linux/poky.git/meta/recipes-devtools/ruby, branch uninative-1.8

ruby: 2.4.2 -> 2.5.0

2018-02-06T11:06:27+00:00

1.Upgrade ruby form 2.4.2 to 2.5.0. 2.Update the checksum of LIC_FILES_CHKSUM. 3.Delete ruby-CVE-2017-9224.patch, ruby-CVE-2017-9227.patch, ruby-CVE-2017-9229.patch, since it is integrated upstream. 4.Modify ruby-CVE-2017-9226.patch, since the data has been changed. (From OE-Core rev: 67b9f407f7c40c63c7f9518b4ee3d4d1cc7c75ce) Signed-off-by: Huang Qiyu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix typo in gmp PACKAGECONFIG option

2018-01-26T13:09:10+00:00

(From OE-Core rev: 9fb931b69ece7f8a644f9e25600bcbbc9266a761) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: remove spurious db build dependency

2017-11-05T22:33:23+00:00

The dbm module uses gdbm by default which is also a build dependency. (From OE-Core rev: 79121ff54420e5cc331552ca5620aed81a36aac9) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: upgrade to 2.4.2

2017-11-05T22:33:21+00:00

The CVE-2017-14064 patch is already at 2.4.2 as explained on project's commit, so removing from the recipe & repo. commit 83735ba29a0bfdaffa8e9c2a1dc025c3b0b63153 Author: hsbt Date: Wed Apr 12 00:21:18 2017 +0000 Merge json-2.0.4. * https://github.com/flori/json/releases/tag/v2.0.4 * https://github.com/flori/json/blob/09fabeb03e73ed88dc8ce8f19d76ac59e51dae20/CHANGES.md#2017-03-23-204 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58323 b2dd03c8-39d4-4d8f-98ff-823fe69b080e (From OE-Core rev: 6e37a88af155d5e5453fb0f44bb11d6f8e406438) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: CVE-2017-14064

2017-09-18T10:07:30+00:00

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-14064 Upstream patch: https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85 (From OE-Core rev: 17dbfd967019f9b50a9f6aa3f48cd3658fcccc70) Signed-off-by: Ovidiu Panait Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix CVE-2017-922{6-9}

2017-08-19T21:15:39+00:00

CVE-2017-9226 : check too big code point value for single byte CVE-2017-9227 : access to invalid address by reg->dmin value CVE-2017-9228 : invalid state(CCS_VALUE) in parse_char_class() CVE-2017-9229 : access to invalid address by reg->dmax value (From OE-Core rev: f15f01edbaa431829a50053d07ed6d6b333584c7) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

ruby: fix CVE-2017-9224

2017-08-18T09:40:26+00:00

Use DATA_ENSURE(1) before access. (From OE-Core rev: 9db907a0bd331c47c4882b82f9f1d2a7ef1f6d1f) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

meta: Add/fix missing Upstream-Status to patches

2017-06-27T09:38:43+00:00

This adds or fixes the Upstream-Status for all remaining patches missing it in OE-Core. (From OE-Core rev: 563cab8e823c3fde8ae4785ceaf4d68a5d3e25df) Signed-off-by: Richard Purdie

ruby: upgrade to 2.4.1

2017-05-25T22:59:32+00:00

(From OE-Core rev: 3ff2d0bc7a8e7a7e8c8e953dc0ccf84d891688ef) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: upgrade 2.3.3 -> 2.4.0

2017-03-01T23:27:11+00:00

Two LIC_FILES_CHKSUM checksums changed (COPYING and LEGAL) but LICENSE remains the same. (From OE-Core rev: 2bbad067b6b928d4615df938d0e41fa84e451c15) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie