subtree updates2.7.0

meta-openembedded: 6fa72d587a..8d5dcd6522:
  Changqing Li (1):
        netkit-telnet: add rconflicts

  Hongxu Jia (1):
        crash: do not use unstable github archive tarballs

  Liwei Song (1):
        turbostat: copy bits.h from kernel to turbostat

  Martin Jansa (14):
        gtkwave: add distro_features_check
        umip: make MACHINE_ARCH
        mscgen: fix SRC_URI for multilib
        triggerhappy: fix issues
        python-cassandra-driver.inc: fix DEPENDS
        opencv: use the same package name in PACKAGES and RDEPENDS
        igmpproxy: remove 0001-src-igmpproxy.h-Include-sys-types.h-for-u_short-u_in.patch and _GNU_SOURCE
        libvncserver: set PV in the recipe
        ccid: fix SRC_URI
        ne10, libopus: add armv7ve override as well
        hunspell: use git fetcher instead of github archive
        ttf-mplus, ttf-vlgothic: add ttf-mplus license
        libmikmod: fix SRC_URI
        leptonica: fix SRC_URI

  Mingli Yu (1):
        mariadb: Upgrade to 10.3.15

  Qi.Chen@windriver.com (1):
        polkit: fix CVE-2019-6133

  nick83ola (1):
        uthash: do not use unstable github archive tarballs

meta-xilinx: 64aa3d35ae..f3c8b1c9a8:
  Alejandro Enedino Hernandez Samaniego (7):
        opencl-clhpp: Allow empty packages to be built
        opencl-headers: Allow empty packages to be built
        gcc-8: rebase microblaze patches for gcc 8.2.0
        gcc8: update microblaze patches
        gcc: update microblaze patches
        update gcc-8 patches
        gcc: Remove xilinx.ld requirement

  Jaewon Lee (6):
        zc1254-zynqmp.conf: Add support for zc1254 evaluation board
        zc1275-zynqmp.conf: Add support for zc1275 evaluation board
        zcu102-zynqmp.conf: Changing qemu boot mode
        Adding FPGA_MNGR_RECONFIG_ENABLE to control enabling fpga manager
        gcc: Removing already upstreamed patch
        Rebasing binutils patches from 2.31 to 2.32

  Madhurkiran Harikrishnan (2):
        kernel-module-mali: Fix errors associated with kernel upgrade to 4.19
        xf86-video-armsoc: Remove the recipe for xf86-video-armsoc

  Manjukumar Matha (10):
        libmali-xlnx_git.bb: Fix the package arch for libmali
        zcu111-zynqmp.conf: Add support for ZCU111 evaluation board
        qemu-system-aarch64-multiarch: Enable plm argument in runqemu
        arm-trusted-firmware.inc: Add support to build ATF for versal devices
        linux-xlnx.inc: Add support to build kernel for versal devices
        linux-xlnx.inc: Use KBUILD_DEFCONFIG in externalsrc mode if defined
        kernel-simpleimage.bbclass: Use dts for simpleImage generation for Microblaze
        kernel-simpleimage.bbclass: Deploy simpleImage unstrip file
        kernel-simpleimage.bbclass: Deploy simpleImage strip
        binutils%.bbappend: Update Microblaze binutils patches to v2.31

  Min Ma (4):
        ocl-icd_git.bb: Add recipe for OpenCL ICD loaders
        opencl-clhpp_git.bb: Recipe for OpenCL Host API C++ bindings
        zocl: Recipe for Xilinx runtime driver module
        xrt: Xilinx Runtime User Space Libraries and headers

  Sai Hari Chandana Kalluri (1):
        xilinx-testimage.bbclass: Include IMAGE_AUTOLOGIN and IMAGE_FSTYPES values for runqemu

  Sreeja Vadakattu (1):
        machine-xilinx-default.inc: Make u-boot.elf as UBOOT_ELF for zynq

  Vineeth Chowdary Karumanchi (1):
        tune-zynq.inc: Build zImage in addition to uImage

meta-raspberrypi: 6c73694912..c2f2eaf445:
  Andrei Gherzan (42):
        rpi-base.inc: Include rpi4 dtb
        raspberrypi3.conf: Clarify machine mode
        linux-raspberrypi: Include configuration for RaspberryPi3 defconfig
        linux-raspberrypi: Update 4.19 kernel to 4.19.56
        rpi-base: Rename the rpi0w dtb
        firmware: Update to 20190620
        raspberrypi4.conf: Add initial machine 32 bit configuration
        linux-firmware-rpidistro: Fix WiFi on RaspberryPi 4
        rpi-base.inc: Include the "fake" KMS dtbo
        raspberrypi4: Use vc4-fkms-v3d
        linux-raspberrypi: Bump 4.19 revision to fix RPi 4 arm64 builds
        raspberrypi4-64.conf: Introduce RPi arm64 machine
        firmware: Rename firmware inc file to raspberrypi-firmware.inc
        armstubs: Add support for compiling ARM stubs
        rpi-config: Handle ARMSTUB
        sdcard_image-rpi.bbclass: Include in the SD card image the armstub file
        raspberrypi4-64.conf: Initial machine configuration
        raspberrypi-tools: Update to remove Makefile patch
        linux-raspberrypi: Fix defconfig for RPi4-64
        linux-raspberrypi.inc: Explicitly set defconfig for raspberrypi4-64
        sdcard_image-rpi.bbclass: Fix typo
        linux-raspberrypi: Bump 4.19 revision to have proper coherent_pool set
        raspberrypi4-64.conf: Define a machine feature for armstubs
        sdcard_image-rpi.bbclass: Use armstub machine feature
        linux-raspberrypi: Bump 4.19.57 revision
        raspberrypi4.conf: Define uboot defconfig
        raspberrypi4-64.conf: Uboot configuration and drop armstub
        u-boot: Use a temporary fork for RPi4 support
        raspberrypi-firmware: Update to 20190709
        raspberrypi4.conf: The firmware uses kernel7l.img when LPAE is supported
        linux-raspberrypi: Bump 4.19 to 4.19.58
        linux-raspberrypi: Build dtbs with dtbs make target for all 64bit targets
        linux-raspberrypi: Bump 4.19 revision
        raspberrypi4-64.conf: Remove memory limitation
        u-boot: Replace custom fork by patches (warrior backport)
        rpi-config: Check for armstub based on machine feature
        sdcard_image-rpi: Check for armstub based on machine feature
        armstubs: Error out when ARMSTUBS is not defined
        raspberrypi*: Define ARMSTUB for all machines
        u-boot: Fix patches names in SRC_URI
        raspberrypi4-64.conf: Limit RAM to 3G
        u-boot: Backport patch to fix u-boot compilation without USB config

  Carton (2):
        bluez5: Fixed typo (RC_URI -> SRC_URI)
        rpi-config: Check some config values against "1"

  Khem Raj (4):
        rpi-default-versions: Switch defaults to 4.19
        userland: Update to 20190501
        firmware: Update 20190220 -> 20190517
        linux-raspberrypi: Upgrade to 4.19.57

  Riyaz (1):
        rpi-base.inc: Enabling open-source vc4graphics driver for all RPI platforms

  dir (1):
        vc-graphics: Don't install sbin directory

  malus-brandywine (1):
        sdcard_image-rpi : minor bug in use of FATPAYLOAD

poky: 38d5c8ea98..01b8a8b54b:
  Anuj Mittal (7):
        expat: fix CVE-2018-20843
        vim: fix CVE-2019-12735
        gstreamer1.0-plugins-base: fix CVE-2019-9928
        wget: fix CVE-2019-5953
        bzip2: fix CVE-2019-12900
        python3: fix CVE-2018-20852 CVE-2019-9636
        curl: fix CVE-2019-5435 CVE-2019-5436

  Scott Rifenbark (4):
        overview-manual: Updated manual history table.
        Documentation: Prepared for 2.7.1 release
        ref-manual: Fixed typo for BBMULTICONFIG variable.
        poky.ent: Updated release date to July 2019

Change-Id: I93a3341457ea44866bb077749cf78e630ae6e7a6
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>

1 files changed, 124 insertions, 0 deletions

diff --git a/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch b/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch
new file mode 100644
index 0000000000..ff671d3fab
--- /dev/null
+++ b/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch
@@ -0,0 +1,124 @@
+From e5123d81ffb3be35a1b2767d6ced1a097aaf77be Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Sat, 9 Mar 2019 18:58:25 -0800
+Subject: [PATCH] bpo-35121: prefix dot in domain for proper subdomain
+ validation (GH-10258) (GH-12261)
+
+Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy.  Patch by Karthikeyan Singaravelan.
+(cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14)
+
+Co-authored-by: Xtreak <tir.karthi@gmail.com>
+Upstream-Status: Backport
+CVE: CVE-2018-20852
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> 
+---
+ Lib/http/cookiejar.py                         | 13 ++++++--
+ Lib/test/test_http_cookiejar.py               | 30 +++++++++++++++++++
+ .../2018-10-31-15-39-17.bpo-35121.EgHv9k.rst  |  4 +++
+ 3 files changed, 45 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
+
+diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
+index e0f1032b2816..00cb1250a07e 100644
+--- a/Lib/http/cookiejar.py
++++ b/Lib/http/cookiejar.py
+@@ -1145,6 +1145,11 @@ def return_ok_domain(self, cookie, request):
+         req_host, erhn = eff_request_host(request)
+         domain = cookie.domain
+ 
++        if domain and not domain.startswith("."):
++            dotdomain = "." + domain
++        else:
++            dotdomain = domain
++
+         # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
+         if (cookie.version == 0 and
+             (self.strict_ns_domain & self.DomainStrictNonDomain) and
+@@ -1157,7 +1162,7 @@ def return_ok_domain(self, cookie, request):
+             _debug("   effective request-host name %s does not domain-match "
+                    "RFC 2965 cookie domain %s", erhn, domain)
+             return False
+-        if cookie.version == 0 and not ("."+erhn).endswith(domain):
++        if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
+             _debug("   request-host %s does not match Netscape cookie domain "
+                    "%s", req_host, domain)
+             return False
+@@ -1171,7 +1176,11 @@ def domain_return_ok(self, domain, request):
+             req_host = "."+req_host
+         if not erhn.startswith("."):
+             erhn = "."+erhn
+-        if not (req_host.endswith(domain) or erhn.endswith(domain)):
++        if domain and not domain.startswith("."):
++            dotdomain = "." + domain
++        else:
++            dotdomain = domain
++        if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
+             #_debug("   request domain %s does not match cookie domain %s",
+             #       req_host, domain)
+             return False
+diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
+index abc625d672a7..6e1b30881310 100644
+--- a/Lib/test/test_http_cookiejar.py
++++ b/Lib/test/test_http_cookiejar.py
+@@ -415,6 +415,7 @@ def test_domain_return_ok(self):
+             ("http://foo.bar.com/", ".foo.bar.com", True),
+             ("http://foo.bar.com/", "foo.bar.com", True),
+             ("http://foo.bar.com/", ".bar.com", True),
++            ("http://foo.bar.com/", "bar.com", True),
+             ("http://foo.bar.com/", "com", True),
+             ("http://foo.com/", "rhubarb.foo.com", False),
+             ("http://foo.com/", ".foo.com", True),
+@@ -425,6 +426,8 @@ def test_domain_return_ok(self):
+             ("http://foo/", "foo", True),
+             ("http://foo/", "foo.local", True),
+             ("http://foo/", ".local", True),
++            ("http://barfoo.com", ".foo.com", False),
++            ("http://barfoo.com", "foo.com", False),
+             ]:
+             request = urllib.request.Request(url)
+             r = pol.domain_return_ok(domain, request)
+@@ -959,6 +962,33 @@ def test_domain_block(self):
+         c.add_cookie_header(req)
+         self.assertFalse(req.has_header("Cookie"))
+ 
++        c.clear()
++
++        pol.set_blocked_domains([])
++        req = urllib.request.Request("http://acme.com/")
++        res = FakeResponse(headers, "http://acme.com/")
++        cookies = c.make_cookies(res, req)
++        c.extract_cookies(res, req)
++        self.assertEqual(len(c), 1)
++
++        req = urllib.request.Request("http://acme.com/")
++        c.add_cookie_header(req)
++        self.assertTrue(req.has_header("Cookie"))
++
++        req = urllib.request.Request("http://badacme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(pol.return_ok(cookies[0], req))
++        self.assertFalse(req.has_header("Cookie"))
++
++        p = pol.set_blocked_domains(["acme.com"])
++        req = urllib.request.Request("http://acme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(req.has_header("Cookie"))
++
++        req = urllib.request.Request("http://badacme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(req.has_header("Cookie"))
++
+     def test_secure(self):
+         for ns in True, False:
+             for whitespace in " ", "":
+diff --git a/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
+new file mode 100644
+index 000000000000..d2eb8f1f352c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
+@@ -0,0 +1,4 @@
++Don't send cookies of domain A without Domain attribute to domain B
++when domain A is a suffix match of domain B while using a cookiejar
++with :class:`http.cookiejar.DefaultCookiePolicy` policy. Patch by
++Karthikeyan Singaravelan.