Commit Graph

56819 Commits

Author SHA1 Message Date
Fabrice Fontaine
95167f326f package/apcupsd: add APCUPSD_CPE_ID_VENDOR
cpe:2.3🅰️apcupsd:apcupsd is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aapcupsd%3Aapcupsd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 47ce1876ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:17:51 +02:00
Fabrice Fontaine
8fcfd4771f package/acpid: add CPE variables
cpe:2.3🅰️tedfelix:acpid2 is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atedfelix%3Aacpid2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit befe5981ef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:17:40 +02:00
Fabrice Fontaine
f22f59961f package/chrony: add CHRONY_CPE_ID_VENDOR
cpe:2.3🅰️tuxfamily:chrony is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atuxfamily%3Achrony

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7a7cb59ced)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:17:30 +02:00
Bernd Kuhls
f5a37bd892 DEVELOPERS: add Bernd Kuhls to gptfdisk package
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db19b4ebe4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:17:08 +02:00
Bernd Kuhls
ea0a8d3ffd package/gptfdisk: security bump version to 1.0.7
Release notes:
https://sourceforge.net/p/gptfdisk/code/ci/master/tree/NEWS

Version 1.0.6 fixes CVE-2020-0256 & CVE-2021-0308.

Removed md5 hash.

Rebased patch due to upstream commit
6180deb472/#diff-3

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 75d5e8fb9c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:16:39 +02:00
Fabrice Fontaine
5a2437870b package/odb: fix build with gcc 11
Add -std=c++11 to fix the following build failure with gcc 11:

/data/buildroot-autobuilder/instance-0/output-1/host/include/cutl/shared-ptr/base.hxx:34:41: error: ISO C++17 does not allow dynamic exception specifications
   34 | operator new (std::size_t, cutl::share) throw (std::bad_alloc);
      |                                         ^~~~~

Fixes:
 - http://autobuild.buildroot.org/results/9cbb8be7a1d8ac5913fbc5e2a78c4c45b5daf8e2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ac9855e761)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:15:55 +02:00
Bernd Kuhls
f92c96915e package/efibootmgr: fix comment
Building efibootmgr with a musl toolchain is possible.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b7d6149b68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:15:01 +02:00
Fabrice Fontaine
003645e007 package/dc3dd: disable on riscv32
Disable dc3dd on riscv32 because of the size of time_t (riscv32 has
never had a 32-bit time, and has always been 64-bit from the onset):

        In file included from getdate.y:40:
        verify.h:132:30: error: negative width in bit-field 'verify_error_if_negative_size__'
          132 |       (struct { unsigned int verify_error_if_negative_size__: (R) ? 1 : -1; }))
              |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        verify.h:138:61: note: in expansion of macro 'verify_true'
          138 | # define verify(R) extern int (* verify_function__ (void)) [verify_true (R)]
              |                                                             ^~~~~~~~~~~
        getdate.y:116:1: note: in expansion of macro 'verify'
          116 | verify (LONG_MIN <= TYPE_MINIMUM (time_t) && TYPE_MAXIMUM (time_t) <= LONG_MAX);
              | ^~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/267151dec9d2328a5f8c61ddf224219a4f617e5c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6b9d2ab455)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:13:48 +02:00
Bernd Kuhls
a9c25c4257 package/apache: security bump version to 2.4.48
Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.48

Fixes CVE-2021-31618:
mod_http2: Fix a potential NULL pointer dereference [Ivan Zhakov]

Removed patch 0004 which is included in upstream release.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 351122979b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:12:32 +02:00
Fabrice Fontaine
73b5894c90 package/iftop: fix static build
Fixes:
 - http://autobuild.buildroot.org/results/eb53ff6b031c654daec57050dec376b5c9134a81

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 16600cde23)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:11:52 +02:00
Fabrice Fontaine
53318b98ac package/libraw: add Libs.private to libraw.pc
Add Libs.private to libraw.pc to fix the following static build failure
with imagemagick which is raised since commit
2f47cfade4:

/home/giuliobenetti/autobuild/run/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/giuliobenetti/autobuild/run/instance-1/output-1/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libjasper.a(jpg_enc.c.o): in function `jpg_encode':
jpg_enc.c:(.text+0x1f4): undefined reference to `jpeg_stdio_dest'

Fixes:
 - http://autobuild.buildroot.org/results/88e43a1ea2059a684e50b0f5f2af407e8c6df2e1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit cb3b89e4cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:11:20 +02:00
Baruch Siach
96acbda894 package/netperf: move SITE so s.b.o
The original site is gone.

Fixes:
http://autobuild.buildroot.net/results/8d4a2ef5a7f50ea21b844d6cf806bb83016ae17b/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7cf8adc039)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:09:52 +02:00
Fabrice Fontaine
9ab4079a74 package/gupnp: security bump to version 1.2.6
Fix CVE-2021-33516: An issue was discovered in GUPnP before 1.0.7 and
1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web
server can exploit this vulnerability to trick a victim's browser into
triggering actions against local UPnP services implemented using this
library. Depending on the affected service, this could be used for data
exfiltration, data tempering, etc.

Replace patch by upstream commit as current patch doesn't apply cleanly

https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536
https://gitlab.gnome.org/GNOME/gupnp/-/blob/gupnp-1.2.6/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 94a3b3f062)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:08:40 +02:00
Fabrice Fontaine
82cab93ece package/lttng-tools: disable tests
Disabling tests will fix the following build failures on riscv32:

select_poll_epoll.c:408:16: note: each undeclared identifier is reported only once for each function it appears in
select_poll_epoll.c: In function 'ppoll_fds_ulong_max':
select_poll_epoll.c:440:16: error: 'SYS_ppoll' undeclared (first use in this function); did you mean 'SYS_tkill'?
  440 |  ret = syscall(SYS_ppoll, ufds, ULONG_MAX, NULL, NULL);
      |                ^~~~~~~~~
      |                SYS_tkill
select_poll_epoll.c: In function 'pselect_invalid_fd':
select_poll_epoll.c:488:16: error: 'SYS_pselect6' undeclared (first use in this function); did you mean 'SYS_semctl'?
  488 |  ret = syscall(SYS_pselect6, fd + 1, &rfds, NULL, NULL, NULL, NULL);
      |                ^~~~~~~~~~~~
      |                SYS_semctl

Fixes:
 - http://autobuild.buildroot.org/results/dd39188a7191efa512a51f18f4c34d9ee711a6a7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 2df1c10ba7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:07:50 +02:00
Norbert Lange
43969fbfd0 package/lttng-tools: bump version to 2.12.3
Remove patch 001 as it has been fixed upstream.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 97bec5b4cc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 22:07:38 +02:00
Fabrice Fontaine
7c45b795ea package/vlc: disable on riscv32
vlc unconditionally uses __NR_futex resulting in the following build
failure on riscv32:

linux/thread.c:53:20: error: '__NR_futex' undeclared (first use in this function)
   53 |     return syscall(__NR_futex, addr, op, val, to, addr2, val3);
      |                    ^~~~~~~~~~

A patch that fixes this was submitted upstream, but rejected [1].

Fixes:
 - http://autobuild.buildroot.org/results/be0f2243919d7a052b33118d8a901c922f8d88e7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

[1] https://patches.videolan.org/patch/30581/

(cherry picked from commit cc86b866ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:47:24 +02:00
Fabrice Fontaine
f265d103c6 package/capnproto: fix build on riscv32
Fixes:
 - http://autobuild.buildroot.org/results/1c1cd4775241ee57d878cad5c978413d4b4a8736

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e8c2a3e2d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:46:56 +02:00
Fabrice Fontaine
2956477b9e package/directfb: disable on riscv32
directfb unconditionally uses __NR_futex which will raise the following
build failure on riscv32:

system.c:242:21: error: '__NR_futex' undeclared (first use in this function)
  242 |      ret = syscall( __NR_futex, uaddr, op, val, timeout, uaddr2, val3 );
      |                     ^~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/c0f4168575fa85af933539441eea95a3b10dac91

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit cb6fd050cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:45:08 +02:00
Fabrice Fontaine
2e99476104 package/libkcapi: fix build on riscv32
Fix the following build failure on riscv32:

lib/internal.h:331:20: error: '__NR_io_getevents' undeclared (first use in this function); did you mean 'io_getevents'?
  331 |     return syscall(__NR_io_getevents, ctx, min, max, events, timeout);
      |                    ^~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/c828d4330a8888fe8db4299dc2f20759947f329f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5a075b47a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:44:42 +02:00
Fabrice Fontaine
40bcf91160 package/unscd: disable on riscv32
unscd unconditionally uses __NR_clock_gettime which will raise the
following build failure on riscv32:

nscd-0.54.c:339:14: error: '__NR_clock_gettime' undeclared (first use in this function); did you mean 'clock_gettime'?
  339 |  if (syscall(__NR_clock_gettime, CLOCK_MONOTONIC, &ts))
      |              ^~~~~~~~~~~~~~~~~~
      |              clock_gettime

Fixes:
 - http://autobuild.buildroot.org/results/eb77b18f268d8e59c407f757662117a33d3f9ee3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 34173da168)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:44:25 +02:00
Fabrice Fontaine
e16722c065 package/libcamera: fix build on sparc v8
Fix build failure with sparc v8 which is raised since commit
bd9b7b092c due to
https://git.linuxtv.org/libcamera.git/commit/?id=a8310248fc26cc1e1b791af5e9394c1d20bee269

Fixes:
 - http://autobuild.buildroot.org/results/d0726b2253f1f3d006e057f3b32c646c4b9b5f7a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit dc34fa5c6c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:32:57 +02:00
Baruch Siach
f73e2b821b package/libesmtp: move SITE to s.b.n
The original site is gone, and the author is no longer providing
tarballs:

  https://libesmtp.github.io/notes.html

Change website link to the current official page.

Fixes:
http://autobuild.buildroot.net/results/d788315bf708c31e14ba5fb35dccf94753d5f78a/
http://autobuild.buildroot.net/results/83bfdd8e5f897b4d4be81c4c16106feb4e17bd50/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1410cbd163)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:29:10 +02:00
Bernd Kuhls
4f595935a8 DEVELOPERS: add Bernd Kuhls for intel-mediasdk & deps
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 20a4c7a7f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:28:45 +02:00
Fabrice Fontaine
772d18692a package/libcutl: fix build with gcc 11
Add -std=c++11 to fix the following build failure with gcc 11:

In file included from shared-ptr/base.cxx:5:
../cutl/shared-ptr/base.hxx:34:41: error: ISO C++17 does not allow dynamic exception specifications
   34 | operator new (std::size_t, cutl::share) throw (std::bad_alloc);
      |                                         ^~~~~

Fixes:
 - http://autobuild.buildroot.org/results/60a39d402a0d051c92aa11421b7a14f7729a0380

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4d6ca0a8ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:28:00 +02:00
Heiko Thiery
c31386b070 package/i2c-tools: add I2C_TOOLS_CPE_ID_VENDOR
cpe:2.3🅰️i2c-tools_project:i2c-tools is a valid CPE identifier for this
package:

https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ai2c-tools_project%3Ai2c-tools

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9584765654)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:27:24 +02:00
Romain Naour
03f030bfed uclibc: powerpc: fix PIE/PIC builds with secureplt enabled by default
Apply the fix provided by Yann Sionneau when secureplt is enabled
by default by gcc compiler along with PIE/PIC options.

"For the secure PLT to work in PIC, the r30 register needs to point to the GOT"

Fixes:
[qemu_ppc_e500mc_defconfig] https://gitlab.com/buildroot.org/buildroot/-/jobs/1255661606
[qemu_ppc_g3beige_defconfig] https://gitlab.com/buildroot.org/buildroot/-/jobs/1255661607
[qemu_ppc_mac99_defconfig] https://gitlab.com/buildroot.org/buildroot/-/jobs/1255661609

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Yann Sionneau <yann@sionneau.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 826d350fc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:27:03 +02:00
Romain Naour
e7dd5be8db Config.in: disable PIC/PIE for Nios2
Recently in Buildroot the option BR2_PIC_PIE has been enabled by default along
with other hardening features [1]. Since then the nios2 defconfig
qemu_nios2_10m50_defconfig is failing to boot due to a segfault in init program:

Run /init as init process
  with arguments:
    /init
  with environment:
    HOME=/
    TERM=linux
Failed to execute /init (error -12)

See Buildroot build log and Qemu runtime test log in build artifacts [2].

Analyzing one of the binary with strace show that the problem occur
very early when starting the new process:

 # strace ./busybox
 execve("./busybox", ["./busybox"], 0x7f91ce90 /* 10 vars */) = -1 ENOMEM
(Cannot allocate memory)
 +++ killed by SIGSEGV +++

Several binutils/glibc/gcc version has been tested without any success.

The issue has been reported to the glibc mailing list but it can be a linker
or kernel bug [3].

For the Buildroot 2021.05 release, disable BR2_PIC_PIE until the problem is
found and fixed.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/1285145889

[1] https://git.buildroot.net/buildroot/commit/?id=810ba387bec3c5b6904e8893fb4cb6f9d3717466
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/1285145889
[3] https://sourceware.org/pipermail/libc-alpha/2021-May/126912.html

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 6b4b63a571)
[Peter: backport to 2021.02.x to stop users from manually enabling BR2_PIC_PIE]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:20:23 +02:00
Sam Voss
a4bde640c6 package/hostapd: add upstream patch to fix CVE-2021-27803
Fixes the following:

- CVE-2021-27803: A vulnerability was discovered in how p2p/p2p_pd.c in
wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision
discovery requests. It could result in denial of service or other impact
(potentially execution of arbitrary code), for an attacker within radio
range.

Signed-off-by: Sam Voss <sam.voss@collins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 93b8d601bc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 10:19:14 +02:00
Peter Korsgaard
d15b37d492 package/dhcp: security bump to version 4.4.2-P1
Fixes the following security issue:

- CVE-2021-25217: A buffer overrun in lease file parsing code can be used to
  exploit a common vulnerability shared by dhcpd and dhclient

For details, see the advisory:
https://kb.isc.org/docs/cve-2021-25217

Update the LICENSE hash for a change of copyright years.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cebf2b91b3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 08:37:51 +02:00
Yann E. MORIN
fa0c6b0c76 docs: move the IRC channel away from Freenode
Due to the recent events at Frenode [0], the channel has become a bit
unreliable (much spammed), and users have started to move away already,
as quite a few other projects have moved their IRC presence away from
Freenode.

There are a few alternatives. The first to spring to mind, is the new
Libera.Chat network [1], managed by the previous Freenode staff, so we
could expect quite a good experience there. However, it is a very young
network. The second well known alternative is the long-established OFTC,
which has been very reliable in its 20 years of existence.

So, let's move to OFTC, just because it has a track-record of robustness
(which Libera.Chat still has to build, for being young).

Note: there are a lot of other IRC networks, some very good too, but we
probably would be much off-topic on most of them.

[0] https://lwn.net/Articles/856543/
[1] https://libera.chat/
[2] https://www.oftc.net/

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Acked-by: Matthew Weber <matthew.weber@collins.com>
Acked-by: Heiko Thiery <heiko.thiery@gmail.com>
Acked-By: Vincent Fazio <vfazio@xes-inc.com>
Acked-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fe3cb7978a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 08:36:37 +02:00
Fabrice Fontaine
27f2c517cc package/strace: xtensa needs headers >= 5.0
xtensa support needs user_pt_regs since version 5.6 and
2429c69961

However user_pt_regs is only available since kernel 5.0 and
06fbac8e89

Fixes:
 - http://autobuild.buildroot.org/results/c6c4fb3b9098c5fc5dbe4415e2a9757fc775b746

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fb25c95a0b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-10 08:32:16 +02:00
Peter Korsgaard
105cd3e6ce package/nginx: add upstream CVE-2021-23017 security fix
Fixes the following vulnerability:

- CVE-2021-23017: 1-byte memory overwrite in resolver

For more details, see the advisories:
https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html
https://www.openwall.com/lists/oss-security/2021/05/25/5

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: annotate the patch, that it is a backport]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ab9ceea782)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 23:18:01 +02:00
Peter Korsgaard
7d68013a8a package/libcurl: security bump to version 7.77.0
Fixes the following security issues:

- CVE-2021-22897: schannel cipher selection surprise
  https://curl.se/docs/CVE-2021-22897.html

- CVE-2021-22898: TELNET stack contents disclosure
  https://curl.se/docs/CVE-2021-22898.html

- CVE-2021-22901: TLS session caching disaster
  https://curl.se/docs/CVE-2021-22901.html

Unconditionally disable the ldap(s) options.  These require external
libraries, but the options were ignored if the needed libraries weren't
available. This is now changed to be a fatal error since

dae382a1a1

Additionally, add a post-7.77.0 upstream patch to fix compilation with
bearssl.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: annotate the patch, that it is a backport]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eae15d62c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 23:17:35 +02:00
Fabrice Fontaine
388970eb3c package/gdb: fix gdbserver build with m68k and uclibc
Allow to build gdbserver with m68k and uclibc. This patch is not needed
for version above 9.2 because build_gdbserver as been
moved to its own file since
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=919adfe8409211c726c1d05b47ca59890ee648f1

This new file (gdbserver/configure.srv) does not seem to be affected by
this issue

Fixes:
 - http://autobuild.buildroot.org/results/f4d6d9d8418c0da48a3db4ad5a82e19bd16eae34

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d7ac28707)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 23:16:02 +02:00
Fabrice Fontaine
cfbe193dc8 package/mpv: security bump to version 0.33.1
Fix CVE-2021-30145: A format string vulnerability in mpv through 0.33.0
allows user-assisted remote attackers to achieve code execution via a
crafted m3u playlist file.

https://github.com/mpv-player/mpv/releases/tag/v0.33.1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 34a387b5f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:56:31 +02:00
Fabrice Fontaine
0f35d6dca6 package/paho-mqtt-c: security bump to version 1.3.9
Old security issue not fixed:
https://github.com/eclipse/paho.mqtt.c/issues/1084

https://github.com/eclipse/paho.mqtt.c/milestone/16?closed=1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9dad1ef144)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:55:34 +02:00
Fabrice Fontaine
cbcf61a6d5 package/boost: disable logs with riscv32
boost logs can't be built with riscv32 because it unconditionally uses
__NR_futex:

libs/log/src/event.cpp: In member function 'void boost::log::v2_mt_posix::aux::futex_based_event::wait()':
libs/log/src/event.cpp:38:29: error: '__NR_futex' was not declared in this scope
   38 | #define BOOST_LOG_SYS_FUTEX __NR_futex
      |                             ^~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/8c8135fd7c0517c66c9b3975c494da6d7934cc1b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d72350e62a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:54:26 +02:00
Adrian Perez de Castro
9970bbca52 package/webkitgtk: disable gamepad support
Pass -DENABLE_GAMEPAD=OFF to CMake in order to disable support for the
gamepad API, which requires libmanette, a library that is not yet
available in Buildroot.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 97b2511edb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:53:39 +02:00
Adrian Perez de Castro
071df79e1d package/webkitgtk: select missing multimedia deps
Select a few missing multimedia related dependencies:

- BR2_PACKAGE_GST1_PLUGINS_GOOD_PLUGIN_AUTODETECT is needed for
  "autoaudiosink"; not having this element can cause a crash as
  it is used unconditionally.
- BR2_PACKAGE_GST1_PLUGINS_GOOD_PLUGIN_MATROSKA and
  BR2_PACKAGE_GST1_PLUGINS_GOOD_PLUGIN_VPX are needed for
  WebM video playback.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6823e59111)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:52:39 +02:00
Fabrice Fontaine
2b054f52d7 package/libopenh264: fix mips32 build
Fix build failure with mips32 which is raised since the addition of
bootlin toolchains

Fixes:
 - http://autobuild.buildroot.org/results/cba3e9d0fd061cc3a92cb732bcdc2c7b66dbf6cb

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 52b875d3ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:49:32 +02:00
Yann E. MORIN
d18597c141 package/libffi: drop superfluous CPE_ID_VERSION
The default for FOO_CPE_ID_VERSION is to default to FOO_VERSION, so drop
this superfluous definition.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: "Weber, Matthew L Collins" <Matthew.Weber@collins.com>
Reviewed-by: Matthew Weber <Matthew.Weber@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cb1134bb79)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:46:11 +02:00
Fabrice Fontaine
0b20376f67 package/pifmrds: always link with -lm
Commit 888546e527 wrongly removed linking
with -lm resulting in the following build failure:

/home/buildroot/autobuild/run/instance-3/output-1/host/bin/arm-linux-gnueabihf-gcc  -o pi_fm_rds rds.o waveforms.o pi_fm_rds.o fm_mpx.o control_pipe.o -L/home/buildroot/autobuild/run/instance-3/output-1/host/bin/../arm-buildroot-linux-gnueabihf/sysroot/usr/lib -lsndfile
/home/buildroot/autobuild/run/instance-3/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-linux-gnueabihf/7.3.1/../../../../arm-linux-gnueabihf/bin/ld: fm_mpx.o: undefined reference to symbol 'cos@@GLIBC_2.4'
/home/buildroot/autobuild/run/instance-3/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libm.so.6: error adding symbols: DSO missing from command line

Fixes:
 - http://autobuild.buildroot.org/results/b2a6e6fd77bf9071ce9f75fed1811be9ffe5366d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8258081602)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:45:57 +02:00
Fabrice Fontaine
155dfeb314 package/pifmrds: use pkg-config
Use pkg-config to retrieve libsndfile dependencies

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 888546e527)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-09 22:45:34 +02:00
Fabrice Fontaine
5603394b97 package/php-imagick: add CPE variables
cpe:2.3🅰️php:imagick is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aphp%3Aimagick

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5022410324)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:27:00 +02:00
Fabrice Fontaine
32640f39e9 package/libmspack: add CPE variables
cpe:2.3🅰️kyzer:libmspack is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3🅰️kyzer:libmspack

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 20e20555c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:26:43 +02:00
Fabrice Fontaine
bb2f9b0d1e package/perl: add PERL_CPE_ID_VENDOR
cpe:2.3🅰️perl:perl is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aperl%3Aperl

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0aae08ee3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:26:10 +02:00
Fabrice Fontaine
8fd35db31b package/findutils: add FINDUTILS_CPE_ID_VENDOR
cpe:2.3🅰️gnu:findutils is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Afindutils

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5c81ffaffc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:26:06 +02:00
Fabrice Fontaine
c3cd45d320 package/python-pillow: security bump to version 8.2.0
- Fix numerous CVEs:
  https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security
- Update license to HPND:
  81078e8a0d

https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e4625ae8d5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:25:14 +02:00
Fabrice Fontaine
e1f5ffc326 package/python-pillow: add webpmux support
webpmux is an optional dependency since version 2.2.0 and
b4735f7829

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: move into existing webp conditional block]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a1f3e99f0e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:25:02 +02:00
Fabrice Fontaine
70f869e49f package/python-pillow: add xcb support
libxcb is an optional dependency since version 7.1.0 and
3c39e6fcf6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e1e0e275c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-06-08 10:24:54 +02:00