diff options
Diffstat (limited to 'recipes-devtools')
18 files changed, 984 insertions, 0 deletions
diff --git a/recipes-devtools/cmake/cmake-native_3.24.2.bb b/recipes-devtools/cmake/cmake-native_3.24.2.bb new file mode 100644 index 0000000..bcc87eb --- /dev/null +++ b/recipes-devtools/cmake/cmake-native_3.24.2.bb @@ -0,0 +1,65 @@ +require cmake.inc +inherit native + +DEPENDS += "bzip2-replacement-native xz-native zlib-native curl-native ncurses-native zstd-native" + +SRC_URI += "file://OEToolchainConfig.cmake \ + file://environment.d-cmake.sh \ + file://0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch \ + file://0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch \ + " + +LICENSE:append = " & BSD-1-Clause & MIT & BSD-2-Clause" +LIC_FILES_CHKSUM:append = " \ + file://Utilities/cmjsoncpp/LICENSE;md5=5d73c165a0f9e86a1342f32d19ec5926 \ + file://Utilities/cmlibarchive/COPYING;md5=d499814247adaee08d88080841cb5665 \ + file://Utilities/cmexpat/COPYING;md5=9e2ce3b3c4c0f2670883a23bbd7c37a9 \ + file://Utilities/cmlibrhash/COPYING;md5=a8c2a557a5c53b1c12cddbee98c099af \ + file://Utilities/cmlibuv/LICENSE;md5=ad93ca1fffe931537fcf64f6fcce084d \ +" + +B = "${WORKDIR}/build" +do_configure[cleandirs] = "${B}" + +CMAKE_EXTRACONF = "\ + -DCMAKE_LIBRARY_PATH=${STAGING_LIBDIR_NATIVE} \ + -DBUILD_CursesDialog=1 \ + -DCMAKE_USE_SYSTEM_LIBRARIES=1 \ + -DCMAKE_USE_SYSTEM_LIBRARY_JSONCPP=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_LIBARCHIVE=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_LIBUV=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_LIBRHASH=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_EXPAT=0 \ + -DENABLE_ACL=0 -DHAVE_ACL_LIBACL_H=0 \ + -DHAVE_SYS_ACL_H=0 \ + -DCURL_LIBRARIES=-lcurl \ +" + +do_configure () { + ${S}/configure --verbose --prefix=${prefix} \ + ${@oe.utils.parallel_make_argument(d, '--parallel=%d')} \ + ${@bb.utils.contains('CCACHE', 'ccache ', '--enable-ccache', '', d)} \ + -- ${CMAKE_EXTRACONF} +} + +do_compile() { + oe_runmake +} + +do_install() { + oe_runmake 'DESTDIR=${D}' install + + # The following codes are here because eSDK needs to provide compatibilty + # for SDK. That is, eSDK could also be used like traditional SDK. + mkdir -p ${D}${datadir}/cmake + install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/ + mkdir -p ${D}${base_prefix}/environment-setup.d + install -m 644 ${WORKDIR}/environment.d-cmake.sh ${D}${base_prefix}/environment-setup.d/cmake.sh + + # Help docs create tons of files in the native sysroot and aren't needed there + rm -rf ${D}${datadir}/cmake-*/Help +} + +do_compile[progress] = "percent" + +SYSROOT_DIRS_NATIVE += "${datadir}/cmake ${base_prefix}/environment-setup.d" diff --git a/recipes-devtools/cmake/cmake.inc b/recipes-devtools/cmake/cmake.inc new file mode 100644 index 0000000..7561e85 --- /dev/null +++ b/recipes-devtools/cmake/cmake.inc @@ -0,0 +1,28 @@ +# Copyright (C) 2005, Koninklijke Philips Electronics NV. All Rights Reserved +# Released under the MIT license (see packages/COPYING) + +SUMMARY = "Cross-platform, open-source make system" +DESCRIPTION = "CMake is used to control the software compilation process \ +using simple platform and compiler independent configuration files. CMake \ +generates native makefiles and workspaces that can be used in the compiler \ +environment of your choice." +HOMEPAGE = "http://www.cmake.org/" +BUGTRACKER = "http://public.kitware.com/Bug/my_view_page.php" +SECTION = "console/utils" +LICENSE = "BSD-3-Clause" +LIC_FILES_CHKSUM = "file://Copyright.txt;md5=45025187a129339459b6f1a24f7fac6e \ + file://Source/cmake.h;beginline=1;endline=2;md5=a5f70e1fef8614734eae0d62b4f5891b \ + " + +CMAKE_MAJOR_VERSION = "${@'.'.join(d.getVar('PV').split('.')[0:2])}" + +SRC_URI = "https://cmake.org/files/v${CMAKE_MAJOR_VERSION}/cmake-${PV}.tar.gz \ +" + +SRC_URI[sha256sum] = "0d9020f06f3ddf17fb537dc228e1a56c927ee506b486f55fe2dc19f69bf0c8db" + +UPSTREAM_CHECK_REGEX = "cmake-(?P<pver>\d+(\.\d+)+)\.tar" + +# This is specific to the npm package that installs cmake, so isn't +# relevant to OpenEmbedded +CVE_CHECK_IGNORE += "CVE-2016-10642" diff --git a/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch b/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch new file mode 100644 index 0000000..9a2287f --- /dev/null +++ b/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch @@ -0,0 +1,44 @@ +From 89f6c846f02ad6d30b9ebb7eaaaa4fb6f9cec054 Mon Sep 17 00:00:00 2001 +From: Cody P Schafer <dev@codyps.com> +Date: Thu, 27 Apr 2017 11:35:05 -0400 +Subject: [PATCH] CMakeDetermineSystem: use oe environment vars to load default + toolchain file in sdk + +Passing the toolchain by: + + - shell aliases does not work if cmake is called by a script + - unconditionally by a wrapper script causes cmake to believe it is + configuring things when it is not (for example, `cmake --build` breaks). + +The OE_CMAKE_TOOLCHAIN_FILE variable is only used as a default if no +toolchain is explicitly specified. + +Setting the CMAKE_TOOLCHAIN_FILE cmake variable is marked as cached +because '-D' options are cache entries themselves. + +Upstream-Status: Inappropriate [oe-core specific] +Signed-off-by: Cody P Schafer <dev@codyps.com> +Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> + +--- + Modules/CMakeDetermineSystem.cmake | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/Modules/CMakeDetermineSystem.cmake b/Modules/CMakeDetermineSystem.cmake +index 8c7af067..ade2b189 100644 +--- a/Modules/CMakeDetermineSystem.cmake ++++ b/Modules/CMakeDetermineSystem.cmake +@@ -112,6 +112,13 @@ else() + endif() + endif() + ++if(NOT DEFINED CMAKE_TOOLCHAIN_FILE) ++ if(DEFINED ENV{OE_CMAKE_TOOLCHAIN_FILE}) ++ set(CMAKE_TOOLCHAIN_FILE "$ENV{OE_CMAKE_TOOLCHAIN_FILE}" CACHE FILEPATH "toolchain file") ++ message(STATUS "Toolchain file defaulted to '${CMAKE_TOOLCHAIN_FILE}'") ++ endif() ++endif() ++ + # if a toolchain file is used, the user wants to cross compile. + # in this case read the toolchain file and keep the CMAKE_HOST_SYSTEM_* + # variables around so they can be used in CMakeLists.txt. diff --git a/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch b/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch new file mode 100644 index 0000000..d6f7308 --- /dev/null +++ b/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch @@ -0,0 +1,39 @@ +From fd9a04c1434e12f21c043385e306e0b52d38d749 Mon Sep 17 00:00:00 2001 +From: Otavio Salvador <otavio@ossystems.com.br> +Date: Thu, 5 Jul 2018 10:28:04 -0300 +Subject: [PATCH] Disable use of ext2fs/ext2_fs.h by cmake's internal + + libarchive copy +Organization: O.S. Systems Software LTDA. + +We don't want to add a dependency on e2fsprogs-native for cmake-native, +and we don't use CPack so just disable this functionality. + +Upstream-Status: Inappropriate [config] + +Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> +Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> + +--- + Utilities/cmlibarchive/CMakeLists.txt | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt +index bfcaf30..2960683 100644 +--- a/Utilities/cmlibarchive/CMakeLists.txt ++++ b/Utilities/cmlibarchive/CMakeLists.txt +@@ -682,12 +682,8 @@ LA_CHECK_INCLUDE_FILE("copyfile.h" HAVE_COPYFILE_H) + LA_CHECK_INCLUDE_FILE("direct.h" HAVE_DIRECT_H) + LA_CHECK_INCLUDE_FILE("dlfcn.h" HAVE_DLFCN_H) + LA_CHECK_INCLUDE_FILE("errno.h" HAVE_ERRNO_H) +-LA_CHECK_INCLUDE_FILE("ext2fs/ext2_fs.h" HAVE_EXT2FS_EXT2_FS_H) +- +-CHECK_C_SOURCE_COMPILES("#include <sys/ioctl.h> +-#include <ext2fs/ext2_fs.h> +-int main(void) { return EXT2_IOC_GETFLAGS; }" HAVE_WORKING_EXT2_IOC_GETFLAGS) +- ++SET(HAVE_EXT2FS_EXT2_FS_H 0) ++SET(HAVE_WORKING_EXT2_IOC_GETFLAGS 0) + LA_CHECK_INCLUDE_FILE("fcntl.h" HAVE_FCNTL_H) + LA_CHECK_INCLUDE_FILE("grp.h" HAVE_GRP_H) + LA_CHECK_INCLUDE_FILE("io.h" HAVE_IO_H) diff --git a/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake b/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake new file mode 100644 index 0000000..d6a1e04 --- /dev/null +++ b/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake @@ -0,0 +1,20 @@ +set( CMAKE_SYSTEM_NAME Linux ) +set( CMAKE_C_FLAGS $ENV{CFLAGS} CACHE STRING "" FORCE ) +set( CMAKE_CXX_FLAGS $ENV{CXXFLAGS} CACHE STRING "" FORCE ) +set( CMAKE_SYSROOT $ENV{OECORE_TARGET_SYSROOT} ) + +set( CMAKE_FIND_ROOT_PATH $ENV{OECORE_TARGET_SYSROOT} ) +set( CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER ) +set( CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY ) +set( CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY ) +set( CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY ) + +set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "$ENV{OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX}") + +set( CMAKE_SYSTEM_PROCESSOR $ENV{OECORE_TARGET_ARCH} ) + +# Include the toolchain configuration subscripts +file( GLOB toolchain_config_files "${CMAKE_CURRENT_LIST_FILE}.d/*.cmake" ) +foreach(config ${toolchain_config_files}) + include(${config}) +endforeach() diff --git a/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template b/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template new file mode 100644 index 0000000..c69569a --- /dev/null +++ b/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template @@ -0,0 +1,31 @@ +set(SDK_INSTALL_DIR "${CMAKE_CURRENT_LIST_DIR}/../../../../..") +set(HOST_SYSROOT "${SDK_INSTALL_DIR}/sysroots/@OECORE_SDK_SYS") +set(TARGET_SYSROOT "${SDK_INSTALL_DIR}/sysroots/@OECORE_TARGET_SYS") +set(HOST_BIN "${HOST_SYSROOT}/usr/bin") +set(TOOLCHAIN_NAME "@OECORE_TARGET_ALIAS") +set(GCC_DIR "${HOST_BIN}/${TOOLCHAIN_NAME}") + +set(CMAKE_SYSTEM_NAME Linux) +set(CMAKE_SYSTEM_PROCESSOR "@OECORE_TARGET_ARCH") + +set(CMAKE_C_COMPILER "${GCC_DIR}/${TOOLCHAIN_NAME}-gcc") +set(CMAKE_CXX_COMPILER "${GCC_DIR}/${TOOLCHAIN_NAME}-g++") + +set(ARCH_FLAGS "@OECORE_TUNE_CCARGS") +set(CMAKE_C_FLAGS "${ARCH_FLAGS}" CACHE STRING "" FORCE ) +set(CMAKE_CXX_FLAGS "${ARCH_FLAGS}" CACHE STRING "" FORCE ) +set(CMAKE_ASM_FLAGS ${CMAKE_C_FLAGS} CACHE STRING "" FORCE ) +set(CMAKE_LDFLAGS_FLAGS ${CMAKE_C_FLAGS} CACHE STRING "" FORCE ) + +set(CMAKE_SYSROOT "${TARGET_SYSROOT}") + +set(CMAKE_FIND_ROOT_PATH "${TARGET_SYSROOT}" ) + +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER ) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY ) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY ) +set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY ) + +set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "") + +set(CMAKE_PROGRAM_PATH "${HOST_SYSROOT}/usr/bin" CACHE STRING "" FORCE) diff --git a/recipes-devtools/cmake/cmake/cmake-setup.py b/recipes-devtools/cmake/cmake/cmake-setup.py new file mode 100755 index 0000000..af587a4 --- /dev/null +++ b/recipes-devtools/cmake/cmake/cmake-setup.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python3 + +import os +import string +import sys + +class Template(string.Template): + delimiter = "@" + +class Environ(): + def __getitem__(self, name): + if name == "OECORE_SDK_SYS": + return os.path.basename(os.environ["OECORE_NATIVE_SYSROOT"]) + elif name == "OECORE_TARGET_SYS": + return os.path.basename(os.environ["OECORE_TARGET_SYSROOT"]) + elif name == "OECORE_TARGET_ALIAS": + return os.path.basename(os.environ["TARGET_PREFIX"].strip("-")) + else: + return os.environ[name] + +try: + sysroot = os.environ['OECORE_NATIVE_SYSROOT'] +except KeyError: + print("Not in environment setup, bailing") + sys.exit(1) + +template_file = os.path.join(sysroot, 'usr/share/cmake/SDKToolchainConfig.cmake.template') +cross_file = os.path.join(sysroot, 'usr/share/cmake/%s-toolchain.cmake' % (os.path.basename(os.environ["OECORE_TARGET_SYSROOT"]))) +with open(template_file) as in_file: + template = in_file.read() + output = Template(template).substitute(Environ()) + with open(cross_file, "w") as out_file: + out_file.write(output) diff --git a/recipes-devtools/cmake/cmake/environment.d-cmake.sh b/recipes-devtools/cmake/cmake/environment.d-cmake.sh new file mode 100644 index 0000000..7bdb19f --- /dev/null +++ b/recipes-devtools/cmake/cmake/environment.d-cmake.sh @@ -0,0 +1,2 @@ +export OE_CMAKE_TOOLCHAIN_FILE="$OECORE_NATIVE_SYSROOT/usr/share/cmake/OEToolchainConfig.cmake" +export OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX="`echo $OECORE_BASELIB | sed -e s/lib//`" diff --git a/recipes-devtools/cmake/cmake_3.24.2.bb b/recipes-devtools/cmake/cmake_3.24.2.bb new file mode 100644 index 0000000..bb7ed83 --- /dev/null +++ b/recipes-devtools/cmake/cmake_3.24.2.bb @@ -0,0 +1,67 @@ +require cmake.inc + +inherit cmake bash-completion + +DEPENDS += "curl expat zlib libarchive xz ncurses bzip2" + +SRC_URI:append:class-nativesdk = " \ + file://OEToolchainConfig.cmake \ + file://SDKToolchainConfig.cmake.template \ + file://cmake-setup.py \ + file://environment.d-cmake.sh \ + file://0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch \ +" + +LICENSE:append = " & BSD-1-Clause & MIT" +LIC_FILES_CHKSUM:append = " \ + file://Utilities/cmjsoncpp/LICENSE;md5=5d73c165a0f9e86a1342f32d19ec5926 \ + file://Utilities/cmlibrhash/COPYING;md5=a8c2a557a5c53b1c12cddbee98c099af \ + file://Utilities/cmlibuv/LICENSE;md5=ad93ca1fffe931537fcf64f6fcce084d \ +" + +# Strip ${prefix} from ${docdir}, set result into docdir_stripped +python () { + prefix=d.getVar("prefix") + docdir=d.getVar("docdir") + + if not docdir.startswith(prefix): + bb.fatal('docdir must contain prefix as its prefix') + + docdir_stripped = docdir[len(prefix):] + if len(docdir_stripped) > 0 and docdir_stripped[0] == '/': + docdir_stripped = docdir_stripped[1:] + + d.setVar("docdir_stripped", docdir_stripped) +} + +EXTRA_OECMAKE=" \ + -DCMAKE_DOC_DIR=${docdir_stripped}/cmake-${CMAKE_MAJOR_VERSION} \ + -DCMAKE_USE_SYSTEM_LIBRARIES=1 \ + -DCMAKE_USE_SYSTEM_LIBRARY_JSONCPP=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_LIBUV=0 \ + -DCMAKE_USE_SYSTEM_LIBRARY_LIBRHASH=0 \ + -DKWSYS_CHAR_IS_SIGNED=1 \ + -DBUILD_CursesDialog=0 \ + -DKWSYS_LFS_WORKS=1 \ +" + +do_install:append:class-nativesdk() { + mkdir -p ${D}${datadir}/cmake + install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/ + + mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d + install -m 644 ${WORKDIR}/environment.d-cmake.sh ${D}${SDKPATHNATIVE}/environment-setup.d/cmake.sh + + # install cmake-setup.py to create arch-specific toolchain cmake file from template + install -m 0644 ${WORKDIR}/SDKToolchainConfig.cmake.template ${D}${datadir}/cmake/ + install -d ${D}${SDKPATHNATIVE}/post-relocate-setup.d + install -m 0755 ${WORKDIR}/cmake-setup.py ${D}${SDKPATHNATIVE}/post-relocate-setup.d/ +} + +FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}" + +FILES:${PN} += "${datadir}/cmake-${CMAKE_MAJOR_VERSION} ${datadir}/cmake ${datadir}/aclocal ${datadir}/emacs ${datadir}/vim" +FILES:${PN}-doc += "${docdir}/cmake-${CMAKE_MAJOR_VERSION}" +FILES:${PN}-dev = "" + +BBCLASSEXTEND = "nativesdk" diff --git a/recipes-devtools/python/python3/CVE-2022-37454.patch b/recipes-devtools/python/python3/CVE-2022-37454.patch new file mode 100644 index 0000000..f45c5bd --- /dev/null +++ b/recipes-devtools/python/python3/CVE-2022-37454.patch @@ -0,0 +1,106 @@ +From 