linux/poky.git, branch morty-next

selftest/signing: add --batch to gpg invocation when importing keys

2018-04-04T10:06:56+00:00

Otherwise it may pop up windows asking for passphrases which breaks automated testing. Newer YP releases and master already have the fix. [YOCTO #12521] (From OE-Core rev: 5a4b4c0350c724ef4ecc01246133e2b816d8976f) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

qemu: fix memfd_create with glibc 2.27

2018-04-04T10:06:56+00:00

glibc 2.27 has added memfd_create() but this conflicts with a copy in qemu, so take a patch from upstream to fix building with glibc 2.27. (From OE-Core rev: 1efb8527691b59c62709bb2788f4fcf6452e267d) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

libvorbis: CVE-2018-5146

2018-04-04T10:06:56+00:00

Prevent out-of-bounds write in codebook decoding. The bug could allow code execution from a specially crafted Ogg Vorbis file. References: https://www.debian.org/security/2018/dsa-4140 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 (From OE-Core rev: 7d5d262c03745e5c61e1e9c84f108d842d16e5ec) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

libvorbis: CVE-2017-14632

2018-04-04T10:06:56+00:00

Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632 (From OE-Core rev: 6dcd8bdd5ffebafec5bbb811243f4dbf3a7038b8) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

libvorbis: CVE-2017-14633

2018-04-04T10:06:56+00:00

In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633 (From OE-Core rev: f398fb04549577922e6265c0969c6d6c35a11e7c) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

lib/oe/terminal.py: use an absolute path to execute oe-gnome-terminal-phonehome

2018-04-04T10:06:56+00:00

A flaw was found on my Ubuntu 14.04.5 LTS, on which that gnome-terminal is the default terminal, when I run any of the tasks: bitbake busybox -c menuconfig/devshell/devpyshell bitbake virtual/kernel -c menuconfig/devshell/devpyshell I got a error as follows: "Failed to execute child process "oe-gnome-terminal-phonehome" (No such file or directory)" Seems the environment of the process calling Popen is not passed to the child process, this behaviour is a known issue in Python bug tracker: http://bugs.python.org/issue8557 It could be fixed by using an absolute path instead per test. (From OE-Core rev: 640d098ef0dc6aec8780f951578163ed3e7df349) Signed-off-by: Ming Liu Signed-off-by: Richard Purdie (cherry picked from commit 2117c148ef07d84bc605768e3b3671b0126b9337) Signed-off-by: Andre McCurdy Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

fixup 3

2018-04-04T10:06:55+00:00

(From OE-Core rev: 0eb9efa3b1f3f850b51a743fdc82495614289c87) Signed-off-by: Richard Purdie

fixup2

2018-04-04T10:06:55+00:00

(From OE-Core rev: 97556afe54c350b17493bf1c44f5fcc4de62e4f4) Signed-off-by: Richard Purdie

fixup

2018-04-04T10:06:55+00:00

(From OE-Core rev: e1faf9ac7e89d33aba33547ede19a10aaa034207) Signed-off-by: Richard Purdie

sdk: streamline locale removal

2018-04-04T10:06:55+00:00

For some reason dnf is aborting with the fairly useless "failed to read RPMDB" error during SDK creation. Luckily as we're just deleting locale packages we can pass False to remove() to use RPM directly, which doesn't crash. (From OE-Core rev: e286be3a2203b403cefa00fcdb6f9d48e0584cf8) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie