diff options
| author | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2019-08-07 15:00:20 +0300 |
|---|---|---|
| committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2019-08-07 15:05:00 +0300 |
| commit | cb91a7773fc3577e9b2df7bf012f2898b8e87d99 (patch) | |
| tree | dde4f7de2407f4663aeb26f311eb6ab0f69f8d56 /poky | |
| parent | 8e98665c23afa7312bd786dc7be05ae89ede496d (diff) | |
| download | openbmc-2.7.0.tar.xz | |
subtree updates2.7.0
meta-openembedded: 6fa72d587a..8d5dcd6522:
Changqing Li (1):
netkit-telnet: add rconflicts
Hongxu Jia (1):
crash: do not use unstable github archive tarballs
Liwei Song (1):
turbostat: copy bits.h from kernel to turbostat
Martin Jansa (14):
gtkwave: add distro_features_check
umip: make MACHINE_ARCH
mscgen: fix SRC_URI for multilib
triggerhappy: fix issues
python-cassandra-driver.inc: fix DEPENDS
opencv: use the same package name in PACKAGES and RDEPENDS
igmpproxy: remove 0001-src-igmpproxy.h-Include-sys-types.h-for-u_short-u_in.patch and _GNU_SOURCE
libvncserver: set PV in the recipe
ccid: fix SRC_URI
ne10, libopus: add armv7ve override as well
hunspell: use git fetcher instead of github archive
ttf-mplus, ttf-vlgothic: add ttf-mplus license
libmikmod: fix SRC_URI
leptonica: fix SRC_URI
Mingli Yu (1):
mariadb: Upgrade to 10.3.15
Qi.Chen@windriver.com (1):
polkit: fix CVE-2019-6133
nick83ola (1):
uthash: do not use unstable github archive tarballs
meta-xilinx: 64aa3d35ae..f3c8b1c9a8:
Alejandro Enedino Hernandez Samaniego (7):
opencl-clhpp: Allow empty packages to be built
opencl-headers: Allow empty packages to be built
gcc-8: rebase microblaze patches for gcc 8.2.0
gcc8: update microblaze patches
gcc: update microblaze patches
update gcc-8 patches
gcc: Remove xilinx.ld requirement
Jaewon Lee (6):
zc1254-zynqmp.conf: Add support for zc1254 evaluation board
zc1275-zynqmp.conf: Add support for zc1275 evaluation board
zcu102-zynqmp.conf: Changing qemu boot mode
Adding FPGA_MNGR_RECONFIG_ENABLE to control enabling fpga manager
gcc: Removing already upstreamed patch
Rebasing binutils patches from 2.31 to 2.32
Madhurkiran Harikrishnan (2):
kernel-module-mali: Fix errors associated with kernel upgrade to 4.19
xf86-video-armsoc: Remove the recipe for xf86-video-armsoc
Manjukumar Matha (10):
libmali-xlnx_git.bb: Fix the package arch for libmali
zcu111-zynqmp.conf: Add support for ZCU111 evaluation board
qemu-system-aarch64-multiarch: Enable plm argument in runqemu
arm-trusted-firmware.inc: Add support to build ATF for versal devices
linux-xlnx.inc: Add support to build kernel for versal devices
linux-xlnx.inc: Use KBUILD_DEFCONFIG in externalsrc mode if defined
kernel-simpleimage.bbclass: Use dts for simpleImage generation for Microblaze
kernel-simpleimage.bbclass: Deploy simpleImage unstrip file
kernel-simpleimage.bbclass: Deploy simpleImage strip
binutils%.bbappend: Update Microblaze binutils patches to v2.31
Min Ma (4):
ocl-icd_git.bb: Add recipe for OpenCL ICD loaders
opencl-clhpp_git.bb: Recipe for OpenCL Host API C++ bindings
zocl: Recipe for Xilinx runtime driver module
xrt: Xilinx Runtime User Space Libraries and headers
Sai Hari Chandana Kalluri (1):
xilinx-testimage.bbclass: Include IMAGE_AUTOLOGIN and IMAGE_FSTYPES values for runqemu
Sreeja Vadakattu (1):
machine-xilinx-default.inc: Make u-boot.elf as UBOOT_ELF for zynq
Vineeth Chowdary Karumanchi (1):
tune-zynq.inc: Build zImage in addition to uImage
meta-raspberrypi: 6c73694912..c2f2eaf445:
Andrei Gherzan (42):
rpi-base.inc: Include rpi4 dtb
raspberrypi3.conf: Clarify machine mode
linux-raspberrypi: Include configuration for RaspberryPi3 defconfig
linux-raspberrypi: Update 4.19 kernel to 4.19.56
rpi-base: Rename the rpi0w dtb
firmware: Update to 20190620
raspberrypi4.conf: Add initial machine 32 bit configuration
linux-firmware-rpidistro: Fix WiFi on RaspberryPi 4
rpi-base.inc: Include the "fake" KMS dtbo
raspberrypi4: Use vc4-fkms-v3d
linux-raspberrypi: Bump 4.19 revision to fix RPi 4 arm64 builds
raspberrypi4-64.conf: Introduce RPi arm64 machine
firmware: Rename firmware inc file to raspberrypi-firmware.inc
armstubs: Add support for compiling ARM stubs
rpi-config: Handle ARMSTUB
sdcard_image-rpi.bbclass: Include in the SD card image the armstub file
raspberrypi4-64.conf: Initial machine configuration
raspberrypi-tools: Update to remove Makefile patch
linux-raspberrypi: Fix defconfig for RPi4-64
linux-raspberrypi.inc: Explicitly set defconfig for raspberrypi4-64
sdcard_image-rpi.bbclass: Fix typo
linux-raspberrypi: Bump 4.19 revision to have proper coherent_pool set
raspberrypi4-64.conf: Define a machine feature for armstubs
sdcard_image-rpi.bbclass: Use armstub machine feature
linux-raspberrypi: Bump 4.19.57 revision
raspberrypi4.conf: Define uboot defconfig
raspberrypi4-64.conf: Uboot configuration and drop armstub
u-boot: Use a temporary fork for RPi4 support
raspberrypi-firmware: Update to 20190709
raspberrypi4.conf: The firmware uses kernel7l.img when LPAE is supported
linux-raspberrypi: Bump 4.19 to 4.19.58
linux-raspberrypi: Build dtbs with dtbs make target for all 64bit targets
linux-raspberrypi: Bump 4.19 revision
raspberrypi4-64.conf: Remove memory limitation
u-boot: Replace custom fork by patches (warrior backport)
rpi-config: Check for armstub based on machine feature
sdcard_image-rpi: Check for armstub based on machine feature
armstubs: Error out when ARMSTUBS is not defined
raspberrypi*: Define ARMSTUB for all machines
u-boot: Fix patches names in SRC_URI
raspberrypi4-64.conf: Limit RAM to 3G
u-boot: Backport patch to fix u-boot compilation without USB config
Carton (2):
bluez5: Fixed typo (RC_URI -> SRC_URI)
rpi-config: Check some config values against "1"
Khem Raj (4):
rpi-default-versions: Switch defaults to 4.19
userland: Update to 20190501
firmware: Update 20190220 -> 20190517
linux-raspberrypi: Upgrade to 4.19.57
Riyaz (1):
rpi-base.inc: Enabling open-source vc4graphics driver for all RPI platforms
dir (1):
vc-graphics: Don't install sbin directory
malus-brandywine (1):
sdcard_image-rpi : minor bug in use of FATPAYLOAD
poky: 38d5c8ea98..01b8a8b54b:
Anuj Mittal (7):
expat: fix CVE-2018-20843
vim: fix CVE-2019-12735
gstreamer1.0-plugins-base: fix CVE-2019-9928
wget: fix CVE-2019-5953
bzip2: fix CVE-2019-12900
python3: fix CVE-2018-20852 CVE-2019-9636
curl: fix CVE-2019-5435 CVE-2019-5436
Scott Rifenbark (4):
overview-manual: Updated manual history table.
Documentation: Prepared for 2.7.1 release
ref-manual: Fixed typo for BBMULTICONFIG variable.
poky.ent: Updated release date to July 2019
Change-Id: I93a3341457ea44866bb077749cf78e630ae6e7a6
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'poky')
29 files changed, 944 insertions, 38 deletions
diff --git a/poky/documentation/bsp-guide/bsp-guide.xml b/poky/documentation/bsp-guide/bsp-guide.xml index f559e0809c..ba571fa273 100644 --- a/poky/documentation/bsp-guide/bsp-guide.xml +++ b/poky/documentation/bsp-guide/bsp-guide.xml @@ -128,9 +128,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/dev-manual/dev-manual.xml b/poky/documentation/dev-manual/dev-manual.xml index 5dda016d78..c4674d410d 100644 --- a/poky/documentation/dev-manual/dev-manual.xml +++ b/poky/documentation/dev-manual/dev-manual.xml @@ -113,9 +113,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/kernel-dev/kernel-dev.xml b/poky/documentation/kernel-dev/kernel-dev.xml index 33553df060..c1270a115b 100644 --- a/poky/documentation/kernel-dev/kernel-dev.xml +++ b/poky/documentation/kernel-dev/kernel-dev.xml @@ -98,9 +98,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/mega-manual/mega-manual.xml b/poky/documentation/mega-manual/mega-manual.xml index 37d26492d9..d984d5458b 100644 --- a/poky/documentation/mega-manual/mega-manual.xml +++ b/poky/documentation/mega-manual/mega-manual.xml @@ -84,9 +84,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/overview-manual/overview-manual.xml b/poky/documentation/overview-manual/overview-manual.xml index b23c39497c..913406ea84 100644 --- a/poky/documentation/overview-manual/overview-manual.xml +++ b/poky/documentation/overview-manual/overview-manual.xml @@ -38,9 +38,19 @@ </revision> <revision> <revnumber>2.6</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>November 2018</date> <revremark>Released with the Yocto Project 2.6 Release.</revremark> </revision> + <revision> + <revnumber>2.7</revnumber> + <date>May 2019</date> + <revremark>Released with the Yocto Project 2.7 Release.</revremark> + </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/poky.ent b/poky/documentation/poky.ent index 199e651089..2fbc8fa84e 100644 --- a/poky/documentation/poky.ent +++ b/poky/documentation/poky.ent @@ -1,14 +1,14 @@ -<!ENTITY DISTRO "2.7"> -<!ENTITY DISTRO_COMPRESSED "27"> +<!ENTITY DISTRO "2.7.1"> +<!ENTITY DISTRO_COMPRESSED "271"> <!ENTITY DISTRO_NAME_NO_CAP "warrior"> <!ENTITY DISTRO_NAME "Warrior"> <!ENTITY DISTRO_NAME_NO_CAP_MINUS_ONE "thud"> <!ENTITY DISTRO_NAME_MINUS_ONE "Thud"> -<!ENTITY YOCTO_DOC_VERSION "2.7"> +<!ENTITY YOCTO_DOC_VERSION "2.7.1"> <!ENTITY YOCTO_DOC_VERSION_MINUS_ONE "2.6"> -<!ENTITY DISTRO_REL_TAG "yocto-2.7"> +<!ENTITY DISTRO_REL_TAG "yocto-2.7.1"> <!ENTITY METAINTELVERSION "11.0"> -<!ENTITY REL_MONTH_YEAR "May 2019"> +<!ENTITY REL_MONTH_YEAR "July 2019"> <!ENTITY META_INTEL_REL_TAG "&METAINTELVERSION;-&DISTRO_NAME_NO_CAP;-&YOCTO_DOC_VERSION;"> <!ENTITY POKYVERSION "21.0.0"> <!ENTITY POKYVERSION_COMPRESSED "2100"> diff --git a/poky/documentation/profile-manual/profile-manual.xml b/poky/documentation/profile-manual/profile-manual.xml index af2c7baf72..5365469ee3 100644 --- a/poky/documentation/profile-manual/profile-manual.xml +++ b/poky/documentation/profile-manual/profile-manual.xml @@ -98,9 +98,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/ref-manual/ref-manual.xml b/poky/documentation/ref-manual/ref-manual.xml index 26295f02f6..384c9b8a70 100644 --- a/poky/documentation/ref-manual/ref-manual.xml +++ b/poky/documentation/ref-manual/ref-manual.xml @@ -129,9 +129,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/ref-manual/ref-variables.xml b/poky/documentation/ref-manual/ref-variables.xml index 1e3f282a53..222b24dd6a 100644 --- a/poky/documentation/ref-manual/ref-variables.xml +++ b/poky/documentation/ref-manual/ref-variables.xml @@ -1358,7 +1358,7 @@ For example, the following line specifies three configuration files: <literallayout class='monospaced'> - BBMULTIFONFIG = "configA configB configC" + BBMULTICONFIG = "configA configB configC" </literallayout> Each configuration file you use must reside in the <link linkend='build-directory'>Build Directory</link> diff --git a/poky/documentation/sdk-manual/sdk-manual.xml b/poky/documentation/sdk-manual/sdk-manual.xml index 9ce4a5b03d..70cc291c00 100644 --- a/poky/documentation/sdk-manual/sdk-manual.xml +++ b/poky/documentation/sdk-manual/sdk-manual.xml @@ -63,9 +63,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/toaster-manual/toaster-manual.xml b/poky/documentation/toaster-manual/toaster-manual.xml index 42dc6a33eb..98d6fe5626 100644 --- a/poky/documentation/toaster-manual/toaster-manual.xml +++ b/poky/documentation/toaster-manual/toaster-manual.xml @@ -73,9 +73,14 @@ </revision> <revision> <revnumber>2.7</revnumber> - <date>&REL_MONTH_YEAR;</date> + <date>May 2019</date> <revremark>Released with the Yocto Project 2.7 Release.</revremark> </revision> + <revision> + <revnumber>2.7.1</revnumber> + <date>&REL_MONTH_YEAR;</date> + <revremark>Released with the Yocto Project 2.7.1 Release.</revremark> + </revision> </revhistory> <copyright> diff --git a/poky/documentation/tools/mega-manual.sed b/poky/documentation/tools/mega-manual.sed index 79bbeef575..62922f16d4 100644 --- a/poky/documentation/tools/mega-manual.sed +++ b/poky/documentation/tools/mega-manual.sed @@ -1,36 +1,36 @@ # Processes bitbake-user-manual (<word>-<word>-<word> style). # This style is for manual three-word folders, which currently is only the BitBake User Manual. # We used to have the "yocto-project-qs" and "poky-ref-manual" folders but no longer do. -# s@"ulink" href="http://www.yoctoproject.org/docs/2.7/[a-z]*-[a-z]*-[a-z]*/[a-z]*-[a-z]*-[a-z]*.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/bitbake-user-manual/bitbake-user-manual.html#@"link" href="#@g +# s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/[a-z]*-[a-z]*-[a-z]*/[a-z]*-[a-z]*-[a-z]*.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/bitbake-user-manual/bitbake-user-manual.html#@"link" href="#@g # Processes all other manuals (<word>-<word> style). # This style is for manual folders that use two word, which is the standard now (e.g. "ref-manual"). # Here is the one-liner: -# s@"ulink" href="http://www.yoctoproject.org/docs/2.7/[a-z]*-[a-z]*/[a-z]*-[a-z]*.html#@"link" href="#@g +# s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/[a-z]*-[a-z]*/[a-z]*-[a-z]*.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/sdk-manual/sdk-manual.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/bsp-guide/bsp-guide.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/dev-manual/dev-manual.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/overview-manual/overview-manual.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/brief-yoctoprojectqs/brief-yoctoprojectqs.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/kernel-dev/kernel-dev.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/profile-manual/profile-manual.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/ref-manual/ref-manual.html#@"link" href="#@g -s@"ulink" href="http://www.yoctoproject.org/docs/2.7/toaster-manual/toaster-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/sdk-manual/sdk-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/bsp-guide/bsp-guide.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/dev-manual/dev-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/overview-manual/overview-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/brief-yoctoprojectqs/brief-yoctoprojectqs.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/kernel-dev/kernel-dev.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/profile-manual/profile-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/ref-manual/ref-manual.html#@"link" href="#@g +s@"ulink" href="http://www.yoctoproject.org/docs/2.7.1/toaster-manual/toaster-manual.html#@"link" href="#@g # Process cases where just an external manual is referenced without an id anchor -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/brief-yoctoprojectqs/brief-yoctoprojectqs.html" target="_top">Yocto Project Quick Build</a>@Yocto Project Quick Build@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/bitbake-user-manual/bitbake-user-manual.html" target="_top">BitBake User Manual</a>@BitBake User Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/dev-manual/dev-manual.html" target="_top">Yocto Project Development Tasks Manual</a>@Yocto Project Development Tasks Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/overview-manual/overview-manual.html" target="_top">Yocto Project Overview and Concepts Manual</a>@Yocto project Overview and Concepts Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/sdk-manual/sdk-manual.html" target="_top">Yocto Project Application Development and the Extensible Software Development Kit (eSDK)</a>@Yocto Project Application Development and the Extensible Software Development Kit (eSDK)@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/bsp-guide/bsp-guide.html" target="_top">Yocto Project Board Support Package (BSP) Developer's Guide</a>@Yocto Project Board Support Package (BSP) Developer's Guide@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/profile-manual/profile-manual.html" target="_top">Yocto Project Profiling and Tracing Manual</a>@Yocto Project Profiling and Tracing Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/kernel-dev/kernel-dev.html" target="_top">Yocto Project Linux Kernel Development Manual</a>@Yocto Project Linux Kernel Development Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/ref-manual/ref-manual.html" target="_top">Yocto Project Reference Manual</a>@Yocto Project Reference Manual@g -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/toaster-manual/toaster-manual.html" target="_top">Toaster User Manual</a>@Toaster User Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/brief-yoctoprojectqs/brief-yoctoprojectqs.html" target="_top">Yocto Project Quick Build</a>@Yocto Project Quick Build@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/bitbake-user-manual/bitbake-user-manual.html" target="_top">BitBake User Manual</a>@BitBake User Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/dev-manual/dev-manual.html" target="_top">Yocto Project Development Tasks Manual</a>@Yocto Project Development Tasks Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/overview-manual/overview-manual.html" target="_top">Yocto Project Overview and Concepts Manual</a>@Yocto project Overview and Concepts Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/sdk-manual/sdk-manual.html" target="_top">Yocto Project Application Development and the Extensible Software Development Kit (eSDK)</a>@Yocto Project Application Development and the Extensible Software Development Kit (eSDK)@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/bsp-guide/bsp-guide.html" target="_top">Yocto Project Board Support Package (BSP) Developer's Guide</a>@Yocto Project Board Support Package (BSP) Developer's Guide@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/profile-manual/profile-manual.html" target="_top">Yocto Project Profiling and Tracing Manual</a>@Yocto Project Profiling and Tracing Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/kernel-dev/kernel-dev.html" target="_top">Yocto Project Linux Kernel Development Manual</a>@Yocto Project Linux Kernel Development Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/ref-manual/ref-manual.html" target="_top">Yocto Project Reference Manual</a>@Yocto Project Reference Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/toaster-manual/toaster-manual.html" target="_top">Toaster User Manual</a>@Toaster User Manual@g # Process a single, rouge occurrence of a linked reference to the Mega-Manual. -s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7/mega-manual/mega-manual.html" target="_top">Yocto Project Mega-Manual</a>@Yocto Project Mega-Manual@g +s@<a class="ulink" href="http://www.yoctoproject.org/docs/2.7.1/mega-manual/mega-manual.html" target="_top">Yocto Project Mega-Manual</a>@Yocto Project Mega-Manual@g diff --git a/poky/meta/recipes-core/expat/expat/CVE-2018-20843.patch b/poky/meta/recipes-core/expat/expat/CVE-2018-20843.patch new file mode 100644 index 0000000000..af6641eff1 --- /dev/null +++ b/poky/meta/recipes-core/expat/expat/CVE-2018-20843.patch @@ -0,0 +1,26 @@ +From 11f8838bf99ea0a6f0b76f9760c43704d00c4ff6 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Wed, 12 Jun 2019 15:42:22 +0200 +Subject: [PATCH] xmlparse.c: Fix extraction of namespace prefix from XML name + (#186) + +Upstream-Status: Backport +CVE: CVE-2018-20843 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + expat/lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 30d55c5c..737d7cd2 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -6071,7 +6071,7 @@ setElementTypePrefix(XML_Parser parser, ELEMENT_TYPE *elementType) + else + poolDiscard(&dtd->pool); + elementType->prefix = prefix; +- ++ break; + } + } + return 1; diff --git a/poky/meta/recipes-core/expat/expat_2.2.6.bb b/poky/meta/recipes-core/expat/expat_2.2.6.bb index c9e6081a35..0cef70555a 100644 --- a/poky/meta/recipes-core/expat/expat_2.2.6.bb +++ b/poky/meta/recipes-core/expat/expat_2.2.6.bb @@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=5b8620d98e49772d95fc1d291c26aa79" SRC_URI = "${SOURCEFORGE_MIRROR}/expat/expat-${PV}.tar.bz2 \ file://autotools.patch \ file://libtool-tag.patch \ + file://CVE-2018-20843.patch;striplevel=2 \ " SRC_URI[md5sum] = "ca047ae951b40020ac831c28859161b2" diff --git a/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch b/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch new file mode 100644 index 0000000000..ff671d3fab --- /dev/null +++ b/poky/meta/recipes-devtools/python/python3/CVE-2018-20852.patch @@ -0,0 +1,124 @@ +From e5123d81ffb3be35a1b2767d6ced1a097aaf77be Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Sat, 9 Mar 2019 18:58:25 -0800 +Subject: [PATCH] bpo-35121: prefix dot in domain for proper subdomain + validation (GH-10258) (GH-12261) + +Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan. +(cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14) + +Co-authored-by: Xtreak <tir.karthi@gmail.com> +Upstream-Status: Backport +CVE: CVE-2018-20852 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + Lib/http/cookiejar.py | 13 ++++++-- + Lib/test/test_http_cookiejar.py | 30 +++++++++++++++++++ + .../2018-10-31-15-39-17.bpo-35121.EgHv9k.rst | 4 +++ + 3 files changed, 45 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst + +diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py +index e0f1032b2816..00cb1250a07e 100644 +--- a/Lib/http/cookiejar.py ++++ b/Lib/http/cookiejar.py +@@ -1145,6 +1145,11 @@ def return_ok_domain(self, cookie, request): + req_host, erhn = eff_request_host(request) + domain = cookie.domain + ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't + if (cookie.version == 0 and + (self.strict_ns_domain & self.DomainStrictNonDomain) and +@@ -1157,7 +1162,7 @@ def return_ok_domain(self, cookie, request): + _debug(" effective request-host name %s does not domain-match " + "RFC 2965 cookie domain %s", erhn, domain) + return False +- if cookie.version == 0 and not ("."+erhn).endswith(domain): ++ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): + _debug(" request-host %s does not match Netscape cookie domain " + "%s", req_host, domain) + return False +@@ -1171,7 +1176,11 @@ def domain_return_ok(self, domain, request): + req_host = "."+req_host + if not erhn.startswith("."): + erhn = "."+erhn +- if not (req_host.endswith(domain) or erhn.endswith(domain)): ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): + #_debug(" request domain %s does not match cookie domain %s", + # req_host, domain) + return False +diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py +index abc625d672a7..6e1b30881310 100644 +--- a/Lib/test/test_http_cookiejar.py ++++ b/Lib/test/test_http_cookiejar.py +@@ -415,6 +415,7 @@ def test_domain_return_ok(self): + ("http://foo.bar.com/", ".foo.bar.com", True), + ("http://foo.bar.com/", "foo.bar.com", True), + ("http://foo.bar.com/", ".bar.com", True), ++ ("http://foo.bar.com/", "bar.com", True), + ("http://foo.bar.com/", "com", True), + ("http://foo.com/", "rhubarb.foo.com", False), + ("http://foo.com/", ".foo.com", True), +@@ -425,6 +426,8 @@ def test_domain_return_ok(self): + ("http://foo/", "foo", True), + ("http://foo/", "foo.local", True), + ("http://foo/", ".local", True), ++ ("http://barfoo.com", ".foo.com", False), ++ ("http://barfoo.com", "foo.com", False), + ]: + request = urllib.request.Request(url) + r = pol.domain_return_ok(domain, request) +@@ -959,6 +962,33 @@ def test_domain_block(self): + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + ++ c.clear() ++ ++ pol.set_blocked_domains([]) ++ req = urllib.request.Request("http://acme.com/") ++ res = FakeResponse(headers, "http://acme.com/") ++ cookies = c.make_cookies(res, req) ++ c.extract_cookies(res, req) ++ self.assertEqual(len(c), 1) ++ ++ req = urllib.request.Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertTrue(req.has_header("Cookie")) ++ ++ req = urllib.request.Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(pol.return_ok(cookies[0], req)) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ p = pol.set_blocked_domains(["acme.com"]) ++ req = urllib.request.Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ req = urllib.request.Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ + def test_secure(self): + for ns in True, False: + for whitespace in " ", "": +diff --git a/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst +new file mode 100644 +index 000000000000..d2eb8f1f352c +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst +@@ -0,0 +1,4 @@ ++Don't send cookies of domain A without Domain attribute to domain B ++when domain A is a suffix match of domain B while using a cookiejar ++with :class:`http.cookiejar.DefaultCookiePolicy` policy. Patch by ++Karthikeyan Singaravelan. diff --git a/poky/meta/recipes-devtools/python/python3/CVE-2019-9636.patch b/poky/meta/recipes-devtools/python/python3/CVE-2019-9636.patch new file mode 100644 index 0000000000..72128f0b0d --- /dev/null +++ b/poky/meta/recipes-devtools/python/python3/CVE-2019-9636.patch @@ -0,0 +1,154 @@ +From daad2c482c91de32d8305abbccc76a5de8b3a8be Mon Sep 17 00:00:00 2001 +From: Steve Dower <steve.dower@microsoft.com> +Date: Thu, 7 Mar 2019 09:08:18 -0800 +Subject: [PATCH] bpo-36216: Add check for characters in netloc that normalize + to separators (GH-12201) + +Upstream-Status: Backport +CVE: CVE-2019-9636 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + Doc/library/urllib.parse.rst | 18 +++++++++++++++ + Lib/test/test_urlparse.py | 23 +++++++++++++++++++ + Lib/urllib/parse.py | 17 ++++++++++++++ + .../2019-03-06-09-38-40.bpo-36216.6q1m4a.rst | 3 +++ + 4 files changed, 61 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst + +diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst +index 0c8f0f607314..b565e1edd321 100644 +--- a/Doc/library/urllib.parse.rst ++++ b/Doc/library/urllib.parse.rst +@@ -124,6 +124,11 @@ or on combining URL components into a URL string. + Unmatched square brackets in the :attr:`netloc` attribute will raise a + :exc:`ValueError`. + ++ Characters in the :attr:`netloc` attribute that decompose under NFKC ++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``, ++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is ++ decomposed before parsing, no error will be raised. ++ + .. versionchanged:: 3.2 + Added IPv6 URL parsing capabilities. + +@@ -136,6 +141,10 @@ or on combining URL components into a URL string. + Out-of-range port numbers now raise :exc:`ValueError`, instead of + returning :const:`None`. + ++ .. versionchanged:: 3.7.3 ++ Characters that affect netloc parsing under NFKC normalization will ++ now raise :exc:`ValueError`. ++ + + .. function:: parse_qs(qs, keep_blank_values=False, strict_parsing=False, encoding='utf-8', errors='replace', max_num_fields=None) + +@@ -257,10 +266,19 @@ or on combining URL components into a URL string. + Unmatched square brackets in the :attr:`netloc` attribute will raise a + :exc:`ValueError`. + ++ Characters in the :attr:`netloc` attribute that decompose under NFKC ++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``, ++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is ++ decomposed before parsing, no error will be raised. ++ + .. versionchanged:: 3.6 + Out-of-range port numbers now raise :exc:`ValueError`, instead of + returning :const:`None`. + ++ .. versionchanged:: 3.7.3 ++ Characters that affect netloc parsing under NFKC normalization will ++ now raise :exc:`ValueError`. ++ + + .. function:: urlunsplit(parts) + +diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py +index be50b47603aa..e6638aee2244 100644 +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -1,3 +1,5 @@ ++import sys ++import unicodedata + import unittest + import urllib.parse + +@@ -984,6 +986,27 @@ def test_all(self): + expected.append(name) + self.assertCountEqual(urllib.parse.__all__, expected) + ++ def test_urlsplit_normalization(self): ++ # Certain characters should never occur in the netloc, ++ # including under normalization. ++ # Ensure that ALL of them are detected and cause an error ++ illegal_chars = '/:#?@' ++ hex_chars = {'{:04X}'.format(ord(c)) for c in illegal_chars} ++ denorm_chars = [ ++ c for c in map(chr, range(128, sys.maxunicode)) ++ if (hex_chars & set(unicodedata.decomposition(c).split())) ++ and c not in illegal_chars ++ ] ++ # Sanity check that we found at least one such character ++ self.assertIn('\u2100', denorm_chars) ++ self.assertIn('\uFF03', denorm_chars) ++ ++ for scheme in ["http", "https", "ftp"]: ++ for c in denorm_chars: ++ url = "{}://netloc{}false.netloc/path".format(scheme, c) ++ with self.subTest(url=url, char='{:04X}'.format(ord(c))): ++ with self.assertRaises(ValueError): ++ urllib.parse.urlsplit(url) + + class Utility_Tests(unittest.TestCase): + """Testcase to test the various utility functions in the urllib.""" +diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py +index f691ab74f87f..39c5d6a80824 100644 +--- a/Lib/urllib/parse.py ++++ b/Lib/urllib/parse.py +@@ -391,6 +391,21 @@ def _splitnetloc(url, start=0): + delim = min(delim, wdelim) # use earliest delim position + return url[start:delim], url[delim:] # return (domain, rest) + ++def _checknetloc(netloc): ++ if not netloc or netloc.isascii(): ++ return ++ # looking for characters like \u2100 that expand to 'a/c' ++ # IDNA uses NFKC equivalence, so normalize for this check ++ import unicodedata ++ netloc2 = unicodedata.normalize('NFKC', netloc) ++ if netloc == netloc2: ++ return ++ _, _, netloc = netloc.rpartition('@') # anything to the left of '@' is okay ++ for c in '/?#@:': ++ if c in netloc2: ++ raise ValueError("netloc '" + netloc2 + "' contains invalid " + ++ "characters under NFKC normalization") ++ + def urlsplit(url, scheme='', allow_fragments=True): + """Parse a URL into 5 components: + <scheme>://<netloc>/<path>?<query>#<fragment> +@@ -419,6 +434,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult('http', netloc, url, query, fragment) + _parse_cache[key] = v + return _coerce_result(v) +@@ -442,6 +458,7 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, fragment = url.split('#', 1) + if '?' in url: + url, query = url.split('?', 1) ++ _checknetloc(netloc) + v = SplitResult(scheme, netloc, url, query, fragment) + _parse_cache[key] = v + return _coerce_result(v) +diff --git a/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +new file mode 100644 +index 000000000000..5546394157f9 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst +@@ -0,0 +1,3 @@ ++Changes urlsplit() to raise ValueError when the URL contains characters that ++decompose under IDNA encoding (NFKC-normalization) into characters that ++affect how the URL is parsed. diff --git a/poky/meta/recipes-devtools/python/python3_3.7.2.bb b/poky/meta/recipes-devtools/python/python3_3.7.2.bb index 7ef7cb5998..dc851cb52a 100644 --- a/poky/meta/recipes-devtools/python/python3_3.7.2.bb +++ b/poky/meta/recipes-devtools/python/python3_3.7.2.bb @@ -22,6 +22,8 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0002-Don-t-do-runtime-test-to-get-float-byte-order.patch \ file://0003-setup.py-pass-missing-libraries-to-Extension-for-mul.patch \ file://0001-Lib-sysconfig.py-fix-another-place-where-lib-is-hard.patch \ + file://CVE-2018-20852.patch \ + file://CVE-2019-9636.patch \ " SRC_URI_append_class-native = " \ diff --git a/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/CVE-2019-12900.patch b/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/CVE-2019-12900.patch new file mode 100644 index 0000000000..9841644881 --- /dev/null +++ b/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/CVE-2019-12900.patch @@ -0,0 +1,33 @@ +From 11e1fac27eb8a3076382200736874c78e09b75d6 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid <aacid@kde.org> +Date: Tue, 28 May 2019 19:35:18 +0200 +Subject: [PATCH] Make sure nSelectors is not out of range + +nSelectors is used in a loop from 0 to nSelectors to access selectorMtf +which is + UChar selectorMtf[BZ_MAX_SELECTORS]; +so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid memory +access + +Fixes out of bounds access discovered while fuzzying karchive +CVE: CVE-2019-12900 +Upstream-Status: Backport +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + decompress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/decompress.c b/decompress.c +index 311f566..b6e0a29 100644 +--- a/decompress.c ++++ b/decompress.c +@@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s ) + GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); + if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR); + GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); +- if (nSelectors < 1) RETURN(BZ_DATA_ERROR); ++ if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); + for (i = 0; i < nSelectors; i++) { + j = 0; + while (True) { diff --git a/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/fix-regression-CVE-2019-12900.patch b/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/fix-regression-CVE-2019-12900.patch new file mode 100644 index 0000000000..362e6cf319 --- /dev/null +++ b/poky/meta/recipes-extended/bzip2/bzip2-1.0.6/fix-regression-CVE-2019-12900.patch @@ -0,0 +1,82 @@ +From 212f3ed7ac3931c9e0e9167a0bdc16eeb3c76af4 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Wed, 3 Jul 2019 01:28:11 +0200 +Subject: [PATCH] Accept as many selectors as the file format allows. + +But ignore any larger than the theoretical maximum, BZ_MAX_SELECTORS. + +The theoretical maximum number of selectors depends on the maximum +blocksize (900000 bytes) and the number of symbols (50) that can be +encoded with a different Huffman tree. BZ_MAX_SELECTORS is 18002. + +But the bzip2 file format allows the number of selectors to be encoded +with 15 bits (because 18002 isn't a factor of 2 and doesn't fit in +14 bits). So the file format maximum is 32767 selectors. + +Some bzip2 encoders might actually have written out more selectors +than the theoretical maximum because they rounded up the number of +selectors to some convenient factor of 8. + +The extra 14766 selectors can never be validly used by the decompression +algorithm. So we can read them, but then discard them. + +This is effectively what was done (by accident) before we added a +check for nSelectors to be at most BZ_MAX_SELECTORS to mitigate +CVE-2019-12900. + +The extra selectors were written out after the array inside the +EState struct. But the struct has extra space allocated after the +selector arrays of 18060 bytes (which is larger than 14766). +All of which will be initialized later (so the overwrite of that +space with extra selector values would have been harmless). + +Upstream-Status: Backport +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + compress.c | 2 +- + decompress.c | 10 ++++++++-- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/compress.c b/compress.c +index caf7696..19b662b 100644 +--- a/compress.c ++++ b/compress.c +@@ -454,7 +454,7 @@ void sendMTFValues ( EState* s ) + + AssertH( nGroups < 8, 3002 ); + AssertH( nSelectors < 32768 && +- nSelectors <= (2 + (900000 / BZ_G_SIZE)), ++ nSelectors <= BZ_MAX_SELECTORS, + 3003 ); + + +diff --git a/decompress.c b/decompress.c +index b6e0a29..78060c9 100644 +--- a/decompress.c ++++ b/decompress.c +@@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s ) + GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); + if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR); + GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); +- if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); ++ if (nSelectors < 1) RETURN(BZ_DATA_ERROR); + for (i = 0; i < nSelectors; i++) { + j = 0; + while (True) { +@@ -296,8 +296,14 @@ Int32 BZ2_decompress ( DState* s ) + j++; + if (j >= nGroups) RETURN(BZ_DATA_ERROR); + } +- s->selectorMtf[i] = j; ++ /* Having more than BZ_MAX_SELECTORS doesn't make much sense ++ since they will never be used, but some implementations might ++ "round up" the number of selectors, so just ignore those. */ ++ if (i < BZ_MAX_SELECTORS) ++ s->selectorMtf[i] = j; + } ++ if (nSelectors > BZ_MAX_SELECTORS) ++ nSelectors = BZ_MAX_SELECTORS; + + /*--- Undo the MTF values for the selectors. ---*/ + { diff --git a/poky/meta/recipes-extended/bzip2/bzip2_1.0.6.bb b/poky/meta/recipes-extended/bzip2/bzip2_1.0.6.bb index 7d04e30d53..d30e1b960c 100644 --- a/poky/meta/recipes-extended/bzip2/bzip2_1.0.6.bb +++ b/poky/meta/recipes-extended/bzip2/bzip2_1.0.6.bb @@ -14,6 +14,8 @@ SRC_URI = "http://downloads.yoctoproject.org/mirror/sources/${BP}.tar.gz \ file://Makefile.am;subdir=${BP} \ file://run-ptest \ file://CVE-2016-3189.patch \ + file://CVE-2019-12900.patch \ + file://fix-regression-CVE-2019-12900.patch \ " SRC_URI[md5sum] = "00b516f4704d4a7cb50a1d97e6e8e15b" diff --git a/poky/meta/recipes-extended/wget/wget/CVE-2019-5953.patch b/poky/meta/recipes-extended/wget/wget/CVE-2019-5953.patch new file mode 100644 index 0000000000..00efe20a2f --- /dev/null +++ b/poky/meta/recipes-extended/wget/wget/CVE-2019-5953.patch @@ -0,0 +1,34 @@ +From 692d5c5215de0db482c252492a92fc424cc6a97c Mon Sep 17 00:00:00 2001 +From: Tim Ruehsen <tim.ruehsen@gmx.de> +Date: Fri, 5 Apr 2019 11:50:44 +0200 +Subject: Fix a buffer overflow vulnerability + +* src/iri.c(do_conversion): Reallocate the output buffer to a larger + size if it is already full +Upstream-Status: Backport +CVE: CVE-2019-5953 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- +--- a/src/iri.c ++++ b/src/iri.c +@@ -188,11 +191,14 @@ do_conversion (const char *tocode, const char *fromcode, char const *in_org, siz + } + else if (errno == E2BIG) /* Output buffer full */ + { ++ logprintf (LOG_VERBOSE, ++ _("Reallocate output buffer len=%d outlen=%d inlen=%d\n"), len, outlen, inlen); + tooshort++; + done = len; +- len = outlen = done + inlen * 2; +- s = xrealloc (s, outlen + 1); +- *out = s + done; ++ len = done + inlen * 2; ++ s = xrealloc (s, len + 1); ++ *out = s + done - outlen; ++ outlen += inlen * 2; + } + else /* Weird, we got an unspecified error */ + { +-- +cgit v1.0-41-gc330 + diff --git a/poky/meta/recipes-extended/wget/wget_1.20.1.bb b/poky/meta/recipes-extended/wget/wget_1.20.1.bb index d176bd0acd..e852a0c0cf 100644 --- a/poky/meta/recipes-extended/wget/wget_1.20.1.bb +++ b/poky/meta/recipes-extended/wget/wget_1.20.1.bb @@ -1,5 +1,6 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://0002-improve-reproducibility.patch \ + file://CVE-2019-5953.patch \ " SRC_URI[md5sum] = "f6ebe9c7b375fc9832fb1b2028271fb7" diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch new file mode 100644 index 0000000000..0ad7245c8e --- /dev/null +++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch @@ -0,0 +1,33 @@ +From f672277509705c4034bc92a141eefee4524d15aa Mon Sep 17 00:00:00 2001 +From: Tobias Ronge <tobiasr@axis.com> +Date: Thu, 14 Mar 2019 10:12:27 +0100 +Subject: [PATCH] gstrtspconnection: Security loophole making heap overflow + +The former code allowed an attacker to create a heap overflow by +sending a longer than allowed session id in a response and including a +semicolon to change the maximum length. With this change, the parser +will never go beyond 512 bytes. + +Upstream-Status: Backport +CVE: CVE-2019-9928 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + gst-libs/gst/rtsp/gstrtspconnection.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst-libs/gst/rtsp/gstrtspconnection.c b/gst-libs/gst/rtsp/gstrtspconnection.c +index a6755bedd..c0429064a 100644 +--- a/gst-libs/gst/rtsp/gstrtspconnection.c ++++ b/gst-libs/gst/rtsp/gstrtspconnection.c +@@ -2461,7 +2461,7 @@ build_next (GstRTSPBuilder * builder, GstRTSPMessage * message, + maxlen = sizeof (conn->session_id) - 1; + /* the sessionid can have attributes marked with ; + * Make sure we strip them */ +- for (i = 0; session_id[i] != '\0'; i++) { ++ for (i = 0; i < maxlen && session_id[i] != '\0'; i++) { + if (session_id[i] == ';') { + maxlen = i; + /* parse timeout */ +-- +2.21.0 + diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb index f3e6daf564..05d90dc3a6 100644 --- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb +++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb @@ -20,6 +20,7 @@ SRC_URI = " \ file://0010-gl-Add-switch-for-explicitely-enabling-disabling-GBM.patch \ file://0011-gl-Add-switches-for-explicitely-enabling-disabling-P.patch \ file://link-with-libvchostif.patch \ + file://CVE-2019-9928.patch \ " SRC_URI[md5sum] = "4dbe20c1bf44191c2b8833234df5cb2a" SRC_URI[sha256sum] = "ca6139490e48863e7706d870ff4e8ac9f417b56f3b9e4b3ce490c13b09a77461" diff --git a/poky/meta/recipes-support/curl/curl/CVE-2019-5435.patch b/poky/meta/recipes-support/curl/curl/CVE-2019-5435.patch new file mode 100644 index 0000000000..f72435f608 --- /dev/null +++ b/poky/meta/recipes-support/curl/curl/CVE-2019-5435.patch @@ -0,0 +1,266 @@ +From 756380f74d58d5a877b26dc21be7b1316b617213 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Mon, 29 Apr 2019 08:00:49 +0200 +Subject: [PATCH] CURL_MAX_INPUT_LENGTH: largest acceptable string input size + +This limits all accepted input strings passed to libcurl to be less than +CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: +curl_easy_setopt() and curl_url_set(). + +The 8000000 number is arbitrary picked and is meant to detect mistakes +or abuse, not to limit actual practical use cases. By limiting the +acceptable string lengths we also reduce the risk of integer overflows +all over. + +NOTE: This does not apply to `CURLOPT_POSTFIELDS`. + +Test 1559 verifies. + +Closes #3805 + +Upstream-Status: Backport +CVE: CVE-2019-5435 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + lib/setopt.c | 7 +++++ + lib/urlapi.c | 8 +++++ + lib/urldata.h | 4 +++ + tests/data/Makefile.inc | 2 +- + tests/data/test1559 | 44 ++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 6 ++-- + tests/libtest/lib1559.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++ + 7 files changed, 146 insertions(+), 3 deletions(-) + create mode 100644 tests/data/test1559 + create mode 100644 tests/libtest/lib1559.c + +diff --git a/lib/setopt.c b/lib/setopt.c +index b5f74a9..edf7165 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -61,6 +61,13 @@ CURLcode Curl_setstropt(char **charp, const char *s) + if(s) { + char *str = strdup(s); + ++ if(str) { ++ size_t len = strlen(str); ++ if(len > CURL_MAX_INPUT_LENGTH) { ++ free(str); ++ return CURLE_BAD_FUNCTION_ARGUMENT; ++ } ++ } + if(!str) + return CURLE_OUT_OF_MEMORY; + +diff --git a/lib/urlapi.c b/lib/urlapi.c +index a19867e..822e4b3 100644 +--- a/lib/urlapi.c ++++ b/lib/urlapi.c +@@ -642,6 +642,10 @@ static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags) + ************************************************************/ + /* allocate scratch area */ + urllen = strlen(url); ++ if(urllen > CURL_MAX_INPUT_LENGTH) ++ /* excessive input length */ ++ return CURLUE_MALFORMED_INPUT; ++ + path = u->scratch = malloc(urllen * 2 + 2); + if(!path) + return CURLUE_OUT_OF_MEMORY; +@@ -1272,6 +1276,10 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what, + const char *newp = part; + size_t nalloc = strlen(part); + ++ if(nalloc > CURL_MAX_INPUT_LENGTH) ++ /* excessive input length */ ++ return CURLUE_MALFORMED_INPUT; ++ + if(urlencode) { + const char *i; + char *o; +diff --git a/lib/urldata.h b/lib/urldata.h +index 24187a4..049a34d 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -79,6 +79,10 @@ + */ + #define RESP_TIMEOUT (120*1000) + ++/* Max string intput length is a precaution against abuse and to detect junk ++ input easier and better. */ ++#define CURL_MAX_INPUT_LENGTH 8000000 ++ + #include "cookie.h" + #include "psl.h" + #include "formdata.h" +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 2eca9c6..3dd234f 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -176,7 +176,7 @@ test1525 test1526 test1527 test1528 test1529 test1530 test1531 test1532 \ + test1533 test1534 test1535 test1536 test1537 test1538 \ + test1540 test1541 \ + test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \ +-test1558 test1560 test1561 test1562 \ ++test1558 test1559 test1560 test1561 test1562 \ + \ + test1590 test1591 test1592 \ + \ +diff --git a/tests/data/test1559 b/tests/data/test1559 +new file mode 100644 +index 0000000..cbed6fb +--- /dev/null ++++ b/tests/data/test1559 +@@ -0,0 +1,44 @@ ++<testcase> ++<info> ++<keywords> ++CURLOPT_URL ++</keywords> ++</info> ++ ++<reply> ++</reply> ++ ++<client> ++<server> ++none ++</server> ++ ++# require HTTP so that CURLOPT_POSTFIELDS works as assumed ++<features> ++http ++</features> ++<tool> ++lib1559 ++</tool> ++ ++<name> ++Set excessive URL lengths ++</name> ++</client> ++ ++# ++# Verify that the test runs to completion without crashing ++<verify> ++<errorcode> ++0 ++</errorcode> ++<stdout> ++CURLOPT_URL 10000000 bytes URL == 43 ++CURLOPT_POSTFIELDS 10000000 bytes data == 0 ++CURLUPART_URL 10000000 bytes URL == 3 ++CURLUPART_SCHEME 10000000 bytes scheme == 3 ++CURLUPART_USER 10000000 bytes user == 3 ++</stdout> ++</verify> ++ ++</testcase> +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index e38f481..52b51c5 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -31,8 +31,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect \ + lib1534 lib1535 lib1536 lib1537 lib1538 \ + lib1540 lib1541 \ + lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ +- lib1558 \ +- lib1560 \ ++ lib1558 lib1559 lib1560 \ + lib1591 lib1592 \ + lib1900 lib1905 \ + lib2033 +@@ -529,6 +528,9 @@ lib1557_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1557 + lib1558_SOURCES = lib1558.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1558_LDADD = $(TESTUTIL_LIBS) + ++lib1559_SOURCES = lib1559.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1559_LDADD = $(TESTUTIL_LIBS) ++ + lib1560_SOURCES = lib1560.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1560_LDADD = $(TESTUTIL_LIBS) + +diff --git a/tests/libtest/lib1559.c b/tests/libtest/lib1559.c +new file mode 100644 +index 0000000..2aa3615 +--- /dev/null ++++ b/tests/libtest/lib1559.c +@@ -0,0 +1,78 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.haxx.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ ***************************************************************************/ ++#include "test.h" ++ ++#include "testutil.h" ++#include "warnless.h" ++#include "memdebug.h" ++ ++#define EXCESSIVE 10*1000*1000 ++int test(char *URL) ++{ ++ CURLcode res = 0; ++ CURL *curl = NULL; ++ char *longurl = malloc(EXCESSIVE); ++ CURLU *u; ++ (void)URL; ++ ++ memset(longurl, 'a', EXCESSIVE); ++ longurl[EXCESSIVE-1] = 0; ++ ++ global_init(CURL_GLOBAL_ALL); ++ easy_init(curl); ++ ++ res = curl_easy_setopt(curl, CURLOPT_URL, longurl); ++ printf("CURLOPT_URL %d bytes URL == %d\n", ++ EXCESSIVE, (int)res); ++ ++ res = curl_easy_setopt(curl, CURLOPT_POSTFIELDS, longurl); ++ printf("CURLOPT_POSTFIELDS %d bytes data == %d\n", ++ EXCESSIVE, (int)res); ++ ++ u = curl_url(); ++ if(u) { ++ CURLUcode uc = curl_url_set(u, CURLUPART_URL, longurl, 0); ++ printf("CURLUPART_URL %d bytes URL == %d\n", ++ EXCESSIVE, (int)uc); ++ uc = curl_url_set(u, CURLUPART_SCHEME, longurl, CURLU_NON_SUPPORT_SCHEME); ++ printf("CURLUPART_SCHEME %d bytes scheme == %d\n", ++ EXCESSIVE, (int)uc); ++ uc = curl_url_set(u, CURLUPART_USER, longurl, 0); ++ printf("CURLUPART_USER %d bytes user == %d\n", ++ EXCESSIVE, (int)uc); ++ curl_url_cleanup(u); ++ } ++ ++ free(longurl); ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ ++ return 0; ++ ++test_cleanup: ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ ++ return res; /* return the final return code */ ++} diff --git a/poky/meta/recipes-support/curl/curl/CVE-2019-5436.patch b/poky/meta/recipes-support/curl/curl/CVE-2019-5436.patch new file mode 100644 index 0000000000..eee26ce273 --- /dev/null +++ b/poky/meta/recipes-support/curl/curl/CVE-2019-5436.patch @@ -0,0 +1,30 @@ +From 2da531b3068e22cf714f001b493a704b2e9b923f Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Fri, 3 May 2019 22:20:37 +0200 +Subject: [PATCH] tftp: use the current blksize for recvfrom() + +bug: https://curl.haxx.se/docs/CVE-2019-5436.html +Reported-by: l00p3r on hackerone +CVE-2019-5436 + +Upstream-Status: Backport +CVE: CVE-2019-5436 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> + +--- + lib/tftp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/tftp.c b/lib/tftp.c +index 8b92b7b..289cda2 100644 +--- a/lib/tftp.c ++++ b/lib/tftp.c +@@ -1009,7 +1009,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done) + state->sockfd = state->conn->sock[FIRSTSOCKET]; + state->state = TFTP_STATE_START; + state->error = TFTP_ERR_NONE; +- state->blksize = TFTP_BLKSIZE_DEFAULT; ++ state->blksize = blksize; + state->requested_blksize = blksize; + + ((struct sockaddr *)&state->local_addr)->sa_family = diff --git a/poky/meta/recipes-support/curl/curl_7.64.1.bb b/poky/meta/recipes-support/curl/curl_7.64.1.bb index 47c28beff6..00c8c5a826 100644 --- a/poky/meta/recipes-support/curl/curl_7.64.1.bb +++ b/poky/meta/recipes-support/curl/curl_7.64.1.bb @@ -7,6 +7,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=be5d9e1419c4363f4b32037a2d3b7ffa" SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ file://0001-replace-krb5-config-with-pkg-config.patch \ + file://CVE-2019-5435.patch \ + file://CVE-2019-5436.patch \ " SRC_URI[md5sum] = "790c101927845208a9d7e8c429ddd1b2" diff --git a/poky/meta/recipes-support/vim/files/CVE-2019-12735.patch b/poky/meta/recipes-support/vim/files/CVE-2019-12735.patch new file mode 100644 index 0000000000..d8afa1867b --- /dev/null +++ b/poky/meta/recipes-support/vim/files/CVE-2019-12735.patch @@ -0,0 +1,64 @@ +From e8197acdd091881fdbf9ed6ca8318f3c96465f0a Mon Sep 17 00:00:00 2001 +From: Bram Moolenaar <Bram@vim.org> +Date: Wed, 22 May 2019 22:38:25 +0200 +Subject: [PATCH] patch 8.1.1365: source command doesn't check for the sandbox + +Problem: Source command doesn't check for the sandbox. (Armin Razmjou) +Solution: Check for the sandbox when sourcing a file. + +Upstream-Status: Backport +CVE: CVE-2019-12735 +Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> +--- + src/getchar.c | 6 ++++++ + src/testdir/test_source.vim | 9 +++++++++ + src/version.c | 2 ++ + 3 files changed, 17 insertions(+) + +diff --git a/src/getchar.c b/src/getchar.c +index 0e9942b..475f644 100644 +--- a/src/getchar.c ++++ b/src/getchar.c +@@ -1407,6 +1407,12 @@ openscript( + emsg(_(e_nesting)); + return; + } ++ ++ // Disallow sourcing a file in the sandbox, the commands would be executed ++ // later, possibly outside of the sandbox. ++ if (check_secure()) ++ return; ++ + #ifdef FEAT_EVAL + if (ignore_script) + /* Not reading from script, also don't open one. Warning message? */ +diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim +index a33d286..5166baf 100644 +--- a/src/testdir/test_source.vim ++++ b/src/testdir/test_source.vim +@@ -36,3 +36,12 @@ func Test_source_cmd() + au! SourcePre + au! SourcePost + endfunc ++ ++func Test_source_sandbox() ++ new ++ call writefile(["Ohello\<Esc>"], 'Xsourcehello') ++ source! Xsourcehello | echo ++ call assert_equal('hello', getline(1)) ++ call assert_fails('sandbox source! Xsourcehello', 'E48:') ++ bwipe! ++endfunc +diff --git a/src/version.c b/src/version.c +index a49f6fb..e4f74be 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -780,6 +780,8 @@ static char *(features[]) = + static int included_patches[] = + { /* Add new patch number below this line */ + /**/ ++ 1365, ++/**/ + 1017, + /**/ + 1016, diff --git a/poky/meta/recipes-support/vim/vim_8.1.1017.bb b/poky/meta/recipes-support/vim/vim_8.1.1017.bb index 7627d2844b..e161e12eed 100644 --- a/poky/meta/recipes-support/vim/vim_8.1.1017.bb +++ b/poky/meta/recipes-support/vim/vim_8.1.1017.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/vim/vim.git \ file://disable_acl_header_check.patch;patchdir=.. \ file://vim-add-knob-whether-elf.h-are-checked.patch;patchdir=.. \ file://0001-src-Makefile-improve-reproducibility.patch;patchdir=.. \ + file://CVE-2019-12735.patch;patchdir=.. \ " SRCREV = "493fbe4abee660d30b4f2aef87b754b0a720213c" |