Commit Graph

40448 Commits

Author SHA1 Message Date
Baruch Siach
2f8d885b62 package/libgpg-error: bump to version 1.33
The syscfg header name is now based on the target triplet, with the
vendor part set to "unknown". The symlink approach no longer works since
we use "buildroot" for the vendor part. Override the target host
configure parameter to match the build system expectation.

The x86 header vendor part has been renamed to "unknown" as well.
Account for that in BR2_PACKAGE_LIBGPG_ERROR_SYSCFG.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e58b5b1b93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:51:39 +01:00
Baruch Siach
e8a43fb2ed libgpg-error: bump to version 1.32
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 00f879faf5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:51:23 +01:00
Baruch Siach
cfe096ee60 libgpg-error: bump to version 1.31
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9788ecc7fd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:50:52 +01:00
Baruch Siach
ad444c2557 package/openssh: add upstream security fix
Fixes CVE-2018-20685: The scp client allows server to modify permissions
of the target directory by using empty ("D0777 0 \n") or dot ("D0777 0
.\n") directory name.

The bug reporter lists a number of related vulnerabilities that are not
fixed yet:

  https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8233c66612)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:26:39 +01:00
Baruch Siach
44b86a7e1a openssh: bump to version 7.9p1
Drop patch #1. uClibc no longer includes pthreads.h indirectly.

Drop patch #2. The sys/param.h header is included indirectly through the
local includes.h header since version 6.8p1.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 458ad4d7b6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:26:01 +01:00
Fabrice Fontaine
8967a17894 package/cc-tool: drop BR2_PACKAGE_BOOST_SIGNALS select
cc-tool depends on signals2 not signals, indeed only signals2 is used
in src/data/progress_watcher.h and BOOST_SIGNALS defined in
m4/boost.m4 is never used in configure.ac.

There is no need to select any sort of BR2_PACKAGE_BOOST_SIGNALS2
option, as signals2 is a header-only boost library, and such
header-only boost libraries do not have any Config.in options, as they
are all always installed with the base boost library.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Thomas: tweak commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 024ed470ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:18:56 +01:00
Asaf Kahlon
e2d0f6bff8 package/python-pyyaml: security bump to 4.2b4
Fixes CVE-2017-18342: In PyYAML before 4.1, the yaml.load() API
could execute arbitrary code.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1cf071726d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:14:45 +01:00
Yegor Yefremov
bfc00651e9 python-pyyaml: bump to version 3.13
Fixes:
http://autobuild.buildroot.net/results/e71/e715a7dc8b6856b4aba0b9b4568d61420c52a5c8

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fbe289f145)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:14:33 +01:00
Peter Seiderer
e7c0363e7e boot/barebox: change download site to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2cf0688647)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:51:45 +01:00
Yann E. MORIN
ee512e587a infra/pkg-cmake: use an obviously-invalid value for CMAKE_SYSTEM_VERSION
In 36568732e4, we expanded toolchain.cmake to also define the value for
CMAKE_SYSTEM_VERSION, as the cmake documentation states that it must be
manually defined when doing cross-compilation [0]:

    When the CMAKE_SYSTEM_NAME variable is set explicitly to enable
    cross compiling then the value of CMAKE_SYSTEM_VERSION must also
    be set explicitly to specify the target system version.

However, the fix in 36568732e4 uses the version of the kernel headers,
assuming that would be the oldest kernel we could run on. Yet, this is
not the case, because glibc (for example) has fallbacks to support
running on kernels older than the headers it was built against.

The cmake official wiki [1] additionally states:

  * CMAKE_SYSTEM_VERSION : optional, version of your target system, not
    used very much.

Folllowed a little bit below, by:

  * CMAKE_TOOLCHAIN_FILE : absolute or relative path to a cmake script
    which sets up all the toolchain related variables mentioned above

    For instance for crosscompiling from Linux to Embedded Linux on PowerPC
    this file could look like this:

        # this one is important
        SET(CMAKE_SYSTEM_NAME Linux)
        #this one not so much
        SET(CMAKE_SYSTEM_VERSION 1)

    [...]

Furthermore, using the kernel headers version can be a bit misleading (as
it really looks like is is the correct version to use when it is not),
while it is obvious that 1 is not really the output of `uname -r` and
thus is definitely not misleading.

