]> code.ossystems Code Review - openembedded-core.git/log
openembedded-core.git
7 years agomesa: update SRC_URI
Armin Kuster [Sat, 11 Feb 2017 21:50:37 +0000 (16:50 -0500)]
mesa: update SRC_URI

ERROR: mesa-2_11.1.2-r0 do_checkuri: Function failed: Fetcher failure for URL: 'ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz'. URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz doesn't work
ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/mesa/2_11.1.2-r0/temp/log.do_checkuri.30779
Log data follows:
| DEBUG: Executing python function do_checkuri
| DEBUG: Testing URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz
| DEBUG: checkstatus() urlopen failed: <urlopen error ftp error: 550 Failed to change directory.>
| DEBUG: Python function do_checkuri finished
| ERROR: Function failed: Fetcher failure for URL: 'ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz'. URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz doesn't work

Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agolibpng -lsb: update SRC_URI
Armin Kuster [Sat, 11 Feb 2017 19:55:39 +0000 (14:55 -0500)]
libpng -lsb: update SRC_URI

ERROR: libpng12-1.2.56-r0 do_checkuri: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work
ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/libpng12/1.2.56-r0/temp/log.do_checkuri.19750
Log data follows:
| DEBUG: Executing python function do_checkuri
| DEBUG: Testing URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz
| DEBUG: checkstatus() urlopen failed: HTTP Error 404: Not Found
| DEBUG: Python function do_checkuri finished
| ERROR: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work

Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agolibxslt: update SRC_URI
Armin Kuster [Sat, 11 Feb 2017 19:36:36 +0000 (14:36 -0500)]
libxslt: update SRC_URI

| ERROR: Function failed: Fetcher failure for URL: 'ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz'. URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz doesn't work
ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/x86_64-linux/libxslt-native/1.1.28-r0/temp/log.do_checkuri.16102
Log data follows:
| DEBUG: Executing python function do_checkuri
| DEBUG: Testing URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz
| DEBUG: checkstatus() urlopen failed: <urlopen error ftp error: [Errno 110] Connection timed out>
| DEBUG: Python function do_checkuri finished
| ERROR: Function failed: Fetcher failure for URL: 'ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz'. URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz doesn't work

Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agolibpng: update SRC_URI back to SF
Armin Kuster [Sat, 11 Feb 2017 19:26:10 +0000 (14:26 -0500)]
libpng: update SRC_URI back to SF

ERROR: Task 944 (virtual:nativesdk:/home/akuster/oss/maint/poky/meta/recipes-multimedia/libpng/libpng_1.6.21.bb, do_checkuri) failed with exit code '1'
ERROR: libpng12-1.2.56-r0 do_checkuri: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work
ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/libpng12/1.2.56-r0/temp/log.do_checkuri.14781
Log data follows:
| DEBUG: Executing python function do_checkuri
| DEBUG: Testing URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz
| DEBUG: checkstatus() urlopen failed: HTTP Error 404: Not Found
| DEBUG: Python function do_checkuri finished
| ERROR: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work

SF now has a old releases dir which contains this tarball. It got dropped from Gentoo

Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agolibpcre: update SRC_URI
Armin Kuster [Sat, 11 Feb 2017 19:09:13 +0000 (14:09 -0500)]
libpcre: update SRC_URI

ERROR: Task 75 (/home/akuster/oss/maint/poky/meta/recipes-support/libpcre/libpcre_8.38.bb, do_checkuri) failed with exit code '1'
ERROR: libpcre-native-8.38-r0 do_checkuri: Function failed: Fetcher failure for URL: 'ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.38.tar.bz2'. URL ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.38.tar.bz2 doesn't work

Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agozlib: update SRC_URI to fix fetching
Joshua Lock [Thu, 5 Jan 2017 16:34:23 +0000 (16:34 +0000)]
zlib: update SRC_URI to fix fetching

Upstream have removed the file from zlib.net as a new version has
been released, switch to fetching from the official sourceforge
mirror.

[YOCTO #10879]

(From OE-Core rev: bb99e4a620efd59556539c156cd98ea23aae74c8)

(From OE-Core rev: b7599330f1d629384e16a5fbeffc1a65c1555667)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agopopulate_sdk_ext: whitelist do_package tasks
Ed Bartosh [Wed, 4 Jan 2017 18:48:18 +0000 (20:48 +0200)]
populate_sdk_ext: whitelist do_package tasks

With enabled SSTATE_MIRRORS sstate code expects mirrors to
contain entries for all tasks, which is not the case for ext
installer as it uses reduced sstate cache.

Added do_package tasks to BB_SETSCENE_ENFORCE_WHITELIST to prevent
installer failing with ERROR: Sstate artifact unavailable

[YOCTO #10832]

(From OE-Core rev: 2ed46ada4b8e496493835e84b36f7e9c367f59d2)

(From OE-Core rev: eb2fc2cd9081a4533ed30fe81c9f491b06cc5ae1)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agopopulate_sdk_ext: fix working with uninative sstate
Ed Bartosh [Wed, 4 Jan 2017 18:48:17 +0000 (20:48 +0200)]
populate_sdk_ext: fix working with uninative sstate

Mapped uninative sstate directories to make ext SDK installer to
use them when it's run on systems with gcc version different from
gcc version used to build installer.

[YOCTO #10832]

(From OE-Core rev: fb945c0fd2e66d70461e6cf2e602020eeabe32f7)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-9538
Mingli Yu [Wed, 7 Dec 2016 08:01:12 +0000 (16:01 +0800)]
tiff: Security fix CVE-2016-9538

* tools/tiffcrop.c: fix read of undefined buffer in
readContigStripsIntoBuffer() due to uint16 overflow.

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9538

Patch from:
https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f

(From OE-Core rev: 9af5d5ea882c853e4cb15006f990d3814eeea9ae)

(From OE-Core rev: 33cad1173f6d1b803b794a2ec57fe8a9ef19fb44)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-9535
Mingli Yu [Wed, 7 Dec 2016 08:01:11 +0000 (16:01 +0800)]
tiff: Security fix CVE-2016-9535

* libtiff/tif_predict.h, libtiff/tif_predict.c:
Replace assertions by runtime checks to avoid assertions in debug mode,
or buffer overflows in release mode. Can happen when dealing with
unusual tile size like YCbCr with subsampling.

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9535

Patch from:
https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1
https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33

(From OE-Core rev: 61d3feb9cad9f61f6551b43f4f19bfa33cadd275)

(From OE-Core rev: d55b4470c20f4a4b73b1e6f148a45d94649dfdb5)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-9539
Zhixiong Chi [Mon, 28 Nov 2016 09:52:13 +0000 (17:52 +0800)]
tiff: Security fix CVE-2016-9539

tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in
readContigTilesIntoBuffer(). Reported as MSVR 35092.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9539

Patch from:
https://github.com/vadz/libtiff/commit/ae9365db1b271b62b35ce018eac8799b1d5e8a53

(From OE-Core rev: 58bf0a237ca28459eb8c3afa030c0054f5bc1f16)

(From OE-Core rev: 0933a11707a369c8eaefebd31e8eea634084d66e)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-9540
Zhixiong Chi [Mon, 28 Nov 2016 08:12:04 +0000 (16:12 +0800)]
tiff: Security fix CVE-2016-9540

tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled
images with odd tile width versus image width. Reported as MSVR 35103,
aka "cpStripToTile heap-buffer-overflow."

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9540

Patch from:
https://github.com/vadz/libtiff/commit/5ad9d8016fbb60109302d558f7edb2cb2a3bb8e3

(From OE-Core rev: cc97dc66006c7892473e3b4790d05e12445bb927)

(From OE-Core rev: ad2c4710ef15c35f6dd4e7642efbceb2cbf81736)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-3632
Yi Zhao [Thu, 17 Nov 2016 08:08:10 +0000 (16:08 +0800)]
tiff: Security fix CVE-2016-3632

CVE-2016-3632 libtiff: The _TIFFVGetField function in tif_dirinfo.c in
LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of
service (out-of-bounds write) or execute arbitrary code via a crafted
TIFF image.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3632
http://bugzilla.maptools.org/show_bug.cgi?id=2549
https://bugzilla.redhat.com/show_bug.cgi?id=1325095

The patch is from RHEL7.

(From OE-Core rev: 9206c86239717718be840a32724fd1c190929370)

(From OE-Core rev: 0c6928f4129e5b1e24fa2d42279353e9d15d39f0)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-3658
Zhixiong Chi [Mon, 14 Nov 2016 09:46:52 +0000 (17:46 +0800)]
tiff: Security fix CVE-2016-3658

The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool
allows remote attackers to cause a denial of service (out-of-bounds read) via vectors
involving the ma variable.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658
http://bugzilla.maptools.org/show_bug.cgi?id=2546

Patch from:
https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d

(From OE-Core rev: c060e91d2838f976774d074ef07c9e7cf709f70a)

(From OE-Core rev: cc266584158c8dfc8583d21534665b6152a4f7ee)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoexpat: CVE-2012-6702, CVE-2016-5300
Sona Sarmadi [Mon, 16 Jan 2017 06:30:00 +0000 (07:30 +0100)]
expat: CVE-2012-6702, CVE-2016-5300

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6702
http://www.openwall.com/lists/oss-security/2016/06/04/5

Reference to upstream fix:
https://bugzilla.redhat.com/attachment.cgi?id=1165210
Squashed backport against vanilla Expat 2.1.1, addressing:
* CVE-2012-6702 -- unanticipated internal calls to srand
* CVE-2016-5300 -- use of too little entropy

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agooeqa: fix hasPackage, add hasPackageMatch
Ross Burton [Wed, 15 Jun 2016 11:01:23 +0000 (12:01 +0100)]
oeqa: fix hasPackage, add hasPackageMatch

hasPackage() was looking for the string provided as an RE substring in the
manifest, which resulted in a large number of false positives (i.e. libgtkfoo
would match "gtk+").

Rewrite the manifest loader to parse the files into a proper data structure,
change hasPackage to do full string matches, and add hasPackageMatch which does
RE substring matches.

(From OE-Core rev: b9409863af71899e02275439949e3f4cdfaf2d0f)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotzdata: update to 2016i
Armin Kuster [Fri, 4 Nov 2016 05:53:28 +0000 (22:53 -0700)]
tzdata: update to 2016i

  Briefly: Cyprus split into two time zones on 2016-10-30, and Tonga
  reintroduces DST on 2016-11-06.

  Changes to future time stamps

    Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on
    2017-01-15 at 03:00.  Assume future observances in Tonga will be
    from the first Sunday in November through the third Sunday in
    January, like Fiji.  (Thanks to Pulu ʻAnau.)  Switch to numeric
    time zone abbreviations for this zone.

  Changes to past and future time stamps

    Northern Cyprus is now +03 year round, causing a split in Cyprus
    time zones starting 2016-10-30 at 04:00.  This creates a zone
    Asia/Famagusta.  (Thanks to Even Scharning and Matt Johnson.)

    Antarctica/Casey switched from +08 to +11 on 2016-10-22.
    (Thanks to Steffen Thorsen.)

  Changes to past time stamps

    Several corrections were made for pre-1975 time stamps in Italy.
    These affect Europe/Malta, Europe/Rome, Europe/San_Marino, and
    Europe/Vatican.

    First, the 1893-11-01 00:00 transition in Italy used the new UT
    offset (+01), not the old (+00:49:56).  (Thanks to Michael
    Deckers.)

    Second, rules for daylight saving in Italy were changed to agree
    with Italy's National Institute of Metrological Research (INRiM)
    except for 1944, as follows (thanks to Pierpaolo Bernardi, Brian
    Inglis, and Michael Deckers):

      The 1916-06-03 transition was at 24:00, not 00:00.

      The 1916-10-01, 1919-10-05, and 1920-09-19 transitions were at
      00:00, not 01:00.

      The 1917-09-30 and 1918-10-06 transitions were at 24:00, not
      01:00.

      The 1944-09-17 transition was at 03:00, not 01:00.  This
      particular change is taken from Italian law as INRiM's table,
      (which says 02:00) appears to have a typo here.  Also, keep the
      1944-04-03 transition for Europe/Rome, as Rome was controlled by
      Germany then.

      The 1967-1970 and 1972-1974 fallback transitions were at 01:00,
      not 00:00.

(From OE-Core rev: daf95f7fd9f7ab65685d7b764d8e50df8d00d308)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotzcode: update to 2016i
Armin Kuster [Fri, 4 Nov 2016 05:53:27 +0000 (22:53 -0700)]
tzcode: update to 2016i

Changes to code

  The code should now be buildable on AmigaOS merely by setting the
  appropriate Makefile variables.  (From a patch by Carsten Larsen.)

(From OE-Core rev: d2b8c4ee535684f5d874082a7f76efbda1907ea5)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoopenssl: Security fix CVE-2016-8610
Armin Kuster [Sun, 6 Nov 2016 15:33:27 +0000 (07:33 -0800)]
openssl: Security fix CVE-2016-8610

affects openssl < 1.0.2i

(From OE-Core rev: 0256b61cdafe540edb3cec2a34429e24b037cfae)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotiff: Security fix CVE-2016-3622
Yi Zhao [Wed, 26 Oct 2016 08:26:48 +0000 (16:26 +0800)]
tiff: Security fix CVE-2016-3622

CVE-2016-3622 libtiff: The fpAcc function in tif_predict.c in the
tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to
cause a denial of service (divide-by-zero error) via a crafted TIFF
image.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3622
http://www.openwall.com/lists/oss-security/2016/04/07/4

Patch from:
https://github.com/vadz/libtiff/commit/92d966a5fcfbdca67957c8c5c47b467aa650b286

(From OE-Core rev: 0af0466f0381a72b560f4f2852e1d19be7b6a7fb)

(From OE-Core rev: 928eadf8442cf87fb2d4159602bd732336d74bb7)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
7 years agotiff: Security fix CVE-2016-3623
Yi Zhao [Wed, 26 Oct 2016 08:26:47 +0000 (16:26 +0800)]
tiff: Security fix CVE-2016-3623

CVE-2016-3623 libtiff: The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier
allows remote attackers to cause a denial of service (divide-by-zero) by
setting the (1) v or (2) h parameter to 0.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3623
http://bugzilla.maptools.org/show_bug.cgi?id=2569

Patch from:
https://github.com/vadz/libtiff/commit/bd024f07019f5d9fea236675607a69f74a66bc7b

(From OE-Core rev: d66824eee47b7513b919ea04bdf41dc48a9d85e9)

(From OE-Core rev: f0e77ffa6bbc3adc61a2abd5dbc9228e830c055d)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
7 years agotiff: Security fix CVE-2016-3991
Yi Zhao [Wed, 26 Oct 2016 08:26:46 +0000 (16:26 +0800)]
tiff: Security fix CVE-2016-3991

CVE-2016-3991 libtiff: Heap-based buffer overflow in the loadImage
function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote
attackers to cause a denial of service (out-of-bounds write) or execute
arbitrary code via a crafted TIFF image with zero tiles.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3991
http://bugzilla.maptools.org/show_bug.cgi?id=2543

Patch from:
https://github.com/vadz/libtiff/commit/e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba

(From OE-Core rev: d31267438a654ecb396aefced201f52164171055)

(From OE-Core rev: cf58711f12425fc1c29ed1e3bf3919b3452aa2b2)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
7 years agotiff: Security fix CVE-2016-3990
Yi Zhao [Wed, 26 Oct 2016 08:26:45 +0000 (16:26 +0800)]
tiff: Security fix CVE-2016-3990

CVE-2016-3990 libtiff: Heap-based buffer overflow in the
horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and
earlier allows remote attackers to cause a denial of service (crash) or
execute arbitrary code via a crafted TIFF image to tiffcp.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3990
http://bugzilla.maptools.org/show_bug.cgi?id=2544

Patch from:
https://github.com/vadz/libtiff/commit/6a4dbb07ccf92836bb4adac7be4575672d0ac5f1

(From OE-Core rev: c6492563037bcdf7f9cc50c8639f7b6ace261e62)

(From OE-Core rev: d7165cd738ac181fb29d2425e360f2734b0d1107)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
7 years agotiff: Security fix CVE-2016-3945
Yi Zhao [Wed, 26 Oct 2016 08:26:44 +0000 (16:26 +0800)]
tiff: Security fix CVE-2016-3945

CVE-2016-3945 libtiff: Multiple integer overflows in the (1)
cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in
LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote
attackers to cause a denial of service (crash) or execute arbitrary code
via a crafted TIFF image, which triggers an out-of-bounds write.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3945
http://bugzilla.maptools.org/show_bug.cgi?id=2545

Patch from:
https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6

(From OE-Core rev: 04b9405c7e980d7655c2fd601aeeae89c0d83131)

(From OE-Core rev: 3a4d2618c50aed282af335ef213c5bc0c9f0534e)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
7 years agotzdata: Update to 2016h
Armin Kuster [Mon, 24 Oct 2016 03:00:16 +0000 (20:00 -0700)]
tzdata: Update to 2016h

Changes to future time stamps

    Asia/Gaza and Asia/Hebron end DST on 2016-10-29 at 01:00, not
    2016-10-21 at 00:00.  (Thanks to Sharef Mustafa.)  Predict that
    future fall transitions will be on the last Saturday of October
    at 01:00, which is consistent with predicted spring transitions
    on the last Saturday of March.  (Thanks to Tim Parenti.)

Changes to past time stamps

    In Turkey, transitions in 1986-1990 were at 01:00 standard time
    not at 02:00, and the spring 1994 transition was on March 20, not
    March 27.  (Thanks to Kıvanç Yazan.)

Changes to past and future time zone abbreviations

    Asia/Colombo now uses numeric time zone abbreviations like "+0530"
    instead of alphabetic ones like "IST" and "LKT".  Various
    English-language sources use "IST", "LKT" and "SLST", with no
    working consensus.  (Usage of "SLST" mentioned by Sadika
    Sumanapala.)

(From OE-Core rev: ff11ca44fec8e4b2aa523e032bd967e3ab8339a8)

(From OE-Core rev: 5637d1555b51569cdd7202ee47a0b913a0b429cb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agotzcode-native: update to 2016h
Armin Kuster [Mon, 24 Oct 2016 03:00:15 +0000 (20:00 -0700)]
tzcode-native: update to 2016h

Changes to code

zic no longer mishandles relativizing file names when creating
symbolic links like /etc/localtime, when these symbolic links
are outside the usual directory hierarchy.  This fixes a bug
introduced in 2016g.  (Problem reported by Andreas Stieger.)

(From OE-Core rev: 9c5de646e01a83219be74e99dcf7c1e56ba38b53)

(From OE-Core rev: 9288b6e699abbf5b314029b0db9230ca159b335a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8625
Sona Sarmadi [Tue, 15 Nov 2016 09:08:20 +0000 (10:08 +0100)]
curl: CVE-2016-8625

IDNA 2003 makes curl use wrong host

Affected versions: curl 7.12.0 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102K.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8624
Sona Sarmadi [Tue, 15 Nov 2016 09:08:19 +0000 (10:08 +0100)]
curl: CVE-2016-8624

invalid URL parsing with '#'

Affected versions: curl 7.1 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102J.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8623
Sona Sarmadi [Tue, 15 Nov 2016 09:08:18 +0000 (10:08 +0100)]
curl: CVE-2016-8623

Use-after-free via shared cookies

Affected versions: curl 7.10.7 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102I.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8622
Sona Sarmadi [Tue, 15 Nov 2016 09:08:17 +0000 (10:08 +0100)]
curl: CVE-2016-8622

URL unescape heap overflow via integer truncation

Affected versions: curl 7.24.0 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102H.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8621
Sona Sarmadi [Tue, 15 Nov 2016 09:08:16 +0000 (10:08 +0100)]
curl: CVE-2016-8621

curl_getdate read out of bounds

Affected versions: curl 7.12.2 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102G.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8620
Sona Sarmadi [Tue, 15 Nov 2016 09:08:15 +0000 (10:08 +0100)]
curl: CVE-2016-8620

glob parser write/read out of bounds

Affected versions: curl 7.34.0 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102F.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8619
Sona Sarmadi [Tue, 15 Nov 2016 09:08:14 +0000 (10:08 +0100)]
curl: CVE-2016-8619

double-free in krb5 code

Affected versions: curl 7.3 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102E.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8618
Sona Sarmadi [Tue, 15 Nov 2016 09:08:13 +0000 (10:08 +0100)]
curl: CVE-2016-8618

double-free in curl_maprintf

Affected versions: curl 7.1 to and including 7.50.3
Reference:
https://curl.haxx.se/docs/adv_20161102D.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8617
Sona Sarmadi [Tue, 15 Nov 2016 09:08:12 +0000 (10:08 +0100)]
curl: CVE-2016-8617

OOB write via unchecked multiplication

Affected versions: curl 7.1 to and including 7.50.3

Reference:
https://curl.haxx.se/docs/adv_20161102C.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8616
Sona Sarmadi [Tue, 15 Nov 2016 09:08:11 +0000 (10:08 +0100)]
curl: CVE-2016-8616

case insensitive password comparison

Affected versions: curl 7.7 to and including 7.50.3

Reference:
https://curl.haxx.se/docs/adv_20161102B.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agocurl: CVE-2016-8615
Sona Sarmadi [Tue, 15 Nov 2016 09:08:10 +0000 (10:08 +0100)]
curl: CVE-2016-8615

cookie injection for other servers

Affected versions: curl 7.1 to and including 7.50.3

Reference:
https://curl.haxx.se/docs/adv_20161102A.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoweston: Add no-input-device patch to 1.9.0.
Daniel Díaz [Tue, 25 Oct 2016 18:09:45 +0000 (13:09 -0500)]
weston: Add no-input-device patch to 1.9.0.

The included patch, backported from Weston master, allows
it to run without any input device at launch. An ini option
is introduced for this purpose, so there is no behavioral
change.

Related change in weston.ini:
  [core]
  require-input=true

Default is true; setting it false allows Weston to run
without a keyboard or mouse, which is handy for automated
environments.

Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoqemu: Security fix CVE-2016-4952
Adrian Dudau [Thu, 3 Nov 2016 13:18:01 +0000 (14:18 +0100)]
qemu: Security fix CVE-2016-4952

affects qemu < 2.7.0

Quick Emulator(Qemu) built with the VMWARE PVSCSI paravirtual SCSI bus
emulation support is vulnerable to an OOB r/w access issue. It could
occur while processing SCSI commands 'PVSCSI_CMD_SETUP_RINGS' or
'PVSCSI_CMD_SETUP_MSG_RING'.

A privileged user inside guest could use this flaw to crash the Qemu
process resulting in DoS.

References:
----------
http://www.openwall.com/lists/oss-security/2016/05/23/1

Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoqemu: Security fix CVE-2016-4439
Adrian Dudau [Thu, 3 Nov 2016 13:18:00 +0000 (14:18 +0100)]
qemu: Security fix CVE-2016-4439

affects qemu < 2.7.0

Quick Emulator(Qemu) built with the ESP/NCR53C9x controller emulation
support is vulnerable to an OOB write access issue. The controller uses
16-byte FIFO buffer for command and data transfer. The OOB write occurs
while writing to this command buffer in routine get_cmd().

A privileged user inside guest could use this flaw to crash the Qemu
process resulting in DoS.

References:
----------
http://www.openwall.com/lists/oss-security/2016/05/19/4
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4441

Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agogstreamer1.0-libav: Add 'valgrind' config option
Otavio Salvador [Thu, 10 Nov 2016 14:44:09 +0000 (15:44 +0100)]
gstreamer1.0-libav: Add 'valgrind' config option

This fixes following error:

,----
| src/libavutil/log.c:51:31: fatal error: valgrind/valgrind.h: No such file or directory
|  #include <valgrind/valgrind.h>
`----

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agonss: Disable warning on deprecated API usage
Zeeshan Ali [Mon, 14 Nov 2016 09:40:54 +0000 (10:40 +0100)]
nss: Disable warning on deprecated API usage

nss itself enables Werror if gcc is version 4.8 of greater, which fails
the build against new glibc (2.24) because of use of readdir_r(), which
is now deprecated. Let's just disable warnings on deprecated API usage.

https://bugzilla.yoctoproject.org/show_bug.cgi?id=10644

Signed-off-by: Zeeshan Ali <zeeshan.ali@pelagicore.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agobinutils: apply RPATH fixes from our libtool patches
Ross Burton [Mon, 3 Oct 2016 14:16:32 +0000 (15:16 +0100)]
binutils: apply RPATH fixes from our libtool patches

We don't autoreconf/libtoolize binutils as it has very strict requirements, so
extend our patching of the stock libtool to include two fixes to RPATH
behaviour, as part of the solution to ensure that native binaries don't have
RPATHs pointing at the host system's /usr/lib.

This generally doesn't cause a problem but it can cause some binaries (such as
ar) to abort on startup:

./x86_64-pokysdk-linux-ar: relocation error: /usr/lib/libc.so.6: symbol
_dl_starting_up, version GLIBC_PRIVATE not defined in file ld-linux.so.2 with
link time reference

The situation here is that ar is built and as it links to the host libc/loader
has an RPATH for /usr/lib.  If tmp is wiped and then binutils is installed from
sstate relocation occurs and the loader changed to the sysroot, but there
remains a RPATH for /usr/lib.  This means that the sysroot loader is used with
the host libc, which can be incompatible.  By telling libtool that the host
library paths are in the default search path, and ensuring that all default
search paths are not added as RPATHs by libtool, the result is a binary that
links to what it should be linking to and nothing else.

[ YOCTO #9287 ]

(From OE-Core rev: 6b201081b622cc083cc2b1a8ad99d6f7d2bea480)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agobinutils: fix typo in libtool patch
Ross Burton [Mon, 3 Oct 2016 14:16:31 +0000 (15:16 +0100)]
binutils: fix typo in libtool patch

There was a clear typo in a function name, correct it.

(From OE-Core rev: dcf44e184a807d76463a3bf1b2315e80b9469de3)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
minor fixup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoclasses/native: set lt_cv_sys_lib_dlsearch_path_spec
Ross Burton [Mon, 3 Oct 2016 14:16:30 +0000 (15:16 +0100)]
classes/native: set lt_cv_sys_lib_dlsearch_path_spec

This variable is used by libtool to know what paths are on the default loader
search path.  As we have modified loader paths, native.bbclass can tell libtool
that both the sysroot libdir and the host library paths are searched, so no
RPATHs for those will be generated.

(From OE-Core rev: 2d0a1b029447842a6f97f72ae636c9020c4206a9)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agoclasses/cross: set lt_cv_sys_lib_dlsearch_path_spec
Ross Burton [Mon, 3 Oct 2016 14:16:29 +0000 (15:16 +0100)]
classes/cross: set lt_cv_sys_lib_dlsearch_path_spec

This variable is used by libtool to know what paths are on the default loader
search path.  As we have modified loader paths, cross.bbclass can tell libtool
that both the sysroot libdir and the host library paths are searched, so no
RPATHs for those will be generated.

(From OE-Core rev: 5b61324fa76b27bb6ce13e78b17e767eed2f8f57)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agorm_work: Ensure we don't remove sigbasedata files
Richard Purdie [Wed, 2 Nov 2016 15:05:17 +0000 (15:05 +0000)]
rm_work: Ensure we don't remove sigbasedata files

We don't remove sigdata files, we also shouldn't remove sigbasedata files
as this hinders debugging.

(From OE-Core rev: 988349f90c8dc5498b1f08f71e99b13e928a0fd0)

(From OE-Core rev: c8d96b10ee3bc2eae0fd269d2564286fd0bc82ed)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
7 years agosstate: Ensure we don't remove sigbasedata files
Richard Purdie [Wed, 2 Nov 2016 15:04:08 +0000 (15:04 +0000)]
sstate: Ensure we don't remove sigbasedata files

We don't remove sigdata files, we also shouldn't remove sigbasedata files
as this hinders debugging.

(From OE-Core rev: 1ebd85f8dfe45b92c0137547c05e013e340f9cec)

(From OE-Core rev: 3764a5ce8a1f26b46c389c256c10596ed8d31cc7)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoRevert "file: update SRCREV for 5.25 to fix fetch fail on missing commit"
Richard Purdie [Tue, 21 Mar 2017 22:18:14 +0000 (22:18 +0000)]
Revert "file: update SRCREV for 5.25 to fix fetch fail on missing commit"

This reverts commit b35225c88ff681a4a903f7fb4612ac768214f539.

Upstream restored the original hashes.

8 years agofile: update SRCREV for 5.25 to fix fetch fail on missing commit
Paul Gortmaker [Fri, 17 Mar 2017 23:24:26 +0000 (19:24 -0400)]
file: update SRCREV for 5.25 to fix fetch fail on missing commit

Machines that cloned a while ago will have the commit, but new
deployments won't because it seems the upstream changed/rebased
and the old commit ID has been garbage-collected away.  Hence
the fetch fails to check out the named commit ID.

Both the old (gone) commit, and the "new" commit show the same
dates and commit log and point at 5.25, so hopefully this is
the right thing to do.  A git diff of the two seems to only show
a blanket uprev of CVS tags and deletion of a couple autogen'd
files, and no real source changes.

(From OE-Core rev: adb71e06768adadda7b69c3b5e81ca3ad67237f4)

Cc: Christos Zoulas <christos@zoulas.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agobuild-appliance-image: Update to krogoth head revision
Richard Purdie [Wed, 9 Nov 2016 00:06:44 +0000 (00:06 +0000)]
build-appliance-image: Update to krogoth head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agoperf: adapt to Makefile.config
Bruce Ashfield [Tue, 30 Aug 2016 16:49:00 +0000 (12:49 -0400)]
perf: adapt to Makefile.config

commit 4842576cd857 [perf tools: Move config/Makefile into Makefile.config]
relocated the configuration Makefile of perf. As such, we need to adapt
our fixup routines to work with the Makefile no matter where it is.

(From OE-Core rev: 573d584ff704025387782e35ed344e73294d6d0a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperf: Fix to obey LD failure
Sujith Haridasan [Wed, 5 Oct 2016 05:58:39 +0000 (11:28 +0530)]
perf: Fix to obey LD failure

This patch brings the last bit from meta-mentor for the perf
to build successfully with minnowmax BSP. The meta-mentor
commit for the same is:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-mentor/commit/meta-mentor-staging?id=a8db95c0d4081cf96915e0c3c4063a44f55e21cc

The previous fix:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-kernel/perf?id=ef942d6025e1a339642b10ec1e29055f4ee6bd46
was incomplete and was not submitted upstream. And due to that this change is required.

When built on minnowmax ( machine name: intel-corei7-64),
an error is noticed during the do_compile:

 /home/sujith/codebench-linux-install-2015.12-133-i686-pc-linux-gnu/codebench/bin/i686-pc-linux-gnu-ld:
Relocatable linking with relocations from format elf64-x86-64
(/home/sujith/MEL/dogwood/build-minnowmax/tmp/work/intel_corei7_64-mel-linux/perf/1.0-r9/perf-1.0/fd/array.o)
to format elf32-i386 (/home/sujith/MEL/dogwood/build-minnowmax/tmp/work/intel_corei7_64-mel-linux/perf/1.0-r9/perf-1.0/fd/libapi-in.o)
is not supported

This change help fix the issue.

(From OE-Core rev: 122ae03e2f1a2252a6914d51087531557f9a08f2)

Signed-off-by: Sujith Haridasan <Sujith_Haridasan@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperf: Fix to obey LD failure on qemux86-64
Christopher Larson [Wed, 21 Sep 2016 05:17:42 +0000 (10:47 +0530)]
perf: Fix to obey LD failure on qemux86-64

When built on an i686 host for qemux86-64 without the
fix to obey LD and it fails:

/scratch/dogwood/toolchains/x86_64/bin/i686-pc-linux-gnu-ld:
Relocatable linking with relocations from format elf64-x86-64
(/scratch/dogwood/perf-ld-test/build/tmp/work/qemux86_64-mel-linux/perf/1.0-r9/perf-1.0/fs/fs.o)
to format elf32-i386 (/scratch/dogwood/perf-ld-test/build/tmp/work/qemux86_64-mel-linux/perf/1.0-r9/perf-1.0/fs/libapi-in.o)
is not supported

This is because LD includes HOST_LD_ARCH, which contains TUNE_LDARGS,
which is -m elf32_x86_64 for x86_64. Without that, direct use of ld will fail.

(From OE-Core rev: 0ce06611068e74e6ea2e226e3f967aaa91fecd25)

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Sujith Haridasan <Sujith_Haridasan@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoThis is a backport from master of 2 consecutive fixes.
Jussi Kukkonen [Tue, 30 Aug 2016 08:32:07 +0000 (11:32 +0300)]
This is a backport from master of 2 consecutive fixes.

First fix commit:
1100af93cb07caf24d568c039d52fb0c80714c30
Second fix commit:
b7b2e348716161deb21c9864ac5caa5f1df1fa9c

The error these commits fix can prevent Eclipse debugging on
certain target configurations.

* base-files: Add shell test quoting

  tty can return "not a tt" which results in warnings when /etc/profile
  is executed.

  (From OE-Core rev: eed586dd238efe859442b21b425f04e262bcdb2b)

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base-files: fix profile error under < /dev/null

  Previous attempts to constrain execution of `resize` to only TTYs did
  not properly handle situations when `tty` would return the string "not a
  tty". The symptom is "/etc/profile: line 34: test: too many arguments".
  Fix this by utilizing the exit code of `tty`. Also use `case` instead of
  `cut` to eliminate a subshell.

  (From OE-Core rev: e67637e4472ff3a1e2801b84ee3d69d4e14b9efc)

Signed-off-by: Richard Tollerton <rich.tollerton@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: brian avery <brian.avery@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs.py: Add disabling eDP error to x86_common whitelist
California Sullivan [Fri, 30 Sep 2016 23:40:51 +0000 (16:40 -0700)]
parselogs.py: Add disabling eDP error to x86_common whitelist

The NUC6 firmware tells the kernel to try and initialize an embedded
DisplayPort it does not have, causing this warning. Its harmless, so
just whitelist it.

Fixes [YOCTO #9434].

(From OE-Core rev: 4c3fb7f63aad4a5d1b9720c76091cd0646859c2a)

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agooeqa/parselogs: Don't use cwd for file transfers
Richard Purdie [Fri, 9 Sep 2016 12:19:02 +0000 (13:19 +0100)]
oeqa/parselogs: Don't use cwd for file transfers

If you run:

MACHINE=A bitbake <image> -c testimage
MACHINE=B bitbake <image> -c testimage

and A has errors in parselogs, machine B can pick these up and cause
immense confusion. This is because the test transfers the log files
to cwd which is usually TOPDIR. This is clearly bad and this patch
uses a subdir of WORKDIR to ensure machines don't contaminate each
other.

Also ensure any previous logs are cleaned up from any existing
transfer directory.

(From OE-Core rev: ac8f1e58ca3a0945795087cad9443be3e3e6ead8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs.py: Ignore Skylake graphics firmware load errors on genericx86-64
California Sullivan [Wed, 17 Aug 2016 05:14:53 +0000 (22:14 -0700)]
parselogs.py: Ignore Skylake graphics firmware load errors on genericx86-64

These errors can't be fixed without adding the firmware to the initramfs
and building it into the kernel, which we don't want to do for
genericx86-64. Since graphics still work acceptably without the firmware
blobs, just ignore the errors for that MACHINE.

(From OE-Core rev: d73a26a71b2b16be06cd9a80a6ba42ffae8412c4)

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs: Ignore uvesafb timeouts
Richard Purdie [Fri, 19 Aug 2016 10:03:00 +0000 (11:03 +0100)]
parselogs: Ignore uvesafb timeouts

We're periodically seeing uvesafb timeouts on the autobuilder. Whitelist these
errors as there is little it seems we can do about them and we therefore
choose to ignore them rather than fail the builds.

[YOCTO #8245]

There is a better solution proposed in the bug with a -1 timeout however
this avoids failed builds until such times as that is implemented.

(From OE-Core rev: 8097f2da79b7862733494d2321e3dfdb0880804d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs: Ignore amb_nb warning messages under qemux86*
Richard Purdie [Thu, 18 Aug 2016 07:53:25 +0000 (08:53 +0100)]
parselogs: Ignore amb_nb warning messages under qemux86*

(From OE-Core rev: 857f4ca134e4575e71993b4fa255ebafec612d1e)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs.py: Add dmi and ioremap errors to ignore list for core2
California Sullivan [Wed, 17 Aug 2016 05:14:54 +0000 (22:14 -0700)]
parselogs.py: Add dmi and ioremap errors to ignore list for core2

These errors have been occuring since the introduction of the 4.4
kernel with no apparent functionality loss. Whitelist for now.

(From OE-Core rev: 47b9058994f15507fc18ce0b08ac82a4c052966e)

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoparselogs.py: Add amd_nb error to x86_common whitelist
California Sullivan [Fri, 23 Sep 2016 18:15:00 +0000 (11:15 -0700)]
parselogs.py: Add amd_nb error to x86_common whitelist

This has always silently failed on hardware without AMD Northbridge,
and a recent kernel patch made it not silent. It would be ideal to only
whitelist the error for genericx86 MACHINEs and disable the CONFIG
option that enables it in intel-* MACHINEs, but in order to disable
this configuration option we would have to enable EXPERT and
DEBUG_KERNEL, which we don't want. Instead just whitelist it on all
x86 MACHINEs.

Fixes [YOCTO #10261].

(From OE-Core rev: 9c432dae1045a087f8eb2de7c9bd3a9cbd46c459)

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.1: fix CVE-2016-5195 (dirtycow)
Bruce Ashfield [Sat, 22 Oct 2016 03:47:37 +0000 (23:47 -0400)]
linux-yocto/4.1: fix CVE-2016-5195 (dirtycow)

Backporting commit 19be0eaffa [mm: remove gup_flags FOLL_WRITE games
from __get_user_pages()] to address the dirtycow exploit.

(From OE-Core rev: 8470ea4cfd5fca4c9573e39c7c3486aeb310990a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.4: update to v4.4.26
Bruce Ashfield [Sat, 22 Oct 2016 03:47:36 +0000 (23:47 -0400)]
linux-yocto/4.4: update to v4.4.26

Integrating the 4.4.23->26 -stable releases. Among other fixes
this contains commit:

  mm: remove gup_flags FOLL_WRITE games from __get_user_pages()

Which addresses CVE-2016-5195.

(From OE-Core rev: e2472c1a66ef62f6904cc9b635b275e7da32e51a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.4/4.8: kernel config warning cleanups
Bruce Ashfield [Wed, 19 Oct 2016 01:08:17 +0000 (21:08 -0400)]
linux-yocto/4.4/4.8: kernel config warning cleanups

Merging the following patches into 4.4 and 4.8 to remove kernel
configuration warnings:

  bbaf01752b01 meta-yocto-bsp: beaglebone: remove the stale kernel options
  552a83790b17 features: Fix configcheck warnings in features used by intel-quark BSPs
  c33d9c2c575f features: Fix configcheck warnings in features used by intel-core* BSPs

(From OE-Core rev: ac9842bc3a17f15c3807aa06e4469c030346420e)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Droped the 4.8 kernel changes, 4.8 not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.1/4.4: remove innappropriate standard/base patches
Bruce Ashfield [Mon, 3 Oct 2016 05:54:33 +0000 (01:54 -0400)]
linux-yocto/4.1/4.4: remove innappropriate standard/base patches

Before standard/intel/* was created in the 4.1 and 4.4 kernel trees,
some patches were merged to standard/base to add features/support for
intel platforms.

While this isn't entirely bad, there have been some compile issues
reported in some configurations. Since we don't need these commits
on standard/base, we can relocate them to make standard/base upstream
clean.

This commit removes those patches from standard/base, and restores
then to the standard/intel/* branches.

(From OE-Core rev: 2c19e6378697141992c9bd7ff2bd4d57a4f9fe9b)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.4: update to v4.4.22
Bruce Ashfield [Mon, 3 Oct 2016 05:54:32 +0000 (01:54 -0400)]
linux-yocto/4.4: update to v4.4.22

(From OE-Core rev: 286d893f9e7caed06035f7916492a74e0212df6a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Hand applied to manage merge conflicts.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolinux-yocto/4.1: update to 4.1.33
Bruce Ashfield [Mon, 3 Oct 2016 05:54:31 +0000 (01:54 -0400)]
linux-yocto/4.1: update to 4.1.33

(From OE-Core rev: af4e9d92ae23f0e668da4732ef79cd1f1bb6fc1f)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Hand applied to manage merge conflicts.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agogcc-runtime.inc: Add CPP support for x86-64-x32 tune
Juro Bystricky [Sat, 8 Oct 2016 17:53:52 +0000 (10:53 -0700)]
gcc-runtime.inc: Add CPP support for x86-64-x32 tune

Using the following setup (as specified in yocto sample code):

MACHINE = "qemux86-64"
require conf/multilib.conf
MULTILIBS = "multilib:libx32"
DEFAULTTUNE_virtclass-multilib-libx32 = "x86-64-x32"

We fail to compile simple CPP programs because CPP cannot
find relevant header files, looking for them in a non-existing place.
To fix this, we create a symlink of the name CPP expects and point it to
the corresponding existing directory.

[YOCTO#10354]
[YOCTO#10380]

(From OE-Core rev: 9f9be229040f4f9a523a1e25afd78d5c3f4efc23)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agogcc-runtime.inc: add CPP support for mips64-n32 tune
Juro Bystricky [Mon, 29 Aug 2016 22:45:36 +0000 (15:45 -0700)]
gcc-runtime.inc: add CPP support for mips64-n32 tune

This patch fixes the problem where the CPP compiler cannot find include files.
The compiler is configured to look for the files in places that do not exist.
When querying the CPP for search paths, we observe messages such as these:

multilib configuration:

MACHINE="qemumips64"
require conf/multilib.conf
MULTILIBS = "multilib:lib64 multilib:lib32"
DEFAULTTUNE = "mips64-n32"
DEFAULTTUNE_virtclass-multilib-lib64 = "mips64"
DEFAULTTUNE_virtclass-multilib-lib32 = "mips32r2"

ignoring nonexistent directory "<path>/sysroots/mips64-n32-poky-linux-gnun32/usr/include/c++/6.2.0/mips64-poky-linux/32

single lib configuration:
MACHINE="qemumips64"
DEFAULTTUNE = "mips64-n32"
ignoring nonexistent directory "<path>/sysroots/mips64-n32-poky-linux-gnun32/usr/include/c++/6.2.0/mips64-poky-linux/

To fix this, create a symlink of the name CPP expects and point it to the corresponding "gnun32" directory.

[YOCTO#10142]

(From OE-Core rev: 55115f90f909d27599c686852e73df321ad1edff)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolibgcc-common.inc: Fix broken symlinks for multilib SDK
Juro Bystricky [Sat, 8 Oct 2016 17:53:53 +0000 (10:53 -0700)]
libgcc-common.inc: Fix broken symlinks for multilib SDK

This patch fixes broken "32" symlinks for multilib settings:

MACHINE = "qemuarm64"
require conf/multilib.conf
MULTILIBS = "multilib:lib32"
DEFAULTTUNE_virtclass-multilib-lib32 = "armv7a"

and

MACHINE = "qemux86-64"
require conf/multilib.conf
MULTILIBS = "multilib:libx32"
DEFAULTTUNE_virtclass-multilib-libx32 = "x86-64-x32"

[YOCTO#8642]
[YOCTO#10380]

(From OE-Core rev: 2810671a0f96776c135137f27a5ca52194ddd692)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobash: Security fix CVE-2016-0634
Sona Sarmadi [Mon, 10 Oct 2016 11:54:35 +0000 (13:54 +0200)]
bash: Security fix CVE-2016-0634

References to upstream patch:
https://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-047
http://openwall.com/lists/oss-security/2016/09/16/8

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodropbear: fix multiple CVEs
Sona Sarmadi [Wed, 2 Nov 2016 09:52:11 +0000 (10:52 +0100)]
dropbear: fix multiple CVEs

CVE-2016-7406
CVE-2016-7407
CVE-2016-7408
CVE-2016-7409

References:
https://matt.ucc.asn.au/dropbear/CHANGES
http://seclists.org/oss-sec/2016/q3/504

[YOCTO #10443]

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorpm: prevent race in tempdir creation
Markus Lehtonen [Fri, 14 Oct 2016 10:41:26 +0000 (13:41 +0300)]
rpm: prevent race in tempdir creation

This patch fixes an extramely rare race condition in creation of rpmdb
temporary directory. The "rpmdb-more-verbose-error-logging" patch is
still left in place, just for the case.

[YOCTO #9416]

(From OE-Core rev: 84de3283fa2a2908d367eb58953903ae685b0298)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobinutils: Fix gas error with cfi_section inconsistencies
Khem Raj [Fri, 14 Oct 2016 12:04:07 +0000 (05:04 -0700)]
binutils: Fix gas error with cfi_section inconsistencies

This error is visible when using clang but not when using gcc
this has been reported and fixed upstream.

llvm bug https://llvm.org/bugs/show_bug.cgi?id=29017
binutils bug https://sourceware.org/bugzilla/show_bug.cgi?id=20648

(From OE-Core rev: e5a81575f11dc2a0ec9ee4184514750d2dbd09aa)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
hand merged to apply against 2.26
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodevtool: Use the wildcard flag in update_recipe_patch
Ola x Nilsson [Tue, 23 Aug 2016 07:28:10 +0000 (09:28 +0200)]
devtool: Use the wildcard flag in update_recipe_patch

The --wilcard-version flag was only used in the srcrev variant of the
update-recipe command.

(From OE-Core rev: d3057cba0b01484712fcee3c52373c143608a436)

Signed-off-by: Ola x Nilsson <ola.x.nilsson@axis.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodevtool: build_image: Fix recipe filter
Ola x Nilsson [Tue, 23 Aug 2016 09:08:21 +0000 (11:08 +0200)]
devtool: build_image: Fix recipe filter

The missing split() causes dev and dbg packages to match.

(From OE-Core rev: bf83e0f0a3d52958c4380599f1afc4b8e058afd7)

Signed-off-by: Ola x Nilsson <ola.x.nilsson@axis.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoclasses/externalsrc: re-run do_configure when configure files change
Paul Eggleton [Tue, 11 Oct 2016 21:33:47 +0000 (10:33 +1300)]
classes/externalsrc: re-run do_configure when configure files change

If the user modifies files such as CMakeLists.txt in the case of cmake,
we want do_configure to re-run so that those changes can take effect. In
order to accomplish that, have a variable CONFIGURE_FILES which
specifies a list of files that will be put into do_configure's checksum
(either full paths, or just filenames which will be searched for in the
entire source tree). CONFIGURE_FILES then just needs to be set
appropriately depending on what do_configure is doing; for now I've set
this for autotools and cmake which are the most common cases.

Fixes [YOCTO #7617].

(From OE-Core rev: 923fc20c2862a6d75f949082c9f6532ab7e2d2cd)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodevtool: add: fix error message when only specifying a recipe name
Paul Eggleton [Tue, 4 Oct 2016 09:31:14 +0000 (22:31 +1300)]
devtool: add: fix error message when only specifying a recipe name

We were supposed to be printing out the specified recipe name here but I
forgot to specify a parameter for the string.

(From OE-Core rev: 87f844e533adfc229a5d26857a82cc6b125216c8)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agooe-selftest: recipetool: add tests for git URL mangling
Paul Eggleton [Tue, 26 Jul 2016 02:57:50 +0000 (14:57 +1200)]
oe-selftest: recipetool: add tests for git URL mangling

Add three tests to verify that the git URL mangling is working the way
it's supposed to. This should prevent us regressing on this again in
future.

(From OE-Core rev: d8d01f462ddbb79cff23b544fcd0ce251f05f8ce)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorecipetool: create: fix greedy regex that broke support for github tarballs
Paul Eggleton [Tue, 26 Jul 2016 02:57:49 +0000 (14:57 +1200)]
recipetool: create: fix greedy regex that broke support for github tarballs

The regex here needs to be anchored to the end or it'll match longer
URLs, which was exactly what I was trying to avoid. This regression was
introduced in OE-Core revision 7998dc3597657229507e5c140fceef1e485ac402.

Fixes [YOCTO #10023].

(From OE-Core rev: 9291c5d3c257d5ada7605dfe46ababda08f6d3c1)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolib/oe/recipeutils: fix patch_recipe*() with empty input
Paul Eggleton [Mon, 25 Jul 2016 08:47:17 +0000 (20:47 +1200)]
lib/oe/recipeutils: fix patch_recipe*() with empty input

If you supplied an empty file to patch_recipe() (or an empty list to
patch_recipe_lines()) then the result was IndexError because the code
checking to see if it needed to add an extra line of padding didn't
check to see if there were in fact any lines before trying to access the
last line.

Fixes [YOCTO #9972].

(From OE-Core rev: 92a73e870478ddb2a2d137e3fff28828809bec2e)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agorecipetool: create: fix handling of github URLs
Paul Eggleton [Wed, 6 Jul 2016 23:57:07 +0000 (11:57 +1200)]
recipetool: create: fix handling of github URLs

For a while now, Github hasn't been advertising a specific repository
URL since cloning the web URL with git works. Armed with this knowledge
and fully expecting people to just paste the github URL, we need to
handle this situation specially. If it looks like a github URL to the
root of a repository then treat it as a git repository instead of a
normal https URL to be fetched by the wget fetcher.

(From OE-Core rev: 7998dc3597657229507e5c140fceef1e485ac402)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodevtool: reset: allow reset to work if the recipe file has been deleted
Paul Eggleton [Wed, 6 Jul 2016 23:57:11 +0000 (11:57 +1200)]
devtool: reset: allow reset to work if the recipe file has been deleted

We were attempting to open the recipe file unconditionally here - we
need to account for the possibility that the recipe file has been
deleted or moved away by the user.

(From OE-Core rev: 47822a2aff56fd338c16b5ad756feda9f395a8a1)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agodevtool: update-recipe: fix --initial-rev option
Paul Eggleton [Wed, 6 Jul 2016 23:57:10 +0000 (11:57 +1200)]
devtool: update-recipe: fix --initial-rev option

In OE-Core revision 7baf57ad896112cf2258b3e2c2a1f8b756fb39bc I changed
the default update-recipe behaviour to only update patches for commits
that were changed; unfortunately I failed to handle the --initial-rev
option which was broken after that point. Rework how the initial
revision is passed in so that it now operates correctly.

(From OE-Core rev: b2ca2523cc9e51a4759b4420b07b0b67b3f5ac43)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobind: fix two CVEs
Zheng Ruoqin [Fri, 14 Oct 2016 14:11:04 +0000 (10:11 -0400)]
bind: fix two CVEs

Add two CVE patches from upstream
git: https://www.isc.org/git/

1.CVE-2016-2775.patch
2.CVE-2016-2776.patch

(From OE-Core rev: 5f4588d675e400f13bb6001df04790c867a95230)

Signed-off-by: zhengruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoarchiver: fix gcc-source handling
Saul Wold [Mon, 10 Oct 2016 18:32:05 +0000 (11:32 -0700)]
archiver: fix gcc-source handling

The source archiver was not handling the gcc-source target correctly, since it uses the
work-shared directory, we don't want to unpack and patch it twice, just as the comments
say, but the code was not there to check for the gcc-source target.

[YOCTO #10265]

(From OE-Core rev: bbac0699ceadb7a25a60643fb23dffce8b4d23d0)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoglibc: fix CVE-2016-1234, CVE-2016-3075, CVE-2016-5417
Pascal Bach [Fri, 14 Oct 2016 12:26:44 +0000 (14:26 +0200)]
glibc: fix CVE-2016-1234, CVE-2016-3075, CVE-2016-5417

Only relevant for krogoth since version 2.24+ (master, morty) is not affected.

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobinutils: fix AR issue when opkg is unpacking IPKs containing empty entries
Christophe Chapuis [Sun, 31 Jul 2016 18:52:41 +0000 (18:52 +0000)]
binutils: fix AR issue when opkg is unpacking IPKs containing empty entries

* this patch is backported from 2.26.1 which is already in oe-core/master
  since this patch:
  commit 37e8b6ecf9f9163d7b5b3becdc2feba57df4838f
  Author: Khem Raj <raj.khem@gmail.com>
  Date:   Thu Jul 7 11:08:29 2016 -0700
  Subject: binutils: Upgrade to 2.26.1

  -SRCREV = "71fa566a9cf2597b60a58c1d7c148bab637454a6"
  +SRCREV = "c29838e7f484e0b5714b02e7feb9a88d3a045dd2"

* verified that the patch exists in this SRCREV range:
  ~/projects/binutils $ git log --oneline 71fa566a9cf2597b60a58c1d7c148bab637454a6..c29838e7f484e0b5714b02e7feb9a88d3a045dd2^C
  ...
  343a405 Allow zero length archive elements
  ...
  so it isn't needed in master branch

Signed-off-by: Christophe Chapuis <chris.chapuis@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
8 years agopython3: Security fix CVE-2016-1000110
Armin Kuster [Sun, 2 Oct 2016 17:49:08 +0000 (10:49 -0700)]
python3: Security fix CVE-2016-1000110

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython: Security fix CVE-2016-1000110
Armin Kuster [Sun, 2 Oct 2016 17:48:28 +0000 (10:48 -0700)]
python: Security fix CVE-2016-1000110

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-1238
Mingli Yu [Mon, 26 Sep 2016 06:00:42 +0000 (14:00 +0800)]
perl: fix CVE-2016-1238

Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agomultilib_header: avoid sstate checksum issues for -nativesdk recipes
Joshua Lock [Fri, 30 Sep 2016 09:09:27 +0000 (10:09 +0100)]
multilib_header: avoid sstate checksum issues for -nativesdk recipes

Much as with -native recipes, as addressed in commit
b15730caf0d4c40271796887505507f2501958bb, arch specific variables
like MIPSPKGSFX_ABI were affecting -nativesdk sstate checksums for
recipes like nativesdk-glibc-initial.

Disable multilib_header for nativesdk as we don't use multilibs in
this scenario.

[YOCTO #10320]

(From OE-Core rev: f1c7b4f16dc9a7e5155108641fed8b3d98c931f3)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:35 +0000 (16:42 -0700)]
tzdata: update to 2016g

LICENSE md5sum changed do to rewording some text not released to the license.
see https://github.com/eggert/tz/commit/8c143a2b65fdfd43a7911be6fdb700c9c4553f58

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: Update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:34 +0000 (16:42 -0700)]
tzcode-native: Update to 2016g

LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopulseaudio: Disable unit tests
Davis, Michael [Wed, 28 Sep 2016 18:36:41 +0000 (18:36 +0000)]
pulseaudio: Disable unit tests

Pulseaudio unit tests create a dependency on check not in the recipe.
Since unit tests are not used they are disabled to eliminate build race condition.

Backported from master commit 92cfdb2ba7e04e2b70986c6569f500dd2a48b5d1

Signed-off-by: Michael Davis <michael.davis@essvote.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopigz: Update SRC_URI
Richard Purdie [Wed, 5 Oct 2016 07:55:11 +0000 (08:55 +0100)]
pigz: Update SRC_URI

Upstream have released a new tarball and removed the old one. Revert to
the Yocto Project source mirror instead, preserving the upstream version
check.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agouseradd: Fix infinite build loop
Richard Purdie [Thu, 29 Sep 2016 01:27:35 +0000 (21:27 -0400)]
useradd: Fix infinite build loop

http://git.openembedded.org/openembedded-core-contrib/commit/?id=642c6cf0b6a0371de476513162bd0cefa9c438b3
introduces a problem if the USERADD_PARAM variable has trailing
whitespace as the code infinitely loops causing build hangs.

Add a similar sed expression to $remaining to avoid this.

(From OE-Core rev: d6241e4c94a0a72acfc57e96a59918c0b2146d65)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agolibarchive: respect disable-acl configuration option
Maxin B. John [Tue, 27 Sep 2016 19:25:35 +0000 (15:25 -0400)]
libarchive: respect disable-acl configuration option

Update configure.ac to properly handle --disable-acl option

[YOCTO #9668]

(From OE-Core rev: 84fe3f29f2bdaf98c9beefdfede143084fba093b)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agouseradd.bbclass: Strip trailing ';' in cmd params
Khem Raj [Wed, 18 May 2016 04:20:15 +0000 (21:20 -0700)]
useradd.bbclass: Strip trailing ';' in cmd params

When there are more than 1 packages in a recipe requiring useradd
services, they are concatnated and a ';' is inserted just after
each of the users being added by the packages. A situation arises
in cases where this is controlled by PACKAGECONFIG then we add a
';' separator in the USERADD_PARAM value itself for each packagecofig
since we do not know which one will be picked, we end up in situation
where the final string returned from get_all_cmd_params() appears to be

a; ; b; c;

and then the logic which uses these cmds triggers with ';' as separator
but in this case it will fail after executing useradd 'a' because the next
cmd it will call will be just a whitespace

This is highlighted by the systemd patch to add more users as needed
by systemd 229 components.

(From OE-Core rev: e8d4356c38e3c2aacd6dc49231c73bcb7d597308)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>