948c6794711458fd148a3fa62296cadeeb2ed631 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Fri, 28 Oct 2022 03:07:50 -0700 +Subject: [PATCH] [3.8] gh-98517: Fix buffer overflows in _sha3 module + (GH-98519) (#98527) + +This is a port of the applicable part of XKCP's fix [1] for +CVE-2022-37454 and avoids the segmentation fault and the infinite +loop in the test cases published in [2]. + +[1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a +[2]: https://mouha.be/sha-3-buffer-overflow/ + +Regression test added by: Gregory P. Smith [Google LLC] <greg@krypto.org> +(cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3) + +Co-authored-by: Theo Buehler <botovq@users.noreply.github.com> + +CVE: CVE-2022-37454 +Upstream-Status: Backport [https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631] +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> +--- + Lib/test/test_hashlib.py | 9 +++++++++ + .../2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | 1 + + Modules/_sha3/kcp/KeccakSponge.inc | 15 ++++++++------- + 3 files changed, 18 insertions(+), 7 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst + +diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py +index 8b53d23ef525..e6cec4e306e5 100644 +--- a/Lib/test/test_hashlib.py ++++ b/Lib/test/test_hashlib.py +@@ -434,6 +434,15 @@ def test_case_md5_huge(self, size): + def test_case_md5_uintmax(self, size): + self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3') + ++ @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') ++ @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) ++ def test_sha3_update_overflow(self, size): ++ """Regression test for gh-98517 CVE-2022-37454.""" ++ h = hashlib.sha3_224() ++ h.update(b'\x01') ++ h.update(b'\x01'*0xffff_ffff) ++ self.assertEqual(h.hexdigest(), '80762e8ce6700f114fec0f621fd97c4b9c00147fa052215294cceeed') ++ + # use the three examples from Federal Information Processing Standards + # Publication 180-1, Secure Hash Standard, 1995 April 17 + # http://www.itl.nist.gov/div897/pubs/fip180-1.htm +diff --git a/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst +new file mode 100644 +index 000000000000..2d23a6ad93c7 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst +@@ -0,0 +1 @@ ++Port XKCP's fix for the buffer overflows in SHA-3 (CVE-2022-37454). +diff --git a/Modules/_sha3/kcp/KeccakSponge.inc b/Modules/_sha3/kcp/KeccakSponge.inc +index e10739deafa8..cf92e4db4d36 100644 +--- a/Modules/_sha3/kcp/KeccakSponge.inc ++++ b/Modules/_sha3/kcp/KeccakSponge.inc +@@ -171,7 +171,7 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat + i = 0; + curData = data; + while(i < dataByteLen) { +- if ((instance->byteIOIndex == 0) && (dataByteLen >= (i + rateInBytes))) { ++ if ((instance->byteIOIndex == 0) && (dataByteLen-i >= rateInBytes)) { + #ifdef SnP_FastLoop_Absorb + /* processing full blocks first */ + +@@ -199,10 +199,10 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat + } + else { + /* normal lane: using the message queue */ +- +- partialBlock = (unsigned int)(dataByteLen - i); +- if (partialBlock+instance->byteIOIndex > rateInBytes) ++ if (dataByteLen-i > rateInBytes-instance->byteIOIndex) + partialBlock = rateInBytes-instance->byteIOIndex; ++ else ++ partialBlock = (unsigned int)(dataByteLen - i); + #ifdef KeccakReference + displayBytes(1, "Block to be absorbed (part)", curData, partialBlock); + #endif +@@ -281,7 +281,7 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte + i = 0; + curData = data; + while(i < dataByteLen) { +- if ((instance->byteIOIndex == rateInBytes) && (dataByteLen >= (i + rateInBytes))) { ++ if ((instance->byteIOIndex == rateInBytes) && (dataByteLen-i >= rateInBytes)) { + for(j=dataByteLen-i; j>=rateInBytes; j-=rateInBytes) { + SnP_Permute(instance->state); + SnP_ExtractBytes(instance->state, curData, 0, rateInBytes); +@@ -299,9 +299,10 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte + SnP_Permute(instance->state); + instance->byteIOIndex = 0; + } +- partialBlock = (unsigned int)(dataByteLen - i); +- if (partialBlock+instance->byteIOIndex > rateInBytes) ++ if (dataByteLen-i > rateInBytes-instance->byteIOIndex) + partialBlock = rateInBytes-instance->byteIOIndex; ++ else ++ partialBlock = (unsigned int)(dataByteLen - i); + i += partialBlock; + + SnP_ExtractBytes(instance->state, curData, instance->byteIOIndex, partialBlock); + diff --git a/recipes-devtools/python/python3/CVE-2022-45061.patch b/recipes-devtools/python/python3/CVE-2022-45061.patch new file mode 100644 index 0000000..2d0a449 --- /dev/null +++ b/recipes-devtools/python/python3/CVE-2022-45061.patch @@ -0,0 +1,101 @@ +From 064ec20bf7a181ba5fa961aaa12973812aa6ca5d Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Mon, 7 Nov 2022 18:57:10 -0800 +Subject: [PATCH] [3.11] gh-98433: Fix quadratic time idna decoding. (GH-99092) + (GH-99222) + +There was an unnecessary quadratic loop in idna decoding. This restores +the behavior to linear. + +(cherry picked from commit d315722564927c7202dd6e111dc79eaf14240b0d) + +(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15) + +Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> +Co-authored-by: Gregory P. Smith <greg@krypto.org> + +CVE: CVE-2022-45061 +Upstream-Status: Backport [https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d] +Signed-off-by: Omkar Patil <Omkar.Patil@kpit.com> + +--- + Lib/encodings/idna.py | 32 +++++++++---------- + Lib/test/test_codecs.py | 6 ++++ + ...2-11-04-09-29-36.gh-issue-98433.l76c5G.rst | 6 ++++ + 3 files changed, 27 insertions(+), 17 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst + +diff --git a/Lib/encodings/idna.py b/Lib/encodings/idna.py +index ea4058512fe3..bf98f513366b 100644 +--- a/Lib/encodings/idna.py ++++ b/Lib/encodings/idna.py +@@ -39,23 +39,21 @@ def nameprep(label): + + # Check bidi + RandAL = [stringprep.in_table_d1(x) for x in label] +- for c in RandAL: +- if c: +- # There is a RandAL char in the string. Must perform further +- # tests: +- # 1) The characters in section 5.8 MUST be prohibited. +- # This is table C.8, which was already checked +- # 2) If a string contains any RandALCat character, the string +- # MUST NOT contain any LCat character. +- if any(stringprep.in_table_d2(x) for x in label): +- raise UnicodeError("Violation of BIDI requirement 2") +- +- # 3) If a string contains any RandALCat character, a +- # RandALCat character MUST be the first character of the +- # string, and a RandALCat character MUST be the last +- # character of the string. +- if not RandAL[0] or not RandAL[-1]: +- raise UnicodeError("Violation of BIDI requirement 3") ++ if any(RandAL): ++ # There is a RandAL char in the string. Must perform further ++ # tests: ++ # 1) The characters in section 5.8 MUST be prohibited. ++ # This is table C.8, which was already checked ++ # 2) If a string contains any RandALCat character, the string ++ # MUST NOT contain any LCat character. ++ if any(stringprep.in_table_d2(x) for x in label): ++ raise UnicodeError("Violation of BIDI requirement 2") ++ # 3) If a string contains any RandALCat character, a ++ # RandALCat character MUST be the first character of the ++ # string, and a RandALCat character MUST be the last ++ # character of the string. ++ if not RandAL[0] or not RandAL[-1]: ++ raise UnicodeError("Violation of BIDI requirement 3") + + return label + +diff --git a/Lib/test/test_codecs.py b/Lib/test/test_codecs.py +index d1faf0126c1e..37ade7d80d02 100644 +--- a/Lib/test/test_codecs.py ++++ b/Lib/test/test_codecs.py +@@ -1532,6 +1532,12 @@ def test_builtin_encode(self): + self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org") + self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.") + ++ def test_builtin_decode_length_limit(self): ++ with self.assertRaisesRegex(UnicodeError, "too long"): ++ (b"xn--016c"+b"a"*1100).decode("idna") ++ with self.assertRaisesRegex(UnicodeError, "too long"): ++ (b"xn--016c"+b"a"*70).decode("idna") ++ + def test_stream(self): + r = codecs.getreader("idna")(io.BytesIO(b"abc")) + r.read(3) +diff --git a/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst +new file mode 100644 +index 000000000000..5185fac2e29d +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst +@@ -0,0 +1,6 @@ ++The IDNA codec decoder used on DNS hostnames by :mod:`socket` or :mod:`asyncio` ++related name resolution functions no longer involves a quadratic algorithm. ++This prevents a potential CPU denial of service if an out-of-spec excessive ++length hostname involving bidirectional characters were decoded. Some protocols ++such as :mod:`urllib` http ``3xx`` redirects potentially allow for an attacker ++to supply such a name. + diff --git a/recipes-devtools/python/python3_%.bbappend b/recipes-devtools/python/python3_%.bbappend index 70b4561..6636814 100644 --- a/recipes-devtools/python/python3_%.bbappend +++ b/recipes-devtools/python/python3_%.bbappend @@ -1,6 +1,13 @@ # Make python3 the default # Remove this stuff if there is ever a python4. +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" + +SRC_URI_append = " \ + file://CVE-2022-45061.patch \ + file://CVE-2022-37454.patch \ +" + # Debian and Ubuntu have this (prior levels linked to python2) PACKAGES_append = " python-is-python3" ALLOW_EMPTY_python-is-python3 = "1" diff --git a/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch b/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch new file mode 100644 index 0000000..474d82d --- /dev/null +++ b/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch @@ -0,0 +1,173 @@ +From 785c0072c80c2f6e0839478453cf65fdeac15da0 Mon Sep 17 00:00:00 2001 +From: Khem Raj <raj.khem@gmail.com> +Date: Mon, 29 Aug 2022 19:53:28 -0700 +Subject: [PATCH] Add missing prototypes to function declarations + +With Clang 15+ compiler -Wstrict-prototypes is triggering warnings which +are turned into errors with -Werror, this fixes the problem by adding +missing prototypes + +Fixes errors like +| log.c:134:24: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] +| static void syslog_init() +| ^ +| void + +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032858.html] +Signed-off-by: Khem Raj <raj.khem@gmail.com> +--- + checksum.c | 2 +- + exclude.c | 2 +- + hlink.c | 3 +-- + lib/pool_alloc.c | 2 +- + log.c | 2 +- + main.c | 2 +- + syscall.c | 4 ++-- + zlib/crc32.c | 2 +- + zlib/trees.c | 2 +- + zlib/zutil.c | 4 ++-- + 10 files changed, 12 insertions(+), 13 deletions(-) + +diff --git a/checksum.c b/checksum.c +index fb8c0a0..174c28c 100644 +--- a/checksum.c ++++ b/checksum.c +@@ -629,7 +629,7 @@ int sum_end(char *sum) + return csum_len_for_type(cursum_type, 0); + } + +-void init_checksum_choices() ++void init_checksum_choices(void) + { + #ifdef SUPPORT_XXH3 + char buf[32816]; +diff --git a/exclude.c b/exclude.c +index adc82e2..79f5a82 100644 +--- a/exclude.c ++++ b/exclude.c +@@ -358,7 +358,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end) + memcpy(partial_string_buf, s_start, partial_string_len); + } + +-void free_implied_include_partial_string() ++void free_implied_include_partial_string(void) + { + if (partial_string_buf) { + free(partial_string_buf); +diff --git a/hlink.c b/hlink.c +index 66810a3..6511dfb 100644 +--- a/hlink.c ++++ b/hlink.c +@@ -117,8 +117,7 @@ static void match_gnums(int32 *ndx_list, int ndx_count) + struct ht_int32_node *node = NULL; + int32 gnum, gnum_next; + +- qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)()) hlink_compare_gnum); +- ++ qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)(const void *, const void *)) hlink_compare_gnum); + for (from = 0; from < ndx_count; from++) { + file = hlink_flist->sorted[ndx_list[from]]; + gnum = F_HL_GNUM(file); +diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c +index a1a7245..4eae062 100644 +--- a/lib/pool_alloc.c ++++ b/lib/pool_alloc.c +@@ -9,7 +9,7 @@ struct alloc_pool + size_t size; /* extent size */ + size_t quantum; /* allocation quantum */ + struct pool_extent *extents; /* top extent is "live" */ +- void (*bomb)(); /* called if malloc fails */ ++ void (*bomb)(const char *, const char *, int); /* called if malloc fails */ + int flags; + + /* statistical data */ +diff --git a/log.c b/log.c +index 44344e2..991e359 100644 +--- a/log.c ++++ b/log.c +@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf) + } + } + +-static void syslog_init() ++static void syslog_init(void) + { + int options = LOG_PID; + +diff --git a/main.c b/main.c +index 9ebfbea..affa244 100644 +--- a/main.c ++++ b/main.c +@@ -244,7 +244,7 @@ void read_del_stats(int f) + stats.deleted_files += stats.deleted_specials = read_varint(f); + } + +-static void become_copy_as_user() ++static void become_copy_as_user(void) + { + char *gname; + uid_t uid; +diff --git a/syscall.c b/syscall.c +index d92074a..92ca86d 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -389,9 +389,9 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence) + { + #ifdef HAVE_LSEEK64 + #if !SIZEOF_OFF64_T +- OFF_T lseek64(); ++ OFF_T lseek64(int fd, OFF_T offset, int whence); + #else +- off64_t lseek64(); ++ off64_t lseek64(int fd, off64_t offset, int whence); + #endif + return lseek64(fd, offset, whence); + #else +diff --git a/zlib/crc32.c b/zlib/crc32.c +index 05733f4..50c6c02 100644 +--- a/zlib/crc32.c ++++ b/zlib/crc32.c +@@ -187,7 +187,7 @@ local void write_table(out, table) + /* ========================================================================= + * This function can be used by asm versions of crc32() + */ +-const z_crc_t FAR * ZEXPORT get_crc_table() ++const z_crc_t FAR * ZEXPORT get_crc_table(void) + { + #ifdef DYNAMIC_CRC_TABLE + if (crc_table_empty) +diff --git a/zlib/trees.c b/zlib/trees.c +index 9c66770..0d9047e 100644 +--- a/zlib/trees.c ++++ b/zlib/trees.c +@@ -231,7 +231,7 @@ local void send_bits(s, value, length) + /* =========================================================================== + * Initialize the various 'constant' tables. + */ +-local void tr_static_init() ++local void tr_static_init(void) + { + #if defined(GEN_TREES_H) || !defined(STDC) + static int static_init_done = 0; +diff --git a/zlib/zutil.c b/zlib/zutil.c +index bbba7b2..61f8dc9 100644 +--- a/zlib/zutil.c ++++ b/zlib/zutil.c +@@ -27,12 +27,12 @@ z_const char * const z_errmsg[10] = { + ""}; + + +-const char * ZEXPORT zlibVersion() ++const char * ZEXPORT zlibVersion(void) + { + return ZLIB_VERSION; + } + +-uLong ZEXPORT zlibCompileFlags() ++uLong ZEXPORT zlibCompileFlags(void) + { + uLong flags; + +-- +2.37.2 + diff --git a/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch b/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch new file mode 100644 index 0000000..1d9c4bf --- /dev/null +++ b/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch @@ -0,0 +1,68 @@ +From e64a58387db46239902b610871a0eb81626e99ff Mon Sep 17 00:00:00 2001 +From: Paul Eggert <eggert@cs.ucla.edu> +Date: Thu, 18 Aug 2022 07:46:28 -0700 +Subject: [PATCH] Turn on -pedantic-errors at the end of 'configure' + +Problem reported by Khem Raj in: +https://lists.gnu.org/r/autoconf-patches/2022-08/msg00009.html +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032862.html] +--- |