From c5b151f59f3d339b0b0bf390f1b3fe8c4d48d40d Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Wed, 28 Dec 2022 08:37:18 +0100 Subject: libarchive: upgrade 3.6.1 -> 3.6.2 Libarchive 3.6.2 is a bugfix and security release. Important security fixes: NULL pointer dereference vulnerability in archive_write.c (#1754, #1759, CVE-2022-36227) Important bug fixes: include ZSTD in Windows builds (#1688) SSL fixes on Windows (#1714, #1723, #1724) rar5 reader: fix possible garbled output with bsdtar -O (#1745) mtree reader: support reading mtree files with tabs (#1783) various small fixes for issues found by CodeQL Use --without-iconv as otherwise autotools write a bogus iconv dependency into .pc file. (From OE-Core rev: 4dd785cc05fd57f6cce8838cca7379c6e0bfd15c) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit edce1bce81fe2f47fb2c5e2b94ebda73f95cbaea) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- ...Do-not-include-sys-mount.h-when-linux-fs..patch | 47 --------------- .../libarchive/libarchive/CVE-2022-36227.patch | 42 ------------- .../libarchive/libarchive_3.6.1.bb | 70 ---------------------- .../libarchive/libarchive_3.6.2.bb | 67 +++++++++++++++++++++ 4 files changed, 67 insertions(+), 159 deletions(-) delete mode 100644 meta/recipes-extended/libarchive/libarchive/0001-libarchive-Do-not-include-sys-mount.h-when-linux-fs..patch delete mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch delete mode 100644 meta/recipes-extended/libarchive/libarchive_3.6.1.bb create mode 100644 meta/recipes-extended/libarchive/libarchive_3.6.2.bb (limited to 'meta') diff --git a/meta/recipes-extended/libarchive/libarchive/0001-libarchive-Do-not-include-sys-mount.h-when-linux-fs..patch b/meta/recipes-extended/libarchive/libarchive/0001-libarchive-Do-not-include-sys-mount.h-when-linux-fs..patch deleted file mode 100644 index 0d21799682..0000000000 --- a/meta/recipes-extended/libarchive/libarchive/0001-libarchive-Do-not-include-sys-mount.h-when-linux-fs..patch +++ /dev/null @@ -1,47 +0,0 @@ -From a2f68263a1da5ad227bcb9cd8fa91b93c8b6c99f Mon Sep 17 00:00:00 2001 -From: Khem Raj -Date: Mon, 25 Jul 2022 10:56:53 -0700 -Subject: [PATCH] libarchive: Do not include sys/mount.h when linux/fs.h is - present - -These headers are in conflict and only one is needed by -archive_read_disk_posix.c therefore include linux/fs.h if it exists -otherwise include sys/mount.h - -It also helps compiling with glibc 2.36 -where sys/mount.h conflicts with linux/mount.h see [1] - -[1] https://sourceware.org/glibc/wiki/Release/2.36 - -Upstream-Status: Submitted [https://github.com/libarchive/libarchive/pull/1761] -Signed-off-by: Khem Raj ---- - libarchive/archive_read_disk_posix.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/libarchive/archive_read_disk_posix.c b/libarchive/archive_read_disk_posix.c -index 2b39e672..a96008db 100644 ---- a/libarchive/archive_read_disk_posix.c -+++ b/libarchive/archive_read_disk_posix.c -@@ -34,9 +34,6 @@ __FBSDID("$FreeBSD$"); - #ifdef HAVE_SYS_PARAM_H - #include - #endif --#ifdef HAVE_SYS_MOUNT_H --#include --#endif - #ifdef HAVE_SYS_STAT_H - #include - #endif -@@ -54,6 +51,8 @@ __FBSDID("$FreeBSD$"); - #endif - #ifdef HAVE_LINUX_FS_H - #include -+#elif HAVE_SYS_MOUNT_H -+#include - #endif - /* - * Some Linux distributions have both linux/ext2_fs.h and ext2fs/ext2_fs.h. --- -2.25.1 - diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch deleted file mode 100644 index d0d143710c..0000000000 --- a/meta/recipes-extended/libarchive/libarchive/CVE-2022-36227.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b5332ed6d59ba5113a0a2c67fd82b69fcd5cde68 Mon Sep 17 00:00:00 2001 -From: obiwac -Date: Fri, 22 Jul 2022 22:41:10 +0200 -Subject: [PATCH] libarchive: CVE-2022-36227 Handle a `calloc` returning NULL - (fixes #1754) - -Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5] -CVE: CVE-2022-36227 -Signed-off-by: Hitendra Prajapati archive = _a; - f->state = ARCHIVE_WRITE_FILTER_STATE_NEW; - if (a->filter_first == NULL) -@@ -548,6 +552,10 @@ archive_write_open2(struct archive *_a, void *client_data, - a->client_data = client_data; - - client_filter = __archive_write_allocate_filter(_a); -+ -+ if (client_filter == NULL) -+ return (ARCHIVE_FATAL); -+ - client_filter->open = archive_write_client_open; - client_filter->write = archive_write_client_write; - client_filter->close = archive_write_client_close; --- -2.25.1 - diff --git a/meta/recipes-extended/libarchive/libarchive_3.6.1.bb b/meta/recipes-extended/libarchive/libarchive_3.6.1.bb deleted file mode 100644 index 79e13e514f..0000000000 --- a/meta/recipes-extended/libarchive/libarchive_3.6.1.bb +++ /dev/null @@ -1,70 +0,0 @@ -SUMMARY = "Support for reading various archive formats" -DESCRIPTION = "C library and command-line tools for reading and writing tar, cpio, zip, ISO, and other archive formats" -HOMEPAGE = "http://www.libarchive.org/" -SECTION = "devel" -LICENSE = "BSD-2-Clause" -LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665" - -DEPENDS = "e2fsprogs-native" - -PACKAGECONFIG ?= "zlib bz2 xz zstd" - -PACKAGECONFIG:append:class-target = "\ - ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)} \ -" - -DEPENDS_BZIP2 = "bzip2-replacement-native" -DEPENDS_BZIP2:class-target = "bzip2" - -PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl," -PACKAGECONFIG[xattr] = "--enable-xattr,--disable-xattr,attr," -PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib," -PACKAGECONFIG[bz2] = "--with-bz2lib,--without-bz2lib,${DEPENDS_BZIP2}," -PACKAGECONFIG[xz] = "--with-lzma,--without-lzma,xz," -PACKAGECONFIG[openssl] = "--with-openssl,--without-openssl,openssl," -PACKAGECONFIG[libxml2] = "--with-xml2,--without-xml2,libxml2," -PACKAGECONFIG[expat] = "--with-expat,--without-expat,expat," -PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo," -PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," -PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," -PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls," -PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd," - -EXTRA_OECONF += "--enable-largefile" - -SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ - file://0001-libarchive-Do-not-include-sys-mount.h-when-linux-fs..patch \ - file://CVE-2022-36227.patch \ - " -UPSTREAM_CHECK_URI = "http://libarchive.org/" - -SRC_URI[sha256sum] = "c676146577d989189940f1959d9e3980d28513d74eedfbc6b7f15ea45fe54ee2" - -inherit autotools update-alternatives pkgconfig - -CPPFLAGS += "-I${WORKDIR}/extra-includes" - -do_configure[cleandirs] += "${WORKDIR}/extra-includes" -do_configure:prepend() { - # We just need the headers for some type constants, so no need to - # build all of e2fsprogs for the target - cp -R ${STAGING_INCDIR_NATIVE}/ext2fs ${WORKDIR}/extra-includes/ -} - -ALTERNATIVE_PRIORITY = "80" - -PACKAGES =+ "bsdtar" -FILES:bsdtar = "${bindir}/bsdtar" - -ALTERNATIVE:bsdtar = "tar" -ALTERNATIVE_LINK_NAME[tar] = "${base_bindir}/tar" -ALTERNATIVE_TARGET[tar] = "${bindir}/bsdtar" - -PACKAGES =+ "bsdcpio" -FILES:bsdcpio = "${bindir}/bsdcpio" - -ALTERNATIVE:bsdcpio = "cpio" -ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio" -ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta/recipes-extended/libarchive/libarchive_3.6.2.bb b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb new file mode 100644 index 0000000000..f447035b67 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb @@ -0,0 +1,67 @@ +SUMMARY = "Support for reading various archive formats" +DESCRIPTION = "C library and command-line tools for reading and writing tar, cpio, zip, ISO, and other archive formats" +HOMEPAGE = "http://www.libarchive.org/" +SECTION = "devel" +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://COPYING;md5=d499814247adaee08d88080841cb5665" + +DEPENDS = "e2fsprogs-native" + +PACKAGECONFIG ?= "zlib bz2 xz zstd" + +PACKAGECONFIG:append:class-target = "\ + ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)} \ +" + +DEPENDS_BZIP2 = "bzip2-replacement-native" +DEPENDS_BZIP2:class-target = "bzip2" + +PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl," +PACKAGECONFIG[xattr] = "--enable-xattr,--disable-xattr,attr," +PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib," +PACKAGECONFIG[bz2] = "--with-bz2lib,--without-bz2lib,${DEPENDS_BZIP2}," +PACKAGECONFIG[xz] = "--with-lzma,--without-lzma,xz," +PACKAGECONFIG[openssl] = "--with-openssl,--without-openssl,openssl," +PACKAGECONFIG[libxml2] = "--with-xml2,--without-xml2,libxml2," +PACKAGECONFIG[expat] = "--with-expat,--without-expat,expat," +PACKAGECONFIG[lzo] = "--with-lzo2,--without-lzo2,lzo," +PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," +PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," +PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls," +PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd," + +EXTRA_OECONF += "--enable-largefile --without-iconv" + +SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz" +UPSTREAM_CHECK_URI = "http://libarchive.org/" + +SRC_URI[sha256sum] = "ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f19b9b3" + +inherit autotools update-alternatives pkgconfig + +CPPFLAGS += "-I${WORKDIR}/extra-includes" + +do_configure[cleandirs] += "${WORKDIR}/extra-includes" +do_configure:prepend() { + # We just need the headers for some type constants, so no need to + # build all of e2fsprogs for the target + cp -R ${STAGING_INCDIR_NATIVE}/ext2fs ${WORKDIR}/extra-includes/ +} + +ALTERNATIVE_PRIORITY = "80" + +PACKAGES =+ "bsdtar" +FILES:bsdtar = "${bindir}/bsdtar" + +ALTERNATIVE:bsdtar = "tar" +ALTERNATIVE_LINK_NAME[tar] = "${base_bindir}/tar" +ALTERNATIVE_TARGET[tar] = "${bindir}/bsdtar" + +PACKAGES =+ "bsdcpio" +FILES:bsdcpio = "${bindir}/bsdcpio" + +ALTERNATIVE:bsdcpio = "cpio" +ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio" +ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio" + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf