summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdrian Stratulat <adrian.stratulat@enea.com>2019-09-04 08:23:32 +0300
committerAdrian Mangeac <Adrian.Mangeac@enea.com>2019-09-05 18:21:18 +0200
commit3a54ed3bfbcaa4373e3aa32ce2fc57494e198320 (patch)
treed03b7783ed239e57d7635680c6d8a8da1de949a1
parent40caebeb7544992cc09aa7a2885ae92437926486 (diff)
downloadmeta-el-common-3a54ed3bfbcaa4373e3aa32ce2fc57494e198320.tar.gz
libxslt: remove patch for CVE-2015-9019
CVE-2015-9019 affects libxslt 1.1.29, while the 'warrior' branch uses libxslt 1.1.33. This patch is not applicable anymore. References: https://nvd.nist.gov/vuln/detail/CVE-2015-9019 https://git.enea.com/cgit/linux/poky.git/tree/meta/recipes-support/libxslt?h=warrior Change-Id: I0ec21f4f3f574d06a6cf00eca9f1a221028c175b Signed-off-by: Adrian Stratulat <adrian.stratulat@enea.com>
-rw-r--r--recipes-support/libxslt/libxslt/CVE-2015-9019.patch55
-rw-r--r--recipes-support/libxslt/libxslt_%.bbappend5
2 files changed, 0 insertions, 60 deletions
diff --git a/recipes-support/libxslt/libxslt/CVE-2015-9019.patch b/recipes-support/libxslt/libxslt/CVE-2015-9019.patch
deleted file mode 100644
index 1ab8225..0000000
--- a/recipes-support/libxslt/libxslt/CVE-2015-9019.patch
+++ /dev/null
@@ -1,55 +0,0 @@
1commit 047a0fd99e64c554c4edf44cc67ee765b09af017
2Author: Marcus Meissner <meissner@suse.de>
3Date: Tue Apr 4 16:27:39 2017 +0200
4
5initialize the random seed
6
7In libxslt 1.1.29 and earlier, the EXSLT math.random function was
8not initialized with a random seed during startup, which could
9cause usage of this function to produce predictable outputs.
10
11CVE: CVE-2015-9019
12Upstream-Status: Backport [https://bug758400.bugzilla-attachments.gnome.org/attachment.cgi?id=349240&action=diff&collapsed=&context=patch&format=raw&headers=1]
13
14Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
15
16diff --git a/libexslt/math.c b/libexslt/math.c
17index 6b24dbe0..b7a8d6e1 100644
18--- a/libexslt/math.c
19+++ b/libexslt/math.c
20@@ -23,6 +23,14 @@
21 #ifdef HAVE_STDLIB_H
22 #include <stdlib.h>
23 #endif
24+#ifdef HAVE_UNISTD_H
25+#include <unistd.h>
26+#endif
27+#include <fcntl.h>
28+#ifdef HAVE_TIME_H
29+#include <time.h>
30+#endif
31+
32
33 #include "exslt.h"
34
35@@ -474,6 +482,20 @@ static double
36 exsltMathRandom (void) {
37 double ret;
38 int num;
39+ long seed;
40+ static int randinit = 0;
41+
42+ if (!randinit) {
43+ int fd = open("/dev/urandom",O_RDONLY);
44+
45+ seed = time(NULL); /* just in case /dev/urandom is not there */
46+ if (fd == -1) {
47+ read (fd, &seed, sizeof(seed));
48+ close (fd);
49+ }
50+ srand(seed);
51+ randinit = 1;
52+ }
53
54 num = rand();
55 ret = (double)num / (double)RAND_MAX;
diff --git a/recipes-support/libxslt/libxslt_%.bbappend b/recipes-support/libxslt/libxslt_%.bbappend
deleted file mode 100644
index aba6e6a..0000000
--- a/recipes-support/libxslt/libxslt_%.bbappend
+++ /dev/null
@@ -1,5 +0,0 @@
1# look for files in the layer first
2FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
3
4SRC_URI += "file://CVE-2015-9019.patch \
5 "