invariants preclude reaching an overflow state in practice.
+
+However, in release builds compiled with NDEBUG, assertions are
+compiled out. Replace the assert with an explicit runtime check:
+if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) {
+ return NULL;
+}
+immediately preceding the addition, ensuring consistent defensive
+behavior across all build configurations.
+
+Also extend test_alloc_tracker_size_recorded in alloc_tests.c to
+exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying
+that the allocation fails and the recorded size remains unchanged.
+
+Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>
+
+CVE: CVE-2026-102633
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af902d7d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 7 ++++---
+ tests/alloc_tests.c | 4 ++++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index dfcfb0c2..67005454 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -998,9 +998,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
+ }
+ }
+
+- // NOTE: Integer overflow detection has already been done for us
+- // by expat_heap_increase_tolerable(..) above
+- assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
++ // Detect and prevent integer overflow
++ if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) {
++ return NULL;
++ }
+
+ // Actually allocate
+ mallocedPtr = parser->m_mem.realloc_fcn(
+diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
+index 6be0a073..a5cea463 100644
+--- a/tests/alloc_tests.c
++++ b/tests/alloc_tests.c
+@@ -2118,6 +2118,10 @@ START_TEST(test_alloc_tracker_size_recorded) {
+ assert_true(ptr != NULL);
+ assert_true(sizeRecordedFor(ptr) == 10);
+
++ assert_true(expat_realloc(parser, ptr, SIZE_MAX, -1) == NULL);
++
++ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged
++
+ assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL);
+
+ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged
diff --git a/meta/recipes-core/expat/expat_2.8.5.bb b/meta/recipes-core/expat/expat_2.8.5.bb
index c032e18c77a..dfb07d249ae 100644
--- a/meta/recipes-core/expat/expat_2.8.5.bb
+++ b/meta/recipes-core/expat/expat_2.8.5.bb
@@ -10,6 +10,7 @@ VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}"
SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://run-ptest \
+ file://CVE-2026-102633.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 07/17] expat: patch CVE-2026-77214
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 06/17] expat: patch CVE-2026-102633 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 08/17] glibc: stable 2.44 branch updates to 34106fee69 Yoann Congal
` (9 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-77214
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++
meta/recipes-core/expat/expat_2.8.5.bb | 1 +
2 files changed, 107 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch b/meta/recipes-core/expat/expat/CVE-2026-77214.patch
new file mode 100644
index 00000000000..b4105255f70
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch
@@ -0,0 +1,106 @@
+From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001
+From: Filippo Tedeschi <filippotedeschi98@gmail.com>
+Date: Fri, 25 Sep 2026 19:51:10 +0200
+Subject: [PATCH] lib|tests: Validate len against buffer capacity in
+ XML_ParseBuffer
+
+In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the
+internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)),
+parser->m_bufferEnd was previously advanced past parser->m_bufferLim.
+This violated the parser's internal pointer invariant (m_bufferEnd <=
+m_bufferLim) and caused callProcessor() to read unallocated or
+uninitialized heap memory beyond the buffer bounds.
+
+Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for
+both XML_INITIALIZED and XML_PARSING states. If len exceeds the
+available buffer capacity, return XML_STATUS_ERROR with
+XML_ERROR_INVALID_ARGUMENT.
+
+Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c.
+
+Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
+Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>
+
+CVE: CVE-2026-77214
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 5 +++
+ tests/basic_tests.c | 41 +++++++++++++++++++++++++
+ 2 files changed, 46 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 08ef9f72..6e3af97b 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2447,6 +2447,11 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ parser->m_parsingStatus.parsing = XML_PARSING;
+ }
+
++ if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd)) {
++ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT;
++ return XML_STATUS_ERROR;
++ }
++
+ // Detect and avoid integer overflow
+ if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 06268469..35e17d31 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -3725,6 +3725,46 @@ START_TEST(test_negative_len_parse_buffer) {
+ }
+ END_TEST
+
++/* Test XML_ParseBuffer rejects calls where len exceeds available buffer */
++START_TEST(test_parse_buffer_exceeds_buffer) {
++ for (int isFinal = 0; isFinal < 2; isFinal++) {
++ set_subtest("isFinal=%d", isFinal);
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++
++ /* Calling XML_ParseBuffer without any prior XML_GetBuffer call */
++ if (XML_ParseBuffer(parser, 10, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer without XML_GetBuffer was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_NO_BUFFER)
++ fail("Expected XML_ERROR_NO_BUFFER.");
++
++ /* Acquire a small buffer */
++ void *const buffer = XML_GetBuffer(parser, 10);
++ if (buffer == NULL)
++ fail("XML_GetBuffer failed.");
++
++ /* Calling XML_ParseBuffer with len exceeding available buffer capacity */
++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer with len > capacity was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
++ fail("Expected XML_ERROR_INVALID_ARGUMENT.");
++
++ /* Valid parse */
++ memcpy(buffer, "<r></r>", 7);
++ if (XML_ParseBuffer(parser, 7, XML_FALSE) != XML_STATUS_OK)
++ xml_failure(parser);
++
++ /* Subsequent XML_ParseBuffer where len exceeds remaining capacity */
++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer on subsequent chunk was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
++ fail("Expected XML_ERROR_INVALID_ARGUMENT.");
++
++ XML_ParserFree(parser);
++ }
++}
++END_TEST
++
+ /* Test odd corners of the XML_GetBuffer interface */
+ static enum XML_Status
+ get_feature(enum XML_FeatureEnum feature_id, long *presult) {
+@@ -7181,6 +7221,7 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_empty_parse);
+ tcase_add_test(tc_basic, test_negative_len_parse);
+ tcase_add_test(tc_basic, test_negative_len_parse_buffer);
++ tcase_add_test(tc_basic, test_parse_buffer_exceeds_buffer);
+ tcase_add_test(tc_basic, test_get_buffer_1);
+ tcase_add_test(tc_basic, test_get_buffer_2);
+ #if XML_CONTEXT_BYTES > 0
diff --git a/meta/recipes-core/expat/expat_2.8.5.bb b/meta/recipes-core/expat/expat_2.8.5.bb
index dfb07d249ae..125d0e1f82e 100644
--- a/meta/recipes-core/expat/expat_2.8.5.bb
+++ b/meta/recipes-core/expat/expat_2.8.5.bb
@@ -11,6 +11,7 @@ VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}"
SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://run-ptest \
file://CVE-2026-102633.patch \
+ file://CVE-2026-77214.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 08/17] glibc: stable 2.44 branch updates to 34106fee69
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 07/17] expat: patch CVE-2026-77214 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 09/17] gcc: Fix for CVE-2026-102010 Yoann Congal
` (8 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Update SRCREV to pull the latest fixes from the upstream
release/2.44/master branch, including fixes for the following CVEs:
CVE-2026-18374 CVE-2026-8674 CVE-2026-86805 CVE-2026-89092
CVE-2026-95818 CVE-2026-97399
Also mark following CVEs are fixed as they have been included in
previous hash already:
cb61572ea3 iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)
6f9b2bfa50 iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)
[CVE-2026-19499] e88b9f0e5c stdio-common: Convert vfprintf and related functions to buffers
Commits between the old SRCREV (5c479454d1) and the new SRCREV (34106fee69):
34106fee69 powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)
07dc0a64a3 realloc: Fix mmap non-mremap reallocation case [BZ #34697]
c90398e005 CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache
67dd5150c6 LoongArch: Add standard search paths for 32-bit
2ee4e25c97 LoongArch: Support pointer guard on LoongArch32
6dea23eeac LoongArch: Fix intermittent nptl/tst-cancel32 failure
13fd9fe7df Revert "posix: Add POSIX aliases to some spawn functions" (BZ 34437)
1848099f06 stdlib: Don't call clearenv from __libc_setenv_freemem
[CVE-2026-86805,CVE-2026-95818] 6b48c0b29c elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)
1f50262410 resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]
e01330dcec fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]
e58294a5a7 io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]
d7179269b7 Revert "io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]"
d19791b12a x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed
b14c4b0bc9 io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]
b84047b5b7 elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]
b4f51887c4 nptl: Skip pretty-printer tests without python3 [BZ #34507]
30950ce64d libio: Add test for fopen with an empty ", ccs=" value [BZ #34574]
0b4e41fc51 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling
Testing Results:
+--------------+--------+--------+------+
| Result | Before | After | Diff |
+--------------+--------+--------+------+
| PASS | 6029 | 6031 | +2 |
| FAIL | 76 | 74 | -2 |
| XFAIL | 16 | 16 | 0 |
| UNSUPPORTED | 587 | 589 | +2 |
+--------------+--------+--------+------+
Changes in testcases: Before After
elf/tst-dl-cache-old-format --- UNSUPPORTED
elf/tst-origin-secure --- UNSUPPORTED
malloc/tst-malloc-tcache-leak-malloc-largetcache FAIL PASS
malloc/tst-malloc-too-large-malloc-check FAIL PASS
malloc/tst-mallocfork3-malloc-largetcache FAIL PASS
posix/tst-regcomp-truncated PASS FAIL
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: b3534113dd2dc47d3f45e66ba59f19d30f16f18b)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.44.bb | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index b9a45392772..2fb355a29bd 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.44/master"
PV = "2.44+git"
-SRCREV_glibc ?= "5c479454d1232f71c78fa21584e90a2f57883407"
+SRCREV_glibc ?= "34106fee698c83eb0af71d4d0381e66b399be746"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes-core/glibc/glibc_2.44.bb
index d547f595abf..886a15f1572 100644
--- a/meta/recipes-core/glibc/glibc_2.44.bb
+++ b/meta/recipes-core/glibc/glibc_2.44.bb
@@ -22,7 +22,8 @@ CVE_STATUS[CVE-2025-0577] = "not-applicable-platform: specific to RHEL patches"
# when upgrading, clear CVE list but keep the variables
CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
CVE_STATUS_STABLE_BACKPORTS = "\
- CVE-2026-5435 CVE-2026-19542 \
+ CVE-2026-5435 CVE-2026-19542 CVE-2026-18374 CVE-2026-19499 CVE-2026-77117 CVE-2026-80489 \
+ CVE-2026-8674 CVE-2026-86805 CVE-2026-89092 CVE-2026-95818 CVE-2026-97399 \
"
CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 09/17] gcc: Fix for CVE-2026-102010
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 08/17] glibc: stable 2.44 branch updates to 34106fee69 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 10/17] go: upgrade 1.27.1 -> 1.27.2 Yoann Congal
` (7 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
PR 127656 use-after-free in libstdc++ pbds binary heap erase_if
After reallocating the storage the m_a_entries pointer is left dangling
and the new storage is leaked. Update m_a_entries after reallocation
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-102010
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: afc275bd17dea41c2ea6a5c73c697052c2df4e38)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/gcc/gcc-16.2.inc | 1 +
.../gcc/gcc/0026-CVE-2026-102010.patch | 71 +++++++++++++++++++
2 files changed, 72 insertions(+)
create mode 100644 meta/recipes-devtools/gcc/gcc/0026-CVE-2026-102010.patch
diff --git a/meta/recipes-devtools/gcc/gcc-16.2.inc b/meta/recipes-devtools/gcc/gcc-16.2.inc
index 818dea8ac5a..3497493619e 100644
--- a/meta/recipes-devtools/gcc/gcc-16.2.inc
+++ b/meta/recipes-devtools/gcc/gcc-16.2.inc
@@ -74,6 +74,7 @@ SRC_URI = "${BASEURI} \
file://0025-gcc-testsuite-tweaks-for-mips-OE.patch \
file://0001-mapper-localhost-might-not-be-known.patch \
file://0001-Fix-check-for-working-assembler-gdwarf-4-option.patch \
+ file://0026-CVE-2026-102010.patch \
"
UNPACKDIR = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/sources"
diff --git a/meta/recipes-devtools/gcc/gcc/0026-CVE-2026-102010.patch b/meta/recipes-devtools/gcc/gcc/0026-CVE-2026-102010.patch
new file mode 100644
index 00000000000..407119c0765
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0026-CVE-2026-102010.patch
@@ -0,0 +1,71 @@
+From aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6 Mon Sep 17 00:00:00 2001
+From: Jonathan Wakely <jwakely@redhat.com>
+Date: Fri, 25 Sep 2026 18:14:34 +0100
+Subject: [PATCH] libstdc++: Fix use-after-free in pbds binary heap
+ (CVE-2026-102010) [PR127656]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+After reallocating the storage the m_a_entries pointer is left dangling
+and the new storage is leaked.
+
+libstdc++-v3/ChangeLog:
+
+ PR libstdc++/127656
+ * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+ (erase_if): Update m_a_entries after reallocation.
+ * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc:
+ New test.
+
+CVE: CVE-2026-102010
+
+Upstream-Status: Backport [https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6]
+
+Reviewed-by: Tomasz Kamiński <tkaminsk@redhat.com>
+Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
+---
+ .../detail/binary_heap_/erase_fn_imps.hpp | 1 +
+ .../regression/priority_queues_erase_if.cc | 19 +++++++++++++++++++
+ 2 files changed, 20 insertions(+)
+ create mode 100644 libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+
+diff --git a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+index 2e70ed5c663..80d2cccbbf0 100644
+--- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
++++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+@@ -121,6 +121,7 @@ erase_if(Pred pred)
+ entry_pointer new_entries = s_entry_allocator.allocate(new_size);
+ std::copy(m_a_entries, m_a_entries + left, new_entries);
+ s_entry_allocator.deallocate(m_a_entries, m_actual_size);
++ m_a_entries = new_entries;
+ m_actual_size = new_size;
+ resize_policy::notify_arbitrary(m_actual_size);
+ }
+diff --git a/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+new file mode 100644
+index 00000000000..30b8452eff9
+--- /dev/null
++++ b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+@@ -0,0 +1,19 @@
++// { dg-do run }
++
++// CVE-2026-201020 use-after-free in binary heap erase_if
++
++#include <ext/pb_ds/priority_queue.hpp>
++
++bool is_odd(int v) { return v & 1; }
++
++int main()
++{
++ using __gnu_pbds::priority_queue;
++ using __gnu_pbds::binary_heap_tag;
++ priority_queue<int, std::less<int>, binary_heap_tag> q;
++ q.push(1);
++ q.push(2);
++ q.push(3);
++ q.erase_if(&is_odd);
++ q.clear();
++}
+--
+2.49.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 10/17] go: upgrade 1.27.1 -> 1.27.2
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 09/17] gcc: Fix for CVE-2026-102010 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 11/17] kea: Upgrade 3.2.0 -> 3.2.1 Yoann Congal
` (6 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Upgrade to latest 1.27.x release [1]:
$ git --no-pager log --oneline go1.27.1..go1.27.2
022c863611 (tag: go1.27.2) [release-branch.go1.27] go1.27.2
cbb0fb8b51 [release-branch.go1.27] net/http: apply header limits to Trailer headers too
12acaf3086 [release-branch.go1.27] net/http/internal/http2: prevent crash due to HPACK encoder race
31dc9e2449 [release-branch.go1.27] net/http/internal/http2: avoid 2x refund on stream close with buffered data
1d58cdaa10 [release-branch.go1.27] net/http/internal/http2: avoid excessive work on initial window changes
ababc3cd87 [release-branch.go1.27] net/http: limit the size of range headers parsed in ServeContent
9636ab0f17 [release-branch.go1.27] os: correct Root junction handling on Windows (avoid mkdir escape)
e92229e24a [release-branch.go1.27] net/http: avoid server reuse of connection after CONNECT
76875df0f3 [release-branch.go1.27] net/http, net/http/httputil: avoid post-CONNECT pool corruption
7c79b50a74 [release-branch.go1.27] net/textproto: enforce MIME memory limit on first line
f022e61963 [release-branch.go1.27] crypto/tls: validate ECH outer extension references
68fa7699a2 [release-branch.go1.27] cmd/go: always verify toolchain downloads with sumdb
1e4f1fec6f [release-branch.go1.27] cmd/go: bundle go.sum h1 hashes for golang.org/fips140
6e2cfab0a1 [release-branch.go1.27] html/template: recognize `yield` as regexp preceder keyword
b26d150e69 [release-branch.go1.27] html/template: reset JS context for template expressions
bd9992d1d1 [release-branch.go1.27] cmd/link: pass -no_fixup_chains to C linker when building plugin on macOS
ce0ff94df1 [release-branch.go1.27] cmd/cover: preserve statement counts when splitting coverage blocks
87b06e2c18 [release-branch.go1.27] runtime: create Windows threads on the system stack
9c26a3af46 [release-branch.go1.27] cmd/internal/obj/ppc64: fix async preempt safepoint bug
b73c143090 [release-branch.go1.27] cmd/compile: use a 32-bit type for rewritten rotate amounts
8ada93d797 [release-branch.go1.27] encoding/json: fix UnsupportedValueError.Value regression
d995fb820d [release-branch.go1.27] net/http: populate Request.TLS from HTTP/2 connection state
322f1785b0 [release-branch.go1.27] encoding/json/v2: avoid setting with errors parsing float
bc516c2b36 [release-branch.go1.27] cmd/go: include VetxOnly in the vet action ID
4e4eec75bd [release-branch.go1.27] os: preserve completion notification modes for NewFile handles
359bec41ae [release-branch.go1.27] cmd/compile: support unified V5 export data (method indices)
bd8f7a67b7 [release-branch.go1.27] cmd: vendor changes for "go fix"
fa3bd01f47 [release-branch.go1.27] cmd/compile: call racefuncexit before a tail call
aee72efe29 [release-branch.go1.27] testing: escape framing markers only in test2json mode
620e2e0a1a [release-branch.go1.27] runtime: keep the working directory for non-bundled ios/arm64 binaries
d16d95ce1d [release-branch.go1.27] compress/flate: do not emit the preset dictionary into the output
e89d44fee0 [release-branch.go1.27] os: handle unsupported OBJ_DONT_REPARSE on older Windows
c407a15ec8 [release-branch.go1.27] cmd/compile: don't stack-allocate a slice whose element interior escapes
ff5898f7aa [release-branch.go1.27] internal/runtime/syscall/linux: sync EpollEvent with the kernel header
072779d815 [release-branch.go1.27] net/http/internal/http2: delete malformed framing-related headers
2e4b38eeb8 [release-branch.go1.27] net/http: discard trailer when draining a response body
8cd5a090e0 [release-branch.go1.27] net/http: return nil from Body.Close after a failed Read
db5314201a [release-branch.go1.27] net/http: read Response before signaling eofc in readLoop
aa6fc252ed [release-branch.go1.27] net/http: fix HTTP/1 deadlock on concurrent response body Read and Close
1cfd8f0112 [release-branch.go1.27] encoding/json: avoid calling MarshalText on named string map keys
f8a45f672b [release-branch.go1.27] cmd/compile: fix large riscv64 move/zero
072330d2ed [release-branch.go1.27] cmd/compile: correctly mark interface calls as used for tail call wrappers
1e44a4c9d9 [release-branch.go1.27] runtime: don't add the itabs of a plugin twice
2ee6421c51 [release-branch.go1.27] runtime: netpoll: fix 32-bit little-endian eventfd type confusion
33c04bd7da [release-branch.go1.27] runtime: disable mutex profile during async preemption on windows
113a7a0a0f [release-branch.go1.27] crypto/mlkem: fix FIPS 130-3 CAST
Fixes CVE-2026-97032, CVE-2026-78659, CVE-2026-97031, CVE-2026-94444,
CVE-2026-94447, CVE-2026-94448, CVE-2026-97030, CVE-2026-94440,
CVE-2026-56866, CVE-2026-94439, CVE-2026-78669, CVE-2026-78660,
CVE-2026-56857, CVE-2026-78667 and CVE-2026-78663.
Release information: [2]
[1] https://github.com/golang/go/compare/go1.27.1...go1.27.2
[2] https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9908e0891f364a598365b86a9dd48b1ef1606e47)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/go/{go-1.27.1.inc => go-1.27.2.inc} | 2 +-
...binary-native_1.27.1.bb => go-binary-native_1.27.2.bb} | 6 +++---
...oss-canadian_1.27.1.bb => go-cross-canadian_1.27.2.bb} | 0
.../go/{go-cross_1.27.1.bb => go-cross_1.27.2.bb} | 0
.../go/{go-crosssdk_1.27.1.bb => go-crosssdk_1.27.2.bb} | 0
.../go/{go-runtime_1.27.1.bb => go-runtime_1.27.2.bb} | 0
...go-make-content-based-hash-generation-less-pedan.patch | 8 ++++----
.../go/go/0003-ld-add-soname-to-shareable-objects.patch | 6 +++---
.../go/0006-cmd-go-make-GOROOT-precious-by-default.patch | 2 +-
....go-filter-out-build-specific-paths-from-linker-.patch | 4 ++--
...rnal-cgrouptest-skip-when-cpu.max-is-not-availab.patch | 6 +++---
meta/recipes-devtools/go/{go_1.27.1.bb => go_1.27.2.bb} | 0
12 files changed, 17 insertions(+), 17 deletions(-)
rename meta/recipes-devtools/go/{go-1.27.1.inc => go-1.27.2.inc} (91%)
rename meta/recipes-devtools/go/{go-binary-native_1.27.1.bb => go-binary-native_1.27.2.bb} (80%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.27.1.bb => go-cross-canadian_1.27.2.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.27.1.bb => go-cross_1.27.2.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.27.1.bb => go-crosssdk_1.27.2.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.27.1.bb => go-runtime_1.27.2.bb} (100%)
rename meta/recipes-devtools/go/{go_1.27.1.bb => go_1.27.2.bb} (100%)
diff --git a/meta/recipes-devtools/go/go-1.27.1.inc b/meta/recipes-devtools/go/go-1.27.2.inc
similarity index 91%
rename from meta/recipes-devtools/go/go-1.27.1.inc
rename to meta/recipes-devtools/go/go-1.27.2.inc
index d7ba03b1bdd..86598ad22f7 100644
--- a/meta/recipes-devtools/go/go-1.27.1.inc
+++ b/meta/recipes-devtools/go/go-1.27.2.inc
@@ -17,4 +17,4 @@ SRC_URI += "\
file://0010-cmd-go-clear-GOROOT-for-func-ldShared-when-trimpath-.patch \
file://0011-internal-cgrouptest-skip-when-cpu.max-is-not-availab.patch \
"
-SRC_URI[main.sha256sum] = "4e408abae126d916b6164627193f2c54f0e3ca1312d693b86db45f862ab238b1"
+SRC_URI[main.sha256sum] = "03495da2ba64894d40f5c4992e49454fa78b50690604ff92b6afff5081b76e62"
diff --git a/meta/recipes-devtools/go/go-binary-native_1.27.1.bb b/meta/recipes-devtools/go/go-binary-native_1.27.2.bb
similarity index 80%
rename from meta/recipes-devtools/go/go-binary-native_1.27.1.bb
rename to meta/recipes-devtools/go/go-binary-native_1.27.2.bb
index f909581e499..19482f79c4b 100644
--- a/meta/recipes-devtools/go/go-binary-native_1.27.1.bb
+++ b/meta/recipes-devtools/go/go-binary-native_1.27.2.bb
@@ -9,9 +9,9 @@ PROVIDES = "go-native"
# Checksums available at https://go.dev/dl/
SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}"
-SRC_URI[go_linux_amd64.sha256sum] = "63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445"
-SRC_URI[go_linux_arm64.sha256sum] = "3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec"
-SRC_URI[go_linux_ppc64le.sha256sum] = "ad1ff83c24f783c2d4a025852b928a05c199e8742a14a5482d88de0293d2bd0d"
+SRC_URI[go_linux_amd64.sha256sum] = "ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5"
+SRC_URI[go_linux_arm64.sha256sum] = "94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8"
+SRC_URI[go_linux_ppc64le.sha256sum] = "059d5f01b1607a724ea5ae87c5589041a51c577a6f3f20099e49d00f31c803fa"
UPSTREAM_CHECK_URI = "https://golang.org/dl/"
UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux"
diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.27.1.bb b/meta/recipes-devtools/go/go-cross-canadian_1.27.2.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross-canadian_1.27.1.bb
rename to meta/recipes-devtools/go/go-cross-canadian_1.27.2.bb
diff --git a/meta/recipes-devtools/go/go-cross_1.27.1.bb b/meta/recipes-devtools/go/go-cross_1.27.2.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross_1.27.1.bb
rename to meta/recipes-devtools/go/go-cross_1.27.2.bb
diff --git a/meta/recipes-devtools/go/go-crosssdk_1.27.1.bb b/meta/recipes-devtools/go/go-crosssdk_1.27.2.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-crosssdk_1.27.1.bb
rename to meta/recipes-devtools/go/go-crosssdk_1.27.2.bb
diff --git a/meta/recipes-devtools/go/go-runtime_1.27.1.bb b/meta/recipes-devtools/go/go-runtime_1.27.2.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-runtime_1.27.1.bb
rename to meta/recipes-devtools/go/go-runtime_1.27.2.bb
diff --git a/meta/recipes-devtools/go/go/0001-cmd-go-make-content-based-hash-generation-less-pedan.patch b/meta/recipes-devtools/go/go/0001-cmd-go-make-content-based-hash-generation-less-pedan.patch
index 6372b7805b7..92e2a1bc8bc 100644
--- a/meta/recipes-devtools/go/go/0001-cmd-go-make-content-based-hash-generation-less-pedan.patch
+++ b/meta/recipes-devtools/go/go/0001-cmd-go-make-content-based-hash-generation-less-pedan.patch
@@ -108,7 +108,7 @@ index 8dcf324529f5..617b7ece73f0 100644
}
// Configuration specific to compiler toolchain.
-@@ -2838,8 +2840,25 @@ func envList(key, def string) []string {
+@@ -2839,8 +2841,25 @@ func envList(key, def string) []string {
return args
}
@@ -135,7 +135,7 @@ index 8dcf324529f5..617b7ece73f0 100644
if cppflags, err = buildFlags("CPPFLAGS", "", p.CgoCPPFLAGS, checkCompilerFlags); err != nil {
return
}
-@@ -2855,6 +2874,13 @@ func (b *Builder) CFlags(p *load.Package) (cppflags, cflags, cxxflags, fflags, l
+@@ -2856,6 +2875,13 @@ func (b *Builder) CFlags(p *load.Package) (cppflags, cflags, cxxflags, fflags, l
if ldflags, err = buildFlags("LDFLAGS", DefaultCFlags, p.CgoLDFLAGS, checkLinkerFlags); err != nil {
return
}
@@ -149,7 +149,7 @@ index 8dcf324529f5..617b7ece73f0 100644
return
}
-@@ -2943,7 +2969,7 @@ func (b *Builder) runCgo(ctx context.Context, a *Action) error {
+@@ -2944,7 +2970,7 @@ func (b *Builder) runCgo(ctx context.Context, a *Action) error {
cgoExe := base.Tool("cgo")
cgofiles = mkAbsFiles(p.Dir, cgofiles)
@@ -158,7 +158,7 @@ index 8dcf324529f5..617b7ece73f0 100644
if err != nil {
return err
}
-@@ -3501,7 +3527,7 @@ func (b *Builder) swigOne(a *Action, file, objdir string, pcCFLAGS []string, cxx
+@@ -3502,7 +3528,7 @@ func (b *Builder) swigOne(a *Action, file, objdir string, pcCFLAGS []string, cxx
p := a.Package
sh := b.Shell(a)
diff --git a/meta/recipes-devtools/go/go/0003-ld-add-soname-to-shareable-objects.patch b/meta/recipes-devtools/go/go/0003-ld-add-soname-to-shareable-objects.patch
index 59ae99c44d3..2e46e22161e 100644
--- a/meta/recipes-devtools/go/go/0003-ld-add-soname-to-shareable-objects.patch
+++ b/meta/recipes-devtools/go/go/0003-ld-add-soname-to-shareable-objects.patch
@@ -22,7 +22,7 @@ diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
index 9cbc12919f1d..0f33521777d1 100644
--- a/src/cmd/link/internal/ld/lib.go
+++ b/src/cmd/link/internal/ld/lib.go
-@@ -1672,6 +1672,7 @@ func (ctxt *Link) hostlink() {
+@@ -1680,6 +1680,7 @@ func (ctxt *Link) hostlink() {
argv = append(argv, "-Wl,-z,relro")
}
argv = append(argv, "-shared")
@@ -30,7 +30,7 @@ index 9cbc12919f1d..0f33521777d1 100644
if ctxt.HeadType == objabi.Hwindows {
argv = addASLRargs(argv, *flagAslr)
} else {
-@@ -1687,6 +1688,7 @@ func (ctxt *Link) hostlink() {
+@@ -1695,6 +1696,7 @@ func (ctxt *Link) hostlink() {
argv = append(argv, "-Wl,-z,relro")
}
argv = append(argv, "-shared")
@@ -38,7 +38,7 @@ index 9cbc12919f1d..0f33521777d1 100644
case BuildModePlugin:
if ctxt.HeadType == objabi.Hdarwin {
argv = append(argv, "-dynamiclib")
-@@ -1695,6 +1697,7 @@ func (ctxt *Link) hostlink() {
+@@ -1703,6 +1705,7 @@ func (ctxt *Link) hostlink() {
argv = append(argv, "-Wl,-z,relro")
}
argv = append(argv, "-shared")
diff --git a/meta/recipes-devtools/go/go/0006-cmd-go-make-GOROOT-precious-by-default.patch b/meta/recipes-devtools/go/go/0006-cmd-go-make-GOROOT-precious-by-default.patch
index 74fd1faa697..77b4bedd017 100644
--- a/meta/recipes-devtools/go/go/0006-cmd-go-make-GOROOT-precious-by-default.patch
+++ b/meta/recipes-devtools/go/go/0006-cmd-go-make-GOROOT-precious-by-default.patch
@@ -94,7 +94,7 @@ index 617b7ece73f0..46c0712c5bd0 100644
if err := sh.Mkdir(buildAction.Objdir); err != nil {
return nil, err
}
-@@ -1922,6 +1939,14 @@ func (b *Builder) linkShared(ctx context.Context, a *Action) (err error) {
+@@ -1923,6 +1940,14 @@ func (b *Builder) linkShared(ctx context.Context, a *Action) (err error) {
return err
}
diff --git a/meta/recipes-devtools/go/go/0007-exec.go-filter-out-build-specific-paths-from-linker-.patch b/meta/recipes-devtools/go/go/0007-exec.go-filter-out-build-specific-paths-from-linker-.patch
index 0cc770a006a..e6a5ce587eb 100644
--- a/meta/recipes-devtools/go/go/0007-exec.go-filter-out-build-specific-paths-from-linker-.patch
+++ b/meta/recipes-devtools/go/go/0007-exec.go-filter-out-build-specific-paths-from-linker-.patch
@@ -18,7 +18,7 @@ diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
index 46c0712c5bd0..e7c0459ee4c0 100644
--- a/src/cmd/go/internal/work/exec.go
+++ b/src/cmd/go/internal/work/exec.go
-@@ -1597,6 +1597,29 @@ func (b *Builder) linkActionID(a *Action) cache.ActionID {
+@@ -1598,6 +1598,29 @@ func (b *Builder) linkActionID(a *Action) cache.ActionID {
return h.Sum()
}
@@ -48,7 +48,7 @@ index 46c0712c5bd0..e7c0459ee4c0 100644
// printLinkerConfig prints the linker config into the hash h,
// as part of the computation of a linker-related action ID.
func (b *Builder) printLinkerConfig(h io.Writer, p *load.Package) {
-@@ -1607,7 +1630,7 @@ func (b *Builder) printLinkerConfig(h io.Writer, p *load.Package) {
+@@ -1608,7 +1631,7 @@ func (b *Builder) printLinkerConfig(h io.Writer, p *load.Package) {
case "gc":
fmt.Fprintf(h, "link %s %q %s\n", b.toolID("link"), forcedLdflags, ldBuildmode)
if p != nil {
diff --git a/meta/recipes-devtools/go/go/0011-internal-cgrouptest-skip-when-cpu.max-is-not-availab.patch b/meta/recipes-devtools/go/go/0011-internal-cgrouptest-skip-when-cpu.max-is-not-availab.patch
index f13cf78f7a7..cf6283b2bf4 100644
--- a/meta/recipes-devtools/go/go/0011-internal-cgrouptest-skip-when-cpu.max-is-not-availab.patch
+++ b/meta/recipes-devtools/go/go/0011-internal-cgrouptest-skip-when-cpu.max-is-not-availab.patch
@@ -21,13 +21,13 @@ Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1 file changed, 6 insertions(+)
diff --git a/src/internal/cgrouptest/cgrouptest_linux.go b/src/internal/cgrouptest/cgrouptest_linux.go
-index ad9599c..a4b9b52 100644
+index ad9599c9..a4b9b52d 100644
--- a/src/internal/cgrouptest/cgrouptest_linux.go
+++ b/src/internal/cgrouptest/cgrouptest_linux.go
@@ -82,6 +82,12 @@ func InCgroupV2(t *testing.T, fn func(*CgroupV2)) {
}
}()
-
+
+ // cpu.max only exists when the kernel supports CPU bandwidth control
+ // (CONFIG_CFS_BANDWIDTH), even if the cpu controller is enabled.
+ if _, err := os.Stat(filepath.Join(path, "cpu.max")); err != nil {
@@ -36,4 +36,4 @@ index ad9599c..a4b9b52 100644
+
migrateTo(t, path)
defer migrateTo(t, orig)
-
+
diff --git a/meta/recipes-devtools/go/go_1.27.1.bb b/meta/recipes-devtools/go/go_1.27.2.bb
similarity index 100%
rename from meta/recipes-devtools/go/go_1.27.1.bb
rename to meta/recipes-devtools/go/go_1.27.2.bb
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 11/17] kea: Upgrade 3.2.0 -> 3.2.1
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 10/17] go: upgrade 1.27.1 -> 1.27.2 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 12/17] lib/oe/recipeutils: honor stable_upgrade for UPSTREAM_CHECK_COMMITS recipes Yoann Congal
` (5 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
ReleaseNotes: https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.2.1
The following summarizes the changes since the previous release:
```
2511. [bug] tmark
Related name change requests (NCRs), are now
sent by kea-dhcp4 and kea-dhcp6 in a single
message to kea-dhcp-ddns. This ensures that
kea-dhcp-ddns processes them in the order they
were received.
(Gitlab #4806, #3005)
2510. [bug] tmark
Modified kea-dhcp-ddns to avoid starting a
transaction for a request if there is already
a transaction for the request's FQDN or ip address.
Prior to this it used the DHCID to guard against
concurrent work.
(Gitlab #4805,#4585)
2509. [func] tmark
Modified kea-dhcp4 and kea-dhcp6 to avoid
scheduling unnecessary DDNS entry removals
when renewing leases.
(Gitlab #4804, #4794)
2508. [bug] fdupont
Made lexical analyzers more robust with null characters
in input, e.g. in server or agent configuration files.
(Gitlab #4795,#4739)
2507. [build] fdupont
Added OpenSSL 4.0.x support.
(Gitlab #4756, #4673)
2506. [bug] tmark
Improved handling of special characters
in values written to memfile lease database.
(Gitlab #4787, #4393)
2505. [bug] razvan, fdupont
Fixed bugs related to out of bound container access which can
cause Kea to crash if -D_GLIBCXX_ASSERTIONS flag is used at
compilation time. This affected perfdhcp, host_cache hook
library, kea-dhcp4, kea-dhcp6, kea-dhcp-ddns and kea-netconf.
Thank you to Joseph Bisch (joseph.bisch@gmail.com) for reporting
this issue.
(Gitlab #4783,#4741,#4708)
2504. [bug] fdupont
Made parsing of DHCPv6 relayed messages stricter:
now truncated RELAY-FORW and RELAY-REPLY headers
cause the whole message to be dropped. Thank you to
Qifan Zhang from Palo Alto Networks for reporting
the issue.
(Gitlab #4752,#4560,#4735)
2503. [bug] fdupont
Set the broadcast flag in DHCPNAK responses to relayed
DHCPREQUEST queries as required by RFC 2131 4.3.2.
Thank you to Florian Krieger from Frauscher Sensor Technology
Group GmbH for reporting the issue.
(Gitlab #4751,#4424)
2502. [bug] razvan,tmark
Corrected MLM_MYSQL_FETCH_FAILURE to 1 so MySQL
selectQuery and host lookups detect mysql_stmt_fetch
errors instead of silently ignoring them.
(Gitlab #4754,#4658)
2501. [bug] fdupont,tmark
Fixed an issue in debug-level logging of dropped packets
that could cause the server to crash under heavy load.
Applies to both kea-dhcp4 and kea-dhcp6.
(Gitlab #4750,#4755,#4719,#4748)
2500. [bug] fdupont,tmark
Removed spurious DHCP_RECEIVE4_UNKNOWN and
DHCP_RECEIVE6_UNKNOWN warnings sent for instance
when a command is received. This bug was introduced
in 3.2.0 release.
(Gitlab #4749, #4674)
2499. [build] razvan
The library version numbers have been bumped up for the Kea 3.2.1
stable release.
(Gitlab #4811)
2498. [bug] tmark
Improved handling of special characters
in values written to memfile lease database.
(Gitlab #4787,#4393)
- Drop 0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch as change is part of release
- Refresh the existing patches
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac5263766fac6ee9715589a23ab6f5a45428b656)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...-qualifiers-to-OpenSSL-X509-pointers.patch | 49 -------------------
...se-a-runtime-safe-interpreter-string.patch | 8 +--
.../0001-mk_cfgrpt.sh-strip-prefixes.patch | 2 +-
...er_unittest_support.cc-do-not-write-.patch | 2 +-
.../kea/files/fix-multilib-conflict.patch | 2 +-
.../kea/{kea_3.2.0.bb => kea_3.2.1.bb} | 3 +-
6 files changed, 8 insertions(+), 58 deletions(-)
delete mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
rename meta/recipes-connectivity/kea/{kea_3.2.0.bb => kea_3.2.1.bb} (96%)
diff --git a/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch b/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
deleted file mode 100644
index 987890f4ff1..00000000000
--- a/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 82d28b1be73bbc00e73e59d0c59c51a1e76519a5 Mon Sep 17 00:00:00 2001
-From: Simo Sorce <simo@redhat.com>
-Date: Mon, 27 Apr 2026 17:49:56 -0400
-Subject: [PATCH] Add const qualifiers to OpenSSL X509 pointers
-
-Added const qualifiers to the X509_NAME and X509_NAME_ENTRY pointers when
-retrieving subject and issuer names from TLS certificates. This ensures const-
-correctness and maintains compatibility with newer OpenSSL versions, which
-return const pointers from these getter functions.
-
-Signed-off-by: Simo Sorce <simo@redhat.com>
-
-Upstream-Status: Submitted [https://gitlab.isc.org/isc-projects/kea/-/issues/4673]
-Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
----
- src/lib/asiolink/openssl_tls.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lib/asiolink/openssl_tls.h b/src/lib/asiolink/openssl_tls.h
-index 57c3323..52a969b 100644
---- a/src/lib/asiolink/openssl_tls.h
-+++ b/src/lib/asiolink/openssl_tls.h
-@@ -175,9 +175,9 @@ public:
- if (!cert) {
- return ("");
- }
-- ::X509_NAME *name = ::X509_get_subject_name(cert);
-+ const ::X509_NAME *name = ::X509_get_subject_name(cert);
- int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1);
-- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
-+ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
- if (!ne) {
- ::X509_free(cert);
- return ("");
-@@ -209,9 +209,9 @@ public:
- if (!cert) {
- return ("");
- }
-- ::X509_NAME *name = ::X509_get_issuer_name(cert);
-+ const ::X509_NAME *name = ::X509_get_issuer_name(cert);
- int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1);
-- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
-+ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
- if (!ne) {
- ::X509_free(cert);
- return ("");
---
-2.53.0
-
diff --git a/meta/recipes-connectivity/kea/files/0001-meson-use-a-runtime-safe-interpreter-string.patch b/meta/recipes-connectivity/kea/files/0001-meson-use-a-runtime-safe-interpreter-string.patch
index 20a68e5e564..e3ab78525b4 100644
--- a/meta/recipes-connectivity/kea/files/0001-meson-use-a-runtime-safe-interpreter-string.patch
+++ b/meta/recipes-connectivity/kea/files/0001-meson-use-a-runtime-safe-interpreter-string.patch
@@ -1,4 +1,4 @@
-From 312f5b7e8286c306502bed348fe5da765c20f98d Mon Sep 17 00:00:00 2001
+From 8f832387e2e31683dca5df092c464ad655a417d2 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Thu, 28 Aug 2025 17:02:49 -0700
Subject: [PATCH] meson: use a runtime-safe interpreter string
@@ -44,10 +44,10 @@ index 5fc5ee9..6485ce2 100644
if PDFLATEX.found()
doc_conf.set('HAVE_PDFLATEX', 'yes')
diff --git a/meson.build b/meson.build
-index f3ef0ea..11a41cf 100644
+index 4e9ce4b..3cd8987 100644
--- a/meson.build
+++ b/meson.build
-@@ -648,9 +648,13 @@ link_args = []
+@@ -655,9 +655,13 @@ link_args = []
# Also, Meson might use it by default, but might not use it on all systems, so lots of variables...
# EXECUTABLE_RPATH = f'$ORIGIN/../@LIBDIR@'
# HOOK_RPATH = '$ORIGIN/../..'
@@ -62,7 +62,7 @@ index f3ef0ea..11a41cf 100644
# Add rpaths for NETCONF dependencies.
if NETCONF_DEP.found()
-@@ -769,7 +773,13 @@ report_conf_data.set('CXX_ARGS', ' '.join(compile_args))
+@@ -776,7 +780,13 @@ report_conf_data.set('CXX_ARGS', ' '.join(compile_args))
report_conf_data.set('LD_ID', cpp.get_linker_id())
link_args += get_option('cpp_link_args')
report_conf_data.set('LD_ARGS', ' '.join(link_args))
diff --git a/meta/recipes-connectivity/kea/files/0001-mk_cfgrpt.sh-strip-prefixes.patch b/meta/recipes-connectivity/kea/files/0001-mk_cfgrpt.sh-strip-prefixes.patch
index beee04e1593..38703edba91 100644
--- a/meta/recipes-connectivity/kea/files/0001-mk_cfgrpt.sh-strip-prefixes.patch
+++ b/meta/recipes-connectivity/kea/files/0001-mk_cfgrpt.sh-strip-prefixes.patch
@@ -1,4 +1,4 @@
-From 97599e59234b8d79748eb7b1cdd451c91e94152f Mon Sep 17 00:00:00 2001
+From 9389b17972f09a6629d5a5fe5d869df6614c3109 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Thu, 28 Aug 2025 17:31:39 -0700
Subject: [PATCH] mk_cfgrpt.sh: strip prefixes
diff --git a/meta/recipes-connectivity/kea/files/0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch b/meta/recipes-connectivity/kea/files/0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch
index 22a26f345dd..2a0db44e61b 100644
--- a/meta/recipes-connectivity/kea/files/0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch
+++ b/meta/recipes-connectivity/kea/files/0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch
@@ -1,4 +1,4 @@
-From 39281b6199b1307b6b70f3163a70ab9ce4f445d0 Mon Sep 17 00:00:00 2001
+From 98e5871081dec4953d7f92992a8167feb4fe8fa1 Mon Sep 17 00:00:00 2001
From: Alexander Kanavin <alex.kanavin@gmail.com>
Date: Tue, 10 Nov 2020 15:57:03 +0000
Subject: [PATCH] src/lib/log/logger_unittest_support.cc: do not write build
diff --git a/meta/recipes-connectivity/kea/files/fix-multilib-conflict.patch b/meta/recipes-connectivity/kea/files/fix-multilib-conflict.patch
index c1ac4854254..e78e7792626 100644
--- a/meta/recipes-connectivity/kea/files/fix-multilib-conflict.patch
+++ b/meta/recipes-connectivity/kea/files/fix-multilib-conflict.patch
@@ -1,4 +1,4 @@
-From 5180d1866b99125d3353f76151e84644a5791e3d Mon Sep 17 00:00:00 2001
+From 414842987006bf8f1b6e447901360c230966a908 Mon Sep 17 00:00:00 2001
From: Kai Kang <kai.kang@windriver.com>
Date: Tue, 14 Oct 2025 01:37:35 +0000
Subject: [PATCH] There are conflict of config files between kea and lib32-kea:
diff --git a/meta/recipes-connectivity/kea/kea_3.2.0.bb b/meta/recipes-connectivity/kea/kea_3.2.1.bb
similarity index 96%
rename from meta/recipes-connectivity/kea/kea_3.2.0.bb
rename to meta/recipes-connectivity/kea/kea_3.2.1.bb
index 38b24eed1f0..3e98e334335 100644
--- a/meta/recipes-connectivity/kea/kea_3.2.0.bb
+++ b/meta/recipes-connectivity/kea/kea_3.2.1.bb
@@ -19,9 +19,8 @@ SRC_URI = "http://ftp.isc.org/isc/kea/${PV}/${BP}.tar.xz \
file://0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch \
file://0001-meson-use-a-runtime-safe-interpreter-string.patch \
file://0001-mk_cfgrpt.sh-strip-prefixes.patch \
- file://0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch \
"
-SRC_URI[sha256sum] = "14bf695d37b65b9b1bf550fea5d0adaf9806c50e5419ef2a176a4b8e9aade3df"
+SRC_URI[sha256sum] = "3478220be62b3aa361a2c7f97d5d2989b934f7864e82d4bd17056e1e208b9735"
inherit meson pkgconfig systemd update-rc.d upstream-version-is-even python3-dir
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 12/17] lib/oe/recipeutils: honor stable_upgrade for UPSTREAM_CHECK_COMMITS recipes
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 11/17] kea: Upgrade 3.2.0 -> 3.2.1 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 13/17] tcl: skip timing-sensitive clock tests Yoann Congal
` (4 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Daniel Turull <daniel.turull@ericsson.com>
Found running AUH --stable on wrynose: recipes with
UPSTREAM_CHECK_COMMITS set (gnu-config, gn, piglit, etc.) always
reported "-new-commits-available" regardless of stable_upgrade, since
that check ran before stable_upgrade was ever consulted.
AI-Generated: kiro:claude-sonnet-5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 439d13ce380c099fe6804c14930039da95dcbc3b)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/lib/oe/recipeutils.py | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/meta/lib/oe/recipeutils.py b/meta/lib/oe/recipeutils.py
index 99e7bc7acf4..522537e0d96 100644
--- a/meta/lib/oe/recipeutils.py
+++ b/meta/lib/oe/recipeutils.py
@@ -1069,16 +1069,23 @@ def get_recipe_upstream_version(rd, stable_upgrade=False):
else:
ud = bb.fetch.FetchData(src_uri, rd)
if rd.getVar("UPSTREAM_CHECK_COMMITS") == "1":
- bb.fetch.get_srcrev(rd)
- upversion = None
- revision = None
- try:
- revision = ud.method.latest_revision(ud, rd, ud.name)
+ if stable_upgrade:
+ # UPSTREAM_CHECK_COMMITS recipes only track git HEAD, not a
+ # version number, so there's no way to filter for a "stable"
+ # release; treat as no update available.
upversion = pv
- if revision != ud.revision:
- upversion = upversion + "-new-commits-available"
- except bb.fetch.FetchError as e:
- bb.warn("Unable to obtain latest revision: {}".format(e))
+ revision = None
+ else:
+ bb.fetch.get_srcrev(rd)
+ upversion = None
+ revision = None
+ try:
+ revision = ud.method.latest_revision(ud, rd, ud.name)
+ upversion = pv
+ if revision != ud.revision:
+ upversion = upversion + "-new-commits-available"
+ except bb.fetch.FetchError as e:
+ bb.warn("Unable to obtain latest revision: {}".format(e))
else:
if stable_upgrade:
stable_release_regex = rd.getVar("UPSTREAM_STABLE_RELEASE_REGEX")
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 13/17] tcl: skip timing-sensitive clock tests
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 12/17] lib/oe/recipeutils: honor stable_upgrade for UPSTREAM_CHECK_COMMITS recipes Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 14/17] nasm: fix CVE-2026-6067 Yoann Congal
` (3 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
The clock-33.* tests check with millisecond-accuracy and as such are
unstable under load, so skip them all.
[ YOCTO #16324 ]
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5e73a6ed434591fa644c567f8f59e2f442022e66)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/tcltk/tcl/run-ptest | 2 ++
meta/recipes-devtools/tcltk8/tcl8/run-ptest | 2 ++
2 files changed, 4 insertions(+)
diff --git a/meta/recipes-devtools/tcltk/tcl/run-ptest b/meta/recipes-devtools/tcltk/tcl/run-ptest
index c01a7a1da28..18e03716e30 100644
--- a/meta/recipes-devtools/tcltk/tcl/run-ptest
+++ b/meta/recipes-devtools/tcltk/tcl/run-ptest
@@ -14,6 +14,8 @@ SKIP="$SKIP async-\* event-\*"
# This test behaves differently when using a system tzdata, skip until fixed upstream
# https://core.tcl-lang.org/tcl/tktview/51aa53616067cb63900b17ca1d71f07b094ffa1a
SKIP="$SKIP clock-59.2\*"
+# These tests check millisecond timing and are unreliable under load
+SKIP="$SKIP clock-33.\*"
# 14882
SKIP="$SKIP cmdMZ-6.6"
# 15081
diff --git a/meta/recipes-devtools/tcltk8/tcl8/run-ptest b/meta/recipes-devtools/tcltk8/tcl8/run-ptest
index f4d0e90c0f0..40666ef851a 100644
--- a/meta/recipes-devtools/tcltk8/tcl8/run-ptest
+++ b/meta/recipes-devtools/tcltk8/tcl8/run-ptest
@@ -14,6 +14,8 @@ SKIP="$SKIP async-\* event-\*"
# This test behaves differently when using a system tzdata, skip until fixed upstream
# https://core.tcl-lang.org/tcl/tktview/51aa53616067cb63900b17ca1d71f07b094ffa1a
SKIP="$SKIP clock-59.2\*"
+# These tests check millisecond timing and are unreliable under load
+SKIP="$SKIP clock-33.\*"
# 14882
SKIP="$SKIP cmdMZ-6.6"
# 15081
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 14/17] nasm: fix CVE-2026-6067
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 13/17] tcl: skip timing-sensitive clock tests Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 15/17] libpcre2: Remove testoutput3C file Yoann Congal
` (2 subsequent siblings)
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Kris Gavvala <kris.gavvala@windriver.com>
When using obj output format, specifying more than 256 segments in
the GROUP directive of the .asm file causes a heap-buffer-overflow.
This patch applies the upstream fix given by the commit in [1]
to address the issue in [2].
[1] https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94
[2] https://github.com/netwide-assembler/nasm/issues/203
[3] https://nvd.nist.gov/vuln/detail/cve-2026-6067
Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1a81d85a8a23fc1a5c8396c8a7cb5cb59e97a9b2)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../nasm/nasm/CVE-2026-6067.patch | 36 +++++++++++++++++++
meta/recipes-devtools/nasm/nasm_3.02.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch
diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch b/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch
new file mode 100644
index 00000000000..e43aafc7ee2
--- /dev/null
+++ b/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch
@@ -0,0 +1,36 @@
+From cc006a1d57bebb6ea49db488539a1613014c062f Mon Sep 17 00:00:00 2001
+From: Nick Clifton <nickclifton@github.com>
+Date: Mon, 29 Jun 2026 13:53:14 -0700
+Subject: [PATCH] outobj: fix buffer overflow when too many segments in a group
+
+The number of entries in a group was hard-coded, but not enforced.
+
+CVE: CVE-2026-6067
+Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94]
+
+Reported-by: <BreakingBad6@github.com>
+Fixes: https://github.com/netwide-assembler/nasm/issues/203
+Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
+Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
+---
+ output/outobj.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/output/outobj.c b/output/outobj.c
+index 685c5933e..9d8bf83c5 100644
+--- a/output/outobj.c
++++ b/output/outobj.c
+@@ -1736,6 +1736,10 @@ obj_directive(enum directive directive, char *value)
+ */
+ continue;
+ }
++ if (grp->nentries >= GROUP_MAX) {
++ nasm_nonfatal("too many segments in a group");
++ return DIRR_ERROR;
++ }
+ for (seg = seghead; seg; seg = seg->next)
+ if (!strcmp(seg->name, p))
+ break;
+--
+2.43.0
+
diff --git a/meta/recipes-devtools/nasm/nasm_3.02.bb b/meta/recipes-devtools/nasm/nasm_3.02.bb
index a7d598cf629..2d2778fd88f 100644
--- a/meta/recipes-devtools/nasm/nasm_3.02.bb
+++ b/meta/recipes-devtools/nasm/nasm_3.02.bb
@@ -10,6 +10,7 @@ DEPENDS = "zlib"
SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \
file://0001-stdlib-Add-strlcat.patch \
file://0002-Add-debug-prefix-map-option.patch \
+ file://CVE-2026-6067.patch \
"
SRC_URI[sha256sum] = "ce7ed93281615379e4a9d4e76503c64a79c1d5ca696dbe148f16cf0b93e239af"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 15/17] libpcre2: Remove testoutput3C file
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 14/17] nasm: fix CVE-2026-6067 Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 16/17] sqlite3: Fix host include path leaking in with readline/editline Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 17/17] barebox: inherit upstream-stable-release-point Yoann Congal
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
This file had to be added to fix an issue with version 10.48. Said issue
is no longer present in version 10.49.
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2964318001151716b0d50b4533af15e46bf0de78)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libpcre/libpcre2/testoutput3C | 174 ------------------
.../recipes-support/libpcre/libpcre2_10.49.bb | 2 -
2 files changed, 176 deletions(-)
delete mode 100644 meta/recipes-support/libpcre/libpcre2/testoutput3C
diff --git a/meta/recipes-support/libpcre/libpcre2/testoutput3C b/meta/recipes-support/libpcre/libpcre2/testoutput3C
deleted file mode 100644
index 2af67a8d036..00000000000
--- a/meta/recipes-support/libpcre/libpcre2/testoutput3C
+++ /dev/null
@@ -1,174 +0,0 @@
-# This set of tests checks local-specific features, using the "fr_FR" locale.
-# It is almost Perl-compatible. When run via RunTest, the locale is edited to
-# be whichever of "fr_FR", "french", or "fr" is found to exist. There is
-# different version of this file called wintestinput3 for use on Windows,
-# where the locale is called "french" and the tests are run using
-# RunTest.bat.
-
-#forbid_utf
-
-/^[\w]+/
-\= Expect no match
- �cole
-No match
-
-/^[\w]+/locale=fr_FR
- �cole
-No match
-
-/^[\W]+/
- �cole
- 0: \xc9
-
-/^[\W]+/locale=fr_FR
-\= Expect no match
- �cole
- 0: \xc9
-
-/[\b]/
- \b
- 0: \x08
-\= Expect no match
- a
-No match
-
-/[\b]/locale=fr_FR
- \b
- 0: \x08
-\= Expect no match
- a
-No match
-
-/^\w+/
-\= Expect no match
- �cole
-No match
-
-/^\w+/locale=fr_FR
- �cole
-No match
-
-/(.+)\b(.+)/
- �cole
- 0: \xc9cole
- 1: \xc9
- 2: cole
-
-/(.+)\b(.+)/locale=fr_FR
-\= Expect no match
- �cole
- 0: \xc9cole
- 1: \xc9
- 2: cole
-
-/�cole/i
- �cole
- 0: \xc9cole
-\= Expect no match
- �cole
-No match
-
-/�cole/i,locale=fr_FR
- �cole
- 0: \xc9cole
- �cole
-No match
-
-/\w/I
-Capture group count = 0
-Starting code units: 0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P
- Q R S T U V W X Y Z _ a b c d e f g h i j k l m n o p q r s t u v w x y z
-Subject length lower bound = 1
-
-/\w/I,locale=fr_FR
-Capture group count = 0
-Starting code units: 0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P
- Q R S T U V W X Y Z _ a b c d e f g h i j k l m n o p q r s t u v w x y z
-Subject length lower bound = 1
-
-# All remaining tests are in the fr_FR locale, so set the default.
-
-#pattern locale=fr_FR
-
-/^[\xc8-\xc9]/i
- �cole
- 0: \xc9
- �cole
-No match
-
-/^[\xc8-\xc9]/
- �cole
- 0: \xc9
-\= Expect no match
- �cole
-No match
-
-/\xb5/i
- �
- 0: \xb5
-\= Expect no match
- \x9c
-No match
-
-/�/i
- \xff
- 0: \xff
-\= Expect no match
- y
-No match
-
-/(.)\1/i
- \xfe\xde
-No match
-
-/\W+/
- >>>\xaa<<<
- 0: >>>\xaa<<<
- >>>\xba<<<
- 0: >>>\xba<<<
-
-/[\W]+/
- >>>\xaa<<<
- 0: >>>\xaa<<<
- >>>\xba<<<
- 0: >>>\xba<<<
-
-/[^[:alpha:]]+/
- >>>\xaa<<<
- 0: >>>\xaa<<<
- >>>\xba<<<
- 0: >>>\xba<<<
-
-/\w+/
- >>>\xaa<<<
-No match
- >>>\xba<<<
-No match
-
-/[\w]+/
- >>>\xaa<<<
-No match
- >>>\xba<<<
-No match
-
-/[[:alpha:]]+/
- >>>\xaa<<<
-No match
- >>>\xba<<<
-No match
-
-/[[:alpha:]][[:lower:]][[:upper:]]/IB
-------------------------------------------------------------------
- Bra
- [A-Za-z]
- [a-z]
- [A-Z]
- Ket
- End
-------------------------------------------------------------------
-Capture group count = 0
-Starting code units: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
- a b c d e f g h i j k l m n o p q r s t u v w x y z
-Subject length lower bound = 3
-
-# End of testinput3
diff --git a/meta/recipes-support/libpcre/libpcre2_10.49.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
index 5fa7c3db3b4..8e0c44fb4c4 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.49.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
@@ -14,7 +14,6 @@ LIC_FILES_CHKSUM = "file://LICENCE.md;md5=6720bf3bcff57543b915c2b22e526df0 \
SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
file://run-ptest \
- file://testoutput3C \
"
GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
@@ -64,7 +63,6 @@ BBCLASSEXTEND = "native nativesdk"
do_install_ptest() {
t=${D}${PTEST_PATH}
cp -r ${S}/testdata $t
- cp ${UNPACKDIR}/testoutput3C $t/testdata/testoutput3C
for i in pcre2posix_test pcre2grep pcre2test; do
"${B}/libtool" --mode=install install "${B}/$i" "$t"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 16/17] sqlite3: Fix host include path leaking in with readline/editline
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 15/17] libpcre2: Remove testoutput3C file Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
2026-10-16 22:24 ` [OE-core][blacksail 17/17] barebox: inherit upstream-stable-release-point Yoann Congal
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Frieder Schrempf <frieder.schrempf@kontron.de>
The autosetup based configure derives the readline CFLAGS from
--with-readline-header, so the ${includedir} based path turns into
"-I/usr/include" and the build host headers are used. With the cross
compiler this fails with -Werror=poison-system-directories. Use
${STAGING_INCDIR} so the include path points to the recipe sysroot.
Tested by building sqlite3 with PACKAGECONFIG readline enabled for
qemuarm on master.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 52f471a0aacd1115886ec1ac1dd3c25798781926)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb
index 137ec26207a..007a823dc59 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb
@@ -34,8 +34,8 @@ inherit pkgconfig siteinfo upstream-stable-release-point
PACKAGECONFIG ?= "fts4 fts5 rtree dyn_ext unlock-notify"
PACKAGECONFIG:class-native ?= "fts4 fts5 rtree dyn_ext"
-PACKAGECONFIG[editline] = "--enable-editline --with-readline-header=${includedir}/editline/readline.h,--disable-editline,libedit ncurses"
-PACKAGECONFIG[readline] = "--enable-readline --with-readline-header=${includedir}/readline/readline.h,--disable-readline,readline ncurses"
+PACKAGECONFIG[editline] = "--enable-editline --with-readline-header=${STAGING_INCDIR}/editline/readline.h,--disable-editline,libedit ncurses"
+PACKAGECONFIG[readline] = "--enable-readline --with-readline-header=${STAGING_INCDIR}/readline/readline.h,--disable-readline,readline ncurses"
PACKAGECONFIG[fts3] = "--enable-fts3,--disable-fts3"
PACKAGECONFIG[fts4] = "--enable-fts4,--disable-fts4"
PACKAGECONFIG[fts5] = "--enable-fts5,--disable-fts5"
^ permalink raw reply related [flat|nested] 18+ messages in thread* [OE-core][blacksail 17/17] barebox: inherit upstream-stable-release-point
2026-10-16 22:24 [OE-core][blacksail 00/17] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-10-16 22:24 ` [OE-core][blacksail 16/17] sqlite3: Fix host include path leaking in with readline/editline Yoann Congal
@ 2026-10-16 22:24 ` Yoann Congal
16 siblings, 0 replies; 18+ messages in thread
From: Yoann Congal @ 2026-10-16 22:24 UTC (permalink / raw)
To: openembedded-core
From: Lucas Stach <l.stach@pengutronix.de>
Barebox uses a vYYYY.MM.stable versioning scheme, with the stable
releases only carrying bug and security fixes. Thus we can use
the upstream-stable-release-point class to mark those releases as
suitable for inclusion in the oe-core stable series.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dd7a67075c67ccd827242f098c41a12023e1a9ba)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-bsp/barebox/barebox.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-bsp/barebox/barebox.bb b/meta/recipes-bsp/barebox/barebox.bb
index a48d97941cc..583fde5d187 100644
--- a/meta/recipes-bsp/barebox/barebox.bb
+++ b/meta/recipes-bsp/barebox/barebox.bb
@@ -6,5 +6,5 @@ Linux kernel driver API for making driver porting easier, \
and a subset of the POSIX C library for writing more command-line utilities."
require barebox-common.inc
-inherit barebox
+inherit barebox upstream-stable-release-point
^ permalink raw reply related [flat|nested] 18+ messages in thread