2014-06-23 16:47:48 +02:00
|
|
|
################################################################################
|
|
|
|
|
#
|
|
|
|
|
# atftp
|
|
|
|
|
#
|
|
|
|
|
################################################################################
|
|
|
|
|
|
2022-10-28 18:57:48 +02:00
|
|
|
ATFTP_VERSION = 0.8.0
|
2014-07-31 10:46:58 +02:00
|
|
|
ATFTP_SITE = http://sourceforge.net/projects/atftp/files
|
2017-03-30 15:43:32 +02:00
|
|
|
ATFTP_LICENSE = GPL-2.0+
|
2014-06-23 16:47:48 +02:00
|
|
|
ATFTP_LICENSE_FILES = LICENSE
|
package: switch to _CPE_ID_VALID
Now that we document _CPE_ID_VALID, and that it shall be used instead of
setting a default value to one of the other _CPE_ID_* variables, change
all of the existing packages to use it, to avoid any error when we later
extend check-package to validate the sanity ofthe _CPE_ID_* variables.
Mechanical change done within the reference container, running the new
check in check-package, to report the CPE_ID errors:
$ make check-package 2>/dev/null \
|awk '{
split($(1), a, ":"); fname = a[1]
split($(2), a, "'\''"); val = a[2]
new_var = $(8); gsub("_CPE_ID_.*", "_CPE_ID_VALID", new_var)
printf("%s %s %s %s\n", fname, $(8), val, new_var)
}' \
|while read fname var val new_var; do
sed -r -i -e "s/${var}[[:space:]]*=[[:space:]]*${val}/${new_var} = YES/" "${fname}"
done
$ git diff -I'CPE_ID_(VENDOR|VALID)'
[empty]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-02-10 22:24:58 +01:00
|
|
|
ATFTP_CPE_ID_VALID = YES
|
2021-07-25 23:30:48 +02:00
|
|
|
ATFTP_SELINUX_MODULES = tftp
|
2022-10-28 18:57:48 +02:00
|
|
|
# No configure in tarball
|
|
|
|
|
ATFTP_AUTORECONF = YES
|
2014-09-27 21:32:44 +02:00
|
|
|
ATFTP_CONF_OPTS = --disable-libwrap --disable-mtftp
|
2014-07-10 15:59:23 +02:00
|
|
|
# For static we need to explicitly link against libpthread
|
|
|
|
|
ATFTP_LIBS = -lpthread
|
package/atftp: security bump to version 0.7.2
Fixes the following security issues:
CVE-2019-11365: An issue was discovered in atftpd in atftp 0.7.1. A remote
attacker may send a crafted packet triggering a stack-based buffer overflow
due to an insecurely implemented strncpy call. The vulnerability is
triggered by sending an error packet of 3 bytes or fewer. There are
multiple instances of this vulnerable strncpy pattern within the code base,
specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and
tftp_mtftp.c.
CVE-2019-11366: An issue was discovered in atftpd in atftp 0.7.1. It does
not lock the thread_list_mutex mutex before assigning the current thread
data structure. As a result, the daemon is vulnerable to a denial of
service attack due to a NULL pointer dereference. If thread_data is NULL
when assigned to current, and modified by another thread before a certain
tftpd_list.c check, there is a crash when dereferencing current->next.
For details, see
https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities
Patch 0001-Makefile.am-link-against-libpthread-for-atftp.patch patches
Makefile.am, so add _AUTORECONF.
CFLAGS is now correctly handled since commit f9dbb96844167f (configure.ac:
fix hard setting of CFLAGS), so drop the workaround about passing
-fgnu89-inline in CPPFLAGS.
Add a hash for the license file.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-05-08 08:35:19 +02:00
|
|
|
# -fgnu89-inline is needed to avoid multiple definition error with gcc 5. See
|
2015-07-13 21:19:38 +02:00
|
|
|
# https://gcc.gnu.org/gcc-5/porting_to.html.
|
|
|
|
|
ATFTP_CONF_ENV = LIBS="$(ATFTP_LIBS)" \
|
package/atftp: security bump to version 0.7.2
Fixes the following security issues:
CVE-2019-11365: An issue was discovered in atftpd in atftp 0.7.1. A remote
attacker may send a crafted packet triggering a stack-based buffer overflow
due to an insecurely implemented strncpy call. The vulnerability is
triggered by sending an error packet of 3 bytes or fewer. There are
multiple instances of this vulnerable strncpy pattern within the code base,
specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and
tftp_mtftp.c.
CVE-2019-11366: An issue was discovered in atftpd in atftp 0.7.1. It does
not lock the thread_list_mutex mutex before assigning the current thread
data structure. As a result, the daemon is vulnerable to a denial of
service attack due to a NULL pointer dereference. If thread_data is NULL
when assigned to current, and modified by another thread before a certain
tftpd_list.c check, there is a crash when dereferencing current->next.
For details, see
https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities
Patch 0001-Makefile.am-link-against-libpthread-for-atftp.patch patches
Makefile.am, so add _AUTORECONF.
CFLAGS is now correctly handled since commit f9dbb96844167f (configure.ac:
fix hard setting of CFLAGS), so drop the workaround about passing
-fgnu89-inline in CPPFLAGS.
Add a hash for the license file.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-05-08 08:35:19 +02:00
|
|
|
CFLAGS="$(TARGET_CFLAGS) -fgnu89-inline"
|
2014-06-23 16:47:48 +02:00
|
|
|
|
|
|
|
|
ifeq ($(BR2_PACKAGE_READLINE),y)
|
|
|
|
|
ATFTP_DEPENDENCIES += readline
|
2014-09-27 21:32:44 +02:00
|
|
|
ATFTP_CONF_OPTS += --enable-libreadline
|
2014-07-10 15:59:23 +02:00
|
|
|
# For static, readline links with ncurses
|
|
|
|
|
ATFTP_LIBS += -lncurses
|
2014-06-23 16:47:48 +02:00
|
|
|
else
|
2014-09-27 21:32:44 +02:00
|
|
|
ATFTP_CONF_OPTS += --disable-libreadline
|
2014-06-23 16:47:48 +02:00
|
|
|
endif
|
|
|
|
|
|
2022-10-28 18:57:48 +02:00
|
|
|
ifeq ($(BR2_PACKAGE_PCRE2),y)
|
|
|
|
|
ATFTP_DEPENDENCIES += pcre2
|
2014-09-27 21:32:44 +02:00
|
|
|
ATFTP_CONF_OPTS += --enable-libpcre
|
2014-06-23 16:47:48 +02:00
|
|
|
else
|
2014-09-27 21:32:44 +02:00
|
|
|
ATFTP_CONF_OPTS += --disable-libpcre
|
2014-06-23 16:47:48 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
$(eval $(autotools-package))
|
