linux/poky.git/meta/recipes-extended/cpio, branch 2.6_M3

cpio: fix CVE-2016-2037

2018-06-15T16:56:24+00:00

"The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file." https://nvd.nist.gov/vuln/detail/CVE-2016-2037 Note that there appear to be two versions of this fix. The original patch posted to the bug-cpio mailing list [1] is used by Debian [2], but apparently causes regression [3]. The patch accepted to the upstream git repo [4] seems to be the most complete fix. [1] https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html [2] https://security-tracker.debian.org/tracker/CVE-2016-2037 [3] https://www.mail-archive.com/bug-cpio@gnu.org/msg00584.html [4] http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=d36ec5f4e93130efb24fb9678aafd88e8070095b (From OE-Core rev: f170288ac706126e69a504a14d564b2e5c3513e4) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: rely on texinfo.bbclass for texinfo-native dependency

2018-06-15T16:56:24+00:00

(From OE-Core rev: 7dad119dd0ee82b14a82b2a0b5a89f790e3bc007) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: move contents of cpio_v2.inc into the cpio recipe

2018-06-15T16:56:24+00:00

Merge contents of cpio_v2.inc into the only recipe which uses it. (From OE-Core rev: 162ff3871779d646dadc7e7287f4667641d6e612) Signed-off-by: Andre McCurdy Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

recipes: Move out stale GPLv2 versions to a seperate layer

2017-03-07T20:05:31+00:00

These are recipes where the upstream has moved to GPLv3 and these old versions are the last ones under the GPLv2 license. There are several reasons for making this move. There is a different quality of service with these recipes in that they don't get security fixes and upstream no longer care about them, in fact they're actively hostile against people using old versions. The recipes tend to need a different kind of maintenance to work with changes in the wider ecosystem and there needs to be isolation between changes made in the v3 versions and those in the v2 versions. There are probably better ways to handle a "non-GPLv3" system but right now having these in OE-Core makes them look like a first class citizen when I believe they have potential for a variety of undesireable issues. Moving them into a separate layer makes their different needs clearer, it also makes it clear how many of these there are. Some are probably not needed (e.g. mc), I also wonder whether some are useful (e.g. gmp) since most things that use them are GPLv3 only already. Someone could now more clearly see how to streamline the list of recipes here. I'm proposing we mmove to this separate layer for 2.3 with its future maintinership and testing to be determined in 2.4 and beyond. (From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b) Signed-off-by: Richard Purdie

meta: use require instead of include when file should exist

2017-01-09T13:39:11+00:00

If the file is expected to exist, then we should always be using require so that if it doesn't we get an error rather than some other more obscure failure later on. (From OE-Core rev: 603ae6eb487489e65da69c68e532cb767ccc1fc2) Signed-off-by: Paul Eggleton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: Add native variant

2016-05-30T14:58:11+00:00

(From OE-Core rev: fb3457a454b045abf1fa6b560b8f96257a4405c1) Signed-off-by: Mariano Lopez Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

Add "CVE:" tag to current patches in OE-core

2016-01-11T23:26:32+00:00

The currnet patches in OE-core doesn't have the "CVE:" tag, now part of the policy of the patches. This is patch add this tag to several patches. There might be patches that I miss; the tag can be added in the future. (From OE-Core rev: 065ebeb3e15311d0d45385e15bf557b1c95b1669) Signed-off-by: Mariano Lopez Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: update to 2.12

2015-12-16T12:12:17+00:00

Drop backported patches: Fix-symlink-bad-length-test-for-64-bit-architectures.patch fix-memory-overrun.patch fix-testcase-symlink-bad-lengths.patch 0001-fix-testcase-of-symlink-bad-length.patch statdef.patch is fixing code that doesn't exist anymore. The problem handled by remove-gets.patch has been fixed differently. The CVE-2015-1197 has been ignored by upstream and had to be rebased: http://lists.gnu.org/archive/html/bug-cpio/2015-09/msg00007.html (From OE-Core rev: feeaa86eb8b1071d56eb6d7ad7120aa389c736a0) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: fix test case of symlink-bad-length

2015-12-12T23:42:52+00:00

(From OE-Core rev: 7e2f2bc55a1b367503ab75ac6863f56d662c34cc) Signed-off-by: Chen Qi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cpio: fix testcase symlink-bad-lengths [ LIN8-947 ]

2015-11-16T11:39:29+00:00

* fix the output of stderr & stdout to meet latest cpio (From OE-Core rev: 80d12c734ad0c1d86ee5b0c6639c4e840dc6dfad) Signed-off-by: Jun Zhang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie