linux/poky.git/meta/recipes-devtools, branch danny-next

perl: fix security issue

2013-03-01T15:38:48+00:00

Add perl-fix-CVE-2012-5195.patch to fix perl memory exhaustion denial-of-service attack issue. And patch is from perl 5.14.3 branch: http://perl5.git.perl.org/perl.git/commit/b675304e3fdbcce3ef853b06b6ebe870d99faa7e [Yocto 3701] (From OE-Core rev: b4799833d26eacf60a7590bc5770b3715389fe66) Signed-off-by: Kang Kai Signed-off-by: Richard Purdie

Python: Fix for CVE-2012-2135

2013-03-01T15:38:47+00:00

Reference:http://http://bugs.python.org/issue14579 The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135 [YOCTO #3450] (From OE-Core rev: 11544f573bc94ce69a8a76d645e46ab6359dee78) Signed-off-by: yanjun.zhu Signed-off-by: Richard Purdie

valgrind: explicitly disable MPI2 support

2013-02-15T13:05:29+00:00

We don't have support for this in OE-Core, so ensure we don't pick this up from the build host if e.g. openmpi development files happen to be installed there. Fixes [YOCTO #3726]. (From OE-Core rev: cc490d76aba0a778409ca1a3d0e1f2c308684c9b) (From OE-Core rev: 1fb5a50a8bbda7ca717125abcc4cb99b50ba6ead) Signed-off-by: Paul Eggleton Signed-off-by: Richard Purdie

guile: add explicit dependency to avoid parallel build issue

2013-02-14T15:19:54+00:00

Add explicit dependency for libpath.h on dynl.x which fixes a potential parallel build issue. [YOCTO #3558] (From OE-Core rev: c92320406ca8874b5862be5386dae80854a1a550) Signed-off-by: Bogdan Marinescu Signed-off-by: Richard Purdie

squashfs: fix CVE-2012-4025

2013-02-14T15:19:52+00:00

CQID:WIND00366813 Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi? p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025 (From OE-Core rev: 4493173c1ab7a0528e0c74935a105e474521ed1c) Signed-off-by: yanjun.zhu [YOCTO #3564] Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

autogen: use pkg-config directly instead of guile-config

2012-12-13T15:21:43+00:00

The autoconf macros in autogen use dpkg (!) and guile-config to determine what/where Guile is. If the build host has an installed guile, these can produce conflicting results. More interestingly, if the Guile library source and compiled form have bad timestamps (source newer than compiled) the configure scripts knows that Guile is present but doesn't know what version it is, resulting in compile errors. [ YOCTO #3370 (partially) ] (From OE-Core rev: 29f37af146b50fa39021884ef97bca9711ee924b) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

guile: touch compiled modules on sstate install

2012-12-13T15:21:43+00:00

When guile is installed from sstate, if the compiled files get a modified time older than the source files then guile will produce warnings like this: ;;; note: source file /data/poky-master/tmp/sysroots/x86_64-linux/usr/share/guile/2.0/ice-9/boot-9.scm ;;; newer than compiled /data/poky-master/tmp/sysroots/x86_64-linux/usr/lib/guile/2.0/ccache/ice-9/boot-9.go Not staging the files and letting guile re-compile them on demand won't work: ;;; compiling /data/poky-master/tmp/sysroots/x86_64-linux/usr/share/guile/2.0/system/base/compile.scm ;;; it seems /data/poky-master/tmp/sysroots/x86_64-linux/usr/share/guile/2.0/system/base/compile.scm ;;; is part of the compiler; skipping auto-compilation So, use a sstate postinst function to explicitly touch the compiled files after the extraction to ensure that they are fresher. [ YOCTO #3370 ] (From OE-Core rev: 1e96fea6c603a500e21b9cd4626ecd19049bf04b) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

guile: fix bashism in script

2012-12-13T15:21:43+00:00

(From OE-Core rev: e206443c132ee94227580fad16b16332007aec42) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

rsync doesn't create hardlinks for certain files

2012-12-13T15:21:43+00:00

commit 4205a4c5d959643cf6c186e0939e202fb6006b82 Author: Amy Fong Date: Thu Nov 29 09:21:49 2012 -0500 rsync cannot create hardlink for node file when use option --link-dest=DIR. By default, rsync's configure file disables certain capabilities when crosscompiling. Signed-off-by: Amy Fong (From OE-Core rev: 4e6b3eeb7cf2ea002819daa57a1248de2daac0cd) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

squashfs: fix for CVE-2012-4024

2012-12-13T15:21:42+00:00

Reference:http://squashfs.git.sourceforge.net/git/gitweb.cgi?p= squashfs/squashfs;a=commit;h=19c38fba0be1ce949ab44310d7f49887576cc123 Fix potential stack overflow in get_component() where an individual pathname component in an extract file (specified on the command line or in an extract file) could exceed the 1024 byte sized targname allocated on the stack. Fix by dynamically allocating targname rather than storing it as a fixed size on the stack. [YOCTO #3513] (From OE-Core rev: a45ec682748b0d6e5bb21af04d205edb5ef1360e) Signed-off-by: yanjun.zhu Signed-off-by: Richard Purdie