summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
diff options
context:
space:
mode:
authorAníbal Limón <anibal.limon@linux.intel.com>2014-11-24 15:16:31 -0600
committerRichard Purdie <richard.purdie@linuxfoundation.org>2014-12-25 08:18:13 +0000
commit172ea4f79e3b5a4256604d404bc9f74c255a8c85 (patch)
treec6eff8a1451a88b190535bae98f1c0241ca9de6b /meta/recipes-devtools
parentf6cf293bbd22b4a0a4d5ab350ea5d3d9e8705ca1 (diff)
downloadpoky-172ea4f79e3b5a4256604d404bc9f74c255a8c85.tar.gz
dpkg: Upgrade to 1.17.21
Remove dpkg-1.17.4-CVE-2014-0471, dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127 and ignore_extra_fields patches that are already in upstream. Rebase no-vla-warning patch. (From OE-Core rev: d09ea40d7f5b59f37625e43973c363c07053fdfb) Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools')
-rw-r--r--meta/recipes-devtools/dpkg/dpkg.inc3
-rw-r--r--meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch68
-rw-r--r--meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch97
-rw-r--r--meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch21
-rw-r--r--meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch24
-rw-r--r--meta/recipes-devtools/dpkg/dpkg_1.17.21.bb (renamed from meta/recipes-devtools/dpkg/dpkg_1.17.4.bb)6
6 files changed, 15 insertions, 204 deletions
diff --git a/meta/recipes-devtools/dpkg/dpkg.inc b/meta/recipes-devtools/dpkg/dpkg.inc
index 929906dfd8..c3c51ebe80 100644
--- a/meta/recipes-devtools/dpkg/dpkg.inc
+++ b/meta/recipes-devtools/dpkg/dpkg.inc
@@ -2,8 +2,7 @@ SUMMARY = "Package maintenance system from Debian"
2LICENSE = "GPLv2.0+" 2LICENSE = "GPLv2.0+"
3SECTION = "base" 3SECTION = "base"
4 4
5SRC_URI = "${DEBIAN_MIRROR}/main/d/dpkg/dpkg_${PV}.tar.xz \ 5SRC_URI = "${DEBIAN_MIRROR}/main/d/dpkg/dpkg_${PV}.tar.xz"
6 file://ignore_extra_fields.patch"
7 6
8DEPENDS = "zlib bzip2 perl ncurses" 7DEPENDS = "zlib bzip2 perl ncurses"
9DEPENDS_class-native = "bzip2-replacement-native zlib-native virtual/update-alternatives-native gettext-native perl-native" 8DEPENDS_class-native = "bzip2-replacement-native zlib-native virtual/update-alternatives-native gettext-native perl-native"
diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch
deleted file mode 100644
index e59c6661ea..0000000000
--- a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch
+++ /dev/null
@@ -1,68 +0,0 @@
1dpkg: Security Advisory - CVE-2014-3127
2
3commit a12eb58959d0a10584a428f4a3103a49204c410f upstream
4
5dpkg 1.15.9 on Debian squeeze introduces support for the "C-style
6encoded filenames" feature without recognizing that the squeeze patch
7program lacks this feature, which triggers an interaction error that
8allows remote attackers to conduct directory traversal attacks and
9modify files outside of the intended directories via a crafted source
10package.
11
12NOTE: this can be considered a release engineering problem in the
13effort to fix CVE-2014-0471.
14
15Upstream-Status: Backport
16
17Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
18Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
19=====================================================
20diff -uarN dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm
21--- dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm 2014-06-05 16:32:41.765446564 +0800
22+++ dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm 2014-06-05 16:37:21.461446359 +0800
23@@ -324,31 +324,6 @@
24 return $line;
25 }
26
27-my %ESCAPE = ((
28- 'a' => "\a",
29- 'b' => "\b",
30- 'f' => "\f",
31- 'n' => "\n",
32- 'r' => "\r",
33- 't' => "\t",
34- 'v' => "\cK",
35- '\\' => '\\',
36- '"' => '"',
37-), (
38- map { sprintf('%03o', $_) => chr($_) } (0..255)
39-));
40-
41-sub _unescape {
42- my ($diff, $str) = @_;
43-
44- if (exists $ESCAPE{$str}) {
45- return $ESCAPE{$str};
46- } else {
47- error(_g('diff %s patches file with unknown escape sequence \\%s'),
48- $diff, $str);
49- }
50-}
51-
52 # Fetch the header filename ignoring the optional timestamp
53 sub _fetch_filename {
54 my ($diff, $header) = @_;
55@@ -358,12 +333,7 @@
56
57 # Is it a C-style string?
58 if ($header =~ m/^"/) {
59- $header =~ m/^"((?:[^\\"]|\\.)*)"/;
60- error(_g('diff %s patches file with unbalanced quote'), $diff)
61- unless defined $1;
62-
63- $header = $1;
64- $header =~ s/\\([0-3][0-7]{2}|.)/_unescape($diff, $1)/eg;
65+ error(_g('diff %s patches file with C-style encoded filename'), $diff);
66 } else {
67 # Tab is the official separator, it's always used when
68 # filename contain spaces. Try it first, otherwise strip on space
diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch
deleted file mode 100644
index 195d309506..0000000000
--- a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch
+++ /dev/null
@@ -1,97 +0,0 @@
1dpkg: Security Advisory - CVE-2014-0471
2
3commit a82651188476841d190c58693f95827d61959b51 upstream
4
5Directory traversal vulnerability in the unpacking functionality in
6dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8
7allows remote attackers to write arbitrary files via a crafted source
8package, related to "C-style filename quoting."
9
10Upstream-Status: Backport
11
12Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
13Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
14===================================================
15diff -uarN dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm
16--- dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm 2014-06-05 15:24:07.422446284 +0800
17+++ dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm 2014-06-05 15:41:37.746446314 +0800
18@@ -324,14 +324,53 @@
19 return $line;
20 }
21
22-# Strip timestamp
23-sub _strip_ts {
24- my $header = shift;
25-
26- # Tab is the official separator, it's always used when
27- # filename contain spaces. Try it first, otherwise strip on space
28- # if there's no tab
29- $header =~ s/\s.*// unless ($header =~ s/\t.*//);
30+my %ESCAPE = ((
31+ 'a' => "\a",
32+ 'b' => "\b",
33+ 'f' => "\f",
34+ 'n' => "\n",
35+ 'r' => "\r",
36+ 't' => "\t",
37+ 'v' => "\cK",
38+ '\\' => '\\',
39+ '"' => '"',
40+), (
41+ map { sprintf('%03o', $_) => chr($_) } (0..255)
42+));
43+
44+sub _unescape {
45+ my ($diff, $str) = @_;
46+
47+ if (exists $ESCAPE{$str}) {
48+ return $ESCAPE{$str};
49+ } else {
50+ error(_g('diff %s patches file with unknown escape sequence \\%s'),
51+ $diff, $str);
52+ }
53+}
54+
55+# Fetch the header filename ignoring the optional timestamp
56+sub _fetch_filename {
57+ my ($diff, $header) = @_;
58+
59+ # Strip any leading spaces.
60+ $header =~ s/^\s+//;
61+
62+ # Is it a C-style string?
63+ if ($header =~ m/^"/) {
64+ $header =~ m/^"((?:[^\\"]|\\.)*)"/;
65+ error(_g('diff %s patches file with unbalanced quote'), $diff)
66+ unless defined $1;
67+
68+ $header = $1;
69+ $header =~ s/\\([0-3][0-7]{2}|.)/_unescape($diff, $1)/eg;
70+ } else {
71+ # Tab is the official separator, it's always used when
72+ # filename contain spaces. Try it first, otherwise strip on space
73+ # if there's no tab
74+ $header =~ s/\s.*// unless $header =~ s/\t.*//;
75+ }
76+
77 return $header;
78 }
79
80@@ -400,7 +439,7 @@
81 unless(s/^--- //) {
82 error(_g("expected ^--- in line %d of diff `%s'"), $., $diff);
83 }
84- $path{old} = $_ = _strip_ts($_);
85+ $path{old} = $_ = _fetch_filename($diff, $_);
86 $fn{old} = $_ if $_ ne '/dev/null' and s{^[^/]*/+}{$destdir/};
87 if (/\.dpkg-orig$/) {
88 error(_g("diff `%s' patches file with name ending .dpkg-orig"), $diff);
89@@ -412,7 +451,7 @@
90 unless (s/^\+\+\+ //) {
91 error(_g("line after --- isn't as expected in diff `%s' (line %d)"), $diff, $.);
92 }
93- $path{new} = $_ = _strip_ts($_);
94+ $path{new} = $_ = _fetch_filename($diff, $_);
95 $fn{new} = $_ if $_ ne '/dev/null' and s{^[^/]*/+}{$destdir/};
96
97 unless (defined $fn{old} or defined $fn{new}) {
diff --git a/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch b/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch
deleted file mode 100644
index 4e3eb97ed8..0000000000
--- a/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch
+++ /dev/null
@@ -1,21 +0,0 @@
1Upstream-Status: Inappropriate [workaround]
2
3Index: dpkg-1.16.8/dpkg-deb/build.c
4===================================================================
5--- dpkg-1.16.8.orig/dpkg-deb/build.c
6+++ dpkg-1.16.8/dpkg-deb/build.c
7@@ -340,13 +340,13 @@ check_new_pkg(const char *dir)
8 if (pkg->priority == pri_other)
9 warning(_("'%s' contains user-defined Priority value '%s'"),
10 controlfile, pkg->otherpriority);
11- for (field = pkg->available.arbs; field; field = field->next) {
12+ /*for (field = pkg->available.arbs; field; field = field->next) {
13 if (known_arbitrary_field(field))
14 continue;
15
16 warning(_("'%s' contains user-defined field '%s'"), controlfile,
17 field->name);
18- }
19+ }*/
20
21 free(controlfile);
diff --git a/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch b/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
index 0e57dbc7fc..f660b18646 100644
--- a/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
+++ b/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
@@ -11,22 +11,22 @@ Upstream-Status: Pending
11 11
12Signed-off-by: Donn Seeley <donn.seeley@windriver.com> 12Signed-off-by: Donn Seeley <donn.seeley@windriver.com>
13Signed-off-by: Robert Yang <liezhi.yang@windriver.com> 13Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
14Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
14--- 15---
15 m4/dpkg-compiler.m4 | 1 - 16 m4/dpkg-compiler.m4 | 1 -
16 1 file changed, 1 deletion(-) 17 1 file changed, 1 deletion(-)
17 18
18diff --git a/m4/dpkg-compiler.m4 b/m4/dpkg-compiler.m4 19diff --git a/m4/dpkg-compiler.m4 b/m4/dpkg-compiler.m4
19index f1c760b..500b5ad 100644 20index 53f67c6..6e66a43 100644
20--- a/m4/dpkg-compiler.m4 21--- a/m4/dpkg-compiler.m4
21+++ b/m4/dpkg-compiler.m4 22+++ b/m4/dpkg-compiler.m4
22@@ -72,7 +72,6 @@ if test "x$enable_compiler_warnings" = "xyes"; then 23@@ -49,7 +49,6 @@ AC_DEFUN([DPKG_CHECK_COMPILER_WARNINGS], [
23 DPKG_WARNING_ALL([-Wformat-security]) 24 DPKG_CHECK_COMPILER_FLAG([-Wformat-security])
24 DPKG_WARNING_ALL([-Wpointer-arith]) 25 DPKG_CHECK_COMPILER_FLAG([-Wpointer-arith])
25 DPKG_WARNING_ALL([-Wlogical-op]) 26 DPKG_CHECK_COMPILER_FLAG([-Wlogical-op])
26- DPKG_WARNING_ALL([-Wvla]) 27- DPKG_CHECK_COMPILER_FLAG([-Wvla])
27 DPKG_WARNING_ALL([-Winit-self]) 28 DPKG_CHECK_COMPILER_FLAG([-Winit-self])
28 DPKG_WARNING_ALL([-Wwrite-strings]) 29 DPKG_CHECK_COMPILER_FLAG([-Wwrite-strings])
29 DPKG_WARNING_ALL([-Wcast-align]) 30 DPKG_CHECK_COMPILER_FLAG([-Wcast-align])
30-- 31---
311.7.10.4 321.17.21
32
diff --git a/meta/recipes-devtools/dpkg/dpkg_1.17.4.bb b/meta/recipes-devtools/dpkg/dpkg_1.17.21.bb
index 83526f3c96..15c0277015 100644
--- a/meta/recipes-devtools/dpkg/dpkg_1.17.4.bb
+++ b/meta/recipes-devtools/dpkg/dpkg_1.17.21.bb
@@ -12,10 +12,8 @@ SRC_URI += "file://noman.patch \
12 file://dpkg-configure.service \ 12 file://dpkg-configure.service \
13 file://glibc2.5-sync_file_range.patch \ 13 file://glibc2.5-sync_file_range.patch \
14 file://no-vla-warning.patch \ 14 file://no-vla-warning.patch \
15 file://dpkg-1.17.4-CVE-2014-0471.patch \
16 file://dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch \
17 " 15 "
18 16
19SRC_URI[md5sum] = "cc25086e1e3bd9512a95f14cfe9002e1" 17SRC_URI[md5sum] = "765a96fd0180196613bbfa3c4aef0775"
20SRC_URI[sha256sum] = "01cdc81c33e77c3d7c40df17e19171794542be7cf12e411381ffcaa8f87b1854" 18SRC_URI[sha256sum] = "3ed776627181cb9c1c9ba33f94a6319084be2e9ec9c23dd61ce784c4f602cf05"
21 19