Finally, random searches [2] about CMAKE_SYSTEM_VERSION, mostly only
turns up issues related with Windows, Mac-OS, and to a lesser extent,
Android (where it is forcibly set to 1), with issues realted to running
under just Linux (as opposed to Adnroid) mostly non-existent.

Consequently, we revert to using the value that is suggested in the
cmake WiKi, i.e. 1, and which is basically what we also used as a
workaround in the azure-iot-sdk-c paclkage up until d300b1d3b1.

A case were we will need to have a real kernel version, is if we one day
have a cmake-based pacakge that builds and installs a kernel module [3],
because it will need the _running_ kernel version to install it in
/lib/modules/VERSION/, but in that case it will anyway most probably
not be the headers version.

[0] https://cmake.org/cmake/help/v3.8/variable/CMAKE_SYSTEM_VERSION.html
[1] https://gitlab.kitware.com/cmake/community/wikis/doc/cmake/CrossCompiling
[2] https://duckduckgo.com/?q=CMAKE_SYSTEM_VERSION
[3] https://stackoverflow.com/questions/38205745/cmake-system-version-not-updated-for-new-kernel

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Samuel Martin <s.martin49@gmail.com>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fc8a5f56b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:48:22 +01:00
Arnout Vandecappelle (Essensium/Mind)
f82541bb8b package/pkg-cmake: add CMAKE_SYSTEM_VERSION to toolchainfile.cmake
Quoting the CMake documentation:

  When the CMAKE_SYSTEM_NAME variable is set explicitly to enable cross
  compiling then the value of CMAKE_SYSTEM_VERSION must also be set
  explicitly to specify the target system version.

Thus, we should also set CMAKE_SYSTEM_VERSION in toolchainfile.cmake. It
is supposed to be set to the value of `uname -r` on the target. We don't
have that exact value available (unless we build the kernel), but the
value of BR2_TOOLCHAIN_HEADERS_AT_LEAST contains the (minimum) version
of the kernel it will run on, so it should be OK for all practical
purposes.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 36568732e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:48:08 +01:00
Thomas Petazzoni
897ac7f65e package/libsquish: re-enable for BR2_STATIC_LIBS configuration
Since the bump to version 1.15, libsquish can conditionally
build/install its shared library, which makes it possible to re-enable
this package for BR2_STATIC_LIBS configurations.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ae4b9e4afb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:46:01 +01:00
Romain Naour
02401f9ea1 package/libsquish: really install shared library
While testing the new supertuxkart 0.10-beta1 version, the build
failed due to missing libsquash shared library.

Indeed, by default (see config file) the shared library is not build
and all symlinks created by LIBSQUISH_INSTALL_{STAGING,TARGET}_CMDS
are curently broken.

To fix that, add USE_SHARED=1 to LIBSQUISH_MAKE_ENV.

Also add a patch to allow reinstall the package.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b621273755)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:45:53 +01:00
Romain Naour
bf376e8b60 package/libsquish: add license file hash
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9b377e9dcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:45:48 +01:00
Fabrice Fontaine
9dde1779fc package/gnuchess: license is GPL-3.0+, not GPL-2.0+
gnuchess is licensed under GPL-3.0+ not GPL-2.0+, also add hash for
license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ef25d13fc7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:28:20 +01:00
Arnout Vandecappelle (Essensium/Mind)
b4d94bf61f patchelf: update _SITE to new location
releases.nixos.org gives some weird XML pages. The upstream location is
nixos.org/releases.

This side uses HSTS, so switch to https to avoid a needless redirect.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2fa462426)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:27:10 +01:00
Peter Korsgaard
1f5fa0a31a package/lighttpd: adjust hash comment after 1.4.52 bump
Commit ec69d3820f (package/lighttpd: bump to version 1.4.52) bumped the
lighttpd version but forgot to adjust the upstream hash comment.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b99b09caee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:26:01 +01:00
Peter Korsgaard
61d2187ccc package/lighttpd: bump to version 1.4.52
Fixes location header parsing regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2918

Fixes header setting regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2919

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ec69d3820f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:25:58 +01:00
Peter Korsgaard
fcb7386526 {linux, linux-headers}: bump 4.{9, 14, 19, 20}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 78f0c1fe4a)
[Peter: drop 4.19.x/4.20.x, linux / hash changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:21:09 +01:00
Peter Korsgaard
6430aa503c package/xenomai: drop consecutive empty lines
Commit 4219c58c (xenomai: remove unnecessary autoreconf) introduced a
check-package warning:

1 warnings generated
package/xenomai/xenomai.mk:27: consecutive empty lines

https://gitlab.com/buildroot.org/buildroot/-/jobs/143155797

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d2e1617ccc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:37:26 +01:00
Thomas De Schampheleire
3a4bf18f35 xenomai: remove unnecessary autoreconf
As xenomai release tarballs ship with a configure script, there is only a
need for autoreconfiguring when patches are applied.

The last patch was removed with git commit
de993bc23a but the AUTORECONF line remained.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4219c58c38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:36:46 +01:00
Baruch Siach
2e9e8a55de tcpreplay: security bump to version 4.3.1
Upstream CHANGELOG entry for 4.3.0 lists these fixes:

    - CVE-2018-18408 use-after-free in post_args (#489)
    - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)
    - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486)
    - CVE-2018-17580 heap-buffer-overflow fast_edit_packet (#485)
    - CVE-2018-17582 heap-buffer-overflow in get_next_packet (#484)
    - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477 dup #408)

Drop tr_cv_libpcap_version and ac_cv_have_bpf; unused in current
configure script.

Make configure script use pcap-config to list library dependencies.
Unfortunately, pcap-config is not entirely correct, so we still need to
set the LIBS variable for static linking.

Use the smaller tar.xz archive.

Add license file hash.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f5961ff56a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:30:16 +01:00
Carlos Santos
fd719e566c package/liburiparser: security bump to version 0.9.1
Fixes an out-of-bounds read, the parsing of some a malformed URIs and a
function that reported 1 more byte than actually needed for IPv4 address
URIs. For additional datails, see

    https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 518eb53ec5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:27:19 +01:00
Peter Korsgaard
208610dbef Makefile, manual, website: Bump copyright year
Happy 2019!

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8e928a8389)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:26:30 +01:00
Peter Korsgaard
c0ea5c0ea2 package/python-django: security bump to version 1.11.18
Fixes CVE-2019-3498: Content spoofing possibility in the default 404 page

For more details, see the announcement:
https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:20:24 +01:00
Peter Korsgaard
15b07c5904 utils/get-developers: really make it callable from elsewhere than the toplevel directory
Commit 62d5558f76 (utils/get-developers: make it callable from elsewhere
than the toplevel directory) tried to fix this by passing in the toplevel
directory when the DEVELOPERS file is parsed.

Unfortunately this is not enough, as E.G.  also the paths listed in the
patches are relative to the toplevel directory, causing it to not match the
entries in the DEVELOPERS file.

In concept this can be fixed by also passing the toplevel directory to the
Developers class, but the simplest solution is just to chdir to the toplevel
Buildroot directory before calling any of the getdeveloperlib functions.

This does require us to finish parsing command line arguments (which opens
the provided patch files) to not get into trouble with relative paths to
patches before chdir'ing / initializing getdeveloperlib.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 45aabcddc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:47 +01:00
Peter Korsgaard
d1f49e7560 Revert "utils/get-developers: make it callable from elsewhere than the toplevel directory"
This reverts commit 62d5558f76.

This actually does not work, as patches contain paths relative to the
toplevel directory as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74fbc20504)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:42 +01:00
Peter Korsgaard
c433d6b97a package/nodejs: bump version to v8.15.0
Fixes regressions introduced by the v8.14.0 security release.  From the
announcement:

The 8.14.0 security release introduced some unexpected breakages on the 8.x
release line.  This is a special release to fix a regression in the HTTP
binary upgrade response body and add a missing CLI flag to adjust the max
header size of the http parser.

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f68e5cf72)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:55:08 +01:00
Peter Korsgaard
198c799595 package/libhttpparser: bump version to v2.9.0
Needed by nodejs v8.15.0+

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a02ce33aa5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:54:59 +01:00
Fabrice Fontaine
5185c4c594 libhttpparser: bump to version 1.8.1
Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ff3d6c414b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:54:48 +01:00
Thomas De Schampheleire
bb938aed2c docs/manual: fix typo get-developer (-> get-developers)
The script is utils/get-developers but the manual refers to get-developer in
several places.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81aeab60cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:50:40 +01:00
Peter Korsgaard
15f373aff8 docs/manual: document the new get-developers -e option
Explain how this can be used with git send-email, and how git can be
configured to use it automatically.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 507d56a6be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:50:36 +01:00
Peter Korsgaard
82231c4176 package/linux-headers: bump 4.{4, 9, 14, 19}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5bbc472463)
[Peter: drop 4.19.x, linux / hash changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:29:20 +01:00
Thomas Petazzoni
39d4c7c4a4 package/lua-msgpack-native: adjust Config.in comment
The Config.in comment of lua-msgpack-native only indicates that it
needs Lua 5.1, while the package can actually build with LuaJIT. This
commit adjusts the comment to match the reality.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6141506760)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:12:51 +01:00
Grégoire Delattre
6140d6762b board/pc: ensure grub.cfg is copied to target filesystem
Before this commit, the grub configuration file was copied to the
TARGET_DIR in a post-image hook, after the filesystem has been
generated. It was kinda working because the board/pc's grub
configuration and the default one are the same and the later was
copied during the build process of the grub2 package.

This commit ensures the custom board/pc grub configuration is copied at
the right time.

Signed-off-by: Grégoire Delattre <gregoire.delattre@gmail.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0b28397a9b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:18:26 +01:00
Peter Korsgaard
03c9b123e6 package/wireshark: security bump to version 2.6.6
Fixes the following security vulnerabilities:

- wnpa-sec-2019-01 The 6LoWPAN dissector could crash. Bug 15217. CVE-2019-5716
  https://www.wireshark.org/security/wnpa-sec-2019-01

- wnpa-sec-2019-02 The P_MUL dissector could crash. Bug 15337. CVE-2019-5717
  https://www.wireshark.org/security/wnpa-sec-2019-02

- wnpa-sec-2019-03 The RTSE dissector and other dissectors could crash.  Bug
  15373.  CVE-2019-5718
  https://www.wireshark.org/security/wnpa-sec-2019-03

- wnpa-sec-2019-04 The ISAKMP dissector could crash. Bug 15374. CVE-2019-5719
  https://www.wireshark.org/security/wnpa-sec-2019-04

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cd232aefc9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:07:08 +01:00
Peter Korsgaard
3f5c1f8246 package/wireshark: security bump to version 2.6.5
The following vulnerabilities have been fixed:

- wnpa-sec-2018-51 The Wireshark dissection engine could crash. Bug 14466. CVE-2018-19625.
- wnpa-sec-2018-52 The DCOM dissector could crash. Bug 15130. CVE-2018-19626.
- wnpa-sec-2018-53 The LBMPDM dissector could crash. Bug 15132. CVE-2018-19623.
- wnpa-sec-2018-54 The MMSE dissector could go into an infinite loop. Bug 15250. CVE-2018-19622.
- wnpa-sec-2018-55 The IxVeriWave file parser could crash. Bug 15279. CVE-2018-19627.
- wnpa-sec-2018-56 The PVFS dissector could crash. Bug 15280. CVE-2018-19624.
- wnpa-sec-2018-57 The ZigBee ZCL dissector could crash. Bug 15281. CVE-2018-19628.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2ec38321d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:06:56 +01:00
Fabrice Fontaine
0af2651146 wireshark: fix static build
Don't give a path in --with-pcap option otherwise PCAP_CONFIG won't be
used (see AC_WIRESHARK_PCAP_CHECK in acinclude.m4) to retrieve pcap
static dependencies such as -lnl-3 and as a result pcap detection will
fail

Fixes:
 - http://autobuild.buildroot.org/results/084354a33825cf4e723e0a9f1e9656ad2a212a15

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fecf82a166)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:06:37 +01:00
Fabrice Fontaine
55d9c073b2 wireshark: disable build of user guide
--disable-guides has been added since version 2.5.0:
aa04d2355e

Fixes:
 - http://autobuild.buildroot.org/results/5ae6d46573942713687f4e659b3eaf0b768ebc71

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 92c32d3890)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:05:47 +01:00
Fabrice Fontaine
d1bfd5f7c1 wireshark: bump to version 2.6.4
- Remove first patch (inet_pton test removed since version 2.5.0 and
  12d63c428f)
- Remove second patch (already in version, since
  3761ef3785)
- Remove WIRESHARK_AUTORECONF=yes as configure.ac is not patched anymore
- gcrypt is a mandatory dependency since version 2.4.0 and
  6b84ddee83
- geoip support has been replaced by maxminddb since version 2.5.0 and
  a1da75c554
- Drop includedir "hack", this is not needed anymore and wireshark is
  now installing files in target. With this hack, build fails on:
  wireshark: installs files in /home/fabrice/buildroot/output/target//home/fabrice/buildroot/output
  package/pkg-generic.mk:310: recipe for target '/home/fabrice/buildroot/output/build/wireshark-2.6.4/.stamp_target_installed' failed
- Disable all new optional features

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Arnout: keep optional dependencies alphabetic on Config.in name;
         add comment of libgcrypt -> libgpg-error dependency.]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

(cherry picked from commit 72bafd5e45)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:41:02 +01:00
Fabrice Fontaine
9e055a17a3 package/wireshark: add lua optional dependency
- lua 5.3 or luajit is not supported
- Don't specify the path to find lua as pkgconfig is used for lua
  (this is not the case for the other options)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fb59a8857e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:37:47 +01:00
Fabrice Fontaine
eba8328652 package/wireshark: add libssh optional dependency
- Optional dependency to libssh has been added with version 2.2.1 and
  d6da95231e
- Specify the path to found libssh as this is done for other options

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 69c38e27a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:37:15 +01:00
Trent Piepho
89084e988c package/rauc: target rauc needs unsquashfs at runtime
In order to provide info about a bundle file, e.g. running "rauc info
bundle.raucb", rauc needs to use the unsquashfs progam from the squashfs
package.

This was not documented until upstream commit 10c501c12752 ("docs:
integration: document need for 'unsquashfs' tool for 'rauc info'"), but
is already present in rauc.

Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4a4dba21b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:32:17 +01:00
Peter Korsgaard
95317402ef package/sqlite: security bump to version 3.25.3
Fixes CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is
enabled, encounters an integer overflow (and resultant buffer overflow) for
FTS3 queries that occur after crafted changes to FTS3 shadow tables,
allowing remote attackers to execute arbitrary code by leveraging the
ability to run arbitrary SQL statements (such as in certain WebSQL use
cases), aka Magellan.

For more details, see:
https://blade.tencent.com/magellan/index_en.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4475c0a57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:22:32 +01:00
Fabrice Fontaine
abd02280c2 sqlite: fix build without threads
If threads are not available, set SQLITE_THREADSAFE to 0.
Indeed, since version 3.25.0, the following line:
THREADSAFE_FLAGS=-DSQLITE_THREADSAFE=0
has been removed from configure.ac
As a result, SQLITE_THREADSAFE will be set to a default value of 1 even
if --disable-threadsafe is set

Fixes:
 - http://autobuild.buildroot.org/results/70b1582edcb787746e4483e80b27f86ac781f0fa

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d3143409ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:22:20 +01:00
Ferdinand van Aartsen
9d43424565 sqlite: bump to version 3.25.2
Signed-off-by: Ferdinand van Aartsen <ferdinand@ombud.nl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5a5102c428)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:22:04 +01:00
Ferdinand van Aartsen
c765d21658 sqlite: bump to version 3.25.1
Make use of https for sqlite.org.

Signed-off-by: Ferdinand van Aartsen <ferdinand@ombud.nl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit acd7fec2c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:21:44 +01:00
Bernd Kuhls
0eee93a563 package/sqlite: bump version to 3.24.0
Release notes:
https://www.sqlite.org/releaselog/3_24_0.html
https://www.sqlite.org/releaselog/3_23_1.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f7e4793c50)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:21:38 +01:00
Joshua Henderson
f232cb356f sqlite: avoid use of unsupported -Ofast CFLAGS
sqlite3 refuses to be built with -ffast-math (a side effect of -Ofast) when it
falls back to implementing its own isnan() function.

sqlite3.c: In function ‘sqlite3IsNaN’:
sqlite3.c:28554:3: error: #error SQLite will not work correctly with the -ffast-math option of GCC.

To work around this, when -Ofast is used replace with -O3.

Signed-off-by: Joshua Henderson <joshua.henderson@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 83781f11dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:21:23 +01:00
Scott Fan
90eadb1dc9 package/sqlite: bump version to 3220000 (3.22.0)
Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f83d92b60f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:20:26 +01:00