Commit Graph

72613 Commits

Author SHA1 Message Date
Julien Olivain
c6cf277662 support/testing: new xxhash runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b118c9dcf344c489b3e78a325060f01540f03eb3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-08 22:45:47 +01:00
Thomas Petazzoni
40e308bc50 linux: select proper defconfig on ARC 750d/770d
The Linux kernel "defconfig" on ARC is haps_hs_smp_defconfig, which
cannot be built on ARC 750d/770d targets, so let's use a kernel
defconfig that works properly on ARC 750d/770d.

Fixes:

  http://autobuild.buildroot.net/results/2913e5958cd6b20dbfdcdad304a5f5a0f8030d8d/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 954b5514a92d9d8439d57a815f097046e6270bb9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-08 21:32:55 +01:00
Thomas Petazzoni
362d72d6f4 linux: select proper defconfig on PowerPC
The handling of BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG is currently
not doing a proper job: it is selecting ppc64le_defconfig if
BR2_powerpc64le, and using the default of "defconfig" for everything
else.

However:

- Since upstream commit 22f17b02f88b48c01d3ac38d40d2b0b695ab2d10,
  which landed in Linux 6.8, the default defconfig is
  ppc64le_defconfig and no longer ppc64_defconfig. This means that
  despite the condition in linux.mk, we are in fact now always
  building ppc64le_defconfig.

- It doesn't handle the 32-bit case, as a 64-bit defconfig gets used
  by default. This causes build failures in the autobuilders.

To fix this we explicitly handle BR2_powerpc64le, BR2_powerpc64 and
BR2_powerpc, and use appropriate defconfigs for each case.

Fixes:

  http://autobuild.buildroot.net/results/c15eaf2e7455aa265cc045e6d8be7cac5348d925/ (powerpc)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 82326a3d8392d02f53c47bdaed21ff8012a6d978)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 13250bf4aafbde9b0f946d5d07aaf3b6dc34d31f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-08 21:31:22 +01:00
Thomas Petazzoni
70f75b7ad9 package/procps-ng: add wchar dependency
Since procps-ng was bumped from 3.3.17 to 4.0.4 in commit
d79f40dbbe98983bc657d4c82d46b38b8283351b ("package/procps-ng: security
bump to version 4.0.4"), the build has been failing on !wchar
configurations with:

src/ps/output.c:68:10: fatal error: wctype.h: No such file or directory
   68 | #include <wctype.h>
      |          ^~~~~~~~~~
compilation terminated.

The problematic code has been added by upstream commit
605ea4a8f7,
which landed in upstream release v4.0.0.

To solve this, we simply add a BR2_USE_WCHAR dependency, and update
the comment related to this dependency on the only reverse dependency
of procps-ng.

Fixes:

  http://autobuild.buildroot.net/results/afc035e866bec6f2c14f9d52fa74a9c1897706de/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f6fe892141cd4c8b6dd934df92eb1fe7d9469e0c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-06 17:14:09 +01:00
Julien Olivain
ea76f2425d support/testing/tests/package/test_xvisor.py: new runtime test
This is a basic test for Xvisor RISC-V 64bit. It is running few
management and status commands. It does not start a Linux kernel.

RISC-V 64bit was chosen for this test because it was the simplest
solution to run xvisor in a qemu emulator.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e14380b3c4c3d5e037662c45b2cf90056056920a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-06 15:16:05 +01:00
Reza Arbab
24be3751ab package/skeleton: create lib64 symlink on s390x
Building on a s390x host, we currently end up with:

  output/host/lib
  output/host/lib32 -> lib
  output/host/lib64

host-libopenssl installs to lib64, but since the kernel build doesn't
explicitly search there, it breaks:

  >>> linux 6.6.32 Building
  [...]
    HOSTCC  scripts/sign-file
  /usr/bin/ld: cannot find -lcrypto: No such file or directory
  collect2: error: ld returned 1 exit status

Fix this by creating a lib64 link instead of lib32, so we get:

  output/host/lib
  output/host/lib64 -> lib

Signed-off-by: Reza Arbab <arbab@linux.ibm.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 66a5f9bc742f517ad245e1ba0dcc8837205beedc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-06 14:59:02 +01:00
Bernd Kuhls
aa14c37abf {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 07149e5f304cdedfc5c5a324ef06df2537e41ac3)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-05 21:03:42 +01:00
Peter Korsgaard
08f268ace7 package/gst-omx: bump version to 1.22.12
No functional change, but bump for consistency.  For details, see the
release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 038c7df88e063fa10b0e1aa5e26159618fea21de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:35 +01:00
Peter Korsgaard
2e84625215 package/gstreamer1-editing-services: bump version to 1.22.12
No functional change, but bump for consistency.  For details, see the
release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fd720980eb51401261438bb4f1928b54c2576438)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:34 +01:00
Peter Korsgaard
64d2f706f7 package/gst1-vaapi: bump version to 1.22.12
No functional change, but bump for consistency.  For details, see the
release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: fixed commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8fd12c62022da53aee2872f8c912744b40393606)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:33 +01:00
Peter Korsgaard
b5486babf7 package/gst1-rtsp-server: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f20de77f15e5b32f299a3ac2f2524f82710bab18)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:32 +01:00
Peter Korsgaard
29c17da5b0 package/gst1-python: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 17c57efe399ab6e18428f1073532f63f59a38a3e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:31 +01:00
Peter Korsgaard
886851a66f package/gst1-libav: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3e5223d4e871c10dd4a9ae6e6b275a2ae74b9646)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:30 +01:00
Peter Korsgaard
0c37db904d package/gst1-devtools: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8fbadc1c060052e01cfdad7c705792d1d9821a67)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:30 +01:00
Peter Korsgaard
8a87115a8f package/gst1-plugins-ugly: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a0c1f2383649e810459482f6614214122adcd78b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:29 +01:00
Peter Korsgaard
c595b5b828 package/gst1-plugins-bad: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1fa7c453e4f1dd099b6818ede10a4404b572424f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:28 +01:00
Peter Korsgaard
af9f7bdd7c package/gst1-plugins-good: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84f8e7c18bfdcbab26b4fd52d5696992ce6d0bbe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:27 +01:00
Peter Korsgaard
1bc589c515 package/gst1-plugins-base: security bump to version 1.22.12
Fixes the following security issue:

CVE-2024-4453: Heap-based buffer overflow in the EXIF image tag parser when
handling certain malformed streams before GStreamer 1.24.3 or 1.22.12

https://gstreamer.freedesktop.org/security/sa-2024-0002.html

For more details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 197cd0de3b02fc66e35632644fc8437ad4464fe9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:27 +01:00
Peter Korsgaard
6f9a2c8083 package/gstreamer1: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 395dcfbb1e5c46870495b75e270613d60f1616e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:26 +01:00
Brandon Maier
0455bcc804 package/gnutls: fix autobuild error from 3.8.8 update
Fixes: http://autobuild.buildroot.net/results/317/3178fca15cbb2520336b0678a16a5be5a51a8702//
Upstream bug report: https://gitlab.com/gnutls/gnutls/-/issues/1604

Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit ca3cf2bea272bb0e0833c7fd2ec8f0fa28387692)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 13:24:16 +01:00
Thomas Bonnefille
e09b44b36a package/gdb: add hash of licence files
Adds sha256 hash of the license files for GDB.

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b0207c1f15c12011782e46233effa61f5acbfcad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 12:30:19 +01:00
Thomas Bonnefille
be577adfbc package/libsha1: Fix gcc14 compilation in libsha1
GCC14 removed the implicit int support.
This commit adds a patch to libsha1 to fix an implicit int declaration
as recommended.

Link: https://gcc.gnu.org/gcc-14/porting_to.html

Fixes:
    http://autobuild.buildroot.net/results/87dc9ba9690cbb6a82875734ce9cb8dbaf878e46/

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d427d27aeeaec4ff52e948fdc7d4be3ce0c9e2bb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 12:08:49 +01:00
Peter Korsgaard
8157e14da6 package/samba4: bump version to 4.19.9
Various bugfixes. For details, see the release notes:

https://www.samba.org/samba/history/samba-4.19.7.html
https://www.samba.org/samba/history/samba-4.19.8.html
https://www.samba.org/samba/history/samba-4.19.9.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 09:16:48 +01:00
Francois Perrad
da6c5f7434 package/gnupg2: bump to version 2.4.7
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2024q4/000487.html

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add release announce link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8e00663624a3c5f2603c54af62efecd6f25874ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:05:17 +01:00
Francois Perrad
1bbcfb3b5b package/gnupg2: bump to version 2.4.6
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2024q4/000486.html

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add release announce link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9b35b02fc5e24a6b8e7888380305e5171818a17)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:05:10 +01:00
Thomas Petazzoni
498406cfdb package/qt6base: properly ignore CVE-2023-32573
In commit
a9aa11544a ("package/qt6/qt6svg:
backport fix for CVE-2023-32573"), a fix for security issue
CVE-2023-32573 was added to qt6svg, with the appropriate
QT6SVG_IGNORE_CVES entry.

However, all CVEs against Qt are reported by the NVD on the qt:qt
vendor/product CPE. For example:

  https://nvd.nist.gov/vuln/detail/CVE-2023-32573

Therefore, the QT6SVG_IGNORE_CVES entry added has no effect, and
CVE-2023-32573 continues to be reported against our qt6base package.

The only reasonable option is to collect all such CVE ignore entries
for Qt modules into the qt6base package, which is the one that matches
with the qt:qt CPE identifier. This commit does just that, with an
hopefully appropriate comment in qt6base.mk that explains what's going
on.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:00:50 +01:00
Thomas Petazzoni
0980919b90 package/qt6/qt6base: fix QT6BASE_IGNORE_CVES for CVE-2023-51714
Commit 4009842cba ("package/qt6/qt6base:
backport fix for CVE-2023-51714") brought in a fix for CVE-2023-51714,
but got the QT6BASE_IGNORE_CVES update wrong, due to a copy/paste
error with the previous QT6BASE_IGNORE_CVES entry. Due to this
CVE-2023-51714 is still reported as affecting qt6base, while the
security fix is already there.

Fixes: 4009842cba ("package/qt6/qt6base: backport fix for CVE-2023-51714")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 16:59:59 +01:00
Peter Korsgaard
9749b6fbc9 package/netatalk: security bump to version 3.1.19
Fixes the following security issues:

CVE-2024-38439: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in
FPLoginExt in login in etc/uams/uams_pam.c.

https://github.com/advisories/GHSA-pcmr-ff73-xcj5

CVE-2024-38440: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of incorrectly using FPLoginExt in
BN_bin2bn in etc/uams/uams_dhx_pam.c.

https://github.com/advisories/GHSA-52mm-rqxx-gfq6

CVE-2024-38441: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName
in afp_mapname in etc/afp/directory.c.

https://github.com/advisories/GHSA-j764-4v6h-pqp7

Release notes:
https://github.com/Netatalk/netatalk/releases/tag/netatalk-3-1-19

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9ab704699ea70b12478eac87313ec7d1ff902c7a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:58:54 +01:00
Peter Korsgaard
c7288d19b9 package/libsndfile: add upstream post-1.2.2 security fixes
Fixes the following security vulnerabilities:

CVE-2022-33065: Multiple signed integers overflow in function au_read_header
in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in
Libsndfile, allows an attacker to cause Denial of Service or other
unspecified impacts.

CVE-2024-50612: libsndfile through 1.2.2 has an ogg_vorbis.c
vorbis_analysis_wrote out-of-bounds read.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e675ffd964d65067bb115ee1e770ee44ba073958)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:57:47 +01:00
Peter Korsgaard
b570feeb64 package/apr: add upstream security fix for CVE-2023-49582
Fixes CVE-2023-49582: Lax permissions set by the Apache Portable Runtime
library on Unix platforms would allow local users read access to named
shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with
APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR
version 1.7.5, which fixes this issue.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a60c38b381bbb46094f57fe1c252df962fab6673)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:55:13 +01:00
Bernd Kuhls
e2143da2c1 {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 49a7cf412133daf3d477a000f4449e984da40e21)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:51:25 +01:00
Bernd Kuhls
6ad85c42fb package/wpewebkit: needs NPTL
Fixes build error

/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
  117 |     pthread_getattr_np(thread, &sattr);

using this defconfig (and libvpx bump to 1.15.0 reverted)

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WPEWEBKIT=y

A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f4a95e5c6e18413e913236f8e7d44cedecc2b2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:30:21 +01:00
Bernd Kuhls
fd1c47e287 package/webkitgtk: needs NPTL
Fixes build error

/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
  117 |     pthread_getattr_np(thread, &sattr);

using this defconfig (and libvpx bump to 1.15.0 reverted)

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y

A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 054e5c4d22e9e235d1818baa1333ca4abace50ea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:29:46 +01:00
Bernd Kuhls
4426fd6b64 package/webkitgtk: multimedia support needs gst1-plugins-bad
Fixes build error

--   Package 'gstreamer-webrtc-1.0' not found
-- Found GStreamer: GSTREAMER_INCLUDE_DIRS;GSTREAMER_LIBRARIES;GSTREAMER_VERSION;GSTREAMER_BASE_INCLUDE_DIRS;GSTREAMER_BASE_LIBRARIES;GSTREAMER_APP_INCLUDE_DIRS;GSTREAMER_APP_LIBRARIES;GSTREAMER_PBUTILS_INCLUDE_DIRS;GSTREAMER_PBUTILS_LIBRARIES;GSTREAMER_VIDEO_INCLUDE_DIRS;GSTREAMER_VIDEO_LIBRARIES;GSTREAMER_MPEGTS_INCLUDE_DIRS;GSTREAMER_MPEGTS_LIBRARIES;GSTREAMER_TAG_INCLUDE_DIRS;GSTREAMER_TAG_LIBRARIES;GSTREAMER_GL_INCLUDE_DIRS;GSTREAMER_GL_LIBRARIES;GSTREAMER_AUDIO_INCLUDE_DIRS;GSTREAMER_AUDIO_LIBRARIES;GSTREAMER_FFT_INCLUDE_DIRS;GSTREAMER_FFT_LIBRARIES;GSTREAMER_TRANSCODER_INCLUDE_DIRS;GSTREAMER_TRANSCODER_LIBRARIES (Required is at least version "1.18.4")
CMake Error at Source/cmake/GStreamerChecks.cmake:62 (message):
  GStreamerTranscoder >= 1.20 is needed for USE_GSTREAMER_TRANSCODER.
Call Stack (most recent call first):
  Source/cmake/OptionsGTK.cmake:478 (include)
  Source/cmake/WebKitCommon.cmake:237 (include)
  CMakeLists.txt:21 (include)

using this defconfig

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y
BR2_PACKAGE_WEBKITGTK_MULTIMEDIA=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a2ec46014687faf91c3db8f9f768a00133c3f36)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:18:58 +01:00
Bernd Kuhls
ecd9ffbdd3 package/webkitgtk: disable libdrm usage when not available
Fixes build error

-- Could NOT find LibDRM (missing: LibDRM_INCLUDE_DIR LibDRM_LIBRARY)
CMake Error at Source/cmake/OptionsGTK.cmake:320 (message):
  libdrm is required for USE_LIBDRM
Call Stack (most recent call first):
  Source/cmake/WebKitCommon.cmake:237 (include)
  CMakeLists.txt:21 (include)

with this defconfig:

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y

due to libdrm being enabled by default:
f736325e66/Source/cmake/OptionsGTK.cmake (L59)

This is a port of buildroot commit 65f8174648a3df922892cfac1ad15279d1bffde3
for the wpewebkit package, quoting its commit message:

    Pass USE_LIBDRM=OFF to the wpewebkit CMake configuration step when the
    libdrm package has not been selected.

    WPE WebKit can be built without libdrm support, and it will still work
    with backends that use other platform-specific methods to handle
    graphics buffers and/or presenting content onto an output. For example
    this is the case with wpebackend-rdk configured to use rpi-userland,
    which uses dispmanx to produce the output instead of DRM/KMS.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 865457e76201f663cf81b09486485fbee961423d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:18:43 +01:00
Peter Korsgaard
0ee60ab4d3 package/opensc: security bump to version 0.26.0
Fixes the following security vulnerabilities:

0.25.0:

CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5
padding in OpenSC
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992

CVE-2024-1454: Potential use-after-free in AuthentIC driver during card
enrollment in pkcs15init
https://github.com/OpenSC/OpenSC/wiki/CVE-2024-1454

0.26.0:

CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init
https://github.com/advisories/GHSA-3q68-hm47-94vg

CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU
response values in libopensc
https://github.com/advisories/GHSA-2mjg-798r-mxwh

CVE-2024-45617: Uninitialized values after incorrect or missing checking
return values of functions in libopensc
https://github.com/advisories/GHSA-cf2w-h975-2fpg

CVE-2024-45618: Uninitialized values after incorrect or missing checking
return values of functions in pkcs15init
https://github.com/advisories/GHSA-f2v6-mw6x-qmwc

CVE-2024-45619: Incorrect handling length of buffers or files in libopensc
https://github.com/advisories/GHSA-9vxw-3j77-cj78

CVE-2024-45620: Incorrect handling of the length of buffers or files in
pkcs15init
https://github.com/advisories/GHSA-9c2g-6v5v-57qg

CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key
https://github.com/advisories/GHSA-mgc5-p43f-72pc

Release notes:
https://github.com/OpenSC/OpenSC/releases/tag/0.26.0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1f4b4ccde7ceb379010aeb93458792202622d64b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:46:47 +01:00
Peter Korsgaard
41bd9a5839 package/libsoup3: security bump to version 3.6.1
Fixes the following security vulnerabilities:

CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in
applications that perform conversion to UTF-8 in
soup_header_parse_param_list_strict.  Input received over the network cannot
trigger this.

https://www.cve.org/CVERecord?id=CVE-2024-52531

CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory
consumption.  during the reading of certain patterns of WebSocket data from
clients.

https://www.cve.org/CVERecord?id=CVE-2024-52532

Changelog: https://gitlab.gnome.org/GNOME/libsoup/-/blob/3.6.1/NEWS

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9120736a7e1e6c6e685d70a5a93e4d861422d70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:42:00 +01:00
Thomas Devoogdt
f62d6af7fd package/libsoup3: bump to 3.6.0
News:
 - https://download.gnome.org/sources/libsoup/3.5/libsoup-3.5.2.news
 - https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.0.news

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e3f464778945d3e7ed31c50d07de02fb2cd85464)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:41:54 +01:00
Thomas Devoogdt
e8c9054461 package/libsoup3: bump to 3.5.1
News: https://download.gnome.org/sources/libsoup/3.5/libsoup-3.5.1.news.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cd2a882768)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:41:46 +01:00
Bernd Kuhls
c5ca74ba46 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bb654e5a3bdef3576e82bd27e0ef809afb1b10d9)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-26 22:50:29 +01:00
Thomas Petazzoni
8b4a5da997 package/cdrkit: fix build with gcc 14.x
This commit adds a patch, which is already in Debian, fixing the build
with gcc 14.x:

/home/autobuild/autobuild/instance-7/output-1/build/host-cdrkit-1.1.11/genisoimage/genisoimage.c:1509:17: error: implicit declaration of function 'parse_checksum_algo' [-Wimplicit-function-declaration]
 1509 |             if (parse_checksum_algo(optarg, &checksum_algo_iso))
      |                 ^~~~~~~~~~~~~~~~~~~
make[3]: *** [genisoimage/CMakeFiles/genisoimage.dir/build.make:76: genisoimage/CMakeFiles/genisoimage.dir/genisoimage.o] Error 1

Fixes:

  http://autobuild.buildroot.net/results/a9cca8da22774ecafdbb382697aae71f78e348f4/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0a0de4d86cd1fbeb5ff0439259b297756b3a5d98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-23 09:26:00 +01:00
Thomas Petazzoni
849306c66d package/cdrkit: convert first patch to Git formatted one
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 347def2fd1f062be5d335d06aaaec577c5fa1d68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-23 09:25:39 +01:00
Peter Korsgaard
310d70cb08 package/python-django: security bump to version 5.0.10
Fixes the following security issues:

CVE-2024-53907: Potential denial-of-service in
django.utils.html.strip_tags()

The strip_tags() method and striptags template filter are subject to a
potential denial-of-service attack via certain inputs containing large
sequences of nested incomplete HTML entities.

CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle

Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle is
subject to SQL injection if untrusted data is used as a lhs value.
Applications that use the jsonfield.has_key lookup through the __ syntax are
unaffected.

https://www.djangoproject.com/weblog/2024/dec/04/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:44:32 +01:00
Peter Korsgaard
460cce9247 package/libcurl: security bump to version 8.11.1
Fixes the following security vulnerability:

CVE-2024-11053: netrc and redirect credential leak
https://curl.se/docs/CVE-2024-11053.html

Changelog: https://curl.se/ch/8.11.1.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4338deaae58a68e397c7375476745778eb7b732f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:24:45 +01:00
Peter Korsgaard
cf454846b5 package/subversion: security bump to version 1.14.5
Fixes the following security vulnerabilities:

CVE-2024-46901: mod_dav_svn denial-of-service via control characters in
paths

It has been discovered that the patch for CVE-2013-1968 was incomplete
and unintentionally left mod_dav_svn vulnerable to control characters
in filenames.

https://subversion.apache.org/security/CVE-2024-46901-advisory.txt

Subversion 1.14.4 also fixed a Windows-only vulnerability:
https://subversion.apache.org/security/CVE-2024-45720-advisory.txt

For change log, see:
https://svn.apache.org/repos/asf/subversion/tags/1.14.5/CHANGES

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add link to change log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9975d28aa3ffbda2b727979b2e322fc8986d6d1b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:24:31 +01:00
Peter Korsgaard
5d1912ba3d package/wireshark: security bump to version 4.0.17
Fixes the following vulnerabilities:

4.0.17:

CVE-2024-8250: wnpa-sec-2024-11 · NTLMSSP dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-11

4.0.16:

CVE-2024-8645: wnpa-sec-2024-10 · SPRT dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-10

4.0.15:

CVE-2024-4854: wnpa-sec-2024-07 · MONGO and ZigBee TLV dissector infinite
loops
https://www.wireshark.org/security/wnpa-sec-2024-07

CVE-2024-4853: wnpa-sec-2024-08 · Editcap byte chopping crash
https://www.wireshark.org/security/wnpa-sec-2024-08

CVE-2024-4855: wnpa-sec-2024-09 · Editcap secret injection crash
https://www.wireshark.org/security/wnpa-sec-2024-09

4.0.14:

CVE-2024-2955: wnpa-sec-2024-06 · T.38 dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-06

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 12:50:49 +01:00
Bernd Kuhls
79299da8c4 package/wget: security bump version to 1.25.0
Release notes:
https://lists.gnu.org/archive/html/bug-wget/2024-11/msg00002.html

Fixes the following vulnerabilities:

- CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in
  the userinfo subcomponent of a URI, and thus there may be insecure
  behavior in which data that was supposed to be in the userinfo
  subcomponent is misinterpreted to be part of the host subcomponent.

  https://nvd.nist.gov/vuln/detail/CVE-2024-38428

- CVE-2024-10524: Applications that use Wget to access a remote resource
  using shorthand URLs and pass arbitrary user credentials in the URL are
  vulnerable.  In these cases attackers can enter crafted credentials which
  will cause Wget to access an arbitrary host.

  https://www.openwall.com/lists/oss-security/2024/11/18/6

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 295b2c4f8ecaf0b6e03725a6c8412795e91888c8)
[Peter: mark as security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 11:58:23 +01:00
Bernd Kuhls
27914e481d package/wget: bump version to 1.24.5
Release notes:
https://lists.gnu.org/archive/html/bug-wget/2024-03/msg00008.html

No versions between > 1.21.4 and < 1.24.5 were released:
https://lists.gnu.org/archive/html/bug-wget/2024-03/msg00012.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9beea334b769b187b9c0870895d4c3bc31758198)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 11:58:12 +01:00
Julien Olivain
76d7d1f1b9 package/nettle: update _SITE to use BR2_GNU_MIRROR
The nettle package is distributed on the GNU project servers. See [1]
and [2]. Buildroot has the BR2_GNU_MIRROR configuration which can
be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

Note: the nettle _SITE was updated to ftp.gnu.org in commit [4].

[1] https://www.lysator.liu.se/~nisse/nettle/
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286
[4] 92f0ef5eaa

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 9ccc0f5642cf173bcc8d51f778331acfea9dbde8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:53:44 +01:00
Julien Olivain
029fc4fb3a package/freeipmi: update _SITE to use BR2_GNU_MIRROR
The freeipmi package is distributed on the GNU project servers.
See [1] and [2]. Buildroot has the BR2_GNU_MIRROR configuration
which can be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

[1] https://www.gnu.org/software/freeipmi/download.html
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit bfa2dbc2d679b88d8166359ec916590050fb5802)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:53:17 +01:00