linux/poky.git/meta/recipes-devtools, branch yocto-3.1.15

libxml-parser-perl: Add missing RDEPENDS

2022-03-09T17:30:49+00:00

Running the ptest package in an image alone highlighted missing module dependencies. Add them to fix those errors. (From OE-Core rev: 6e98fdf7832fed3d93645ed69f62c8df5e89b96b) Signed-off-by: Richard Purdie (cherry picked from commit 3859f49db2d694c7b63fdbe25be0018afba5c738) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bootchart2: Add missing python3-math dependency

2022-03-09T17:30:49+00:00

Without this dependency, generating the bootchart may fail with: " ModuleNotFoundError: No module named 'random' " (cherry picked from commit 487e9f16a00f895159b79f1865fe8b626b47ddc2) (From OE-Core rev: 123d4a673dadfee14d5ad8bbc503405da9602bb0) Signed-off-by: Marek Vasut Cc: Mingli Yu Cc: Richard Purdie Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: fix CVE-2022-23772

2022-03-09T17:30:48+00:00

math/big: prevent large memory consumption in Rat.SetString An attacker can cause unbounded memory growth in a program using (*Rat).SetString due to an unhandled overflow. Upstream-Status: Backport [https://go.dev/issue/50699] CVE: CVE-2022-23772 (From OE-Core rev: e4d15040f62744265b9236ad7276f3371a9172da) Signed-off-by:Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: fix CVE-2022-23806

2022-03-09T17:30:48+00:00

crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values. Upstream-Status: Backport [https://go.dev/issue/50974] CVE: CVE-2022-23806 (From OE-Core rev: eb7aa0929ecd712aeeec0ff37dfb77c3da33b375) Signed-off-by:Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: 2.7.4 -> 2.7.5

2022-03-02T00:21:36+00:00

This release includes security fixes. CVE-2021-41817: Regular Expression Denial of Service Vulnerability of Date Parsing Methods CVE-2021-41816: Buffer Overrun in CGI.escape_html CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse (From OE-Core rev: a7935c9c4a47098f0c1b2eefdf7773bd85891945) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: fix DEPENDS append

2022-02-23T23:43:43+00:00

recent change create a blank scope of DEPENDS for class-target, basically leaving out all general dependencies, leading to the effect that ruby will be shipped without the runtime dependencies of zlib, openssl and libffi, making the corresponding gems unusable at runtime. As the class-target scope should be appended only the correct override is append:class-target (From OE-Core rev: 81fab225daf798792c139f669f5bfd96d9fd25a8) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie (cherry picked from commit 8f92444d388d2406be7d317578908975784d3f22) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: correctly set native/target dependencies

2022-02-23T23:43:42+00:00

In particular libffi was missing from native, which led to linking with host libffi instead. (From OE-Core rev: 61e38b71566183e329d980e26fe8ffe8d331c3a1) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 293c9f879252a814107579542e8fca9af9dde599) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cmake: remove bogus CMAKE_LDFLAGS_FLAGS definition from toolchain file

2022-02-23T23:43:42+00:00

As discussion in [YOCTO #14717] cmake contains a OEToolchainConfig.cmake file to configure the toolchain correctly in cross-compile build for recipes using cmake. The variable CMAKE_LDFLAGS_FLAGS is spelled incorrectly, cmake expects CMAKE_SHARED_LINKER_FLAGS, CMAKE_STATIC_LINKER_FLAGS, CMAKE_EXE_LINKER_FLAGS and CMAKE_MODULE_LINKER_FLAGS to be set instead. As cmake already correctly initializes these from environment there is no need to specify the linker flags in the toolchain file at all. So this just removes the variable, as its value was also set wrong. (From OE-Core rev: cf17fc284bcffe1d5b0797c733bcc2eb293a5d8f) Signed-off-by: Martin Beeger Signed-off-by: Richard Purdie (cherry picked from commit 52e59a5b37f55905ee693a99f9ffc34ed41b4283) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

rpm: fix intermittent compression failure in do_package_write_rpm

2022-02-23T23:43:42+00:00

rpmbuild can start processing random memory when processing the value provided by XZ_THREADS, and unintentionally disable encoding for a file descriptor that in fact requires encoding to be enabled in order for lzwrite() to actually create an rpm. *** Fdopen(0x7f2030002b30,w6T16.xzdio) | fdio 23 fp (nil) ==> lzopen_internal("w6T16", 23, 1) ==> lzopen_internal set encoding ==> lzopen_internal clear encoding ==> Fdopen(0x7f2030002b30,"w6T16.xzdio") returns fd 0x7f2030002b30 | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil) ==> lzwrite(0x7f2030004e30, 0x7f20789d8070, 6) encoding 0 ==> Fwrite(0x7f2030002b30,0x7f20789d8070,6) rc -1 | xzdio 0x7f2030004e30 fp 23 | fdio -1 fp (nil) error: create archive failed: cpio: write When the encoding bit gets cleared on the LZFILE* struct, lzwrite() then rightfully complains when it detects !lzfile->encoding, which then gets bubbled up as a write failure when we go to create the archive. This fix is available in the rpm 4.17-release. (From OE-Core rev: b093005d31467d89b00af621f86eb5cac7f845af) Signed-off-by: Kyle Russell Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

binutils: Fix CVE-2021-45078

2022-02-23T23:43:42+00:00

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=161e87d12167b1e36193385485c1f6ce92f74f02] (From OE-Core rev: be665a2279795c522cb3e3e700ea747efd885f95) (From OE-Core rev: 9793eac0988f10ec2e4cbe0e4fc494ff4dd29585) Signed-off-by: Sundeep KOKKONDA Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie (cherry picked from commit 823d25f5218836fb4298482366fbc5d05d822907) Signed-off-by: Purushottam Choudhary Signed-off-by: Purushottam Choudhary Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie