- Fixes:
- CVE-2015-5312 - Another entity expansion issue
- CVE-2015-7497 - Avoid an heap buffer overflow in xmlDictComputeFastQKey
- CVE-2015-7500 - Fix memory access error due to incorrect entities boundaries
- CVE-2015-8242 - Buffer overead with HTML parser in push mode
- Incorporates upstreamed patches as well, which also fixed:
- CVE-2015-1819 - The xmlreader in libxml allows remote attackers to cause
a denial of service (memory consumption) via crafted XML data, related
to an XML Entity Expansion (XEE) attack.
- CVE-2015-7941 - out-of-bounds memory access.
- CVE-2015-7942 - heap-buffer-overflow in xmlParseConditionalSections.
- CVE-2015-8035 - DoS via crafted xz file.
Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes:
CVE-2015-1819 - The xmlreader in libxml allows remote attackers to cause
a denial of service (memory consumption) via crafted XML data, related
to an XML Entity Expansion (XEE) attack.
CVE-2015-7941 - out-of-bounds memory access.
CVE-2015-7942 - heap-buffer-overflow in xmlParseConditionalSections.
CVE-2015-8035 - DoS via crafted xz file.
All patches upstream.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Now that largefile is mandatory removes package dependencies and
conditionals.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
LZMA support is provided by xz, since liblzma is long dead.
Contrary to zlib, liblzma uses pkg-config, so we do not need to add the
full path to libzma.
Reported-by: vdm on IRC
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This patch aligns the libxml2-config.cmake module to what the libxml-2.0.pc set.
This patch has already been sent upstream:
https://mail.gnome.org/archives/xml/2014-December/msg00015.html
Signed-off-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.
Sed command used:
find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes mesa3d build errors:
http://autobuild.buildroot.net/results/d10/d105a0b3ca11fad34f9a2dae0dae9bd041d918a6/http://autobuild.buildroot.net/results/d71/d7121443715024d15a66ff1abf1261803c10cd35/http://autobuild.buildroot.net/results/ce6/ce64164d76972f82acab277afc9c95a876c6433e/
checking for python2... python2
checking python2 module: libxml2... no
configure: error: failed to find required module libxml2
make: *** [/home/test/test/1/output/build/mesa3d-10.0.4/.stamp_configured] Error 1
mesa3d needs python2 bindings installed by libxml2. To enforce their build
option BR2_PACKAGE_HOST_LIBXML2_PYTHON is used exclusively by mesa3d so this
patch does not affect other packages.
Without this patch host-libxml2 installs the python bindings in
$(HOST_DIR)/usr/lib/$(PYTHON3_VERSION_MAJOR) using this defconfig:
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_PYTHON3=y
because $(HOST_DIR)/usr/bin/python points to $(HOST_DIR)/usr/bin/python3:
Quote from host-libxml2 configure log:
Found python in /home/fli4l/br2/buildroot/output/host/usr/bin/python
Found Python version 3.4
HOST_$(PACKAGE)_NEEDS_HOST_PYTHON does not work here because libxml2 does
not use the python-package infrastructure.
libxml2-python2.patch extends the python detection code in host-libxml2 to
first look for python2, to keep the patch small I did not update the indentions:
Found python2 in /home/fli4l/br2/buildroot/output/host/usr/bin/python2
Found Python version 2.7
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Tested-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The host-libxml2 package does not depend on zlib or lzma, but may
detect versions available on the host. This can cause problems in the
following situation:
1 host-libxml2 is built, finds an available lzma library in the
system, enables lzma support by using it.
2 host-xz is built, which installs a different version of the lzma
library into $(HOST_DIR)
3 host-libxslt is built, tries to link against libxml2, which fails
because now the visible lzma library is the one from
$(HOST_DIR)/usr/lib and no longer the one libxml2 was built agains.
To fix this, this patch passes --without-zlib and --without-lzma to
the host package.
In addition, since the target variant of libxml2 does not have
provisions to depend on the target lzma, we also pass --without-lzma
for the target variant. The case of zlib for the target was already
properly taken into account.
Fixes:
http://autobuild.buildroot.org/results/6dc/6dcef647eb0f0db7de3f34194eb15ceebc645b39/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Tab instead of spaces
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Use the <pkg>_CONFIG_SCRIPTS mechanism in all packages for which it
does all what the package was doing. A few packages, like libxslt, are
for now left out, since they need some additional fixup (for example a
fixup of includedir).
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Finally get rid of all := used for variable definitions in packages,
as we suggest in our manual and during the review of new packages.
While I was at it, I also sometimes added a few missing new lines
between the header and the first variable definition.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The API generation script in mesa3d requires libxml2 to be built with
debug, because it uses the lsCountNode function which is only available
in debug mode.
Note that this is the second "temporary" hack to make mesa3d work.
See http://lists.busybox.net/pipermail/buildroot/2012-November/061936.html
for possible more fundamental solutions.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Patch based on the initial work of Will Wagner (Thanks Will).
libxml2 host library with python support is required to build mesa3d (7.10.1)
Signed-off-by: Vellemans Noel <noel.vellemans@visionbms.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Some of the patches depends on eachother, so rename them to ensure they
get applied in the correct order.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Fixes for CVE-2011-1944, CVE-2011-2821, CVE-2011-2834, CVE-2011-3919,
CVE-2012-0841 and others from upstream.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Thanks to the pkgparentdir and pkgname functions, we can rewrite the
AUTOTARGETS macro in a way that avoids the need for each package to
repeat its name and the directory in which it is present.
[Peter: pkgdir->pkgparentdir]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Some configure options changed so adjust.
Forcibly disabling threads isn't good and also it's detected by
configure when there are no threads.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Bump libxml2 to version 2.7.8.
Re-enable libtool patch now that we handle libtool2 in package infra.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The configuration cache shared between packages, while being in
principle a nice idea to speed-up the configuration of packages by
avoiding repetitive identical checks, turned out to be unreliable due
to the subtle differences between similar but not identical checks in
different packages. After spending some time trying to fix those, we
concluded that supporting the shared configuration cache is definitely
too hard and too unreliable, and that we'd better get rid of it
altogether.
This patch therefore removes the shared configuration cache
infrastructure and usage.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* Remove $(TARGET_DIR)/usr/share/aclocal from target-finalize when not
installing devfiles and
* Remove some (now) redundant cleanup from individual packages
Signed-off-by: Malte Starostik <m-starostik@versanet.de>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
On my target rootfs it is installed documentation for:
atk, cairo, gdk, gdk-pixbuf, gio, glib, gobject, gtk, pango
It ocupies 34M of space. Configure option --disable-gtk-doc doesn't
prevent installation of it. So we should remove them manually if
documentation is disabled.
[Peter: also remove manual rm's from hal/libxml2/libglade]
Signed-off-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Makefile.autotools.in automatically adds these to the configure invocation,
so there's no need to explicitly list them.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The libtool patch is not applied when building for the target because
it does not apply, so do not attempt to apply it when building for the
host. This fixes libxml2 build for the host.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
We have been passing -q to ./configure when using 'make -s' for
packages using Makefile.autotools.in for some time. Do the same
for packages using autotools, but not using the
Makefile.autotools.in infrastructure, taking care to not do it
for packages with hand written configure scripts.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
A C library will have been built by the toolchain makefiles, so there is no
need for packages to explicitly depend on uclibc.
Signed-off-by: Will Newton <will.newton@gmail.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Closes#491
- Deletion of reject files no longer required as they have gone from
the upstream release.
Signed-off-by: Will Newton <will.newton@gmail.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Some other packages, such as shared-mime-info, might need libxml2 and
related tools (xmllint, etc.) to be available on the host. This patch
modifies tthe libxml2 Makefile to compile libxml2 for the host, in
$(HOST_DIR).
Patch from Sven Neumann <s.neumann@raumfeld.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
