linux/poky.git/meta/recipes-devtools/flex, branch honister

flex: Add CVE-2019-6293 to exclusions for checks

2021-09-07T20:54:11+00:00

CVE is effectively disputed - yes there is stack exhaustion but no bug and it is building the parser, not running it, effectively similar to a compiler ICE. Upstream no plans to address and there is no security issue. https://github.com/westes/flex/issues/414 (From OE-Core rev: 0cae5d7a24bedf6784781b62cbb3795a44bab4d1) Signed-off-by: Richard Purdie

Convert to new override syntax

2021-08-02T14:44:10+00:00

This is the result of automated script conversion: scripts/contrib/convert-overrides.py converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie

flex: correct license information

2021-05-28T05:41:03+00:00

License-Update: Corrected license information flex package is under two licenses: - "BSD-3-Clause" is provided in top-level COPYING file; the license actually include third obligation (without the actual "3" numbering) - "LGPL-2.0+" is explained by src/gettext.h (From OE-Core rev: 7beaae812f55a43797a459f3ad25f1be121bdbe1) Signed-off-by: Dmitry Kisil Signed-off-by: Richard Purdie

flex: Fix --noline option behavior

2021-01-20T22:46:18+00:00

Option --noline or -L does not handled properly. So generated code contains #line directives with file absolute path and prevents to create reproducible builds. (From OE-Core rev: 0bf2cb7dc2123f220accf1542c2ae4c4b4b8275a) Signed-off-by: Oleksiy Obitotskyy Signed-off-by: Richard Purdie

flex: Refresh patch

2020-08-01T18:57:49+00:00

The patch changes the same file twice which causes issues with some patch tools (not used in YP by default). Refresh the patch to clean this up anyway. RP: Tweak commit message (From OE-Core rev: cb6e65f8196fd6587c75c3ab2cf060c00a074ec6) Signed-off-by: Zang Ruochen Signed-off-by: Richard Purdie

flex: fix build with autoconf 2.70

2020-07-18T10:06:32+00:00

autoconf 2.70 is coming soon which has some small behavioural fixes, so backport a patch from upstream to fix the build with that release. (From OE-Core rev: 946610f2cc8cd42265ee3fab6c73ad4831aaeb4e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

flex: Replace uninative loader path

2019-12-09T12:00:43+00:00

The Makefile used for flex-ptest can pick up the path to the uninative loader through BUILD_LDFLAGS. This includes the full path to the uninative loader, which is not reproducible. Replace it with /bin/false. It doesn't appear as if these native programs are used in the test suites and if there are likely to be other problems related to building them using the BUILD_* flags. (From OE-Core rev: 3cce2d1c36b0859186139d650fd50d2a56e91abd) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

flex: update to 2.6.4

2019-12-04T12:30:58+00:00

Add a backport patch that addresses segfaults on newer glibc versions. Remove: CVE-2016-6354.patch (backport) 0002-avoid-c-comments-in-c-code-fails-with-gcc-6.patch (issue fixed upstream) do_not_create_pdf_doc.patch (issue fixed upstream) ptest pass rate is 100%. (From OE-Core rev: a0fe05f3ffd67dc42e053c20bd019bb9d463d0ad) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

flex: Clarify BSD license variant

2019-10-15T13:16:11+00:00

The license of flex is BSD-2-Clause. (From OE-Core rev: e8118c5cf205e8bbb005486d7b3e1f7be1e27aac) Signed-off-by: Christophe Priouzeau Signed-off-by: Richard Purdie

flex: set CVE_PRODUCT to include vendor

2019-07-18T11:16:19+00:00

There are many projects called Flex and they have CVEs, so also set the vendor to remove these false positives. (From OE-Core rev: 0598ccdcb31e16f1d1227197591b10ba441fcfe2) Signed-off-by: Ross Burton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie