[PATCH 2/2] ltp-ddt: New recipe to build ltp-ddt test tool.

[PATCH 2/2] ltp-ddt: New recipe to build ltp-ddt test tool.

[Carlos Hernandez]

ltp-ddt is an open source test application for embedded linux devices.
It is based on the linux test project (ltp) but it has a smaller footprint
and it focus mainly on driver and system performance.
Design Highlights:
 * Based on LTP http://ltp.sourceforge.net/
 * Test cases are suitable for embedded devices w/ a limited shell.
 * Support dynamic selection/filtering of test cases based on platform.
 * Support test parameters overrides based on platform.

Signed-off-by: Carlos Hernandez <c-hernandez8@ti.com>
---
 recipes/ltp-ddt/ltp-ddt_0.0.1.bb |   54 ++++++++++++++++++++++++++++++++++++++
 1 files changed, 54 insertions(+), 0 deletions(-)
 create mode 100644 recipes/ltp-ddt/ltp-ddt_0.0.1.bb

diff --git a/recipes/ltp-ddt/ltp-ddt_0.0.1.bb b/recipes/ltp-ddt/ltp-ddt_0.0.1.bb
new file mode 100644
index 0000000..157ee07
--- /dev/null
+++ b/recipes/ltp-ddt/ltp-ddt_0.0.1.bb
@@ -0,0 +1,54 @@
+DESCRIPTION = "Embedded Linux Device Driver Tests based on Linux Test Project"
+HOMEPAGE = "http://arago-project.org/git/projects/?p=test-automation/ltp-ddt.git;a=summary"
+LICENSE = "GPL"
+SECTION = "console/utils"
+DEPENDS += "zip-native virtual/kernel"
+PR = "r0"
+
+inherit autotools
+
+BRANCH ?= "master"
+TAG ?= "ltp-ddt_${PV}"
+
+SRC_URI = "\
+git://arago-project.org/git/projects/test-automation/ltp-ddt.git;protocol=git;\
+branch=${BRANCH};\
+tag=${TAG}\
+"
+S = "${WORKDIR}/git"
+
+EXTRA_OEMAKE_append = "prefix=/usr/ltp CROSS_COMPILE=${HOST_PREFIX} SKIP_IDCHECK=1 KERNEL_INC=${STAGING_KERNEL_DIR}/include"
+
+FILES_${PN}-dbg += "\
+ /usr/ltp/.debug \
+ /usr/ltp/bin/.debug \
+ /usr/ltp/runtest/.debug \
+ /usr/ltp/testcases/bin/.debug \
+ /usr/ltp/testcases/bin/*/bin/.debug \
+ /usr/ltp/testcases/bin/*/test/.debug \
+ /usr/ltp/testcases/bin/ddt/.debug \
+ /usr/ltp/testcases/bin/ddt/*/bin/.debug \
+ /usr/ltp/testcases/bin/ddt/*/test/.debug \
+"
+
+FILES_${PN} += "\
+ /usr/ltp/* \
+ /usr/ltp/bin/* \
+ /usr/ltp/runtest/* \
+ /usr/ltp/testcases/bin/* \
+ /usr/ltp/testcases/bin/*/bin/* \
+ /usr/ltp/testscripts/* \
+"
+
+do_configure(){
+        cp ${S}/include/config.h.default ${S}/include/config.h
+	cp ${S}/include/mk/config.mk.default ${S}/include/mk/config.mk
+	cp ${S}/include/mk/features.mk.default ${S}/include/mk/features.mk
+	echo "${TAG}" > ${S}/ChangeLog
+}
+
+do_install(){
+        oe_runmake DESTDIR=${D} install
+}
+
+
-- 
1.7.0.4

[PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[yanjun.zhu]

The utf-16 decoder in Python 3.1 through 3.3 does not update the
aligned_end variable after calling the unicode_decode_call_errorhandler
function, which allows remote attackers to obtain sensitive information
(process memory) or cause a denial of service (memory corruption and crash)
via unspecified vectors.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135

Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
---
 .../python/python/python-2.7.2-CVE-2012-2135.patch |   12 ++++++++++++
 recipes-devtools/python/python_2.7.2.bbappend      |    1 +
 2 files changed, 13 insertions(+), 0 deletions(-)
 create mode 100644 recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch

diff --git a/recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch b/recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch
new file mode 100644
index 0000000..b913097
--- /dev/null
+++ b/recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch
@@ -0,0 +1,12 @@
+diff -urpN a/Objects/unicodeobject.c b/Objects/unicodeobject.c
+--- a/Objects/unicodeobject.c	2012-11-12 16:25:33.000000000 +0800
++++ b/Objects/unicodeobject.c	2012-11-12 16:26:22.000000000 +0800
+@@ -2568,7 +2568,7 @@ PyUnicode_DecodeUTF16Stateful(const char
+         }
+ 
+         /* UTF-16 code pair: */
+-        if (q >= e) {
++        if (e - q < 2) {
+             errmsg = "unexpected end of data";
+             startinpos = (((const char *)q)-2)-starts;
+             endinpos = ((const char *)e)-starts;
diff --git a/recipes-devtools/python/python_2.7.2.bbappend b/recipes-devtools/python/python_2.7.2.bbappend
index 87be410..64ada6c 100644
--- a/recipes-devtools/python/python_2.7.2.bbappend
+++ b/recipes-devtools/python/python_2.7.2.bbappend
@@ -5,5 +5,6 @@ SRC_URI += "\
     file://python-CVE-2010-3492.patch \
     file://python-2.7.2-CVE-2012-0845.patch \
     file://python-2.7.2-CVE-2012-1150.patch \
+    file://python-2.7.2-CVE-2012-2135.patch \
 "
 PRINC = "2"
-- 
1.6.3.1

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[Otavio Salvador]

On Fri, Nov 16, 2012 at 6:53 AM, yanjun.zhu <yanjun.zhu@windriver.com>wrote:

> The utf-16 decoder in Python 3.1 through 3.3 does not update the
> aligned_end variable after calling the unicode_decode_call_errorhandler
> function, which allows remote attackers to obtain sensitive information
> (process memory) or cause a denial of service (memory corruption and crash)
> via unspecified vectors.
>
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
>
> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
>

I think this needs to be backported to previous releases, right?

-- 
Otavio Salvador                             O.S. Systems
E-mail: otavio@ossystems.com.br  http://www.ossystems.com.br
Mobile: +55 53 9981-7854              http://projetos.ossystems.com.br

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[yzhu1]

On 11/16/2012 08:21 PM, Otavio Salvador wrote:
> On Fri, Nov 16, 2012 at 6:53 AM, yanjun.zhu <yanjun.zhu@windriver.com>wrote:
>
>> The utf-16 decoder in Python 3.1 through 3.3 does not update the
>> aligned_end variable after calling the unicode_decode_call_errorhandler
>> function, which allows remote attackers to obtain sensitive information
>> (process memory) or cause a denial of service (memory corruption and crash)
>> via unspecified vectors.
>>
>> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
>>
>> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
>>
> I think this needs to be backported to previous releases, right?
Hi, Otavio

OK. I will do it.

Thanks a lot.
Zhu Yanjun

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[yzhu1]

On 11/19/2012 10:26 AM, yzhu1 wrote:
> On 11/16/2012 08:21 PM, Otavio Salvador wrote:
>> On Fri, Nov 16, 2012 at 6:53 AM, yanjun.zhu 
>> <yanjun.zhu@windriver.com>wrote:
>>
>>> The utf-16 decoder in Python 3.1 through 3.3 does not update the
>>> aligned_end variable after calling the unicode_decode_call_errorhandler
>>> function, which allows remote attackers to obtain sensitive information
>>> (process memory) or cause a denial of service (memory corruption and 
>>> crash)
>>> via unspecified vectors.
>>>
>>> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
>>>
>>> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
>>>
>> I think this needs to be backported to previous releases, right?
> Hi, Otavio
>
> OK. I will do it.
>
> Thanks a lot.
> Zhu Yanjun
>
>
Hi, Otavio

Sorry. I do not know what is the previous releases. Do you mean denzil 
branch or others?
Would you like to make it clear?

Thanks a lot.
Zhu Yanjun
>
> _______________________________________________
> Openembedded-devel mailing list
> Openembedded-devel@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-devel

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[Otavio Salvador]

On Mon, Nov 19, 2012 at 12:36 AM, yzhu1 <Yanjun.Zhu@windriver.com> wrote:

> On 11/19/2012 10:26 AM, yzhu1 wrote:
>
>> On 11/16/2012 08:21 PM, Otavio Salvador wrote:
>>
>>> On Fri, Nov 16, 2012 at 6:53 AM, yanjun.zhu <yanjun.zhu@windriver.com>**
>>> wrote:
>>>
>>>  The utf-16 decoder in Python 3.1 through 3.3 does not update the
>>>> aligned_end variable after calling the unicode_decode_call_**
>>>> errorhandler
>>>> function, which allows remote attackers to obtain sensitive information
>>>> (process memory) or cause a denial of service (memory corruption and
>>>> crash)
>>>> via unspecified vectors.
>>>>
>>>> http://web.nvd.nist.gov/view/**vuln/detail?vulnId=CVE-2012-**2135<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135>
>>>>
>>>> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
>>>>
>>>>  I think this needs to be backported to previous releases, right?
>>>
>> Hi, Otavio
>>
>> OK. I will do it.
>>
>> Thanks a lot.
>> Zhu Yanjun
>>
>>
>>  Hi, Otavio
>
> Sorry. I do not know what is the previous releases. Do you mean denzil
> branch or others?
> Would you like to make it clear?


Yes, I meant denzil and danny (both released and maintained for now).

-- 
Otavio Salvador                             O.S. Systems
E-mail: otavio@ossystems.com.br  http://www.ossystems.com.br
Mobile: +55 53 9981-7854              http://projetos.ossystems.com.br

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[Paul Eggleton]

On Friday 16 November 2012 16:53:42 yanjun.zhu wrote:
> The utf-16 decoder in Python 3.1 through 3.3 does not update the
> aligned_end variable after calling the unicode_decode_call_errorhandler
> function, which allows remote attackers to obtain sensitive information
> (process memory) or cause a denial of service (memory corruption and crash)
> via unspecified vectors.
> 
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
> 
> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
> ---
>  .../python/python/python-2.7.2-CVE-2012-2135.patch |   12 ++++++++++++
>  recipes-devtools/python/python_2.7.2.bbappend      |    1 +
>  2 files changed, 13 insertions(+), 0 deletions(-)
>  create mode 100644
> recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch

This patch is also against OE-Core, could you send this to the OE-Core list as 
well?

Thanks,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

Re: [PATCH] python: fix for Security Advisory - python - CVE-2012-2135

[yzhu1]

On 11/29/2012 10:07 PM, Paul Eggleton wrote:
> On Friday 16 November 2012 16:53:42 yanjun.zhu wrote:
>> The utf-16 decoder in Python 3.1 through 3.3 does not update the
>> aligned_end variable after calling the unicode_decode_call_errorhandler
>> function, which allows remote attackers to obtain sensitive information
>> (process memory) or cause a denial of service (memory corruption and crash)
>> via unspecified vectors.
>>
>> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
>>
>> Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
>> ---
>>   .../python/python/python-2.7.2-CVE-2012-2135.patch |   12 ++++++++++++
>>   recipes-devtools/python/python_2.7.2.bbappend      |    1 +
>>   2 files changed, 13 insertions(+), 0 deletions(-)
>>   create mode 100644
>> recipes-devtools/python/python/python-2.7.2-CVE-2012-2135.patch
> This patch is also against OE-Core, could you send this to the OE-Core list as
> well?
OK. I will follow your advice.

Thanks a lot.
Zhu Yanjun
> Thanks,
> Paul
>