openembedded-core.git/meta/recipes-core, branch morty

build-appliance-image: Update to morty head revision

2017-02-08T12:00:29+00:00

Signed-off-by: Richard Purdie

zlib: update SRC_URI to fix fetching

2017-01-11T23:28:50+00:00

Upstream have removed the file from zlib.net as a new version has
been released, switch to fetching from the official sourceforge
mirror.

[YOCTO #10879]

(From OE-Core rev: bb99e4a620efd59556539c156cd98ea23aae74c8)

Signed-off-by: Joshua Lock 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie

build-appliance-image: Update to morty head revision

2017-01-11T17:26:48+00:00

Signed-off-by: Richard Purdie

libxml2: Fix more NULL pointer derefs

2017-01-11T11:46:53+00:00

The NULL pointer dereferencing could produced some
security problems.
This is a preventive security fix.

(From OE-Core rev: 8f3008114d5000a0865f50833db7c3a3f9808601)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ranges

2017-01-11T11:46:53+00:00

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

(From OE-Core rev: 00e928bd1c2aed9caeaf9e411743805d2139a023)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: Necessary changes before fixing CVE-2016-5131

2017-01-11T11:46:53+00:00

xpath:
 - Check for errors after evaluating first operand.
 - Add sanity check for empty stack.
 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes

(From OE-Core rev: 96ef568f75dded56a2123b63dcc8b443f796afe0)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

glibc: Enable backtrace from abort on ARM

2017-01-11T11:46:52+00:00

ARM stack frames for abort and raise were limited to the the actual
abort and raise call, such as:

Obtained 4 stack frames.
./test-app(print_trace+0x1c) [0x10a08]
./test-app() [0x10b3c]
/lib/libc.so.6(__default_sa_restorer+0) [0x4adae1e0]
/lib/libc.so.6(gsignal+0xa0) [0x4adacf74]

This is not terribly useful when trying to figure out what function
may have called called the abort, especially when using pthreads.

After the change the trace would now look like:

Obtained 8 stack frames.
./test-app(print_trace+0x1c) [0x10a08]
./test-app() [0x10b3c]
/lib/libc.so.6(__default_sa_restorer+0) [0x4befe1e0]
/lib/libc.so.6(gsignal+0xa0) [0x4befcf74]
/lib/libc.so.6(abort+0x134) [0x4befe358]
./test-app(dummy_function+0x50) [0x10adc]
./test-app(main+0xd4) [0x10c24]
/lib/libc.so.6(__libc_start_main+0x114) [0x4bee7a58]

(From OE-Core rev: 93bf8713d8e13c278543baea94fb8dad0cb80e49)

Signed-off-by: Yuanjie Huang 
Signed-off-by: Mark Hatle 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: Security fix CVE-2016-5131

2017-01-11T11:46:44+00:00

CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through
2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the XPointer range-to function.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131

Patch from:
https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e

(From OE-Core rev: 640bd2b98ff33e49b42f1087650ebe20d92259a4)

Signed-off-by: Yi Zhao 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

util-linux: add su.1 to update-alternatives

2016-11-16T10:33:35+00:00

The su binary is handled by alternatives but the man page wasn't, so
installing both util-linux-doc and shadow-doc produces errors.

Also use d.expand() to neaten the code.

(From OE-Core rev: 70a161ee88d3d54fec6d59039c181b43f1857dc3)

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

busybox/mdev.conf: Ignore eMMC RPMB and boot block devices

2016-11-16T10:33:35+00:00

eMMC devices may report block devices like "mmcblk0rpmb" and
"mmcblk0boot0". These are not actually block devices and any
read/write operation on them will fail. To prevent spamming error
messages attempting to mount them, just ignore these devices.

(From OE-Core rev: 9f4a85eb929f67420d9689d7dddadd120ed49843)

Signed-off-by: Mike Looijmans 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster