Commit Graph

54640 Commits

Author SHA1 Message Date
Peter Korsgaard
4aa20c27bc package/docker-cli: bump version to 19.03.15
Bugfix release, fixing the following issue:

- Check contexts before importing them to reduce risk of extracted files
  escaping context store

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-11 23:06:08 +01:00
Peter Korsgaard
301cba0ea2 package/docker-engine: security bump to version 19.03.15
Fixes the following security issues:

- CVE-2021-21285 Prevent an invalid image from crashing docker daemon
  https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8

- CVE-2021-21284 Lock down file permissions to prevent remapped root from
  accessing docker state
  https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-11 23:06:06 +01:00
Christian Stewart
a4b407d9e1 package/go: bump to version 1.15.8
go1.15.8 (released 2021/02/04) includes fixes to the compiler, linker, runtime,
the go command, and the net/http package.

https://golang.org/doc/go1.15

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ccbbcca9b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-11 21:58:25 +01:00
Peter Korsgaard
d6f0a981f9 packago/go: security bump to version 1.15.7
Fixes the following security issues:

- cmd/go: packages using cgo can cause arbitrary code execution at build time

  The go command may execute arbitrary code at build time when cgo is in use
  on Windows.  This may occur when running “go get”, or any other command
  that builds code.  Only users who build untrusted code (and don’t execute
  it) are affected.

  In addition to Windows users, this can also affect Unix users who have “.”
  listed explicitly in their PATH and are running “go get” or build commands
  outside of a module or with module mode disabled.

  Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

  This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.

- crypto/elliptic: incorrect operations on the P-224 curve

  The P224() Curve implementation can in rare circumstances generate
  incorrect outputs, including returning invalid points from ScalarMult.

  The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
  support P-224 ECDSA keys, but they are not supported by publicly trusted
  certificate authorities.  No other standard library or golang.org/x/crypto
  package supports or uses the P-224 curve.

  The incorrect output was found by the elliptic-curve-differential-fuzzer
  project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).

  This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0e1b5aa572)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-11 21:58:18 +01:00
Thomas Petazzoni
94aeb4712c utils/getdeveloperlib.py: reduce Cc: list based on package infras
When a developer has package/pkg-<infra>.mk assigned to him/her in the
DEVELOPERS file, this has 3 implications:

 (1) Patches adding new packages using this infrastructure are Cc'ed
     to this developer. This is done by the analyze_patch() function,
     which matches the regexp r"^\+\$\(eval
     \$\((host-)?([^-]*)-package\)\)$" in the patch, i.e where an
     added line contains a reference to the infra maintained by the
     developer.

 (2) Patches touching the package/pkg-<infra>.mk file itself are Cc'ed
     to this developer.

 (3) Any patch touching a package using this infra are also Cc'ed to
     this developer.

Point (3) causes a significant amount of patches to be sent to
developers who have package/pkg-generic.mk and
package/pkg-autotools.mk assigned to them in the DEVELOPERS
file. Basically, all patches touching generic or autotools packages
get CC'ed to such developers, which causes a massive amount of patches
to be received.

So this patch adjusts the getdeveloperlib.py to drop point (3), but
preserves point (1) and (2). Indeed, it makes sense to be Cc'ed on new
package additions (to make a review that they use the package
infrastructure correctly), and it makes sense to be Cc'ed on patches
that touch the infrastructure code itself.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 38b0560f4e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-11 21:56:28 +01:00
Peter Korsgaard
8f8159f950 package/intel-microcode: security bump to version 20201118
Fixes the following security issues:

- CVE-2020-8694: Insufficient access control in the Linux kernel driver for
  some Intel(R) Processors may allow an authenticated user to potentially
  enable information disclosure via local access.

  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html

- CVE-2020-8695: Observable discrepancy in the RAPL interface for some
  Intel(R) Processors may allow a privileged user to potentially enable
  information disclosure via local access.

  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html

- CVE-2020-8698: Improper removal of sensitive information before storage or
  transfer in some Intel(R) Processors may allow an authenticated user to
  potentially enable information disclosure via local access.

  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9974d88362)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:58:15 +01:00
Peter Korsgaard
3f52fe670b package/connman: add upstream security fixes for CVE-2021-2667{5, 6}
Fixes the following security issues:

- CVE-2021-26675: Remote (adjacent network) code execution flaw
- CVE-2021-26676: Remote stack information leak

For details, see the advisory:
https://www.openwall.com/lists/oss-security/2021/02/08/2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cf1dd7e007)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:55:43 +01:00
Baruch Siach
9b456d104e package/memtester: fix compile and link flags
The memtester build system does not use CFLAGS/LDFLAGS variables.
Everything should be written to conf-cc and conf-ld.

Use '%' as sed expression delimiter because comma might appear in
LDFLAGS.

Cc: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 25e09fdb9e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:53:53 +01:00
Peter Korsgaard
fff18cb0fa package/mosquitto: bump version to 1.6.13
Includes a number of bugfixes.  For details, see the announcement:
https://mosquitto.org/blog/2021/02/version-2-0-7-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:51:24 +01:00
Bartosz Bilas
38b229167c package/rauc: package/rauc: bump version to 1.5.1
Removed patch applied upstream.

Signed-off-by: Bartosz Bilas <b.bilas@grinn-global.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f786969f2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:34:29 +01:00
Bernd Kuhls
28cc928647 {linux, linux-headers}: bump 5.{4, 10}.x 4.{4, 9, 14, 19} series
Stick to 4.4.255 / 4.4.255 even though .256 is ready, as the wraparound of
the minor version may cause problems:

https://lkml.org/lkml/2021/2/5/747
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.256

https://lkml.org/lkml/2021/2/5/862
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.256

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: stick to 4.{4,9}.255]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b2dad74686)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 20:31:38 +01:00
Peter Korsgaard
c8273b48b9 package/python3: add upstream security fix for CVE-2021-3177
Fixes the following security issue:

- CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in
  PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution
  in certain Python applications that accept floating-point numbers as
  untrusted input, as demonstrated by a 1e300 argument to
  c_double.from_param.  This occurs because sprintf is used unsafely.

For details, see the advisory:
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5405b29570)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 19:57:42 +01:00
Fabrice Fontaine
89898b6991 package/makedumpfile: fix build on sparc64
Fix the following build failure on sparc64:

/home/giuliobenetti/autobuild/run/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/sparc64-buildroot-linux-gnu/9.3.0/../../../../sparc64-buildroot-linux-gnu/bin/ld: /tmp/ccylTux8.o: in function `find_kaslr_offsets':
/home/giuliobenetti/autobuild/run/instance-0/output-1/build/makedumpfile-1.6.8/makedumpfile.c:4017: undefined reference to `get_kaslr_offset'

Even if this build failure is only raised with version 1.6.8,
get_kaslr_offset was also undeclared on sparc64 in version 1.6.7

Fixes:
 - http://autobuild.buildroot.org/results/1421f54f7599bba62c0a4bd5c65ce21c8cc7ee1a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 28df31e8dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 19:56:54 +01:00
Peter Korsgaard
3a042904f1 package/atftp: add security fix for CVE-2020-6097
Fixed the following security issue:

- CVE-2020-6097: An exploitable denial of service vulnerability exists in
  the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1.  A
  specially crafted sequence of RRQ-Multicast requests trigger an assert()
  call resulting in denial-of-service.  An attacker can send a sequence of
  malicious packets to trigger this vulnerability.

For more details, see the report:
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5b36e91fda)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 19:55:11 +01:00
Peter Korsgaard
ef12ec2f6c package/wpa_supplicant: add upstream 2020-2 security fix
Fixes the following security issue:

 - wpa_supplicant P2P group information processing vulnerability (no CVE yet)

   A vulnerability was discovered in how wpa_supplicant processing P2P
   (Wi-Fi Direct) group information from active group owners.  The actual
   parsing of that information validates field lengths appropriately, but
   processing of the parsed information misses a length check when storing a
   copy of the secondary device types.  This can result in writing attacker
   controlled data into the peer entry after the area assigned for the
   secondary device type.  The overflow can result in corrupting pointers
   for heap allocations.  This can result in an attacker within radio range
   of the device running P2P discovery being able to cause unexpected
   behavior, including termination of the wpa_supplicant process and
   potentially arbitrary code execution.

For more details, see the advisory:
https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: keep _PATCH near _VERSION and _SITE]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 74c854bd51)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 19:54:27 +01:00
Romain Naour
b74c28ab89 package/xenomai: disable cobalt for armv8
When a armv8 target is used in 32bits mode, xenomai fail to detect the
ARM architecture and abord the build. (__ARM_ARCH_7A__ is not defined
for armv8 cpus).

There are no autobuilder failures for this issue since cobalt is never
selected, but the following defconfig:

BR2_arm=y
BR2_cortex_a53=y
BR2_ARM_FPU_NEON_VFPV4=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_XENOMAI=y
BR2_PACKAGE_XENOMAI_COBALT=y

This was initialy reproduced using the raspberrypi3_defconfig with
Xenomai package with cobalt selected.

In order to use Xenomai on raspberrypi3 in 32 bits mode, one has to
select BR2_cortex_a7 instead of BR2_cortex_a53 (see a13a388dd4).

See:
https://gitlab.denx.de/Xenomai/xenomai/-/blob/v3.1/lib/cobalt/arch/arm/include/asm/xenomai/features.h#L52

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[yann.morin.1998@free.fr:
  - switch to independent conditional 'default y'
  - slightly reword the commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6490a11018)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 11:25:37 +01:00
Romain Naour
536f7a84a3 package/xenomai: smp support needs at least armv6
There are no autobuilder failures for this issue, but the following
defconfig:

BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_XENOMAI=y
BR2_PACKAGE_XENOMAI_COBALT=y

See:
https://gitlab.denx.de/Xenomai/xenomai/-/blob/v3.1/lib/cobalt/arch/arm/include/asm/xenomai/features.h#L56

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[yann.morin.1998@free.fr: fix the condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cb380c2e11)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 11:25:25 +01:00
Bernd Kuhls
9cf80c8aa0 package/php: security bump version to 7.4.15
Changelog: https://www.php.net/ChangeLog-7.php#7.4.15

Fixes CVE-2021-21702: http://bugs.php.net/80672

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c0ed274ffa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:11:23 +01:00
Fabrice Fontaine
b45271166a package/cereal: fix CVE-2020-11105
Fix CVE-2020-11105: An issue was discovered in USC iLab cereal through
1.3.0. It employs caching of std::shared_ptr values, using the raw
pointer address as a unique identifier. This becomes problematic if an
std::shared_ptr variable goes out of scope and is freed, and a new
std::shared_ptr is allocated at the same address. Serialization fidelity
thereby becomes dependent upon memory layout. In short, serialized
std::shared_ptr variables cannot always be expected to serialize back
into their original values. This can have any number of consequences,
depending on the context within which this manifests.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 26a46564f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:07:56 +01:00
Fabrice Fontaine
bc111b9598 package/sox: fix static build with id3tag
This build failure is raised since bump to
7524160b29a476f7e87bc14fddf12d349f9a3c5e

Fixes:
 - http://autobuild.buildroot.org/results/73efdacf237e3d567fa66f3b3f68e624f5e35bc7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 58fc4b5085)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:03:03 +01:00
Arnout Vandecappelle (Essensium/Mind)
bf4ad2f9a7 package/sox: remove EOL whitespace
Fixes https://gitlab.com/buildroot.org/buildroot/-/jobs/1010083301

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit c7eefe19cc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:02:55 +01:00
Fabrice Fontaine
d4065deba8 package/sox: security bump to latest git commit
Bump to the latest git commit as this will fix the following CVEs:

git log|grep CVE
  sox-fmt: validate comments_bytes before use (CVE-2019-13590) [bug #325]
  fix possible null pointer deref in lsx_make_lpf() (CVE-2019-8357)
  fft4g: bail if size too large (CVE-2019-8356)
  fix possible overflow in lsx_(re)valloc() size calculation (CVE-2019-8355)
  fix possible buffer size overflow in lsx_make_lpf() (CVE-2019-8354)
  xa: validate channel count (CVE-2017-18189)
  aiff: fix crash on empty comment chunk (CVE-2017-15642)
  adpcm: fix stack overflow with >4 channels (CVE-2017-15372)
  flac: fix crash on corrupt metadata (CVE-2017-15371)
  wav: ima_adpcm: fix buffer overflow on corrupt input (CVE-2017-15370)
  wav: fix crash writing header when channel count >64k (CVE-2017-11359)
  hcom: fix crash on input with corrupt dictionary (CVE-2017-11358)
  wav: fix crash if channel count is zero (CVE-2017-11332)

- Tweak configuration options due to
  6ff0e9322f
- libgsm is now an optional dependency since
  e548827ffc
- Add patch to put back --disable-stack-protector

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b6871f9d93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:01:50 +01:00
Fabrice Fontaine
9af206254d package/sox: drop unrecognized options
ffmpeg has been dropped since version 14.4.2 (back in 2013) and
5ae4049727

--disable-gomp has also been removed since version 14.4.1 (back in 2012)
and
84eaacb54f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9829813427)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 10:00:47 +01:00
Peter Korsgaard
38cb4ec8b3 package/python-bottle: security bump to version 0.12.19
Fixes the following security issue:

CVE-2020-28473: The package bottle from 0 and before 0.12.19 are vulnerable
to Web Cache Poisoning by using a vector called parameter cloaking.  When
the attacker can separate query parameters using a semicolon (;), they can
cause a difference in the interpretation of the request between the proxy
(running with default configuration) and the server.  This can result in
malicious requests being cached as completely safe ones, as the proxy would
usually not see the semicolon as a separator, and therefore would not
include it in a cache key of an unkeyed parameter.

In addition, bottle 0.12.18 fixed a compatibility issue with python 3.8+:

https://github.com/bottlepy/bottle/issues/1181

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 14cc349d26)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-10 09:56:25 +01:00
Fabrice Fontaine
7f4a11e2f8 Revert "package/stress-ng: disable libbsd on static build"
This reverts commit f2d6c5ff90.

Now that libbsd can't be enabled for static builds, we can drop the
workaround specific to stress-ng.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 53213e762d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 17:56:08 +01:00
Fabrice Fontaine
d712141cc5 package/libbsd: needs dynamic library
Static linking with libbsd fails because of multiple definition of the
strlcpy symbol. uClibc optionally provides these symbols.

So add a dependency on dynamic library to avoid a build failure with a
zeromq-enabled bitcoin or with stress-ng.

Fixes:
 - http://autobuild.buildroot.org/results/ba87544d42ad5e77a27a7a504bc6336a06f6e291

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1edd0ac66a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 17:54:38 +01:00
Yann Sionneau
a8ee27108b package/libopenssl: fix issue when compiling with BR2_OPTIMIZE_G=y
For instance on risc-v 64 arch the build would otherwise fail because
of undefined ucontext_t because "-DOPENSSL_NO_ASYNC" would not propagate
through to CFLAGS in the Makefile.

Signed-off-by: Yann Sionneau <ysionneau@kalray.eu>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a00b6354a2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 17:52:48 +01:00
Yann E. MORIN
31b3bf6200 package/pkg-meson.mk: fix ccache auto-detection avoidance
Commit f4a61d1ae2 (package/pkg-meson.mk avoid host ccache detection)
forced the host C and C++ compilers so that meson does not try to
autodetect ccache, and instead relies on what we provide.

However, this incorrectly used single-expansion of variables in a
package infra.

For traditional builds, this is OK, because the value does not change
across packages.

However, for builds with per-package directories, this value only refers
to the generic path, which ill not exist until the end of the build when
all packages are aggregated in the host-finalize step.

Fix that by postponing the variable evaluation like all the others.

Reported-by: Xogium on IRC
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 548b8c5412)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 17:52:06 +01:00
Yann E. MORIN
f0157044f9 package/linux-headers: with headers from kernel, also override srcdir
When using the headers from the kernel to be built, with the kernel
set to a custom version, and overriding the kernel sources with
LINUX_OVERRIDE_SRCDIR, the linux-headers package is still trying to
download an archive, and fails to validate its hash.

What is going on under the hood is that, with _OVERRIDE_SRCDIR, the
_VERSION of a package is set to 'custom'. Furthermore, the variable
BR_NO_CHECK_HASH_FOR is recursively expanded, so its value is only
evaluated when it is needed.

For linux-headers, we inherit the values from the linux package, and
the LINUX_HEADERS_VERSION takes the value from the configuration.

Thus we end up with the following situation:

    LINUX_VERSION=custom
    LINUX_HEADERS_VERSION=5.10   # For example
    BR_NO_CHECK_HASH_FOR=... linux-custom.tar.gz ...

And thus the archive downloaded by linux-headers will not match any
exclusion, and since there will most probably not be a hash for it,
the download will fail, as was noticed and reported by Jarkko.

But in this case, what we really want is to really use the headers
from the kernel that we build, we do not even want to attempt a
download at all.

So, when using the headers from the kernel to be built, we also
propagate the LINUX_OVERRIDE_SRCDIR to linux-headers, so that we
also use the headers from the overridden sources.

Furthermore, in that configuration, we explicitly disallow
overriding the linux-headers specifically, as it does not make sense
(even though, if they were overridden to the same location, that'd
be OK, but to simplify the condition, we do not even check for that).

Reported-by: Jarkko Sakkinen <jjs@kapsi.fi>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b9e7adc152)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 17:26:42 +01:00
Nicolas Cavallari
211a67b0cb package/dnsmasq: security bump to 2.83
From the annoucement:
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html

"There are broadly two sets of problems. The first is subtle errors in
dnsmasq's protections against the chronic weakness of the DNS protocol
to cache-poisoning attacks; the Birthday attack, Kaminsky, etc. [...]

[...] the second set of errors is a good old fashioned buffer overflow
in dnsmasq's DNSSEC code."

Fixes CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684,
      CVE-2020-25685, CVE-2020-25686 and CVE-2020-25687

Details: https://www.jsof-tech.com/disclosures/dnspooq

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5cd5d85cda)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 16:38:57 +01:00
Baruch Siach
4d390fc5dd package/dnsmasq: bump to version 2.82
Drop Makefile modification for pkg-config. Build time PATH ensures that
the Buildroot pkg-config is used.

Cc: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 62257b3247)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 16:38:52 +01:00
Joeri Barbarien
7a7442c85c package/chartjs: security bump to 2.9.4
CVE-2020-7746 (https://nvd.nist.gov/vuln/detail/CVE-2020-7746)

    The options parameter is not properly sanitized when it is processed.
    When the options are processed, the existing options (or the defaults
    options) are deeply merged with provided options. However, during this
    operation, the keys of the object being set are not checked, leading to
    a prototype pollution.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a20a86d7f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 16:33:37 +01:00
Thomas De Schampheleire
810926dffe package/chartjs: move 'v' version prefix out of CHARTJS_VERSION
chartjs 2.9.3 has a security vulnerability (CVE-2020-7746) which is not
detected by the CVE scripts, presumably because our version variable starts
with a 'v'.

Move that 'v' prefix out of the version variable to fix that.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0244b11597)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 16:33:26 +01:00
Samuel Mendoza-Jonas
efca26a405 package/busybox: Fix check for IPv6 default route in udhcpc
The check for a default route is inverted, causing the script to wait
for the timeout even when a default IPv6 route is available. Fix this up
so that it exits early as expected.

Reported-by: Bhattiprolu RaviKumar <ravikumar.bhattiprolu@gmail.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 09ad6f392f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:29:45 +01:00
Peter Korsgaard
8f0312d967 package/wireguard-linux-compat: bump version to 1.0.20210124
Fixes a build issue with recent 4.14.x stable kernels.  For details, see the
announcement:

https://lists.zx2c4.com/pipermail/wireguard/2021-January/006349.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ff852b0de4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:27:53 +01:00
Peter Korsgaard
535c86e6f7 package/python-django: security bump to version 3.0.12
Fixes the following security issues:

CVE-2021-3281: Potential directory-traversal via archive.extract()

The django.utils.archive.extract() function, used by startapp --template and
startproject --template, allowed directory-traversal via an archive with
absolute paths or relative paths with dot segments.

For details, see the advisory:
https://www.djangoproject.com/weblog/2021/feb/01/security-releases/

Additionally, 3.0.11 fixed a regression:
https://docs.djangoproject.com/en/3.1/releases/3.0.11/

Update indentation in hash file (two spaces).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 28355e20fe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:26:39 +01:00
Peter Korsgaard
3e8d678be2 package/privoxy: security bump to version 3.0.31
From the announcement:

ChangeLog for Privoxy 3.0.31
--------------------------------------------------------------------
- Security/Reliability:
  - Prevent an assertion from getting triggered by a crafted CGI request.
    Commit 5bba5b89193fa. OVE-20210130-0001.
    Reported by: Joshua Rogers (Opera)
  - Fixed a memory leak when decompression fails "unexpectedly".
    Commit f431d61740cc0. OVE-20210128-0001.

- Bug fixes:
  - Fixed detection of insufficient data for decompression.
    Previously Privoxy could try to decompress a partly
    uninitialized buffer.

https://www.privoxy.org/announce.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3a6fde69e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:23:30 +01:00
Fabrice Fontaine
fa17e077ab package/pugixml: bump to version 1.11.4
- Use LICENSE.md which has been added in the release tarball since
  version 1.11 and
  ccb63a9186
- Fix a build failure with gerbera >= 1.5.0 when building pugixml in
  header-only mode

Fixes:
 - http://autobuild.buildroot.org/results/9c1919bacd23da0505a4eb828a806997a23b640f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 451fed96f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:20:03 +01:00
Thomas Petazzoni
48ef8defa1 package/binutils: bump 2.35.x series to 2.35.2
Release notes:

  https://sourceware.org/pipermail/binutils/2021-January/115150.html

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 98267eb874)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:52:35 +01:00
Thomas De Schampheleire
ee4a1452a0 package/xenomai: set 'custom' as version in case of tarball
When BR2_PACKAGE_XENOMAI_CUSTOM_TARBALL is selected, the xenomai package
declared an empty version, which among others means that the build directory
becomes output/build/xenomai without any version specification, and empty
version information in 'xenomai-show-info'.

Other packages that allow a custom tarball, like 'linux' and
'arm-trusted-firmware', specify 'custom' as version in this case.

Adapt the xenomai package accordingly.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 603bfafa97)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:49:25 +01:00
Peter Korsgaard
11ed6ccd1f package/xserver_xorg-server: don't install init script if nodm is enabled
Both S40xorg and S90nodm tries to run an Xserver on vt1, causing the nodm
one to fail.  If nodm is enabled, then that is likely what the user wants to
run, so skip installing S40xorg.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 735581122a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:40:49 +01:00
Fabrice Fontaine
41cbb88372 package/dhcpcd: create /var/db/dhcpcd
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13506

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-02 18:59:09 +01:00
Fabrice Fontaine
2f11b344d9 package/intel-mediadriver: fix option
Replace INSTALL_DRIVERS_SYSCONF by INSTALL_DRIVER_SYSCONF which is the
correct name since version 18.2.0 and
81796c8a9e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9d41e98d6f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:59 +01:00
Fabrice Fontaine
230f80d156 package/intel-mediadriver: drop unrecognized options
BUILD_ALONG_WITH_CMRTLIB has been dropped since version 18.2.0 and
c3e13c175d

RUN_TEST_SUITE is also unrecognized (only MEDIA_RUN_TEST_SUITE is
recognized)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8a0cbe9474)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:41 +01:00
Fabrice Fontaine
10ee253027 package/intel-mediadriver: fix build with gcc 10
Fixes:
 - http://autobuild.buildroot.org/results/d5ab36026a66a4f371fb6ef6c9ecf43e9617d119

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6a0d2bb945)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:32 +01:00
Geoffrey Le Gourriérec
e8c386da55 package/uclibc: Patch with updated kernel time definitions
Building uclibc 1.0.37 for SuperH architecture with linux-headers 5.10.7
fails at libpthread level due to missing time-related data structures,
usually defined by the kernel. Make uclibc correctly define those types.

A previous patch in buildroot [1] fixed the symptom by tampering with
linux-headers inclusions, but analysis [2] done in collaboration with
Linux folks concluded that the issue lied in (voluntary) include guard
"preemption" in uclibc kernel_types.h.
However, kernel_types.h was not up to date with relevant 64-bit time
data structures, so defining those here was needed.

The present uclibc patch was mailed to uclibc-ng mailing list and got
a positive response; I am not able to give a link to the discussion,
as it has not appeared yet [3] (perhaps I'm not looking at the right
place ?)
So until the patch is merged upstream and we bump uclibc version, keep
our patch here.

[1] https://git.buildroot.net/buildroot/commit/?id=742f37de8d0e3797698411dfc6a63bd7e98aafe2
[2] https://patchwork.kernel.org/project/linux-sh/patch/20210123165652.10884-1-geoffrey.legourrierec@gmail.com/
[3] https://mailman.uclibc-ng.org/pipermail/devel/2021-January/thread.html

Signed-off-by: Geoffrey Le Gourriérec <geoffrey.legourrierec@gmail.com>
Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1f50a44371)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:19:03 +01:00
Peter Korsgaard
551cb63007 Update for 2020.11.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-31 21:34:30 +01:00
Peter Korsgaard
6f48359ff8 CHANGES: update with recent changes
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 18:36:55 +01:00
Fabrice Fontaine
0567775702 package/socat: security bump to version 1.7.4.1
Buffer size option (-b) is internally doubled for CR-CRLF conversion,
but not	checked for integer overflow. This could lead to heap based
buffer overflow, assuming the attacker could provide this parameter.

- Update indentation in hash file (two spaces)
- Update hash of README file due to minor updates:
  https://repo.or.cz/socat.git/commit/b145170837d75bd7a1a5803283910ab075d47bea
  https://repo.or.cz/socat.git/commit/0a115feadc3102f17e0a8a1a985319af0295f704

http://www.dest-unreach.org/socat/doc/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1b18d9104f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 16:38:19 +01:00
Peter Korsgaard
3bf6d795e2 {linux, linux-headers}: bump 4.19.x / 5.{4, 10}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1c61297ec0)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 16:35:46 +01:00