linux/poky.git/meta/recipes-devtools/perl, branch sumo

perl: skip tests that are not useful

2018-11-16T16:33:08+00:00

Some tests, like the one that compares the hashes for a list of files against those stored in a .dat file, don't make sense for downstream distros packaging perl. Backport a patch from upstream that allows skipping of these tests at runtime. Also remove the local patch trying to keep hashes up-to-date for one of those tests. Fixes [YOCTO #12787] (From OE-Core rev: 557f4618b75b8739a647e46054ab587ae2bbdc25) (From OE-Core rev: 7157e7804b21a84ecbd809b6e171106d7ddc86a6) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: CVE-2018-12015

2018-08-29T14:23:51+00:00

Remove existing files before overwriting them Archive should extract only the latest same-named entry. Extracted regular file should not be writtent into existing block device (or any other one). https://rt.cpan.org/Ticket/Display.html?id=125523 Affects perl <= 5.26.2 (From OE-Core rev: ca005cd857f8e79b135c43526d5b792478a07eb3) Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: CVE-2018-6913

2018-08-29T14:23:51+00:00

(perl #131844) fix various space calculation issues in pp_pack.c - for the originally reported case, if the start/cur pointer is in the top 75% of the address space the add (cur) + glen addition would overflow, resulting in the condition failing incorrectly. - the addition of the existing space used to the space needed could overflow, resulting in too small an allocation and a buffer overflow. - the scaling for UTF8 could overflow. - the multiply to calculate the space needed for many items could overflow. For the first case, do a space calculation without making new pointers. For the other cases, detect the overflow and croak if there's an overflow. Originally this used Size_t_MAX as the maximum size of a memory allocation, but for -DDEBUGGING builds realloc() throws a panic for allocations over half the address space in size, changing the error reported for the allocation. For non-DEBUGGING builds the Size_t_MAX limit has the small chance of finding a system that has 3GB of contiguous space available, and allocating that space, which could be a denial of servce in some cases. Unfortunately changing the limit to half the address space means that the exact case with the original issue can no longer occur, so the test is no longer testing against the address + length issue that caused the original problem, since the allocation is failing earlier. One option would be to change the test so the size request by pack is just under 2GB, but this has a higher (but still low) probability that the system has the address space available, and will actually try to allocate the memory, so let's not do that. Note: changed plan tests => 14713; to plan tests => 14712; in a/t/op/pack.t to apply this patch on perl 5.24.1. Affects perl < 5.26.2 (From OE-Core rev: 0542779d2f1a8977a732800a8998fd88971c0c1d) Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: CVE-2018-6797

2018-08-29T14:23:51+00:00

(perl #132227) restart a node if we change to uni rules within the node and encounter... This could lead to a buffer overflow. (cherry picked from commit a02c70e35d1313a5f4e245e8f863c810e991172d) Affects perl >= 5.18 && perl <= 5.26 (From OE-Core rev: 109ffd1b3d10753bfd711a14ad59b194ca3ce831) Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: CVE-2018-6798

2018-08-29T14:23:51+00:00

* CVE-2018-6798-1 The proximal cause is several instances in regexec.c of the code assuming that the input was valid UTF-8, whereas the input was too short for what the start byte claimed it would be. I grepped through the core for any other similar uses, and did not find any. (cherry picked from commit fe7d8ba0a1bf567af8fa8fea128e2b9f4c553e84) * CVE-2018-6798-2 The first patch for 132063 prevented the buffer read overflow when dumping the warning but didn't fix the underlying problem. The next change treats the supplied buffer correctly, preventing the non-UTF-8 SV from being treated as UTF-8, preventing the warning. (cherry picked from commit 1e8b61488f195e1396aa801c685340b156104f4f) Affects perl >= 5.22 && perl <= 5.26 (From OE-Core rev: 4aaf09b9d657b1c2df85bf509008beacd6a00342) Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: native modules will not trigger build perl for target.

2018-06-15T16:56:57+00:00

Currently building perl-native modules triggers build perl for target due to PACKAGES_DYNAMIC regex. This commit will cause, that perl native modules will trigger perl-native build. (From OE-Core rev: 7dd9772eca6df52db09b65537fdf689f1aa3fd8f) (From OE-Core rev: 3ad793c9ae1eb0b0599078298d55a37042f11239) Signed-off-by: Krzysztof Taborski Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: fix CVE-2017-12837

2018-06-15T16:56:57+00:00

https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5 (From OE-Core rev: bd53256e165f5bb59a28d77a466d71fce39080fa) (From OE-Core rev: 5f808ec161d1604ffd1744f5d488b0ca9fc8f50f) Signed-off-by: Hongxu Jia Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

perl: Security fix CVE-2017-12883

2018-04-23T16:26:05+00:00

Affects: Perl < 5.24.3-rc1 and 5.26.x before 5.26.1-RC1 (From OE-Core rev: 60ebf7fcb7bfcef8a8e0cd52e737b082623ff109) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

meta: add missing Signed-off-by and Upstream-Status tags

2018-04-13T15:58:07+00:00

(From OE-Core rev: 4612441b59fd8264fdd5bd4f3e5d195f6085c94c) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

nativesdk-glibc: Split glibc and libcrypt to use libxcrypt instead

2018-04-07T21:34:45+00:00

Fedora28[1] has decided to go ahead and use libxcrypt to replace libcrypt from glibc despite the change not having merged into glibc upstream yet. This breaks the use of uninative in OE on fedora28 since binaries there are now using new symbols only found in libxcrypt. libxcrypt is meant to be backwards compatible with libcrypt but not the reverse. Since this will impact OE in the next release cycle, this changes nativesdk only to use this new model and adds libxcrypt to work in that case. This allows us to build a uninative which is compatible with fedora28 and previous other OSes. In order to work, recipes will now need to depend on virtual/crypt where they use libcrypt since its now a separate library and we can't depend on it from glibc to preseve backwards compatibility since glibc needs to build first. For now, only the problematic nativesdk recipes have been fixed up. For target use, the default provider remains glibc for now. Assuming this change is merged into upstream glibc, we will need to roll this change out for the target but we will do this in the next release cycle when we can better deal with the resulting bugs. [1] https://fedoraproject.org/wiki/Changes/Replace_glibc_libcrypt_with_libxcrypt Original patch from Charles-Antoine Couret , tweaked by RP to add virtual provides, SkipRecipe for libxcrypt and other minor tweaks. (From OE-Core rev: c1573cb7faeb296fe7077a60d02443d5ed5bded0) Signed-off-by: Charles-Antoine Couret Signed-off-by: Richard Purdie