6 files changed, 300 insertions, 3 deletions

diff --git a/meta-oe/recipes-support/procmail/procmail/0001-fix-too-many-arguments-issue.patch b/meta-oe/recipes-support/procmail/procmail/0001-fix-too-many-arguments-issue.patch
new file mode 100644
index 0000000000..9b98720b2e
--- /dev/null
+++ b/meta-oe/recipes-support/procmail/procmail/0001-fix-too-many-arguments-issue.patch
@@ -0,0 +1,88 @@
+From 6f00795de8623347580c4366cb517a6653f73ca4 Mon Sep 17 00:00:00 2001
+From: Liu Yiding <liuyd.fnst@fujitsu.com>
+Date: Mon, 9 Jun 2025 08:01:39 +0000
+Subject: [PATCH] fix too many arguments issue
+
+fix issue like:
+| procmail.c:76:12: error: too many arguments to function 'auth_finduid'; expected 0, have 2
+|    76 |   if(tpass=auth_finduid(uid,0))                           /* save by copying */
+|       |            ^~~~~~~~~~~~ ~~~
+| In file included from procmail.c:36:
+| authenticate.h:15:3: note: declared here
+|    15 |  *auth_finduid Q((const uid_t uid,const int sock));
+| --
+| procmail.c:212:9: error: too many arguments to function 'checkprivFrom_'; expected 0, have 3
+|   212 |         checkprivFrom_(euid,passinvk?auth_username(passinvk):0,override);
+|       |         ^~~~~~~~~~~~~~ ~~~~
+| In file included from procmail.c:41:
+| from.h:9:2: note: declared here
+|     9 |  checkprivFrom_ Q((uid_t euid,const char*logname,int override));
+| --
+| procmail.c:213:9: error: too many arguments to function 'doumask'; expected 0, have 1
+|   213 |         doumask(INIT_UMASK);               /* allowed to set the From_ line? */
+|       |         ^~~~~~~
+| In file included from procmail.c:23:
+| robust.h:12:2: note: declared here
+|    12 |  doumask Q((const mode_t mask));
+
+Upstream-Status: Submitted [https://github.com/BuGlessRB/procmail/pull/11]
+Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
+---
+ src/authenticate.h | 2 +-
+ src/exopen.c       | 2 +-
+ src/includes.h     | 2 +-
+ src/misc.h         | 1 +
+ 4 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/authenticate.h b/src/authenticate.h
+index be9d88d..31e665a 100644
+--- a/src/authenticate.h
++++ b/src/authenticate.h
+@@ -7,7 +7,7 @@ typedef struct auth_identity auth_identity;
+ 
+ #ifndef P
+ #define P(x)   x
+-#define Q(x)   ()
++#define Q(x)   x
+ #endif
+ 
+ /*const*/auth_identity
+diff --git a/src/exopen.c b/src/exopen.c
+index c7647e5..46e3467 100644
+--- a/src/exopen.c
++++ b/src/exopen.c
+@@ -51,7 +51,7 @@ static const char*safehost P((void)) /* return a hostname safe for filenames */
+   return sname;
+ }
+ 
+-int unique(full,p,len,mode,verbos,flags)char*const full;char*p;
++int unique(full,p,len,mode,verbos,flags)const char*const full;char*p;
+  const size_t len;const mode_t mode;const int verbos,flags;
+ { static const char s2c[]=".,+%";static int serial=STRLEN(s2c);
+   static time_t t;char*dot,*end,*host;struct stat filebuf;
+diff --git a/src/includes.h b/src/includes.h
+index 7d6b41f..134805b 100644
+--- a/src/includes.h
++++ b/src/includes.h
+@@ -530,7 +530,7 @@ extern void*memmove();
+  * problems caused by one of those types being shorter than int and thereby
+  * being passed differently under ANSI rules.
+  */
+-#define Q(args)                ()
++#define Q(args)                args
+ 
+ #ifdef oBRAIN_DAMAGE
+ #undef oBRAIN_DAMAGE
+diff --git a/src/misc.h b/src/misc.h
+index 4f62ebc..659dfcb 100644
+--- a/src/misc.h
++++ b/src/misc.h
+@@ -1,4 +1,5 @@
+ /*$Id: misc.h,v 1.56 2001/06/30 01:14:19 guenther Exp $*/
++#include "authenticate.h"
+ 
+ struct dyna_array{int filled,tspace;char*vals;};
+ union offori{off_t o;int i;};
+-- 
+2.43.0
+
diff --git a/meta-oe/recipes-support/procmail/procmail/0001-fix-uname-declaration.patch b/meta-oe/recipes-support/procmail/procmail/0001-fix-uname-declaration.patch
new file mode 100644
index 0000000000..adbc4f584a
--- /dev/null
+++ b/meta-oe/recipes-support/procmail/procmail/0001-fix-uname-declaration.patch
@@ -0,0 +1,27 @@
+From a9e57d4048c94f6bc2533ccc41e6c35d4416571a Mon Sep 17 00:00:00 2001
+From: Liu Yiding <liuyd.fnst@fujitsu.com>
+Date: Mon, 9 Jun 2025 06:44:06 +0000
+Subject: [PATCH] fix uname declaration
+
+Upstream-Status: Submitted [https://github.com/BuGlessRB/procmail/pull/11]
+Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
+---
+ src/includes.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/includes.h b/src/includes.h
+index 4466907..7d6b41f 100644
+--- a/src/includes.h
++++ b/src/includes.h
+@@ -331,7 +331,7 @@ extern int errno;
+ 
+ #ifndef NOuname
+ #ifndef P                /* SINIX V5.23 has the wrong prototype for uname() */
+-extern int uname();                                     /* so we fix it :-) */
++extern int uname(struct utsname *);
+ #define Uname(name)            ((int(*)(struct utsname*))uname)(name)
+ #else
+ #define Uname(name)            uname(name)                 /* no fix needed */
+-- 
+2.43.0
+
diff --git a/meta-oe/recipes-support/procmail/procmail/CVE-2014-3618.patch b/meta-oe/recipes-support/procmail/procmail/CVE-2014-3618.patch
new file mode 100644
index 0000000000..b041924361
--- /dev/null
+++ b/meta-oe/recipes-support/procmail/procmail/CVE-2014-3618.patch
@@ -0,0 +1,29 @@
+Description: Fix heap-overflow in formail
+ CVE-2014-3618: Heap-overflow in formail when processing
+ specially-crafted email headers.
+Origin: http://www.openwall.com/lists/oss-security/2014/09/03/8
+Bug-Debian: https://bugs.debian.org/704675
+Bug-Debian: https://bugs.debian.org/760443
+Forwarded: not-needed
+Last-Update: 2014-09-04
+
+CVE: CVE-2014-3618
+Upstream-Status: Inactive-Upstream [lastrelease: 2001]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+
+--- a/src/formisc.c
++++ b/src/formisc.c
+@@ -84,12 +84,11 @@ normal:        *target++= *start++;
+        case '"':*target++=delim='"';start++;
+       }
+      ;{ int i;
+-       do
++       while(*start)
+           if((i= *target++= *start++)==delim)   /* corresponding delimiter? */
+              break;
+           else if(i=='\\'&&*start)                 /* skip quoted character */
+              *target++= *start++;
+-       while(*start);                                          /* anything? */
+       }
+      hitspc=2;
+    }
diff --git a/meta-oe/recipes-support/procmail/procmail/CVE-2017-16844.patch b/meta-oe/recipes-support/procmail/procmail/CVE-2017-16844.patch
new file mode 100644
index 0000000000..6e04989c33
--- /dev/null
+++ b/meta-oe/recipes-support/procmail/procmail/CVE-2017-16844.patch
@@ -0,0 +1,20 @@
+From: Santiago Vila <sanvila@debian.org>
+Subject: Fix heap-based buffer overflow in loadbuf()
+Bug-Debian: http://bugs.debian.org/876511
+X-Debian-version: 3.22-26
+
+CVE: CVE-2017-16844
+Upstream-Status: Inactive-Upstream [lastrelease: 2001]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+
+--- a/src/formisc.c
++++ b/src/formisc.c
+@@ -103,7 +103,7 @@
+ }
+                                                            /* append to buf */
+ void loadbuf(text,len)const char*const text;const size_t len;
+-{ if(buffilled+len>buflen)                       /* buf can't hold the text */
++{ while(buffilled+len>buflen)                    /* buf can't hold the text */
+      buf=realloc(buf,buflen+=Bsize);
+   tmemmove(buf+buffilled,text,len);buffilled+=len;
+ }
diff --git a/meta-oe/recipes-support/procmail/procmail/gcc14.patch b/meta-oe/recipes-support/procmail/procmail/gcc14.patch
new file mode 100644
index 0000000000..5ca56fa006
--- /dev/null
+++ b/meta-oe/recipes-support/procmail/procmail/gcc14.patch
@@ -0,0 +1,127 @@
+From: Santiago Vila <sanvila@debian.org>
+Subject: Fix build with gcc-14
+Bug-Debian: https://bugs.debian.org/1075398
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+--- a/initmake
++++ b/initmake
+@@ -124,7 +124,7 @@ else
+ fi
+ 
+ cat >_autotst.c <<HERE
+-main()
++int main()
+ { return 0;
+ }
+ HERE
+@@ -200,7 +200,7 @@ cat >_autotst.c <<HERE
+ #include <sys/types.h>
+ #include <stdio.h>
+ #include <sys/stat.h>
+-main()
++int main()
+ { struct stat buf;return!&buf;
+ }
+ HERE
+--- a/src/autoconf
++++ b/src/autoconf
+@@ -414,6 +414,12 @@ cat >_autotst.c <<HERE
+ int dolock,child[NR_of_forks],timeout,fdcollect;
+ char dirlocktest[]="_locktest";
+ 
++#include <stdlib.h>
++int killchildren();
++int fdlock(int fd);
++int sfdlock(int fd);
++int fdunlock();
++
+ void stimeout()
+ { timeout=1;close(fdcollect);killchildren();
+ }
+@@ -435,7 +441,7 @@ unsigned sfork()
+   return pid;
+ }
+ 
+-int main(argc,argv)char*argv[];
++int main(int argc,char*argv[])
+ { int goodlock,testlock,i,pip[2],pipw[2];time_t otimet;unsigned dtimet;
+   static char filename[]="_locktst.l0";
+   close(0);goodlock=0;testlock=FIRST_lock;signal(SIGPIPE,SIG_DFL);
+@@ -585,13 +591,13 @@ int killchildren()
+   return 0;
+ }
+ 
+-int sfdlock(fd)
++int sfdlock(int fd)
+ { int i;unsigned gobble[GOBBLE>>2];
+   for(i=GOBBLE>>2;i;gobble[--i]=~(unsigned)0);          /* SunOS crash test */
+   return fdlock(fd);
+ }
+ 
+-static oldfdlock;
++static int oldfdlock;
+ #ifdef F_SETLKW
+ static struct flock flck;              /* why can't it be a local variable? */
+ #endif
+@@ -599,7 +605,7 @@ static struct flock flck;           /* why can't
+ static off_t oldlockoffset;
+ #endif
+ 
+-int fdlock(fd)
++int fdlock(int fd)
+ { int i;unsigned gobble[GOBBLE>>2];
+   for(i=GOBBLE>>2;i;gobble[--i]=~(unsigned)0);          /* SunOS crash test */
+   oldfdlock=fd;fd=0;
+@@ -993,11 +999,11 @@ int main(){int i;i=1;
+  i+=WIFEXITED(i);
+  i+=WIFSTOPPED(i);
+  i+=WEXITSTATUS(i);
+- i+=WSIGTERM(i);
++ i+=WTERMSIG(i);
+  return i;}
+ HERE
+ 
+-echo 'Testing for WIFEXITED(), WIFSTOPPED(), WEXITSTATUS() & WSIGTERM()'
++echo 'Testing for WIFEXITED(), WIFSTOPPED(), WEXITSTATUS() & WTERMSIG()'
+ if $MAKE _autotst.$O >_autotst.rrr 2>&1
+ then
+    $FGREP -v include/ <_autotst.rrr >_autotst.$O
+@@ -1029,6 +1035,8 @@ cat >_autotst.c <<HERE
+ #ifndef NO_COMSAT
+ #include "network.h"
+ #endif
++int setrgid();
++int setresgid();
+ int main(){char a[2];
+  endpwent();endgrent();memmove(a,"0",1);bcopy("0",a,1);strcspn(a,"0");
+  strtol("0",(char**)0,10);strchr("0",'0');strpbrk(a,"0");rename(a,"0");
+@@ -1059,7 +1067,7 @@ echo 'Testing for memmove, strchr, strpb
+ echo ' rename, setrgid, setegid, pow, opendir, mkdir, waitpid, fsync,'
+ echo ' ftruncate, strtod, strncasecmp, strerror, strlcat,'
+ echo ' memset, bzero, and _exit'
+-if $MAKE _autotst.$O >$DEVNULL 2>&1
++if $MAKE _autotst.$O >_autotst.rrr 2>&1
+ then
+ :
+ else
+@@ -1196,7 +1204,7 @@ unsigned long dobench(strstr,iter,haysta
+   return (unsigned long)clock()-to;
+ }
+ #endif
+-int main(argc,argv)int argc;const char*argv[];
++int main(int argc,const char*argv[])
+ { if(argc==1)
+    { char*haystack;
+ #ifdef BENCHSIZE
+--- a/src/mailfold.c
++++ b/src/mailfold.c
+@@ -378,7 +378,7 @@ void concon(ch)const int ch;   /* flip b
+    }
+ }
+ 
+-void readmail(rhead,tobesent)const long tobesent;
++void readmail(int rhead,const long tobesent)
+ { char*chp,*pastend;static size_t contlengthoffset;
+   ;{ long dfilled;
+      if(rhead==2)                /* already read, just examine what we have */
diff --git a/meta-oe/recipes-support/procmail/procmail_3.22.bb b/meta-oe/recipes-support/procmail/procmail_3.22.bb
index 16917666a4..47c8310eaf 100644
--- a/meta-oe/recipes-support/procmail/procmail_3.22.bb
+++ b/meta-oe/recipes-support/procmail/procmail_3.22.bb
@@ -12,8 +12,13 @@ SRC_URI = "http://www.ring.gr.jp/archives/net/mail/${BPN}/${BP}.tar.gz \
     file://from-debian-to-fix-compile-errors.patch \
     file://from-debian-to-modify-parameters.patch \
     file://from-debian-to-fix-man-file.patch \
-    file://man-file-mailstat.1-from-debian.patch"
-SRC_URI[md5sum] = "1678ea99b973eb77eda4ecf6acae53f1"
+    file://man-file-mailstat.1-from-debian.patch \
+    file://CVE-2014-3618.patch \
+    file://CVE-2017-16844.patch \
+    file://gcc14.patch \
+    file://0001-fix-uname-declaration.patch \
+    file://0001-fix-too-many-arguments-issue.patch \
+"
 SRC_URI[sha256sum] = "087c75b34dd33d8b9df5afe9e42801c9395f4bf373a784d9bc97153b0062e117"
 
 LICENSE = "GPL-2.0-only & Artistic-1.0"
@@ -22,6 +27,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a71e50e197a992c862379e576e669757 \
 
 DEPENDS = "libnet"
 inherit autotools-brokensep
+
 do_configure() {
     find examples -type f | xargs chmod 644
     export CC="${BUILD_CC}"
@@ -33,7 +39,7 @@ do_configure() {
 }
 
 do_compile() {
-    oe_runmake -i TARGET_CFLAGS="$TARGET_CFLAGS -Wno-comments -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" LDFLAGS0="${LDFLAGS}"
+    oe_runmake -i CFLAGS="$TARGET_CFLAGS -Wno-comments -Wno-implicit-int -Wno-implicit-function-declaration -Wno-incompatible-pointer-types -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" LDFLAGS0="${LDFLAGS}"
 }
 
 do_install() {