Update for 2014.11

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

CHANGES

@@ -1,3 +1,37 @@
+2014.11, Released December 1st, 2014
+
+	Minor fixes.
+
+	Infrastructure: LD_LIBRARY_PATH handling tweak to ensure
+	current working directory isn't searched.
+
+	Updated/fixed packages: gd, gdb, libwebsockets, luajit, mono,
+	parted, shairport-sync, util-linux, xapp_bdftopcf,
+	xserver_xorg-server
+
+2014.11-rc3, Released November 28th, 2014
+
+	Fixes all over the tree.
+
+	System: File permissions of /etc/random-seed made more
+	restrictive.
+
+	Toolchain: Various fixes related to locale handling, a fix for
+	building the toolchain wrapper on MIPS.
+
+	Updated/fixed packages: bind, binutils. botan, btrfsprogs,
+	clamav, czmq, dhcp, dillo, dovecot, erlang, flac, gd, glibc,
+	gptfdisk, gst1-validate, heirloom-mailx, lame, libksba,
+	libllcp, libnspr, libpng, libshairplay, libtirpc, linux,
+	linux-headers, mpdecimal, mpg123, network-manager, nfstables,
+	nfs-utils, openssl, pcituils, qt, radvd, rtai, sqlcipher,
+	sstrip, tcpdump, uclibc, uemacs, ushare, wayland, weston,
+	xl2tp, xserver_xorg-server
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#7670: Fails to build mpc-1.0.2 on latest Cygwin
+
 2014.11-rc2, Released November 21st, 2014
 
 	Fixes all over the tree.

Makefile

@@ -28,7 +28,7 @@
 all:
 
 # Set and export the version string
-export BR2_VERSION := 2014.11-rc2
+export BR2_VERSION := 2014.11
 
 # Check for minimal make version (note: this check will break at make 10.x)
 MIN_MAKE_VERSION = 3.81
@@ -514,13 +514,13 @@ endif
 # not have them (Linaro toolchains), we use the ones available on the
 # host machine.
 ifeq ($(BR2_TOOLCHAIN_USES_GLIBC),y)
-GENERATE_LOCALE = $(call qstrip,$(BR2_GENERATE_LOCALE))
-ifneq ($(GENERATE_LOCALE),)
+GLIBC_GENERATE_LOCALES = $(call qstrip,$(BR2_GENERATE_LOCALE))
+ifneq ($(GLIBC_GENERATE_LOCALES),)
 TARGETS += host-localedef
 
-define GENERATE_LOCALES
+define GENERATE_GLIBC_LOCALES
 	$(Q)mkdir -p $(TARGET_DIR)/usr/lib/locale/
-	$(Q)for locale in $(GENERATE_LOCALE) ; do \
+	$(Q)for locale in $(GLIBC_GENERATE_LOCALES) ; do \
 		inputfile=`echo $${locale} | cut -f1 -d'.'` ; \
 		charmap=`echo $${locale} | cut -f2 -d'.' -s` ; \
 		if test -z "$${charmap}" ; then \
@@ -535,7 +535,7 @@ define GENERATE_LOCALES
 			$${locale} ; \
 	done
 endef
-TARGET_FINALIZE_HOOKS += GENERATE_LOCALES
+TARGET_FINALIZE_HOOKS += GENERATE_GLIBC_LOCALES
 endif
 endif
 

docs/download.html

@@ -7,32 +7,32 @@
 
 <p>
 
-The latest stable release is <b>2014.08</b>, which can be downloaded
+The latest stable release is <b>2014.11</b>, which can be downloaded
 here:<p>
 
-<a href="/downloads/buildroot-2014.08.tar.gz">buildroot-2014.08.tar.gz</a>
-(<a href="/downloads/buildroot-2014.08.tar.gz.sign">PGP signature</a>)
+<a href="/downloads/buildroot-2014.11.tar.gz">buildroot-2014.11.tar.gz</a>
+(<a href="/downloads/buildroot-2014.11.tar.gz.sign">PGP signature</a>)
 or
-<a href="/downloads/buildroot-2014.08.tar.bz2">buildroot-2014.08.tar.bz2</a>
-(<a href="/downloads/buildroot-2014.08.tar.bz2.sign">PGP signature</a>).
+<a href="/downloads/buildroot-2014.11.tar.bz2">buildroot-2014.11.tar.bz2</a>
+(<a href="/downloads/buildroot-2014.11.tar.bz2.sign">PGP signature</a>).
 
 <p>
-
-The latest release candidate is <b>2014.11-rc2</b>, which can be
+<!--
+The latest release candidate is <b>2014.11-rc3</b>, which can be
 downloaded here:<p>
 
-<a href="/downloads/buildroot-2014.11-rc2.tar.gz">buildroot-2014.11-rc2.tar.gz</a>
-(<a href="/downloads/buildroot-2014.11-rc2.tar.gz.sign">PGP signature</a>)
+<a href="/downloads/buildroot-2014.11-rc3.tar.gz">buildroot-2014.11-rc3.tar.gz</a>
+(<a href="/downloads/buildroot-2014.11-rc3.tar.gz.sign">PGP signature</a>)
 or
-<a href="/downloads/buildroot-2014.11-rc2.tar.bz2">buildroot-2014.11-rc2.tar.bz2</a>
-(<a href="/downloads/buildroot-2014.11-rc2.tar.bz2.sign">PGP signature</a>).
+<a href="/downloads/buildroot-2014.11-rc3.tar.bz2">buildroot-2014.11-rc3.tar.bz2</a>
+(<a href="/downloads/buildroot-2014.11-rc3.tar.bz2.sign">PGP signature</a>).
 <p>
 
 This and earlier releases (and their PGP signatures) can always be downloaded from
 <a href="/downloads/">http://buildroot.net/downloads/</a>.
 
 <p>
-
+-->
 You can also obtain daily snapshots of the latest Buildroot source tree if you
 want to follow development, but cannot or do not wish to use Git.
 

docs/manual/adding-packages-autotools.txt

@@ -125,7 +125,7 @@ cases, typical packages will therefore only use a few of them.
   variables to pass to the 'autoreconf' program if
   +LIBFOO_AUTORECONF=YES+. These are passed in the environment of
   the 'autoreconf' command. By default, empty.
-  
+
 * +LIBFOO_AUTORECONF_OPTS+ to specify additional options
   passed to the 'autoreconf' program if
   +LIBFOO_AUTORECONF=YES+. By default, empty.

docs/manual/adding-packages-directory.txt

@@ -191,15 +191,19 @@ construct rather than repeating the +depends on+ statement on the
 comment and other config options.
 
 The general format of a dependency +comment+ for package foo is:
+
 --------------------------
 foo needs a toolchain w/ featA, featB, featC
 --------------------------
 
 for example:
+
 --------------------------
 aircrack-ng needs a toolchain w/ largefile, threads
 --------------------------
+
 or
+
 --------------------------
 crda needs a toolchain w/ threads
 --------------------------
@@ -283,6 +287,7 @@ foo needs a Linux kernel to be built
 
 If there is a dependency on both toolchain options and the Linux
 kernel, use this format:
+
 --------------------------
 foo needs a toolchain w/ featA, featB, featC and a Linux kernel to be built
 --------------------------

docs/manual/customize-outside-br.txt

@@ -1,4 +1,5 @@
 // -*- mode:doc -*- ;
+// vim: set syntax=asciidoc:
 
 [[outside-br-custom]]
 === Keeping customizations outside of Buildroot

docs/manual/customize-patches.txt

@@ -1,4 +1,5 @@
 // -*- mode:doc -*- ;
+// vim: set syntax=asciidoc:
 
 [[customize-patches]]
 === Adding project-specific patches

docs/manual/faq-troubleshooting.txt

@@ -19,10 +19,10 @@ Starting dropbear sshd: generating rsa key... generating dsa key... OK
 
 then it means that your system is running, but didn't start a shell on
 the serial console. In order to have the system start a shell on your
-serial console, you have to go into the Buildroot configuration, in 
-+System configuration+, modify +Run a getty (login prompt) after boot+ 
-and set the appropriate port and baud rate in the +getty options+ 
-submenu. This will automatically tune the +/etc/inittab+ file of the 
+serial console, you have to go into the Buildroot configuration, in
++System configuration+, modify +Run a getty (login prompt) after boot+
+and set the appropriate port and baud rate in the +getty options+
+submenu. This will automatically tune the +/etc/inittab+ file of the
 generated system so that a shell starts on the correct serial port.
 
 [[faq-no-compiler-on-target]]

docs/manual/makedev-syntax.txt

@@ -11,13 +11,14 @@ create and how to create them, in order to avoid calls to mknod.
 This syntax is derived from the makedev utility, and more complete
 documentation can be found in the +package/makedevs/README+ file.
 
-It takes the form of a line for each file, with the following layout:
+It takes the form of a space separated list of fields, one file per
+line; the fields are:
 
 |===========================================================
 |name |type |mode |uid |gid |major |minor |start |inc |count
 |===========================================================
 
-There are a few non-trivial blocks here:
+There are a few non-trivial blocks:
 
 - +name+ is the path to the file you want to create/modify
 - +type+ is the type of the file, being one of:
@@ -35,22 +36,23 @@ There are a few non-trivial blocks here:
 
 Let's say you want to change the permissions of a given file; using
 this syntax, you will need to put:
--------------------------------------------------------------------
-/usr/bin/foobar	f	644	0	0	-	-	-	-	-
--------------------------------------------------------------------
+
+----
+/usr/bin/foobar f 644 0 0 - - -	- -
+----
 
 On the other hand, if you want to create the device file +/dev/hda+
 and the corresponding 15 files for the partitions, you will need for
 +/dev/hda+:
 
--------------------------------------------------------------------
-/dev/hda	b	640	0	0	3	0	0	0	-
--------------------------------------------------------------------
+----
+/dev/hda b 640 0 0 3 0 0 0 -
+----
 
 and then for device files corresponding to the partitions of
 +/dev/hda+, +/dev/hdaX+, +X+ ranging from 1 to 15:
 
--------------------------------------------------------------------
-/dev/hda	b	640	0	0	3	1	1	1	15
--------------------------------------------------------------------
+----
+/dev/hda b 640 0 0 3 1 1 1 15
+----
 

docs/manual/makeusers-syntax.txt

@@ -1,4 +1,5 @@
 // -*- mode:doc -*- ;
+// vim: set syntax=asciidoc:
 
 [[makeuser-syntax]]
 == Makeusers syntax documentation

docs/news.html

@@ -9,6 +9,27 @@
 
 <ul>
 
+  <li><b>1 December 2014 -- 2014.11 released</b>
+
+    <p>The stable 2014.11 release is out - Thanks to everyone
+    contributing and testing the release candidates. See the
+    <a href="http://git.buildroot.net/buildroot/plain/CHANGES?id=2014.11">CHANGES</a>
+    file for more details,
+    and go to the <a href="/downloads/">downloads page</a> to pick up the
+    <a href="/downloads/buildroot-2014.11.tar.bz2">2014.11 release</a>.</p>
+
+  <li><b>28 November 2014 -- 2014.11-rc3 released</b>
+
+    <p>Release candidate 3 is out with more cleanups and build fixes. See the <a
+    href="http://git.buildroot.net/buildroot/plain/CHANGES?id=2014.11-rc3">CHANGES</a>
+    file for details.</p>
+
+    <p>Head to the <a href="/downloads/">downloads page</a> to pick up the
+    <a href="/downloads/buildroot-2014.11-rc3.tar.bz2">2014.11-rc3
+    release candidate</a>, and report any problems found to the <a
+    href="lists.html">mailing list</a> or <a
+    href="https://bugs.uclibc.org">bug tracker</a>.</p>
+
   <li><b>21 November 2014 -- 2014.11-rc2 released</b>
 
     <p>Another week, another release candidate with more cleanups and

linux/Config.in

@@ -21,7 +21,7 @@ choice
 	prompt "Kernel version"
 
 config BR2_LINUX_KERNEL_LATEST_VERSION
-	bool "3.17.3"
+	bool "3.17.4"
 
 config BR2_LINUX_KERNEL_SAME_AS_HEADERS
 	bool "Same as toolchain kernel headers"
@@ -104,7 +104,7 @@ config BR2_LINUX_KERNEL_CUSTOM_LOCAL_PATH
 
 config BR2_LINUX_KERNEL_VERSION
 	string
-	default "3.17.3" if BR2_LINUX_KERNEL_LATEST_VERSION
+	default "3.17.4" if BR2_LINUX_KERNEL_LATEST_VERSION
 	default BR2_DEFAULT_KERNEL_HEADERS if BR2_LINUX_KERNEL_SAME_AS_HEADERS
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
 		if BR2_LINUX_KERNEL_CUSTOM_VERSION

package/Makefile.in

@@ -307,11 +307,11 @@ HOST_CONFIGURE_OPTS = PATH=$(BR_PATH) \
 		PKG_CONFIG="$(PKG_CONFIG_HOST_BINARY)" \
 		PKG_CONFIG_SYSROOT_DIR="/" \
 		PKG_CONFIG_LIBDIR="$(HOST_DIR)/usr/lib/pkgconfig:$(HOST_DIR)/usr/share/pkgconfig" \
-		LD_LIBRARY_PATH="$(HOST_DIR)/usr/lib:$(LD_LIBRARY_PATH)" \
+		LD_LIBRARY_PATH="$(HOST_DIR)/usr/lib$(if $(LD_LIBRARY_PATH),:$(LD_LIBRARY_PATH))" \
 		INTLTOOL_PERL=$(PERL)
 
 HOST_MAKE_ENV = PATH=$(BR_PATH) \
-		LD_LIBRARY_PATH="$(HOST_DIR)/usr/lib:$(LD_LIBRARY_PATH)" \
+		LD_LIBRARY_PATH="$(HOST_DIR)/usr/lib$(if $(LD_LIBRARY_PATH),:$(LD_LIBRARY_PATH))" \
 		PKG_CONFIG="$(PKG_CONFIG_HOST_BINARY)" \
 		PKG_CONFIG_SYSROOT_DIR="/" \
 		PKG_CONFIG_LIBDIR="$(HOST_DIR)/usr/lib/pkgconfig"

package/bind/Config.in

@@ -3,6 +3,7 @@ config BR2_PACKAGE_BIND
 	depends on BR2_INET_IPV6
 	depends on BR2_LARGEFILE
 	depends on BR2_USE_MMU # fork()
+	depends on !BR2_PREFER_STATIC_LIB
 	help
 	  BIND (Berkeley Internet Name Domain) is an implementation of
 	  the Domain Name System (DNS) protocols and provides an openly
@@ -38,6 +39,6 @@ config BR2_PACKAGE_BIND_TOOLS
 
 endif
 
-comment "bind needs a toolchain w/ largefile, IPv6"
+comment "bind needs a toolchain w/ largefile, IPv6, dynamic library"
 	depends on BR2_USE_MMU
-	depends on !(BR2_LARGEFILE || BR2_INET_IPV6)
+	depends on !BR2_LARGEFILE || !BR2_INET_IPV6 || BR2_PREFER_STATIC_LIB

package/binutils/2.22/905-Fix-trampolines-search-code-for-conditional-branches.patch

@@ -0,0 +1,90 @@
+From 415480d6471e67aef97c0241d451ef2423a1da9d Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 25 Nov 2014 21:33:21 +0300
+Subject: [PATCH] Fix trampolines search code for conditional branches
+
+For conditional branches that need more than one trampoline to reach its
+target assembler couldn't always find suitable trampoline because
+post-loop condition check was placed inside the loop, resulting in
+premature loop termination. Move check outside the loop.
+
+This fixes the following build errors seen when assembling huge files
+produced by gcc:
+    Error: jump target out of range; no usable trampoline found
+    Error: operand 1 of 'j' has out of range value '307307'
+
+2014-11-25  Max Filippov  <jcmvbkbc@gmail.com>
+
+gas/
+	* config/tc-xtensa.c (search_trampolines): Move post-loop
+	condition check outside the search loop.
+
+gas/testsuite/
+	* gas/xtensa/trampoline.d: Add expected output for branches.
+	* gas/xtensa/trampoline.s: Add test case for branches.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+---
+Backported from: d92b6eece424f0ad35d96fdd85bf207295e8c4c3
+Changes to ChangeLogs are dropped.
+
+ gas/config/tc-xtensa.c                | 8 ++++----
+ gas/testsuite/gas/xtensa/trampoline.d | 9 +++++++++
+ gas/testsuite/gas/xtensa/trampoline.s | 7 +++++++
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/gas/config/tc-xtensa.c b/gas/config/tc-xtensa.c
+index d11b0c7..f23ccf8 100644
+--- a/gas/config/tc-xtensa.c
++++ b/gas/config/tc-xtensa.c
+@@ -9514,11 +9514,11 @@ search_trampolines (TInsn *tinsn, fragS *fragP, bfd_boolean unreachable_only)
+ 	      if (next_addr == 0 || addr - next_addr > J_RANGE)
+ 		break;
+ 	    }
+-	  if (abs (addr - this_addr) < J_RANGE)
+-	    return tf;
+-
+-	  return NULL;
+ 	}
++      if (abs (addr - this_addr) < J_RANGE)
++	return tf;
++
++      return NULL;
+     }
+   for ( ; tf; tf = tf->next)
+     {
+diff --git a/gas/testsuite/gas/xtensa/trampoline.d b/gas/testsuite/gas/xtensa/trampoline.d
+index b4f65dc..5ae32a6 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.d
++++ b/gas/testsuite/gas/xtensa/trampoline.d
+@@ -24,3 +24,12 @@
+ .*33462:.*j.0x49407
+ #...
+ .*49407:.*j.0x49407
++.*4940a:.*beqz.n.a2,.0x4940f
++.*4940c:.*j.0x693d1
++#...
++.*693d1:.*j.0x7ddd4
++#...
++.*7ddd4:.*j.0x927f5
++#...
++.*927f5:.*j.0x927f5
++#...
+diff --git a/gas/testsuite/gas/xtensa/trampoline.s b/gas/testsuite/gas/xtensa/trampoline.s
+index 259a3bb..4465786 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.s
++++ b/gas/testsuite/gas/xtensa/trampoline.s
+@@ -19,3 +19,10 @@
+ 	.endr
+ 3:
+ 	j	3b
++	bnez	a2, 4f
++	.rep	50000
++	and	a2, a2, a3
++	_ret
++	.endr
++4:
++	j	4b
+-- 
+1.8.1.4
+

package/binutils/2.23.2/905-Fix-trampolines-search-code-for-conditional-branches.patch

@@ -0,0 +1,90 @@
+From 415480d6471e67aef97c0241d451ef2423a1da9d Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 25 Nov 2014 21:33:21 +0300
+Subject: [PATCH] Fix trampolines search code for conditional branches
+
+For conditional branches that need more than one trampoline to reach its
+target assembler couldn't always find suitable trampoline because
+post-loop condition check was placed inside the loop, resulting in
+premature loop termination. Move check outside the loop.
+
+This fixes the following build errors seen when assembling huge files
+produced by gcc:
+    Error: jump target out of range; no usable trampoline found
+    Error: operand 1 of 'j' has out of range value '307307'
+
+2014-11-25  Max Filippov  <jcmvbkbc@gmail.com>
+
+gas/
+	* config/tc-xtensa.c (search_trampolines): Move post-loop
+	condition check outside the search loop.
+
+gas/testsuite/
+	* gas/xtensa/trampoline.d: Add expected output for branches.
+	* gas/xtensa/trampoline.s: Add test case for branches.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+---
+Backported from: d92b6eece424f0ad35d96fdd85bf207295e8c4c3
+Changes to ChangeLogs are dropped.
+
+ gas/config/tc-xtensa.c                | 8 ++++----
+ gas/testsuite/gas/xtensa/trampoline.d | 9 +++++++++
+ gas/testsuite/gas/xtensa/trampoline.s | 7 +++++++
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/gas/config/tc-xtensa.c b/gas/config/tc-xtensa.c
+index d11b0c7..f23ccf8 100644
+--- a/gas/config/tc-xtensa.c
++++ b/gas/config/tc-xtensa.c
+@@ -9514,11 +9514,11 @@ search_trampolines (TInsn *tinsn, fragS *fragP, bfd_boolean unreachable_only)
+ 	      if (next_addr == 0 || addr - next_addr > J_RANGE)
+ 		break;
+ 	    }
+-	  if (abs (addr - this_addr) < J_RANGE)
+-	    return tf;
+-
+-	  return NULL;
+ 	}
++      if (abs (addr - this_addr) < J_RANGE)
++	return tf;
++
++      return NULL;
+     }
+   for ( ; tf; tf = tf->next)
+     {
+diff --git a/gas/testsuite/gas/xtensa/trampoline.d b/gas/testsuite/gas/xtensa/trampoline.d
+index b4f65dc..5ae32a6 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.d
++++ b/gas/testsuite/gas/xtensa/trampoline.d
+@@ -24,3 +24,12 @@
+ .*33462:.*j.0x49407
+ #...
+ .*49407:.*j.0x49407
++.*4940a:.*beqz.n.a2,.0x4940f
++.*4940c:.*j.0x693d1
++#...
++.*693d1:.*j.0x7ddd4
++#...
++.*7ddd4:.*j.0x927f5
++#...
++.*927f5:.*j.0x927f5
++#...
+diff --git a/gas/testsuite/gas/xtensa/trampoline.s b/gas/testsuite/gas/xtensa/trampoline.s
+index 259a3bb..4465786 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.s
++++ b/gas/testsuite/gas/xtensa/trampoline.s
+@@ -19,3 +19,10 @@
+ 	.endr
+ 3:
+ 	j	3b
++	bnez	a2, 4f
++	.rep	50000
++	and	a2, a2, a3
++	_ret
++	.endr
++4:
++	j	4b
+-- 
+1.8.1.4
+

package/binutils/2.24/905-Fix-trampolines-search-code-for-conditional-branches.patch

@@ -0,0 +1,90 @@
+From 415480d6471e67aef97c0241d451ef2423a1da9d Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 25 Nov 2014 21:33:21 +0300
+Subject: [PATCH] Fix trampolines search code for conditional branches
+
+For conditional branches that need more than one trampoline to reach its
+target assembler couldn't always find suitable trampoline because
+post-loop condition check was placed inside the loop, resulting in
+premature loop termination. Move check outside the loop.
+
+This fixes the following build errors seen when assembling huge files
+produced by gcc:
+    Error: jump target out of range; no usable trampoline found
+    Error: operand 1 of 'j' has out of range value '307307'
+
+2014-11-25  Max Filippov  <jcmvbkbc@gmail.com>
+
+gas/
+	* config/tc-xtensa.c (search_trampolines): Move post-loop
+	condition check outside the search loop.
+
+gas/testsuite/
+	* gas/xtensa/trampoline.d: Add expected output for branches.
+	* gas/xtensa/trampoline.s: Add test case for branches.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+---
+Backported from: d92b6eece424f0ad35d96fdd85bf207295e8c4c3
+Changes to ChangeLogs are dropped.
+
+ gas/config/tc-xtensa.c                | 8 ++++----
+ gas/testsuite/gas/xtensa/trampoline.d | 9 +++++++++
+ gas/testsuite/gas/xtensa/trampoline.s | 7 +++++++
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/gas/config/tc-xtensa.c b/gas/config/tc-xtensa.c
+index d11b0c7..f23ccf8 100644
+--- a/gas/config/tc-xtensa.c
++++ b/gas/config/tc-xtensa.c
+@@ -9514,11 +9514,11 @@ search_trampolines (TInsn *tinsn, fragS *fragP, bfd_boolean unreachable_only)
+ 	      if (next_addr == 0 || addr - next_addr > J_RANGE)
+ 		break;
+ 	    }
+-	  if (abs (addr - this_addr) < J_RANGE)
+-	    return tf;
+-
+-	  return NULL;
+ 	}
++      if (abs (addr - this_addr) < J_RANGE)
++	return tf;
++
++      return NULL;
+     }
+   for ( ; tf; tf = tf->next)
+     {
+diff --git a/gas/testsuite/gas/xtensa/trampoline.d b/gas/testsuite/gas/xtensa/trampoline.d
+index b4f65dc..5ae32a6 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.d
++++ b/gas/testsuite/gas/xtensa/trampoline.d
+@@ -24,3 +24,12 @@
+ .*33462:.*j.0x49407
+ #...
+ .*49407:.*j.0x49407
++.*4940a:.*beqz.n.a2,.0x4940f
++.*4940c:.*j.0x693d1
++#...
++.*693d1:.*j.0x7ddd4
++#...
++.*7ddd4:.*j.0x927f5
++#...
++.*927f5:.*j.0x927f5
++#...
+diff --git a/gas/testsuite/gas/xtensa/trampoline.s b/gas/testsuite/gas/xtensa/trampoline.s
+index 259a3bb..4465786 100644
+--- a/gas/testsuite/gas/xtensa/trampoline.s
++++ b/gas/testsuite/gas/xtensa/trampoline.s
+@@ -19,3 +19,10 @@
+ 	.endr
+ 3:
+ 	j	3b
++	bnez	a2, 4f
++	.rep	50000
++	and	a2, a2, a3
++	_ret
++	.endr
++4:
++	j	4b
+-- 
+1.8.1.4
+

package/botan/Config.in

@@ -10,12 +10,11 @@ config BR2_PACKAGE_BOTAN
 	depends on BR2_INSTALL_LIBSTDCPP
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on BR2_PACKAGE_BOTAN_ARCH_SUPPORTS
-	depends on !BR2_PREFER_STATIC_LIB # dlfcn.h
 	help
 	  Botan is a crypto library for C++
 
 	  http://botan.randombit.net
 
-comment "botan needs a toolchain w/ C++, threads, dynamic library"
-	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_INSTALL_LIBSTDCPP || BR2_PREFER_STATIC_LIB
+comment "botan needs a toolchain w/ C++, threads"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_INSTALL_LIBSTDCPP
 	depends on BR2_PACKAGE_BOTAN_ARCH_SUPPORTS

package/botan/botan.mk

@@ -20,7 +20,7 @@ BOTAN_CONF_OPTS = \
 	--cc-bin="$(TARGET_CXX)"
 
 ifeq ($(BR2_PREFER_STATIC_LIB),y)
-	BOTAN_CONF_OPTS += --disable-shared
+	BOTAN_CONF_OPTS += --disable-shared --no-autoload
 endif
 
 ifeq ($(BR2_PACKAGE_BZIP2),y)

package/btrfs-progs/btrfs-progs.mk

@@ -17,6 +17,10 @@ BTRFS_PROGS_LICENSE_FILES = COPYING
 ifeq ($(BR2_PREFER_STATIC_LIB),y)
 BTRFS_PROGS_MAKE_TARGET = static
 BTRFS_PROGS_MAKE_INSTALL_TARGET = install-static
+ifeq ($(BR2_NEEDS_GETTEXT_IF_LOCALE),y)
+# Add -lintl for libuuid
+BTRFS_PROGS_MAKE_FLAGS += lib_LIBS="-luuid -lblkid -lm -lz -llzo2 -L. -lintl"
+endif
 else
 BTRFS_PROGS_MAKE_TARGET = all
 BTRFS_PROGS_MAKE_INSTALL_TARGET = install

package/clamav/clamav-0004-fix-static-build.patch

@@ -0,0 +1,21 @@
+stats: fix static link
+
+The stats.c file does not use the dlopen() familly of functions, but
+includes dlfcn.h, which is missing on uClibc when it is configured as
+a static-only C library.
+
+so, simply do not include dlfcn.h.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+diff -durN clamav-0.98.5.orig/libclamav/stats.c clamav-0.98.5/libclamav/stats.c
+--- clamav-0.98.5.orig/libclamav/stats.c	2014-11-13 23:30:43.000000000 +0100
++++ clamav-0.98.5/libclamav/stats.c	2014-11-25 19:57:14.344291266 +0100
+@@ -41,7 +41,6 @@
+ #include <sys/sysctl.h>
+ #endif
+ #endif
+-#include <dlfcn.h>
+ #else
+ #include <Windows.h>
+ #include <tchar.h>

package/czmq/czmq.mk

@@ -19,7 +19,7 @@ CZMQ_LICENSE_FILES = LICENSE
 CZMQ_CONF_ENV = ac_cv_prog_czmq_have_asciidoc=no
 
 ifeq ($(BR2_PREFER_STATIC_LIB),y)
-CZMQ_CONF_OPTS += LIBS=-lstdc++
+CZMQ_CONF_OPTS += LIBS="-lstdc++ -lm"
 endif
 
 define CZMQ_CREATE_CONFIG_DIR

package/dhcp/dhclient-script

@@ -1,2 +1,284 @@
 #!/bin/sh
-# empty dhclient-script to keep dhclient from complaining
+
+# dhclient-script from OpenWRT project
+# http://git.openwrt.org/?p=packages.git;a=blob;f=net/isc-dhcp/files/dhclient-script;h=4afebc0ad20ebac51c5baae5ed01c6713e3a0fd0;hb=HEAD
+
+make_resolv_conf() {
+  if [ x"$new_domain_name_servers" != x ]; then
+    cat /dev/null > /etc/resolv.conf.dhclient
+    chmod 644 /etc/resolv.conf.dhclient
+    if [ x"$new_domain_search" != x ]; then
+      echo search $new_domain_search >> /etc/resolv.conf.dhclient
+    elif [ x"$new_domain_name" != x ]; then
+      # Note that the DHCP 'Domain Name Option' is really just a domain
+      # name, and that this practice of using the domain name option as
+      # a search path is both nonstandard and deprecated.
+      echo search $new_domain_name >> /etc/resolv.conf.dhclient
+    fi
+    for nameserver in $new_domain_name_servers; do
+      echo nameserver $nameserver >>/etc/resolv.conf.dhclient
+    done
+
+  elif [ "x${new_dhcp6_name_servers}" != x ] ; then
+    cat /dev/null > /etc/resolv.conf.dhclient6
+    chmod 644 /etc/resolv.conf.dhclient6
+
+    if [ "x${new_dhcp6_domain_search}" != x ] ; then
+      echo search ${new_dhcp6_domain_search} >> /etc/resolv.conf.dhclient6
+    fi
+    for nameserver in ${new_dhcp6_name_servers} ; do
+      echo nameserver ${nameserver} >> /etc/resolv.conf.dhclient6
+    done
+  fi
+
+  # if both v4 and v6 clients are running, concatenate results
+  cat /etc/resolv.conf.* > /etc/resolv.conf
+}
+
+# Must be used on exit.   Invokes the local dhcp client exit hooks, if any.
+exit_with_hooks() {
+  exit_status=$1
+  if [ -f /etc/dhclient-exit-hooks ]; then
+    . /etc/dhclient-exit-hooks
+  fi
+# probably should do something with exit status of the local script
+  exit $exit_status
+}
+
+# Invoke the local dhcp client enter hooks, if they exist.
+if [ -f /etc/dhclient-enter-hooks ]; then
+  exit_status=0
+  . /etc/dhclient-enter-hooks
+  # allow the local script to abort processing of this state
+  # local script must set exit_status variable to nonzero.
+  if [ $exit_status -ne 0 ]; then
+    exit $exit_status
+  fi
+fi
+
+###
+### DHCPv4 Handlers
+###
+
+if [ x$new_broadcast_address != x ]; then
+  new_broadcast_arg="broadcast $new_broadcast_address"
+fi
+if [ x$new_subnet_mask != x ]; then
+  new_subnet_arg="netmask $new_subnet_mask"
+fi
+if [ x$alias_subnet_mask != x ]; then
+  alias_subnet_arg="netmask $alias_subnet_mask"
+fi
+
+if [ x$reason = xMEDIUM ]; then
+  # Linux doesn't do mediums (ok, ok, media).
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xPREINIT ]; then
+  if [ x$alias_ip_address != x ]; then
+    # Bring down alias interface. Its routes will disappear too.
+    ifconfig $interface:0- 0.0.0.0
+  fi
+  ifconfig $interface 0.0.0.0 up
+
+  # We need to give the kernel some time to get the interface up.
+  sleep 1
+
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xARPCHECK ] || [ x$reason = xARPSEND ]; then
+  exit_with_hooks 0
+fi
+  
+if [ x$reason = xBOUND ] || [ x$reason = xRENEW ] || \
+   [ x$reason = xREBIND ] || [ x$reason = xREBOOT ]; then
+  current_hostname=`hostname`
+  if [ x$current_hostname = x ] || \
+     [ x$current_hostname = x$old_host_name ]; then
+    if [ x$current_hostname = x ] || \
+       [ x$new_host_name != x$old_host_name ]; then
+      hostname $new_host_name
+    fi
+  fi
+    
+  if [ x$old_ip_address != x ] && [ x$alias_ip_address != x ] && \
+		[ x$alias_ip_address != x$old_ip_address ]; then
+    # Possible new alias. Remove old alias.
+    ifconfig $interface:0- 0.0.0.0
+  fi
+  if [ x$old_ip_address != x ] && [ x$old_ip_address != x$new_ip_address ]; then
+    # IP address changed. Bringing down the interface will delete all routes,
+    # and clear the ARP cache.
+    ifconfig $interface 0.0.0.0 down
+
+  fi
+  if [ x$old_ip_address = x ] || [ x$old_ip_address != x$new_ip_address ] || \
+     [ x$reason = xBOUND ] || [ x$reason = xREBOOT ]; then
+
+    ifconfig $interface $new_ip_address $new_subnet_arg \
+							$new_broadcast_arg
+    for router in $new_routers; do
+      if [ "x$new_subnet_mask" = "x255.255.255.255" ] ; then
+	route add -host $router dev $interface
+      fi
+      route add default gw $router
+    done
+  fi
+  if [ x$new_ip_address != x$alias_ip_address ] && [ x$alias_ip_address != x ];
+   then
+    ifconfig $interface:0- 0.0.0.0
+    ifconfig $interface:0 $alias_ip_address $alias_subnet_arg
+    route add -host $alias_ip_address $interface:0
+  fi
+  make_resolv_conf
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xEXPIRE ] || [ x$reason = xFAIL ] || [ x$reason = xRELEASE ] \
+   || [ x$reason = xSTOP ]; then
+  if [ x$alias_ip_address != x ]; then
+    # Turn off alias interface.
+    ifconfig $interface:0- 0.0.0.0
+  fi
+  if [ x$old_ip_address != x ]; then
+    # Shut down interface, which will delete routes and clear arp cache.
+    ifconfig $interface 0.0.0.0 down
+  fi
+  if [ x$alias_ip_address != x ]; then
+    ifconfig $interface:0 $alias_ip_address $alias_subnet_arg
+    route add -host $alias_ip_address $interface:0
+  fi
+
+  # remove v4 dns configuration for this interface
+  rm /etc/resolv.conf.dhclient
+  cat /etc/resolv.conf.* > /etc/resolv.conf
+
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xTIMEOUT ]; then
+  if [ x$alias_ip_address != x ]; then
+    ifconfig $interface:0- 0.0.0.0
+  fi
+  ifconfig $interface $new_ip_address $new_subnet_arg \
+					$new_broadcast_arg
+  set $new_routers
+  if ping -q -c 1 $1; then
+    if [ x$new_ip_address != x$alias_ip_address ] && \
+			[ x$alias_ip_address != x ]; then
+      ifconfig $interface:0 $alias_ip_address $alias_subnet_arg
+      route add -host $alias_ip_address dev $interface:0
+    fi
+    for router in $new_routers; do
+      if [ "x$new_subnet_mask" = "x255.255.255.255" ] ; then
+	route add -host $router dev $interface
+      fi
+      route add default gw $router
+    done
+    make_resolv_conf
+    exit_with_hooks 0
+  fi
+  ifconfig $interface 0.0.0.0 down
+  exit_with_hooks 1
+fi
+
+###
+### DHCPv6 Handlers
+###
+
+if [ x$reason = xPREINIT6 ]; then
+  # Ensure interface is up.
+  ifconfig ${interface} up
+
+  # Remove any stale addresses from aborted clients.
+  ip -f inet6 addr flush dev ${interface} scope global
+
+  exit_with_hooks 0
+fi
+
+if [ x${old_ip6_prefix} != x ] || [ x${new_ip6_prefix} != x ] ; then
+    echo Prefix ${reason} old=${old_ip6_prefix} new=${new_ip6_prefix}
+
+    exit_with_hooks 0
+fi
+
+if [ x$reason = xBOUND6 ]; then
+  if [ x${new_ip6_address} = x ] || [ x${new_ip6_prefixlen} = x ] ; then
+    exit_with_hooks 2;
+  fi
+
+  ifconfig ${interface} add ${new_ip6_address}/${new_ip6_prefixlen}
+
+  # Check for nameserver options.
+  make_resolv_conf
+
+### <<
+  # Set up softwire tunnel
+  if [ x${new_dhcp6_softwire} != x ] ; then
+    /etc/init.d/dhclient stop
+    ifconfig ${interface} 0.0.0.0
+    ip -6 tunnel add tun0 mode ipip6 \
+	remote ${new_dhcp6_softwire} \
+	local ${new_ip6_address} \
+	dev ${interface} encaplimit none
+    ip link set tun0 up
+    ip route add default dev tun0
+  fi
+### >>
+
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xRENEW6 ] || [ x$reason = xREBIND6 ]; then
+  if [ x${new_ip6_address} = x ] || [ x${new_ip6_prefixlen} = x ] ; then
+    exit_with_hooks 2;
+  fi
+
+  ifconfig ${interface} add ${new_ip6_address}/${new_ip6_prefixlen}
+
+  # Make sure nothing has moved around on us.
+
+  # Nameservers/domains/etc.
+  if [ "x${new_dhcp6_name_servers}" != "x${old_dhcp6_name_servers}" ] ||
+     [ "x${new_dhcp6_domain_search}" != "x${old_dhcp6_domain_search}" ] ; then
+    make_resolv_conf
+  fi
+
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xDEPREF6 ]; then
+  if [ x${new_ip6_address} = x ] ; then
+    exit_with_hooks 2;
+  fi
+
+  # Busybox ifconfig has no way to communicate this to the kernel, so ignore it
+
+  exit_with_hooks 0
+fi
+
+if [ x$reason = xEXPIRE6 -o x$reason = xRELEASE6 -o x$reason = xSTOP6 ]; then
+  if [ x${old_ip6_address} = x ] || [ x${old_ip6_prefixlen} = x ] ; then
+    exit_with_hooks 2;
+  fi
+
+  ifconfig ${interface} del ${old_ip6_address}/${old_ip6_prefixlen}
+
+  # remove v6 dns configuration for this interface
+  rm /etc/resolv.conf.dhclient6
+  cat /etc/resolv.conf.* > /etc/resolv.conf
+
+### <<
+  # Tear down softwire tunnel
+  if [ x${old_dhcp6_softwire} != x ] ; then
+    ip link set tun0 down
+    ip tunnel del tun0
+  fi
+### >>
+
+  exit_with_hooks 0
+fi
+
+exit_with_hooks 0

package/dillo/Config.in

@@ -4,6 +4,7 @@ config BR2_PACKAGE_DILLO
 	depends on BR2_INSTALL_LIBSTDCPP
 	depends on BR2_USE_MMU # fltk fork()
 	select BR2_PACKAGE_FLTK
+	select BR2_PACKAGE_LIBICONV if !BR2_ENABLE_LOCALE
 	help
 	  Dillo is a multi-platform graphical web browser known
 	  for its speed and small footprint.

package/dillo/dillo.mk

@@ -17,6 +17,8 @@ DILLO_DEPENDENCIES = fltk
 
 DILLO_CONF_ENV = ac_cv_path_FLTK_CONFIG=$(STAGING_DIR)/usr/bin/fltk-config
 
+DILLO_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBICONV),libiconv)
+
 ifeq ($(BR2_PACKAGE_OPENSSL),y)
 	DILLO_CONF_OPTS += --enable-ssl
 	DILLO_DEPENDENCIES += openssl

package/dovecot/0003-fix-static-build.patch

@@ -0,0 +1,24 @@
+Fix symbol conflict in static build with MySQL enabled
+
+Compile error log:
+http://autobuild.buildroot.net/results/9b5/9b536926b3b2bf82c683b48e9697a220f1b4bf33/build-end.log
+
+Patch suggested by Timo Sirainen:
+http://www.dovecot.org/list/dovecot/2014-November/098787.html
+
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+
+diff -uNr dovecot-2.2.15.org/src/lib/strnum.h dovecot-2.2.15/src/lib/strnum.h
+--- dovecot-2.2.15.org/src/lib/strnum.h	2014-07-02 17:21:24.000000000 +0200
++++ dovecot-2.2.15/src/lib/strnum.h	2014-11-21 19:26:42.316225982 +0100
+@@ -1,6 +1,10 @@
+ #ifndef STRNUM_H
+ #define STRNUM_H
+ 
++/* libmysqlclient really should try to keep its internal stuff internal so
++   they won't conflict with the actual programs that are trying to use it. */
++#define str_to_time str_to_time_libmysqlclient_craps_all_over
++
+ /* Return TRUE if all characters in string are numbers.
+    Stop when `end_char' is found from string. */
+ bool str_is_numeric(const char *str, char end_char) ATTR_PURE;

package/erlang/Config.in

@@ -1,10 +1,11 @@
-comment "erlang needs a toolchain w/ threads"
-	depends on !BR2_TOOLCHAIN_HAS_THREADS
+comment "erlang needs a toolchain w/ threads, shared library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS && BR2_PREFER_STATIC_LIB
 
 config BR2_PACKAGE_ERLANG
 	bool "erlang"
 	depends on BR2_USE_MMU # fork()
 	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on !BR2_PREFER_STATIC_LIB
 	help
 	  Erlang is a programming language used to build massively scalable
 	  soft real-time systems with requirements on high availability.

package/flac/0002-fix-CVE-2014-9028.patch

@@ -0,0 +1,34 @@
+From fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 Mon Sep 17 00:00:00 2001
+From: Erik de Castro Lopo <erikd@mega-nerd.com>
+Date: Wed, 19 Nov 2014 19:35:59 -0800
+Subject: [PATCH] src/libFACL/stream_decoder.c : Fail safely to avoid a heap overflow.
+
+A file provided by the reporters caused the stream decoder to write to
+un-allocated heap space resulting in a segfault. The solution is to
+error out (by returning false from read_residual_partitioned_rice_())
+instead of trying to continue to decode.
+
+Fixes: CVE-2014-9028
+Reported-by: Michele Spagnuolo,
+             Google Security Team <mikispag@google.com>
+---
+ src/libFLAC/stream_decoder.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
+index 88a656d..54e84d4 100644
+--- a/src/libFLAC/stream_decoder.c
++++ b/src/libFLAC/stream_decoder.c
+@@ -2736,7 +2736,8 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne
+ 		if(decoder->private_->frame.header.blocksize < predictor_order) {
+ 			send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC);
+ 			decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC;
+-			return true;
++			/* We have received a potentially malicious bt stream. All we can do is error out to avoid a heap overflow. */
++			return false;
+ 		}
+ 	}
+ 	else {
+-- 
+1.7.2.5
+

package/flac/0003-fix-CVE-2014-8962.patch

@@ -0,0 +1,40 @@
+From 5b3033a2b355068c11fe637e14ac742d273f076e Mon Sep 17 00:00:00 2001
+From: Erik de Castro Lopo <erikd@mega-nerd.com>
+Date: Tue, 18 Nov 2014 07:20:25 -0800
+Subject: [PATCH] src/libFLAC/stream_decoder.c : Fix buffer read overflow.
+
+This is CVE-2014-8962.
+
+Reported-by: Michele Spagnuolo,
+             Google Security Team <mikispag@google.com>
+---
+ src/libFLAC/stream_decoder.c |    6 +++++-
+ 1 files changed, 5 insertions(+), 1 deletions(-)
+
+diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
+index cb66fe2..88a656d 100644
+--- a/src/libFLAC/stream_decoder.c
++++ b/src/libFLAC/stream_decoder.c
+@@ -71,7 +71,7 @@ FLAC_API int FLAC_API_SUPPORTS_OGG_FLAC =
+  *
+  ***********************************************************************/
+ 
+-static FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' };
++static const FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' };
+ 
+ /***********************************************************************
+  *
+@@ -1361,6 +1361,10 @@ FLAC__bool find_metadata_(FLAC__StreamDecoder *decoder)
+ 			id = 0;
+ 			continue;
+ 		}
++
++		if(id >= 3)
++			return false;
++
+ 		if(x == ID3V2_TAG_[id]) {
+ 			id++;
+ 			i = 0;
+-- 
+1.7.2.5
+

package/gd/gd.mk

@@ -13,6 +13,7 @@ GD_LICENSE_FILES = COPYING
 
 GD_CONFIG_SCRIPTS = gdlib-config
 GD_CONF_OPTS = --without-x --disable-rpath
+GD_DEPENDENCIES = host-pkgconf
 
 # gd forgets to link utilities with -pthread even though it uses
 # pthreads, causing linking errors with static linking
@@ -32,6 +33,13 @@ else
 GD_CONF_OPTS += --without-freetype
 endif
 
+ifeq ($(BR2_PACKAGE_LIBICONV),y)
+GD_DEPENDENCIES += libiconv
+# not strictly needed for gd, but ensures -liconv ends up in
+# gdlib-config --libs output
+GD_CONF_ENV += LIBS="-liconv"
+endif
+
 ifeq ($(BR2_PACKAGE_JPEG),y)
 GD_DEPENDENCIES += jpeg
 GD_CONF_OPTS += --with-jpeg
@@ -39,7 +47,7 @@ endif
 
 ifeq ($(BR2_PACKAGE_LIBPNG),y)
 GD_DEPENDENCIES += libpng
-GD_CONF_OPTS += --with-png=$(STAGING_DIR)/usr
+GD_CONF_OPTS += --with-png
 else
 GD_CONF_OPTS += --without-png
 endif

package/gdb/gdb.mk

@@ -146,7 +146,7 @@ else
 endif
 
 ifeq ($(BR2_PACKAGE_HOST_GDB_PYTHON),y)
-	HOST_GDB_CONF_OPTS += --with-python
+	HOST_GDB_CONF_OPTS += --with-python=$(HOST_DIR)/usr/bin/python2
 	HOST_GDB_DEPENDENCIES += host-python
 else
 	HOST_GDB_CONF_OPTS += --without-python

package/glibc/2.18-svnr23787/0001-CVE-2014-7817-eglibc.patch

@@ -0,0 +1,174 @@
+From https://bugzilla.redhat.com/show_bug.cgi?id=1157689
+Modified for eglibc.
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!
+EMBARGOED !!! EMBARGOED !!! EMARGOED !!! EMBARGOED !!! EMBARGOED !!!
+SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!!
+
+CVE-2014-7817:
+
+The function wordexp() fails to properly handle the WRDE_NOCMD
+flag when processing arithmetic inputs in the form of "$((... ``))"
+where "..." can be anything valid. The backticks in the arithmetic
+epxression are evaluated by in a shell even if WRDE_NOCMD forbade
+command substitution. This allows an attacker to attempt to pass
+dangerous commands via constructs of the above form, and bypass
+the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
+in parse_arith(). The patch also hardens parse_backticks() and 
+parse_comm() to check for WRDE_NOCMD flag and return an error instead
+of ever running a shell.
+
+We expand the testsuite and add 3 new regression tests of roughtly
+the same form but with a couple of nested levels. 
+
+On top of the 3 new tests we add fork validation to the WRDE_NOCMD
+testing. If any forks are detected during the execution of a wordexp()
+call with WRDE_NOCMD, the test is marked as failed. This is slightly
+heuristic since vfork might be used, but it provides a higher level
+of assurance that no shells were executed as part of command substitution
+with WRDE_NOCMD in effect. In addition it doesn't require libpthread or
+libdl, instead we use the public implementation namespace function
+__register_atfork (already part of the public ABI for libpthread).
+
+Tested on x86_64 with no regressions.
+
+2014-10-27  Carlos O'Donell  <carlos@redhat.com>
+
+	* wordexp-test.c (__dso_handle): Add prototype.
+	(__register_atfork): Likewise.
+	(__app_register_atfork): New function.
+	(registered_forks): New global.
+	(register_fork): New function.
+	(test_case): Add 3 new tests for WRDE_CMDSUB.
+	(main): Call __app_register_atfork.
+	(testit): If WRDE_NOCMD set registered_forks to zero, run test, and
+	if fork count is non-zero fail the test.
+	* posix/wordexp.c (parse_arith): Return WRDE_NOCMD if WRDE_NOCMD flag
+	is set and parsing '`'. 
+	(parse_comm): Return WRDE_NOCMD if WRDE_NOCMD flag is set.
+	(parse_backtick): Return WRDE_NOCMD if WRDE_NOCMD flag is set and
+	parsing '`'.
+
+diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
+index 4957006..5ce2a1b 100644
+--- a/libc/posix/wordexp-test.c
++++ b/libc/posix/wordexp-test.c
+@@ -27,6 +27,25 @@
+ 
+ #define IFS " \n\t"
+ 
++extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
++extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
++
++static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
++{
++  return __register_atfork (prepare, parent, child,
++			    &__dso_handle == NULL ? NULL : __dso_handle);
++}
++
++/* Number of forks seen.  */
++static int registered_forks;
++
++/* For each fork increment the fork count.  */
++static void
++register_fork (void)
++{
++  registered_forks++;
++}
++
+ struct test_case_struct
+ {
+   int retval;
+@@ -206,6 +225,12 @@ struct test_case_struct
+     { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
++    /* Test for CVE-2014-7817. We test 3 combinations of command
++       substitution inside an arithmetic expression to make sure that
++       no commands are executed and error is returned.  */
++    { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ 
+     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
+   };
+@@ -258,6 +283,15 @@ main (int argc, char *argv[])
+ 	  return -1;
+     }
+ 
++  /* If we are not allowed to do command substitution, we install
++     fork handlers to verify that no forks happened.  No forks should
++     happen at all if command substitution is disabled.  */
++  if (__app_register_atfork (register_fork, NULL, NULL) != 0)
++    {
++      printf ("Failed to register fork handler.\n");
++      return -1;
++    }
++
+   for (test = 0; test_case[test].retval != -1; test++)
+     if (testit (&test_case[test]))
+       ++fail;
+@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
+ 
+   printf ("Test %d (%s): ", ++tests, tc->words);
+ 
++  if (tc->flags & WRDE_NOCMD)
++    registered_forks = 0;
++
+   if (tc->flags & WRDE_APPEND)
+     {
+       /* initial wordexp() call, to be appended to */
+@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
+     }
+   retval = wordexp (tc->words, &we, tc->flags);
+ 
++  if ((tc->flags & WRDE_NOCMD)
++      && (registered_forks > 0))
++    {
++      printf ("FAILED fork called for WRDE_NOCMD\n");
++      return 1;
++    }
++
+   if (tc->flags & WRDE_DOOFFS)
+       start_offs = sav_we.we_offs;
+ 
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index b6b65dd..d6a158f 100644
+--- a/libc/posix/wordexp.c
++++ b/libc/posix/wordexp.c
+@@ -693,6 +693,12 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
+ 	  break;
+ 
+ 	case '`':
++	   if (flags & WRDE_NOCMD)
++	     {
++	       free (expr);
++	       return WRDE_NOCMD;
++	     }
++
+ 	  (*offset)++;
+ 	  error = parse_backtick (&expr, &expr_length, &expr_maxlen,
+ 				  words, offset, flags, NULL, NULL, NULL);
+@@ -1144,6 +1150,10 @@ parse_comm (char **word, size_t *word_length, size_t *max_length,
+   size_t comm_maxlen;
+   char *comm = w_newword (&comm_length, &comm_maxlen);
+ 
++  /* Do nothing if command substitution should not succeed.  */
++  if (flags & WRDE_NOCMD)
++    return WRDE_CMDSUB;
++
+   for (; words[*offset]; ++(*offset))
+     {
+       switch (words[*offset])
+@@ -2121,6 +2131,9 @@ parse_backtick (char **word, size_t *word_length, size_t *max_length,
+       switch (words[*offset])
+ 	{
+ 	case '`':
++	  if (flags & WRDE_NOCMD)
++	    return WRDE_NOCMD;
++
+ 	  /* Go -- give the script to the shell */
+ 	  error = exec_comm (comm, word, word_length, max_length, flags,
+ 			     pwordexp, ifs, ifs_white);

package/glibc/2.19-svnr25243/0001-CVE-2014-7817-eglibc.patch

@@ -0,0 +1,174 @@
+From https://bugzilla.redhat.com/show_bug.cgi?id=1157689
+Modified for eglibc.
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!
+EMBARGOED !!! EMBARGOED !!! EMARGOED !!! EMBARGOED !!! EMBARGOED !!!
+SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!!
+
+CVE-2014-7817:
+
+The function wordexp() fails to properly handle the WRDE_NOCMD
+flag when processing arithmetic inputs in the form of "$((... ``))"
+where "..." can be anything valid. The backticks in the arithmetic
+epxression are evaluated by in a shell even if WRDE_NOCMD forbade
+command substitution. This allows an attacker to attempt to pass
+dangerous commands via constructs of the above form, and bypass
+the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
+in parse_arith(). The patch also hardens parse_backticks() and 
+parse_comm() to check for WRDE_NOCMD flag and return an error instead
+of ever running a shell.
+
+We expand the testsuite and add 3 new regression tests of roughtly
+the same form but with a couple of nested levels. 
+
+On top of the 3 new tests we add fork validation to the WRDE_NOCMD
+testing. If any forks are detected during the execution of a wordexp()
+call with WRDE_NOCMD, the test is marked as failed. This is slightly
+heuristic since vfork might be used, but it provides a higher level
+of assurance that no shells were executed as part of command substitution
+with WRDE_NOCMD in effect. In addition it doesn't require libpthread or
+libdl, instead we use the public implementation namespace function
+__register_atfork (already part of the public ABI for libpthread).
+
+Tested on x86_64 with no regressions.
+
+2014-10-27  Carlos O'Donell  <carlos@redhat.com>
+
+	* wordexp-test.c (__dso_handle): Add prototype.
+	(__register_atfork): Likewise.
+	(__app_register_atfork): New function.
+	(registered_forks): New global.
+	(register_fork): New function.
+	(test_case): Add 3 new tests for WRDE_CMDSUB.
+	(main): Call __app_register_atfork.
+	(testit): If WRDE_NOCMD set registered_forks to zero, run test, and
+	if fork count is non-zero fail the test.
+	* posix/wordexp.c (parse_arith): Return WRDE_NOCMD if WRDE_NOCMD flag
+	is set and parsing '`'. 
+	(parse_comm): Return WRDE_NOCMD if WRDE_NOCMD flag is set.
+	(parse_backtick): Return WRDE_NOCMD if WRDE_NOCMD flag is set and
+	parsing '`'.
+
+diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
+index 4957006..5ce2a1b 100644
+--- a/libc/posix/wordexp-test.c
++++ b/libc/posix/wordexp-test.c
+@@ -27,6 +27,25 @@
+ 
+ #define IFS " \n\t"
+ 
++extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
++extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
++
++static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
++{
++  return __register_atfork (prepare, parent, child,
++			    &__dso_handle == NULL ? NULL : __dso_handle);
++}
++
++/* Number of forks seen.  */
++static int registered_forks;
++
++/* For each fork increment the fork count.  */
++static void
++register_fork (void)
++{
++  registered_forks++;
++}
++
+ struct test_case_struct
+ {
+   int retval;
+@@ -206,6 +225,12 @@ struct test_case_struct
+     { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
++    /* Test for CVE-2014-7817. We test 3 combinations of command
++       substitution inside an arithmetic expression to make sure that
++       no commands are executed and error is returned.  */
++    { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ 
+     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
+   };
+@@ -258,6 +283,15 @@ main (int argc, char *argv[])
+ 	  return -1;
+     }
+ 
++  /* If we are not allowed to do command substitution, we install
++     fork handlers to verify that no forks happened.  No forks should
++     happen at all if command substitution is disabled.  */
++  if (__app_register_atfork (register_fork, NULL, NULL) != 0)
++    {
++      printf ("Failed to register fork handler.\n");
++      return -1;
++    }
++
+   for (test = 0; test_case[test].retval != -1; test++)
+     if (testit (&test_case[test]))
+       ++fail;
+@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
+ 
+   printf ("Test %d (%s): ", ++tests, tc->words);
+ 
++  if (tc->flags & WRDE_NOCMD)
++    registered_forks = 0;
++
+   if (tc->flags & WRDE_APPEND)
+     {
+       /* initial wordexp() call, to be appended to */
+@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
+     }
+   retval = wordexp (tc->words, &we, tc->flags);
+ 
++  if ((tc->flags & WRDE_NOCMD)
++      && (registered_forks > 0))
++    {
++      printf ("FAILED fork called for WRDE_NOCMD\n");
++      return 1;
++    }
++
+   if (tc->flags & WRDE_DOOFFS)
+       start_offs = sav_we.we_offs;
+ 
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index b6b65dd..d6a158f 100644
+--- a/libc/posix/wordexp.c
++++ b/libc/posix/wordexp.c
+@@ -693,6 +693,12 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
+ 	  break;
+ 
+ 	case '`':
++	   if (flags & WRDE_NOCMD)
++	     {
++	       free (expr);
++	       return WRDE_NOCMD;
++	     }
++
+ 	  (*offset)++;
+ 	  error = parse_backtick (&expr, &expr_length, &expr_maxlen,
+ 				  words, offset, flags, NULL, NULL, NULL);
+@@ -1144,6 +1150,10 @@ parse_comm (char **word, size_t *word_length, size_t *max_length,
+   size_t comm_maxlen;
+   char *comm = w_newword (&comm_length, &comm_maxlen);
+ 
++  /* Do nothing if command substitution should not succeed.  */
++  if (flags & WRDE_NOCMD)
++    return WRDE_CMDSUB;
++
+   for (; words[*offset]; ++(*offset))
+     {
+       switch (words[*offset])
+@@ -2121,6 +2131,9 @@ parse_backtick (char **word, size_t *word_length, size_t *max_length,
+       switch (words[*offset])
+ 	{
+ 	case '`':
++	  if (flags & WRDE_NOCMD)
++	    return WRDE_NOCMD;
++
+ 	  /* Go -- give the script to the shell */
+ 	  error = exec_comm (comm, word, word_length, max_length, flags,
+ 			     pwordexp, ifs, ifs_white);

package/glibc/2.19/0001-CVE-2014-7817.patch

@@ -0,0 +1,173 @@
+Patch from https://bugzilla.redhat.com/show_bug.cgi?id=1157689
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!
+EMBARGOED !!! EMBARGOED !!! EMARGOED !!! EMBARGOED !!! EMBARGOED !!!
+SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!!
+
+CVE-2014-7817:
+
+The function wordexp() fails to properly handle the WRDE_NOCMD
+flag when processing arithmetic inputs in the form of "$((... ``))"
+where "..." can be anything valid. The backticks in the arithmetic
+epxression are evaluated by in a shell even if WRDE_NOCMD forbade
+command substitution. This allows an attacker to attempt to pass
+dangerous commands via constructs of the above form, and bypass
+the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
+in parse_arith(). The patch also hardens parse_backticks() and 
+parse_comm() to check for WRDE_NOCMD flag and return an error instead
+of ever running a shell.
+
+We expand the testsuite and add 3 new regression tests of roughtly
+the same form but with a couple of nested levels. 
+
+On top of the 3 new tests we add fork validation to the WRDE_NOCMD
+testing. If any forks are detected during the execution of a wordexp()
+call with WRDE_NOCMD, the test is marked as failed. This is slightly
+heuristic since vfork might be used, but it provides a higher level
+of assurance that no shells were executed as part of command substitution
+with WRDE_NOCMD in effect. In addition it doesn't require libpthread or
+libdl, instead we use the public implementation namespace function
+__register_atfork (already part of the public ABI for libpthread).
+
+Tested on x86_64 with no regressions.
+
+2014-10-27  Carlos O'Donell  <carlos@redhat.com>
+
+	* wordexp-test.c (__dso_handle): Add prototype.
+	(__register_atfork): Likewise.
+	(__app_register_atfork): New function.
+	(registered_forks): New global.
+	(register_fork): New function.
+	(test_case): Add 3 new tests for WRDE_CMDSUB.
+	(main): Call __app_register_atfork.
+	(testit): If WRDE_NOCMD set registered_forks to zero, run test, and
+	if fork count is non-zero fail the test.
+	* posix/wordexp.c (parse_arith): Return WRDE_NOCMD if WRDE_NOCMD flag
+	is set and parsing '`'. 
+	(parse_comm): Return WRDE_NOCMD if WRDE_NOCMD flag is set.
+	(parse_backtick): Return WRDE_NOCMD if WRDE_NOCMD flag is set and
+	parsing '`'.
+
+diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
+index 4957006..5ce2a1b 100644
+--- a/posix/wordexp-test.c
++++ b/posix/wordexp-test.c
+@@ -27,6 +27,25 @@
+ 
+ #define IFS " \n\t"
+ 
++extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
++extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
++
++static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
++{
++  return __register_atfork (prepare, parent, child,
++			    &__dso_handle == NULL ? NULL : __dso_handle);
++}
++
++/* Number of forks seen.  */
++static int registered_forks;
++
++/* For each fork increment the fork count.  */
++static void
++register_fork (void)
++{
++  registered_forks++;
++}
++
+ struct test_case_struct
+ {
+   int retval;
+@@ -206,6 +225,12 @@ struct test_case_struct
+     { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
++    /* Test for CVE-2014-7817. We test 3 combinations of command
++       substitution inside an arithmetic expression to make sure that
++       no commands are executed and error is returned.  */
++    { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ 
+     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
+   };
+@@ -258,6 +283,15 @@ main (int argc, char *argv[])
+ 	  return -1;
+     }
+ 
++  /* If we are not allowed to do command substitution, we install
++     fork handlers to verify that no forks happened.  No forks should
++     happen at all if command substitution is disabled.  */
++  if (__app_register_atfork (register_fork, NULL, NULL) != 0)
++    {
++      printf ("Failed to register fork handler.\n");
++      return -1;
++    }
++
+   for (test = 0; test_case[test].retval != -1; test++)
+     if (testit (&test_case[test]))
+       ++fail;
+@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
+ 
+   printf ("Test %d (%s): ", ++tests, tc->words);
+ 
++  if (tc->flags & WRDE_NOCMD)
++    registered_forks = 0;
++
+   if (tc->flags & WRDE_APPEND)
+     {
+       /* initial wordexp() call, to be appended to */
+@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
+     }
+   retval = wordexp (tc->words, &we, tc->flags);
+ 
++  if ((tc->flags & WRDE_NOCMD)
++      && (registered_forks > 0))
++    {
++      printf ("FAILED fork called for WRDE_NOCMD\n");
++      return 1;
++    }
++
+   if (tc->flags & WRDE_DOOFFS)
+       start_offs = sav_we.we_offs;
+ 
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index b6b65dd..d6a158f 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -693,6 +693,12 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
+ 	  break;
+ 
+ 	case '`':
++	   if (flags & WRDE_NOCMD)
++	     {
++	       free (expr);
++	       return WRDE_NOCMD;
++	     }
++
+ 	  (*offset)++;
+ 	  error = parse_backtick (&expr, &expr_length, &expr_maxlen,
+ 				  words, offset, flags, NULL, NULL, NULL);
+@@ -1144,6 +1150,10 @@ parse_comm (char **word, size_t *word_length, size_t *max_length,
+   size_t comm_maxlen;
+   char *comm = w_newword (&comm_length, &comm_maxlen);
+ 
++  /* Do nothing if command substitution should not succeed.  */
++  if (flags & WRDE_NOCMD)
++    return WRDE_CMDSUB;
++
+   for (; words[*offset]; ++(*offset))
+     {
+       switch (words[*offset])
+@@ -2121,6 +2131,9 @@ parse_backtick (char **word, size_t *word_length, size_t *max_length,
+       switch (words[*offset])
+ 	{
+ 	case '`':
++	  if (flags & WRDE_NOCMD)
++	    return WRDE_NOCMD;
++
+ 	  /* Go -- give the script to the shell */
+ 	  error = exec_comm (comm, word, word_length, max_length, flags,
+ 			     pwordexp, ifs, ifs_white);

package/glibc/2.20/0001-CVE-2014-7817.patch

@@ -0,0 +1,173 @@
+Patch from https://bugzilla.redhat.com/show_bug.cgi?id=1157689
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!
+EMBARGOED !!! EMBARGOED !!! EMARGOED !!! EMBARGOED !!! EMBARGOED !!!
+SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!! SECURITY !!!
+
+CVE-2014-7817:
+
+The function wordexp() fails to properly handle the WRDE_NOCMD
+flag when processing arithmetic inputs in the form of "$((... ``))"
+where "..." can be anything valid. The backticks in the arithmetic
+epxression are evaluated by in a shell even if WRDE_NOCMD forbade
+command substitution. This allows an attacker to attempt to pass
+dangerous commands via constructs of the above form, and bypass
+the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
+in parse_arith(). The patch also hardens parse_backticks() and 
+parse_comm() to check for WRDE_NOCMD flag and return an error instead
+of ever running a shell.
+
+We expand the testsuite and add 3 new regression tests of roughtly
+the same form but with a couple of nested levels. 
+
+On top of the 3 new tests we add fork validation to the WRDE_NOCMD
+testing. If any forks are detected during the execution of a wordexp()
+call with WRDE_NOCMD, the test is marked as failed. This is slightly
+heuristic since vfork might be used, but it provides a higher level
+of assurance that no shells were executed as part of command substitution
+with WRDE_NOCMD in effect. In addition it doesn't require libpthread or
+libdl, instead we use the public implementation namespace function
+__register_atfork (already part of the public ABI for libpthread).
+
+Tested on x86_64 with no regressions.
+
+2014-10-27  Carlos O'Donell  <carlos@redhat.com>
+
+	* wordexp-test.c (__dso_handle): Add prototype.
+	(__register_atfork): Likewise.
+	(__app_register_atfork): New function.
+	(registered_forks): New global.
+	(register_fork): New function.
+	(test_case): Add 3 new tests for WRDE_CMDSUB.
+	(main): Call __app_register_atfork.
+	(testit): If WRDE_NOCMD set registered_forks to zero, run test, and
+	if fork count is non-zero fail the test.
+	* posix/wordexp.c (parse_arith): Return WRDE_NOCMD if WRDE_NOCMD flag
+	is set and parsing '`'. 
+	(parse_comm): Return WRDE_NOCMD if WRDE_NOCMD flag is set.
+	(parse_backtick): Return WRDE_NOCMD if WRDE_NOCMD flag is set and
+	parsing '`'.
+
+diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
+index 4957006..5ce2a1b 100644
+--- a/posix/wordexp-test.c
++++ b/posix/wordexp-test.c
+@@ -27,6 +27,25 @@
+ 
+ #define IFS " \n\t"
+ 
++extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
++extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
++
++static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
++{
++  return __register_atfork (prepare, parent, child,
++			    &__dso_handle == NULL ? NULL : __dso_handle);
++}
++
++/* Number of forks seen.  */
++static int registered_forks;
++
++/* For each fork increment the fork count.  */
++static void
++register_fork (void)
++{
++  registered_forks++;
++}
++
+ struct test_case_struct
+ {
+   int retval;
+@@ -206,6 +225,12 @@ struct test_case_struct
+     { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
+     { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
++    /* Test for CVE-2014-7817. We test 3 combinations of command
++       substitution inside an arithmetic expression to make sure that
++       no commands are executed and error is returned.  */
++    { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
++    { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
+ 
+     { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
+   };
+@@ -258,6 +283,15 @@ main (int argc, char *argv[])
+ 	  return -1;
+     }
+ 
++  /* If we are not allowed to do command substitution, we install
++     fork handlers to verify that no forks happened.  No forks should
++     happen at all if command substitution is disabled.  */
++  if (__app_register_atfork (register_fork, NULL, NULL) != 0)
++    {
++      printf ("Failed to register fork handler.\n");
++      return -1;
++    }
++
+   for (test = 0; test_case[test].retval != -1; test++)
+     if (testit (&test_case[test]))
+       ++fail;
+@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
+ 
+   printf ("Test %d (%s): ", ++tests, tc->words);
+ 
++  if (tc->flags & WRDE_NOCMD)
++    registered_forks = 0;
++
+   if (tc->flags & WRDE_APPEND)
+     {
+       /* initial wordexp() call, to be appended to */
+@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
+     }
+   retval = wordexp (tc->words, &we, tc->flags);
+ 
++  if ((tc->flags & WRDE_NOCMD)
++      && (registered_forks > 0))
++    {
++      printf ("FAILED fork called for WRDE_NOCMD\n");
++      return 1;
++    }
++
+   if (tc->flags & WRDE_DOOFFS)
+       start_offs = sav_we.we_offs;
+ 
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index b6b65dd..d6a158f 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -693,6 +693,12 @@ parse_arith (char **word, size_t *word_length, size_t *max_length,
+ 	  break;
+ 
+ 	case '`':
++	   if (flags & WRDE_NOCMD)
++	     {
++	       free (expr);
++	       return WRDE_NOCMD;
++	     }
++
+ 	  (*offset)++;
+ 	  error = parse_backtick (&expr, &expr_length, &expr_maxlen,
+ 				  words, offset, flags, NULL, NULL, NULL);
+@@ -1144,6 +1150,10 @@ parse_comm (char **word, size_t *word_length, size_t *max_length,
+   size_t comm_maxlen;
+   char *comm = w_newword (&comm_length, &comm_maxlen);
+ 
++  /* Do nothing if command substitution should not succeed.  */
++  if (flags & WRDE_NOCMD)
++    return WRDE_CMDSUB;
++
+   for (; words[*offset]; ++(*offset))
+     {
+       switch (words[*offset])
+@@ -2121,6 +2131,9 @@ parse_backtick (char **word, size_t *word_length, size_t *max_length,
+       switch (words[*offset])
+ 	{
+ 	case '`':
++	  if (flags & WRDE_NOCMD)
++	    return WRDE_NOCMD;
++
+ 	  /* Go -- give the script to the shell */
+ 	  error = exec_comm (comm, word, word_length, max_length, flags,
+ 			     pwordexp, ifs, ifs_white);

package/gptfdisk/gptfdisk-001-configurable-utf16-support.patch

@@ -7,6 +7,8 @@ the UTF16 support or not.
 
 Signed-off-by: Justin Maggard <jmaggard10@gmail.com>
 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+[baruch: add $(LDLIBS)]
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
 ---
 Index: b/Makefile
 ===================================================================
@@ -32,17 +34,17 @@ Index: b/Makefile
  gdisk:	$(LIB_OBJS) gdisk.o gpttext.o
 -#	$(CXX) $(LIB_OBJS) gdisk.o gpttext.o $(LDFLAGS) -luuid -o gdisk
 -	$(CXX) $(LIB_OBJS) gdisk.o gpttext.o $(LDFLAGS) -licuio -licuuc -luuid -o gdisk
-+	$(CXX) $(LIB_OBJS) gdisk.o gpttext.o $(LDFLAGS) $(UTF16_LIBS) -luuid -o gdisk
++	$(CXX) $(LIB_OBJS) gdisk.o gpttext.o $(LDFLAGS) $(UTF16_LIBS) -luuid $(LDLIBS) -o gdisk
  
  cgdisk: $(LIB_OBJS) cgdisk.o gptcurses.o
 -#	$(CXX) $(LIB_OBJS) cgdisk.o gptcurses.o $(LDFLAGS) -luuid -lncurses -o cgdisk
 -	$(CXX) $(LIB_OBJS) cgdisk.o gptcurses.o $(LDFLAGS) -licuio -licuuc -luuid -lncurses -o cgdisk
-+	$(CXX) $(LIB_OBJS) cgdisk.o gptcurses.o $(LDFLAGS) $(UTF16_LIBS) -luuid -lncurses -o cgdisk
++	$(CXX) $(LIB_OBJS) cgdisk.o gptcurses.o $(LDFLAGS) $(UTF16_LIBS) -luuid -lncurses $(LDLIBS) -o cgdisk
  
  sgdisk: $(LIB_OBJS) sgdisk.o gptcl.o
 -#	$(CXX) $(LIB_OBJS) sgdisk.o gptcl.o $(LDFLAGS) -luuid -lpopt -o sgdisk
 -	$(CXX) $(LIB_OBJS) sgdisk.o gptcl.o $(LDFLAGS) -licuio -licuuc -luuid -lpopt -o sgdisk
-+	$(CXX) $(LIB_OBJS) sgdisk.o gptcl.o $(LDFLAGS) $(UTF16_LIBS) -luuid -lpopt -o sgdisk
++	$(CXX) $(LIB_OBJS) sgdisk.o gptcl.o $(LDFLAGS) $(UTF16_LIBS) -luuid -lpopt $(LDLIBS) -o sgdisk
  
  fixparts: $(MBR_LIB_OBJS) fixparts.o
  	$(CXX) $(MBR_LIB_OBJS) fixparts.o $(LDFLAGS) -o fixparts

package/gptfdisk/gptfdisk.mk

@@ -26,6 +26,10 @@ GPTFDISK_DEPENDENCIES += icu
 GPTFDISK_MAKE_OPTS += USE_UTF16=y
 endif
 
+ifeq ($(BR2_NEEDS_GETTEXT_IF_LOCALE)$(BR2_PREFER_STATIC_LIB),yy)
+GPTFDISK_MAKE_OPTS += LDLIBS=-lintl
+endif
+
 define GPTFDISK_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) \
 		$(GPTFDISK_MAKE_OPTS) $(GPTFDISK_TARGETS_y)

package/grantlee/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_GRANTLEE
 	bool "grantlee"
+	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # Qt Script
 	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT
 	depends on BR2_PACKAGE_QT
 	select BR2_PACKAGE_QT_STL
@@ -9,3 +10,7 @@ config BR2_PACKAGE_GRANTLEE
 	  Qt implemantation of the Django template framework
 
 	  http://www.grantlee.org
+
+comment "grantlee needs a toolchain with NPTL"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL
+	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT

package/gstreamer1/gst1-validate/Config.in

@@ -1,9 +1,14 @@
-menuconfig BR2_PACKAGE_GST1_VALIDATE
+config BR2_PACKAGE_GST1_VALIDATE
 	bool "gst1-validate"
+	depends on BR2_PACKAGE_PYTHON
 	select BR2_PACKAGE_GST1_PLUGINS_BASE
+	select BR2_PACKAGE_PYTHON_PYEXPAT
 	help
 	  GstValidate is a tool that allows GStreamer developers to
 	  check that the GstElements they write behave the way they
 	  are supposed to.
 
 	  http://gstreamer.freedesktop.org/
+
+comment "gst1-validate depends on python"
+	depends on !BR2_PACKAGE_PYTHON

package/gstreamer1/gst1-validate/gst1-validate.mk

@@ -12,6 +12,6 @@ GST1_VALIDATE_LICENSE_FILES = COPYING
 
 GST1_VALIDATE_CONF_OPTS = --disable-sphinx-doc
 
-GST1_VALIDATE_DEPENDENCIES = gstreamer1 gst1-plugins-base
+GST1_VALIDATE_DEPENDENCIES = gstreamer1 gst1-plugins-base host-python python
 
 $(eval $(autotools-package))

package/heirloom-mailx/Config.in

@@ -2,6 +2,7 @@ config BR2_PACKAGE_HEIRLOOM_MAILX
 	bool "heirloom-mailx"
 	# uses fork()
 	depends on BR2_USE_MMU
+	depends on !BR2_PREFER_STATIC_LIB
 	help
 	  Heirloom mailx (previously known as nail) is a mail user
 	  agent for Unix systems.
@@ -13,3 +14,7 @@ config BR2_PACKAGE_HEIRLOOM_MAILX
 	  cram-md5), SMTPS, MIME encoding of attachements, and more.
 
 	  http://heirloom.sourceforge.net/mailx.html
+
+comment "heirloom-mailx needs a toolchain w/ dynamic library"
+	depends on BR2_PREFER_STATIC_LIB
+	depends on BR2_USE_MMU

package/lame/lame.mk

@@ -19,7 +19,7 @@ LAME_LICENSE_FILES = COPYING
 # So, if BR2_ENABLE_DEBUG is selected, then we have force lame to be
 # built without debug symbols for Aarch64 and MIPS because these
 # architectures don't have those macros defined.
-ifeq ($(BR2_ENABLE_DEBUG)$(BR2_aarch64)$(BR2_mips)$(BR2_mipsel)$(BR2_mips64)$(BR2_mips64el),yy)
+ifeq ($(BR2_ENABLE_DEBUG)$(BR2_aarch64)$(BR2_arm)$(BR2_armeb)$(BR2_mips)$(BR2_mipsel)$(BR2_mips64)$(BR2_mips64el),yy)
 LAME_CONF_OPTS += --disable-debug
 endif
 

package/libksba/libksba.hash

@@ -1,2 +1,2 @@
-# Locally calculated after checking pgp signature
-sha256	bc96b95516bd2b67f413bc8b5cc5a75a2583c6e666d24dfd0d5bcc6b1aab46f9	libksba-1.3.1.tar.bz2
+# From http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html
+sha1	37d0893a587354af2b6e49f6ae701ca84f52da67	libksba-1.3.2.tar.bz2

package/libksba/libksba.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBKSBA_VERSION = 1.3.1
+LIBKSBA_VERSION = 1.3.2
 LIBKSBA_SOURCE = libksba-$(LIBKSBA_VERSION).tar.bz2
 LIBKSBA_SITE = ftp://ftp.gnupg.org/gcrypt/libksba
 LIBKSBA_LICENSE = LGPLv3+ or GPLv2+ (library, headers), GPLv3+ (manual, tests, build system)

package/libllcp/libllcp.mk

@@ -7,11 +7,13 @@
 LIBLLCP_VERSION = cf0c4b3c9df98851c6092c130192130c3f5a46bd
 LIBLLCP_SITE = https://libllcp.googlecode.com/git
 LIBLLCP_SITE_METHOD = git
-LIBLLCP_DEPENDENCIES = libnfc
+LIBLLCP_DEPENDENCIES = host-pkgconf libnfc
 # There's no ./configure in the repository, so we need to autoreconf
 LIBLLCP_AUTORECONF = YES
 LIBLLCP_INSTALL_STAGING = YES
 LIBLLCP_LICENSE = GPLv3+
 LIBLLCP_LICENSE_FILES = COPYING
+# ensure graphviz isn't used
+LIBLLCP_CONF_ENV = ac_cv_path_DOT=
 
 $(eval $(autotools-package))

package/libnspr/libnspr.mk

@@ -21,6 +21,12 @@ LIBNSPR_CONF_OPTS = --host=$(GNU_HOST_NAME)
 LIBNSPR_CONF_OPTS += --$(if $(BR2_ARCH_IS_64),en,dis)able-64bit
 LIBNSPR_CONF_OPTS += --$(if $(BR2_INET_IPV6),en,dis)able-ipv6
 
+ifeq ($(BR2_PREFER_STATIC_LIB),y)
+LIBNSPR_MAKE_OPTS = SHARED_LIBRARY=
+LIBNSPR_INSTALL_TARGET_OPTS = DESTDIR=$(TARGET_DIR) SHARED_LIBRARY= install
+LIBNSPR_INSTALL_STAGING_OPTS = DESTDIR=$(STAGING_DIR) SHARED_LIBRARY= install
+endif
+
 ifeq ($(BR2_arm),y)
 ifeq ($(BR2_ARM_CPU_HAS_THUMB2),y)
 LIBNSPR_CONF_OPTS += --enable-thumb2

package/libpng/libpng.hash

@@ -0,0 +1,3 @@
+# From http://sourceforge.net/projects/libpng/files/libpng16/1.6.15/
+md5	a95cb387c53215b034203b41ec57c7e5	libpng-1.6.15.tar.xz
+sha1	bddeac8ca97fbcf54d6d32c6eefed5d94b49df88	libpng-1.6.15.tar.xz

package/libpng/libpng.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBPNG_VERSION = 1.6.12
+LIBPNG_VERSION = 1.6.15
 LIBPNG_SERIES = 16
 LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz
 LIBPNG_SITE = http://downloads.sourceforge.net/project/libpng/libpng${LIBPNG_SERIES}/$(LIBPNG_VERSION)

package/libshairplay/Config.in

@@ -2,11 +2,17 @@ config BR2_PACKAGE_LIBSHAIRPLAY
 	bool "libshairplay"
 	depends on BR2_INET_IPV6
 	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU # avahi
+	depends on !BR2_PREFER_STATIC_LIB # avahi
+	select BR2_PACKAGE_AVAHI
+	select BR2_PACKAGE_AVAHI_DAEMON
+	select BR2_PACKAGE_AVAHI_LIBDNSSD_COMPATIBILITY # runtime
 	help
 	  libshairplay is a client library that emulates an airplay
 	  server.
 
 	  https://github.com/juhovh/shairplay
 
-comment "libshairplay needs a toolchain w/ IPv6, threads"
-	depends on !BR2_INET_IPV6 || !BR2_TOOLCHAIN_HAS_THREADS
+comment "libshairplay needs a toolchain w/ IPv6, threads, dynamic library"
+	depends on BR2_USE_MMU
+	depends on !BR2_INET_IPV6 || !BR2_TOOLCHAIN_HAS_THREADS || BR2_PREFER_STATIC_LIB

package/libtirpc/0007-needs-pthread.patch

@@ -0,0 +1,25 @@
+pkg-config: needs pthread as private library
+
+libtirpc needs pthreads. This is automatically pulled in when linking
+with the shared library, thanks to the DT_NEEDED ELF tags.
+
+But for a static library, there is no such mechanism to identify
+required libraries.
+
+Thus, add -pthread to the private libraries in the pkg-config file.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+---
+Patch sent upstream:
+    http://sourceforge.net/p/libtirpc/mailman/message/33072076/
+
+diff -durN libtirpc-0.2.4.orig/libtirpc.pc.in libtirpc-0.2.4/libtirpc.pc.in
+--- libtirpc-0.2.4.orig/libtirpc.pc.in	2013-12-09 21:59:51.000000000 +0100
++++ libtirpc-0.2.4/libtirpc.pc.in	2014-11-23 14:02:58.677760108 +0100
+@@ -8,4 +8,5 @@
+ Requires:
+ Version: @PACKAGE_VERSION@
+ Libs: -L@libdir@ -ltirpc
++Libs.private: -pthread
+ Cflags: -I@includedir@/tirpc

package/libwebsockets/libwebsockets-0002-cmake-disable-shared-library-build-when-BUILD_SHARED.patch

@@ -9,6 +9,8 @@ updating libwebsockets.
 
 Signed-off-by: Samuel Martin <s.martin49@gmail.com>
 Signed-off-by: Sagaert Johan <sagaert.johan@skynet.be>
+[yann.morin.1998@free.fr: further fix after the version bumped]
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
 ---
  CMakeLists.txt | 17 ++++++++++++-----
  1 file changed, 12 insertions(+), 5 deletions(-)
@@ -76,6 +78,30 @@ index 7978845..89853ce 100644
  	target_link_libraries(${lib} ${LIB_LIST})
  endforeach()
  
--- 
-2.1.2
-
+@@ -793,7 +800,7 @@
+ set(LWS_INSTALL_CMAKE_DIR ${DEF_INSTALL_CMAKE_DIR} CACHE PATH "Installation directory for CMake files")
+ 
+ # Export targets (This is used for other CMake projects to easily find the libraries and include files).
+-export(TARGETS websockets websockets_shared
++export(TARGETS ${_libs_websockets}
+         FILE "${PROJECT_BINARY_DIR}/LibwebsocketsTargets.cmake")
+ export(PACKAGE libwebsockets)
+ 
+@@ -829,7 +835,7 @@
+                 ${PROJECT_BINARY_DIR}/LibwebsocketsConfigVersion.cmake 
+                 @ONLY)
+ 
+-set_target_properties(websockets websockets_shared 
++set_target_properties(${_libs_websockets}
+ 					PROPERTIES PUBLIC_HEADER "${HDR_PUBLIC}")
+ 
+ #
+@@ -837,7 +843,7 @@
+ #
+ 
+ # Install libs and headers.
+-install(TARGETS websockets websockets_shared
++install(TARGETS ${_libs_websockets}
+ 		EXPORT LibwebsocketsTargets
+ 		LIBRARY DESTINATION "${LWS_INSTALL_LIB_DIR}${LIB_SUFFIX}" COMPONENT libraries
+ 		ARCHIVE DESTINATION "${LWS_INSTALL_LIB_DIR}${LIB_SUFFIX}" COMPONENT libraries

package/linux-headers/Config.in.host

@@ -165,12 +165,12 @@ config BR2_DEFAULT_KERNEL_HEADERS
 	default "3.0.101"	if BR2_KERNEL_HEADERS_3_0
 	default "3.2.64"	if BR2_KERNEL_HEADERS_3_2
 	default "3.4.104"	if BR2_KERNEL_HEADERS_3_4
-	default "3.10.60"	if BR2_KERNEL_HEADERS_3_10
+	default "3.10.61"	if BR2_KERNEL_HEADERS_3_10
 	default "3.11.10"	if BR2_KERNEL_HEADERS_3_11
-	default "3.12.32"	if BR2_KERNEL_HEADERS_3_12
+	default "3.12.33"	if BR2_KERNEL_HEADERS_3_12
 	default "3.13.11"	if BR2_KERNEL_HEADERS_3_13
-	default "3.14.24"	if BR2_KERNEL_HEADERS_3_14
+	default "3.14.25"	if BR2_KERNEL_HEADERS_3_14
 	default "3.15.10"	if BR2_KERNEL_HEADERS_3_15
 	default "3.16.7"	if BR2_KERNEL_HEADERS_3_16
-	default "3.17.3"	if BR2_KERNEL_HEADERS_3_17
+	default "3.17.4"	if BR2_KERNEL_HEADERS_3_17
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION

package/luajit/luajit.mk

@@ -64,6 +64,11 @@ define LUAJIT_INSTALL_TARGET_CMDS
 	$(MAKE) PREFIX="/usr" DESTDIR="$(TARGET_DIR)" LDCONFIG=true -C $(@D) install
 endef
 
+define LUAJIT_INSTALL_SYMLINK
+	ln -fs luajit $(TARGET_DIR)/usr/bin/lua
+endef
+LUAJIT_POST_INSTALL_TARGET_HOOKS += LUAJIT_INSTALL_SYMLINK
+
 define HOST_LUAJIT_BUILD_CMDS
 	$(MAKE) PREFIX="/usr" BUILDMODE=static -C $(@D) amalg
 endef

package/mono/mono.mk

@@ -55,6 +55,9 @@ HOST_MONO_CONF_OPTS += \
 	--with-profile4=$(if $(BR2_PACKAGE_MONO_40),yes,no) \
 	--with-profile4_5=$(if $(BR2_PACKAGE_MONO_45),yes,no)
 
+# ensure monolite is used
+HOST_MONO_MAKE_OPTS += EXTERNAL_MCS=false
+
 HOST_MONO_DEPENDENCIES = host-monolite host-gettext
 
 define HOST_MONO_SETUP_MONOLITE

package/mpdecimal/0001-Add-minimal-support-for-enable-disable-shared-static.patch

@@ -0,0 +1,101 @@
+From c349964887901848fb4cd5db53a5bcb6dae27aaa Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Sun, 23 Nov 2014 10:16:33 +0100
+Subject: [PATCH] Add minimal support for --{enable,disable}-{shared,static}
+
+mpdecimal uses autoconf, but not automake or libtool, so this commit
+adds some basic handling of --{enable,disable}-{shared,static}, so
+that building the shared library can be disabled in pure static
+library contexts.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+---
+ Makefile.in          |  6 ++++++
+ configure.ac         | 13 +++++++++++++
+ libmpdec/Makefile.in | 11 ++++++++++-
+ 3 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.in b/Makefile.in
+index 2c91891..0c44f36 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -9,6 +9,8 @@ LIBSTATIC = @LIBSTATIC@
+ LIBSONAME = @LIBSONAME@
+ LIBSHARED = @LIBSHARED@
+ INSTALL = @INSTALL@
++BUILD_SHARED = @BUILD_SHARED@
++BUILD_STATIC = @BUILD_STATIC@
+ 
+ prefix = @prefix@
+ exec_prefix = @exec_prefix@
+@@ -32,9 +34,13 @@ install: FORCE
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(includedir)
+ 	$(INSTALL) -m 644 libmpdec/mpdecimal.h $(DESTDIR)$(includedir)
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(libdir)
++ifeq ($(BUILD_STATIC),yes)
+ 	$(INSTALL) -m 644 libmpdec/$(LIBSTATIC) $(DESTDIR)$(libdir)
++endif
++ifeq ($(BUILD_SHARED),yes)
+ 	$(INSTALL) -m 755 libmpdec/$(LIBSHARED) $(DESTDIR)$(libdir)
+ 	cd $(DESTDIR)$(libdir) && ln -sf $(LIBSHARED) $(LIBSONAME) && ln -sf $(LIBSHARED) libmpdec.so
++endif
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(docdir)
+ 	cp -R doc/* $(DESTDIR)$(docdir)
+ 
+diff --git a/configure.ac b/configure.ac
+index 7ee8f86..2b3e505 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -88,6 +88,19 @@ CFLAGS="$saved_cflags"
+ AC_PROG_INSTALL
+ AC_SUBST(INSTALL)
+ 
++AC_ARG_ENABLE([shared],
++	[AS_HELP_STRING([--enable-shared], [build shared library])],
++	[BUILD_SHARED=$enableval],
++	[BUILD_SHARED=yes])
++
++AC_ARG_ENABLE([static],
++	[AS_HELP_STRING([--enable-static], [build static library])],
++	[BUILD_STATIC=$enableval],
++	[BUILD_STATIC=yes])
++
++AC_SUBST(BUILD_SHARED)
++AC_SUBST(BUILD_STATIC)
++
+ # _FORTIFY_SOURCE wrappers for memmove and bcopy are incorrect:
+ # http://sourceware.org/ml/libc-alpha/2010-12/msg00009.html
+ AC_MSG_CHECKING(for glibc _FORTIFY_SOURCE/memmove bug)
+diff --git a/libmpdec/Makefile.in b/libmpdec/Makefile.in
+index d9619a3..985c73c 100644
+--- a/libmpdec/Makefile.in
++++ b/libmpdec/Makefile.in
+@@ -7,6 +7,8 @@
+ LIBSTATIC = @LIBSTATIC@
+ LIBSONAME = @LIBSONAME@
+ LIBSHARED = @LIBSHARED@
++BUILD_SHARED = @BUILD_SHARED@
++BUILD_STATIC = @BUILD_STATIC@
+ 
+ CC = @CC@
+ LD = @LD@
+@@ -32,8 +34,15 @@ ifeq ($(MAKECMDGOALS), profile_use)
+   MPD_LDFLAGS += $(MPD_PUSE)
+ endif
+ 
++ifeq ($(BUILD_SHARED),yes)
++TARGETS += $(LIBSHARED)
++endif
++
++ifeq ($(BUILD_STATIC),yes)
++TARGETS += $(LIBSTATIC)
++endif
+ 
+-default: $(LIBSTATIC) $(LIBSHARED)
++default: $(TARGETS)
+ 
+ 
+ OBJS := basearith.o context.o constants.o convolute.o crt.o mpdecimal.o \
+-- 
+2.1.0
+

package/mpdecimal/mpdecimal.mk

@@ -10,6 +10,7 @@ MPDECIMAL_INSTALL_STAGING = YES
 MPDECIMAL_LICENSE = BSD-2c
 MPDECIMAL_LICENSE_FILES = LICENSE.txt
 MPDECIMAL_CONF_OPTS = LD="$(TARGET_CC)"
+MPDECIMAL_AUTORECONF = YES
 
 # On i386, by default, mpdecimal tries to uses <fenv.h> which is not
 # available in musl/glibc. So in this case, we tell mpdecimal to use

package/mpg123/mpg123.mk

@@ -11,6 +11,7 @@ MPG123_CONF_OPTS = --disable-lfs-alias
 MPG123_INSTALL_STAGING = YES
 MPG123_LICENSE = LGPLv2.1
 MPG123_LICENSE_FILES = COPYING
+MPG123_DEPENDENCIES = host-pkgconf
 
 MPG123_CPU = $(if $(BR2_SOFT_FLOAT),generic_nofpu,generic_fpu)
 

package/network-manager/Config.in

@@ -8,6 +8,7 @@ config BR2_PACKAGE_NETWORK_MANAGER
 	depends on BR2_USE_MMU # dbus
 	depends on BR2_PACKAGE_HAS_UDEV
 	depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_7
+	select BR2_PACKAGE_DHCPCD if !BR2_PACKAGE_DHCP_CLIENT
 	select BR2_PACKAGE_DBUS
 	select BR2_PACKAGE_DBUS_GLIB
 	select BR2_PACKAGE_GNUTLS

package/nfs-utils/0008-tirpc-with-pkgconfig.patch

@@ -0,0 +1,102 @@
+From 1ecd1f2008bfab7bb3cd6ada135c980414a7f1ba Mon Sep 17 00:00:00 2001
+From: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Date: Sun, 23 Nov 2014 15:53:56 +0100
+Subject: [PATCH] configure: use pkg-config to find libtirpc
+
+Currently, we use a custom function to find libtirpc's headers and
+libraries. This works fine for shared linking.
+
+But for static linking, this forgets to link with -lpthread, which is
+required by libtirpc.
+
+A recent patch was sent to libtirpc to add that missing -lpthread in its
+Libs.private section of its .pc file. Thus, pkg-config will soon be able
+to return the appropriate libraries.
+
+So, use pkg-config to find libtirpc.
+
+And for older libtirpc versions, there is no change in behaviour: we're
+still missing the -lpthread. But once libtirpc has been fixed, we'll
+automatically get that missing library for free! :-)
+
+Remove the --with-libirpcinclude flag as it is no longer needed: pkg-config
+will provide us with the -I and -L flags, now.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Cc: Steve Dickson <steved@redhat.com>
+
+---
+Patch sent upstream:
+    http://article.gmane.org/gmane.linux.nfs/67708
+---
+ aclocal/libtirpc.m4 | 68 ++++++++++-------------------------------------------
+ 1 file changed, 13 insertions(+), 55 deletions(-)
+
+diff --git a/aclocal/libtirpc.m4 b/aclocal/libtirpc.m4
+index b823364..4a19c1a 100644
+--- a/aclocal/libtirpc.m4
++++ b/aclocal/libtirpc.m4
+@@ -2,50 +2,19 @@ dnl Checks for TI-RPC library and headers
+ dnl
+ AC_DEFUN([AC_LIBTIRPC], [
+ 
+-  AC_ARG_WITH([tirpcinclude],
+-              [AC_HELP_STRING([--with-tirpcinclude=DIR],
+-                              [use TI-RPC headers in DIR])],
+-              [tirpc_header_dir=$withval],
+-              [tirpc_header_dir=/usr/include/tirpc])
+-
+-  dnl if --enable-tirpc was specifed, the following components
+-  dnl must be present, and we set up HAVE_ macros for them.
+-
+-  if test "$enable_tirpc" != "no"; then
+-
+-    dnl look for the library
+-    AC_CHECK_LIB([tirpc], [clnt_tli_create], [:],
+-                 [if test "$enable_tirpc" = "yes"; then
+-			AC_MSG_ERROR([libtirpc not found.])
+-		  else
+-			AC_MSG_WARN([libtirpc not found. TIRPC disabled!])
+-			enable_tirpc="no"
+-		  fi])
+-  fi
+-
+-  if test "$enable_tirpc" != "no"; then
+-    dnl also must have the headers installed where we expect
+-    dnl look for headers; add -I compiler option if found
+-    AC_CHECK_HEADERS([${tirpc_header_dir}/netconfig.h],
+-    		      AC_SUBST([AM_CPPFLAGS], ["-I${tirpc_header_dir}"]),
+-		      [if test "$enable_tirpc" = "yes"; then
+-			 AC_MSG_ERROR([libtirpc headers not found.])
+-		       else
+-			 AC_MSG_WARN([libtirpc headers not found. TIRPC disabled!])
+-			 enable_tirpc="no"
+-		       fi])
+-
+-  fi
+-
+-  dnl now set $LIBTIRPC accordingly
+-  if test "$enable_tirpc" != "no"; then
+-    AC_DEFINE([HAVE_LIBTIRPC], 1,
+-              [Define to 1 if you have and wish to use libtirpc.])
+-    LIBTIRPC="-ltirpc"
+-  else
+-    LIBTIRPC=""
+-  fi
+-
++  PKG_PROG_PKG_CONFIG([0.9.0])
++  AS_IF(
++    [test "$enable_tirpc" != "no"],
++    [PKG_CHECK_MODULES([TIRPC], [libtirpc >= 0.2.4],
++                       [LIBTIRPC="${TIRPC_LIBS}"
++                        AM_CPPFLAGS="${AM_CPPFLAGS} ${TIRPC_CFLAGS}"
++                        AC_DEFINE([HAVE_LIBTIRPC], [1],
++                                  [Define to 1 if you have and wish to use libtirpc.])],
++                       [AS_IF([test "$enable_tirpc" = "yes"],
++                              [AC_MSG_ERROR([libtirpc not found.])],
++                              [LIBTIRPC=""])])])
++
++  AC_SUBST([AM_CPPFLAGS])
+   AC_SUBST(LIBTIRPC)
+ 
+ ])dnl

package/nfs-utils/nfs-utils.mk

@@ -28,7 +28,7 @@ NFS_UTILS_TARGETS_$(BR2_PACKAGE_NFS_UTILS_RPC_LOCKD) += usr/sbin/rpc.lockd
 NFS_UTILS_TARGETS_$(BR2_PACKAGE_NFS_UTILS_RPC_RQUOTAD) += usr/sbin/rpc.rquotad
 
 ifeq ($(BR2_PACKAGE_LIBTIRPC),y)
-NFS_UTILS_CONF_OPTS += --enable-tirpc --with-tirpcinclude=$(STAGING_DIR)/usr/include/tirpc/
+NFS_UTILS_CONF_OPTS += --enable-tirpc
 NFS_UTILS_DEPENDENCIES += libtirpc
 else
 NFS_UTILS_CONF_OPTS += --disable-tirpc

package/nftables/nftables.mk

@@ -12,8 +12,16 @@ NFTABLES_DEPENDENCIES = gmp libmnl libnftnl readline host-bison host-flex \
 NFTABLES_LICENSE = GPLv2
 NFTABLES_LICENSE_FILES = COPYING
 
+NFTABLES_LIBS = -lncurses
+ifeq ($(BR2_PREFER_STATIC_LIB)$(BR2_PACKAGE_LIBNFTNL_JSON),yy)
+NFTABLES_LIBS += -ljansson -lm
+endif
+ifeq ($(BR2_PREFER_STATIC_LIB)$(BR2_PACKAGE_LIBNFTNL_XML),yy)
+NFTABLES_LIBS += -lmxml -lpthread
+endif
+
 NFTABLES_CONF_ENV = \
 	ac_cv_prog_CONFIG_PDF=no \
-	LIBS="-lncurses"
+	LIBS="$(NFTABLES_LIBS)"
 
 $(eval $(autotools-package))

package/openssl/openssl.mk

@@ -119,6 +119,8 @@ endef
 # libdl has no business in a static build
 ifeq ($(BR2_PREFER_STATIC_LIB),y)
 define OPENSSL_FIXUP_STATIC_PKGCONFIG
+	$(SED) 's/-ldl//' $(STAGING_DIR)/usr/lib/pkgconfig/libcrypto.pc
+	$(SED) 's/-ldl//' $(STAGING_DIR)/usr/lib/pkgconfig/libssl.pc
 	$(SED) 's/-ldl//' $(STAGING_DIR)/usr/lib/pkgconfig/openssl.pc
 endef
 OPENSSL_POST_INSTALL_STAGING_HOOKS += OPENSSL_FIXUP_STATIC_PKGCONFIG

package/parted/parted-003-fix-static-link-uuid.patch

@@ -0,0 +1,48 @@
+configure: use pkg-config to find libuuid
+
+In some conditions, libuuid may be linked with -lintl. This can be the
+case on uClibc when locales are enabled.
+
+When doing a shared link, this dependency is automatically pulled in via
+a DT_NEEDED ELF tag
+
+For a static link, there is no such mechanism to pull in dependent
+libraries.
+
+Currently, the check for libuuid is done with AC_CHECK_LIB, but this
+does not handle dependencies, and thus a stattic build fails.
+
+Use pkg-config to find libuuid, that automatically pulls in the
+dependencies of libuuid, if any.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+---
+Note: of course, that relies on the fact that libuuid installs a proper
+.pc file; a patch will be submitted upstream shortly.
+
+But even considering the current situation, where libuuid does not
+provide a proper .pc file (yet), this patch does not change the
+behaviour we've had so far; it is a bet on the future! ;-)
+
+diff -durN parted-3.1.orig/configure.ac parted-3.1/configure.ac
+--- parted-3.1.orig/configure.ac	2014-11-29 16:27:49.520560137 +0100
++++ parted-3.1/configure.ac	2014-11-29 16:32:50.799702049 +0100
+@@ -313,16 +313,7 @@
+ AC_SUBST([DL_LIBS])
+ 
+ dnl Check for libuuid
+-UUID_LIBS=""
+-AC_CHECK_LIB([uuid], [uuid_generate], [UUID_LIBS="-luuid"],
+-	[AC_MSG_ERROR(dnl
+-[GNU Parted requires libuuid - a part of the util-linux-ng package (but
+-usually distributed separately in libuuid-devel, uuid-dev or similar)
+-This can probably be found on your distribution's CD or FTP site or at:
+-    http://userweb.kernel.org/~kzak/util-linux-ng/
+-Note: originally, libuuid was part of the e2fsprogs package.  Later, it
+-moved to util-linux-ng-2.16, and that package is now the preferred source.])])
+-AC_SUBST([UUID_LIBS])
++PKG_CHECK_MODULES([UUID],[uuid])
+ 
+ dnl Check for libdevmapper
+ DM_LIBS=

package/parted/parted.mk

@@ -7,7 +7,7 @@
 PARTED_VERSION = 3.1
 PARTED_SOURCE = parted-$(PARTED_VERSION).tar.xz
 PARTED_SITE = $(BR2_GNU_MIRROR)/parted
-PARTED_DEPENDENCIES = util-linux
+PARTED_DEPENDENCIES = host-pkgconf util-linux
 PARTED_INSTALL_STAGING = YES
 # For uclinux patch
 PARTED_AUTORECONF = YES
@@ -33,7 +33,7 @@ ifeq ($(BR2_PREFER_STATIC_LIB),y)
 PARTED_CONF_OPTS += --disable-dynamic-loading
 endif
 
-HOST_PARTED_DEPENDENCIES = host-util-linux
+HOST_PARTED_DEPENDENCIES = host-pkgconf host-util-linux
 HOST_PARTED_CONF_OPTS += \
 	--without-readline \
 	--disable-device-mapper \

package/pciutils/pciutils.mk

@@ -65,12 +65,14 @@ endef
 
 define PCIUTILS_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE1) -C $(@D) $(PCIUTILS_MAKE_OPTS) \
-		PREFIX=$(TARGET_DIR)/usr install install-lib install-pcilib
+		PREFIX=$(TARGET_DIR)/usr SBINDIR=$(TARGET_DIR)/usr/bin \
+		install install-lib install-pcilib
 endef
 
 define PCIUTILS_INSTALL_STAGING_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE1) -C $(@D) $(PCIUTILS_MAKE_OPTS) \
-		PREFIX=$(STAGING_DIR)/usr install install-lib install-pcilib
+		PREFIX=$(STAGING_DIR)/usr SBINDIR=$(STAGING_DIR)/usr/bin \
+		install install-lib install-pcilib
 endef
 
 $(eval $(generic-package))

package/qt/Config.in

@@ -375,12 +375,14 @@ config BR2_PACKAGE_QT_WEBKIT
 	depends on BR2_PACKAGE_QT_GUI_MODULE
 	depends on BR2_PACKAGE_QT_NETWORK
 	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT
+	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # needs pthread_getattr_np()
 	help
 	  Build the WebKit module.
 	  If unsure, say n.
 
-comment "WebKit needs shared library/gui/network support"
+comment "WebKit needs shared library/NPTL toolchain/gui/network support"
 	depends on !(BR2_PACKAGE_QT_SHARED && BR2_PACKAGE_QT_GUI_MODULE && BR2_PACKAGE_QT_NETWORK)
+	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL
 	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT
 
 config BR2_PACKAGE_QT_STL
@@ -402,11 +404,16 @@ config BR2_PACKAGE_QT_OPENSSL
 config BR2_PACKAGE_QT_SCRIPT
 	bool "Script Module"
 	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT
+	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # needs pthread_getattr_np()
 	default y
 	help
 	  Build the Qt Script module.
 	  if unsure, say y.
 
+comment "Script Module needs a toolchain with NPTL"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL
+	depends on BR2_PACKAGE_QT_ARCH_SUPPORTS_WEBKIT
+
 config BR2_PACKAGE_QT_SCRIPTTOOLS
 	bool "Script Tools Module"
 	depends on BR2_PACKAGE_QT_SCRIPT

package/radvd/0001-Drop-check-requirement-we-don-t-do-unit-tests.patch

@@ -0,0 +1,29 @@
+From 2074114cef857f95104367c51ac9367082fc8060 Mon Sep 17 00:00:00 2001
+From: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Date: Sun, 23 Nov 2014 12:16:32 +0100
+Subject: [PATCH 1/3] Drop check requirement, we don't do unit tests
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+---
+ configure.ac | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 59b18a8..5dde3b2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -50,10 +50,6 @@ dnl Determine CC and preset CFLAGS
+ AC_PROG_CC_C99
+ AC_PROG_RANLIB
+ 
+-if test "$arch" = "linux" ; then
+-PKG_CHECK_MODULES([CHECK], [check >= 0.9.4])
+-fi
+-
+ dnl Determine of netlink is available
+ AC_MSG_CHECKING(netlink)
+ AC_TRY_COMPILE([
+-- 
+2.1.0
+

package/radvd/0002-Don-t-force-fstack-protector-the-toolchain-might-lac.patch

@@ -0,0 +1,27 @@
+From 324e1ebc7b86f68f49fb4f1c34a4de60d18dd3c1 Mon Sep 17 00:00:00 2001
+From: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Date: Sun, 23 Nov 2014 12:17:11 +0100
+Subject: [PATCH 2/3] Don't force -fstack-protector, the toolchain might lack
+ support for it
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+---
+ Makefile.am | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 80633e7..8b5a2e4 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -43,7 +43,6 @@ DISABLE_WARNINGS = \
+ 
+ AM_CFLAGS = \
+ 	-fno-strict-aliasing \
+-	-fstack-protector \
+ 	$(ENABLE_WARNINGS) \
+ 	$(DISABLE_WARNINGS)
+ 
+-- 
+2.1.0
+

package/radvd/0003-Improve-check-of-the-sysctl-function.patch

@@ -0,0 +1,49 @@
+From 4c86b3cbf52f810615d92835e98d83e9555a4d88 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Sun, 23 Nov 2014 12:13:47 +0100
+Subject: [PATCH 3/3] Improve check of the sysctl() function
+
+Since sysctl is a deprecated system call, new architectures such as
+ARC don't implement it. In such cases, uClibc installs the
+<sys/sysctl.h> header, but dos not implement the sysctl()
+function. This has the annoying side effect of breaking the sysctl
+detection of radvd, which is purely based on the header file being
+present.
+
+To fix this, this commit adds a check based on the existence of the
+sysctl() function.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+---
+ configure.ac   | 1 +
+ device-linux.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 5dde3b2..5518f71 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -161,6 +161,7 @@ AC_CHECK_HEADERS( \
+ 	time.h \
+ )
+ AC_HEADER_TIME
++AC_CHECK_FUNCS([sysctl])
+ 
+ dnl Checks for typedefs, structures, and compiler characteristics.
+ AC_MSG_CHECKING(whether struct sockaddr_in6 has sin6_scope_id)
+diff --git a/device-linux.c b/device-linux.c
+index 1ecaa6b..d9b56b8 100644
+--- a/device-linux.c
++++ b/device-linux.c
+@@ -183,7 +183,7 @@ int check_ip6_forwarding(void)
+ 		value = -1;
+ 	}
+ 
+-#ifdef HAVE_SYS_SYSCTL_H
++#if defined(HAVE_SYS_SYSCTL_H) && defined(HAVE_SYSCTL)
+ 	int forw_sysctl[] = { SYSCTL_IP6_FORWARDING };
+ 	size_t size = sizeof(value);
+ 	if (!fp && sysctl(forw_sysctl, sizeof(forw_sysctl) / sizeof(forw_sysctl[0]), &value, &size, NULL, 0) < 0) {
+-- 
+2.1.0
+

package/radvd/radvd-01-drop-check.patch

@@ -1,18 +0,0 @@
-Drop check requirement, we don't do unit tests.
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
-
-diff -Nura radvd-2.6.orig/configure.ac radvd-2.6/configure.ac
---- radvd-2.6.orig/configure.ac	2014-09-04 15:54:41.735038724 -0300
-+++ radvd-2.6/configure.ac	2014-09-04 15:54:53.106431815 -0300
-@@ -50,10 +50,6 @@
- AC_PROG_CC_C99
- AC_PROG_RANLIB
- 
--if test "$arch" = "linux" ; then
--PKG_CHECK_MODULES([CHECK], [check >= 0.9.4])
--fi
--
- dnl Determine of netlink is available
- AC_MSG_CHECKING(netlink)
- AC_TRY_COMPILE([

package/radvd/radvd-02-drop-stack-protector.patch

@@ -1,15 +0,0 @@
-Don't force -fstack-protector, the toolchain might lack support for it.
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
-
-diff -Nura radvd-2.1.orig/Makefile.am radvd-2.1/Makefile.am
---- radvd-2.1.orig/Makefile.am	2014-07-22 08:23:12.642260069 -0300
-+++ radvd-2.1/Makefile.am	2014-07-22 08:26:42.651380759 -0300
-@@ -43,7 +43,6 @@
- 
- AM_CFLAGS = \
- 	-fno-strict-aliasing \
--	-fstack-protector \
- 	$(ENABLE_WARNINGS) \
- 	$(DISABLE_WARNINGS)
- 

package/radvd/radvd.mk

@@ -9,7 +9,7 @@ RADVD_SOURCE = radvd-$(RADVD_VERSION).tar.xz
 RADVD_SITE = http://www.litech.org/radvd/dist
 RADVD_DEPENDENCIES = host-bison flex host-flex host-pkgconf
 RADVD_CONF_ENV = ac_cv_prog_cc_c99='-std=gnu99'
-# For radvd-01-drop-check.patch & radvd-02-drop-stack-protector.patch
+# We're patching configure.ac/Makefile.am.
 RADVD_AUTORECONF = YES
 
 define RADVD_INSTALL_INITSCRIPT

package/rtai/rtai.mk

@@ -11,7 +11,7 @@ RTAI_INSTALL_STAGING = YES
 
 # The <pkg>_CONFIG_SCRIPTS cannot apply here to the specificities of rtai-config
 define RTAI_POST_PATCH_FIXUP
-	(SED) 's%^staging=.*%staging=$(STAGING_DIR)%' $(STAGING_DIR)/usr/bin/rtai-config
+	$(SED) 's%^staging=.*%staging=$(STAGING_DIR)%' $(STAGING_DIR)/usr/bin/rtai-config
 endef
 
 RTAI_POST_INSTALL_STAGING_HOOKS += RTAI_POST_PATCH_FIXUP

package/shairport-sync/0001-fix-static-link-openssl.patch

@@ -0,0 +1,41 @@
+configure: fix static link with openssl
+
+Use pkg-config to find openssl libraries, that will return all the
+dependent libraries of openssl as well (e.g. -lz) that can not be
+deduced in case of a static link.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+---
+Patch applied upstream:
+    https://github.com/mikebrady/shairport-sync/commit/2a430ec434674ed8c1959698c061662bb7abc1a1
+
+diff -durN shairport-sync-2.1.8.orig/configure.ac shairport-sync-2.1.8/configure.ac
+--- shairport-sync-2.1.8.orig/configure.ac	2014-10-25 18:03:13.000000000 +0200
++++ shairport-sync-2.1.8/configure.ac	2014-11-29 12:52:41.507981720 +0100
+@@ -21,6 +21,8 @@
+ AC_PROG_CC
+ AC_PROG_INSTALL
+ 
++PKG_PROG_PKG_CONFIG([0.9.0])
++
+ # Checks for libraries.
+ if test "x${with_os_type}" = xlinux; then
+  AC_CHECK_LIB([rt],[clock_gettime], , AC_MSG_ERROR(librt needed))
+@@ -52,8 +56,14 @@
+     AC_MSG_ERROR(choose either "openssl" or "polarssl" encryption)
+   fi
+   if test "x${with_ssl}" = xopenssl ; then
+-    AC_CHECK_LIB([crypto], [MD5_Init], , AC_MSG_ERROR(libcrypto selected, but the library cannot be found!))
+-    AC_CHECK_LIB([ssl],[SSL_library_init], , AC_MSG_ERROR(openssl selected but the library cannot be found!))
++    PKG_CHECK_MODULES(
++        [CRYPTO], [libcrypto],
++        [LIBS="${CRYPTO_LIBS} ${LIBS}"
++         AC_DEFINE([HAVE_LIBCRYPTO],[1],[Define to 1 if you have libcrypto])])
++    PKG_CHECK_MODULES(
++        [SSL], [libssl],
++        [LIBS="${SSL_LIBS} ${LIBS}"
++         AC_DEFINE([HAVE_LIBSSL],[1],[Define to 1 if you have libssl])])
+   elif test "x${with_ssl}" = xpolarssl ; then
+     AC_CHECK_LIB([polarssl],[ssl_init], , AC_MSG_ERROR(PolarSSL selected but the library cannot be found!))
+   else

package/shairport-sync/0002-fix-static-link-alsa.patch

@@ -0,0 +1,27 @@
+configure: fix static link with alsa
+
+Use pkg-config to find the alsa library, that will return all the
+dependent libraries of alsa (e.g. -ldl -lpthread -lrt) as well that
+can not be deduced in case of a static link.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+---
+Patch applied upstream:
+    https://github.com/mikebrady/shairport-sync/commit/e5a74a3ff08134a2b11f07bd850659d7816fb03d
+
+diff -durN shairport-sync-2.1.8.orig/configure.ac shairport-sync-2.1.8/configure.ac
+--- shairport-sync-2.1.8.orig/configure.ac	2014-11-29 12:56:11.954118681 +0100
++++ shairport-sync-2.1.8/configure.ac	2014-11-29 13:07:24.941687600 +0100
+@@ -99,7 +99,10 @@
+   HAS_ALSA=1
+   AM_CONDITIONAL([USE_ALSA], [test 0])
+   AC_DEFINE([CONFIG_ALSA], 1, [Needed by the compiler.])
+-  AC_CHECK_LIB([asound], [snd_pcm_open], , AC_MSG_ERROR(ALSA support requires the asound library!))], )
++  PKG_CHECK_MODULES(
++    [ALSA], [alsa],
++    [LIBS="${ALSA_LIBS} ${LIBS}"
++     AC_DEFINE([HAVE_LIBASOUND],[1],[Define to 1 if you have ALSA])])])
+ AM_CONDITIONAL([USE_ALSA], [test "x$HAS_ALSA" = "x1"])
+ 
+ # Look for SNDIO flag

package/shairport-sync/0003-fix-static-link-popt.patch

@@ -0,0 +1,25 @@
+configure: fix static link with popt
+
+Use pkg-config to find the popt library.
+
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+
+---
+Patch applied upstream:
+    https://github.com/mikebrady/shairport-sync/commit/1f759e57e8c0682613eaaf89a46fdf6db4c6b5cd
+
+diff -durN shairport-sync-2.1.8.orig/configure.ac shairport-sync-2.1.8/configure.ac
+--- shairport-sync-2.1.8.orig/configure.ac	2014-11-29 14:14:36.655955733 +0100
++++ shairport-sync-2.1.8/configure.ac	2014-11-29 14:16:21.072719327 +0100
+@@ -31,7 +31,10 @@
+ AC_CHECK_LIB([daemon],[daemon_log], , AC_MSG_ERROR(libdaemon needed))
+ AC_CHECK_LIB([pthread],[pthread_create], , AC_MSG_ERROR(pthread library needed))
+ AC_CHECK_LIB([m],[exp], , AC_MSG_ERROR(maths library needed))
+-AC_CHECK_LIB([popt],[poptGetContext], , AC_MSG_ERROR(libpopt needed))
++PKG_CHECK_MODULES(
++    [POPT], [popt],
++    [LIBS="${POPT_LIBS} ${LIBS}"
++     AC_DEFINE([HAVE_LIBPOPT],[1],[Define to 1 if you have popt])])
+ 
+ # Look for piddir flag
+ AC_ARG_WITH(piddir, [ --with-piddir=<pathname> Specify a pathname to a directory in which to write the PID file.], [

package/shairport-sync/shairport-sync.mk

@@ -9,9 +9,12 @@ SHAIRPORT_SYNC_SITE = $(call github,mikebrady,shairport-sync,$(SHAIRPORT_SYNC_VE
 
 SHAIRPORT_SYNC_LICENSE = MIT, BSD-3c
 SHAIRPORT_SYNC_LICENSE_FILES = LICENSES
-SHAIRPORT_SYNC_DEPENDENCIES = alsa-lib libdaemon popt
+SHAIRPORT_SYNC_DEPENDENCIES = alsa-lib libdaemon popt host-pkgconf
+
+# Touching configure.ac with the patches
 SHAIRPORT_SYNC_AUTORECONF = YES
-SHAIRPORT_SYNC_CONF_OPTS = --with-alsa # required
+
+SHAIRPORT_SYNC_CONF_OPTS = --with-alsa
 
 # Avahi or tinysvcmdns (shaiport-sync bundles its own version of tinysvcmdns).
 # Avahi support needs libavahi-client, which is built by avahi if avahi-daemon

package/sqlcipher/sqlcipher.mk

@@ -11,14 +11,13 @@ SQLCIPHER_INSTALL_STAGING = YES
 
 SQLCIPHER_CONF_ENV = \
 	CFLAGS="$(TARGET_CFLAGS) $(SQLCIPHER_CFLAGS)" \
-	LDFLAGS="$(TARGET_LDFLAGS) $(SQLCIPHER_LDFLAGS)" \
 	TCLSH_CMD=$(HOST_DIR)/usr/bin/tclsh$(TCL_VERSION_MAJOR)
 
 SQLCIPHER_CONF_OPTS = \
 	--enable-threadsafe
 
 SQLCIPHER_CFLAGS += -DSQLITE_HAS_CODEC # Required according to the README
-SQLCIPHER_LDFLAGS += -lcrypto -lz
+SQLCIPHER_CONF_ENV += LIBS="-lcrypto -lz"
 
 ifneq ($(BR2_LARGEFILE),y)
 # the sqlite configure script fails to define SQLITE_DISABLE_LFS when

package/sstrip/sstrip.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SSTRIP_SITE = svn://dev.openwrt.org/openwrt/trunk/tools/sstrip
+SSTRIP_SITE = svn://svn.openwrt.org/openwrt/trunk/tools/sstrip
 SSTRIP_VERSION = 20154
 HOST_SSTRIP_BINARY = $(GNU_TARGET_NAME)-sstrip
 

package/tcpdump/0002-fix-CVE-2014-8767.patch

@@ -0,0 +1,20 @@
+From https://bugzilla.redhat.com/show_bug.cgi?id=1165160
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+--- tcpdump-tcpdump-4.6/print-olsr.c	2014-10-23 14:07:12.000000000 +0700
++++ tcpdump-4.6.2/print-olsr.c	2014-11-21 14:56:18.205542679 +0700
+@@ -234,6 +234,13 @@
+     ND_PRINT((ndo, "\n\t      neighbor\n\t\t"));
+     neighbor = 1;
+ 
++    u_int caplength;
++
++    /* Checking length of available data before print */
++    caplength = (ndo->ndo_snapend >= msg_data) ? ndo->ndo_snapend - msg_data : 0;
++    if (hello_len > caplength)
++        hello_len = caplength;
++
+     while (hello_len >= sizeof(struct in_addr)) {
+ 
+         /* print 4 neighbors per line */

package/tcpdump/0003-fix-CVE-2014-8768.patch

@@ -0,0 +1,19 @@
+From https://bugzilla.redhat.com/show_bug.cgi?id=1165161
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+--- tcpdump-tcpdump_4.5/print-geonet.c	2014-02-17 05:58:41.000000000 +0700
++++ print-geonet.c	2014-11-21 10:06:58.590217933 +0700
+@@ -237,6 +237,12 @@
+ 		printf("Malformed (small) ");
+ 	}
+ 
++	/* Checking length before print */
++	u_int caplength;
++	caplength = (ndo->ndo_snapend >= bp) ? ndo->ndo_snapend - bp : 0;
++	if (length > caplength)
++		length = caplength;
++
+ 	/* Print user data part */
+ 	if (ndo->ndo_vflag)
+ 		default_print(bp, length);