openembedded-core.git/meta/recipes-devtools, branch dizzy

rsync: backport libattr checking patch

2016-01-30T12:01:43+00:00

Add check_libattr.patch to version 3.1.0 recipe, which checks
and includes libattr to linker, otherwise rsync may fail to build
with linker error below (as -lattr option gets omitted):

[..]
lib/sysxattrs.o: undefined reference to symbol 'llistxattr@@ATTR_1.0'
[..]/lib/libattr.so.1: error adding symbols: DSO missing from command line

Signed-off-by: Sergiy Kibrik 
Signed-off-by: Armin Kuster

qemu-slirp: CVE-2014-3640

2015-09-01T20:30:27+00:00

Fixes NULL pointer deref in sosendto().

Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640

Upstream patch:
http://git.qemu.org/?p=qemu.git;a=commit;
h=9a72433843d912a45046959b1953861211d1838d

Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

qemu-vnc: CVE-2014-7815

2015-09-01T20:28:02+00:00

Fixes an uninitialized data structure use flaw in qemu-vnc
which allows remote attackers to cause a denial of service
(crash).

Upstream patch:
http://git.qemu.org/?p=qemu.git;a=commit;
h=b2f1d90530301d7915dddc8a750063757675b21a

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7815
http://www.securityfocus.com/bid/70998

Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

qemu: CVE-2014-7840

2015-09-01T20:28:00+00:00

Fixes insufficient parameter validation during ram load

Reference
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7840

Upstream commit:
http://git.qemu.org/?p=qemu.git;a=commit;
h=0be839a2701369f669532ea5884c15bead1c6e08

Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

dpkg: Fix tarfix.patch

2015-07-27T13:20:50+00:00

Accidentally forgot to merge the backport changes into the commit. Fix
so the patch applies correctly.

Signed-off-by: Richard Purdie

dpkg: Fix for Fedora22 and new versions of tar

2015-07-27T11:25:05+00:00

They managed to 'break' tar. Again. Sorry, they fixed a regression
which broke dpkg-deb.

The addition of:
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=163e96a0e619a900eab6de827c7c5749ecc9d3f2
("Bugfix: entries read from the -T file did not get proper matching_flag.")
means that the no-recursion option gets lost. This leads to many files getting included
multiple times, along with files which shouldn't be there.

The commit message is horrendous. The patch actually makes the option positional
(as documnted since 2003) and therefore doesn't affect the input from the -T option.

Moving the --no-reursion option to earlier in the command avoids the bug.

The bug was not present in tar 1.28 however it has been backported in at least
Fedora 22 and heading into Fedora 21.

Redhat reports of issue:
https://bugzilla.redhat.com/show_bug.cgi?id=1230762 [tar]
https://bugzilla.redhat.com/show_bug.cgi?id=1241508 [dpkg]

Discussion of bug in upstream tar:
http://www.mail-archive.com/bug-tar@gnu.org/msg04799.html

[YOCTO #7988]

(From OE-Core rev: 6be698b7270f73f40d38713ecf13f12aec0ced61)

Signed-off-by: Richard Purdie 

Conflicts:
	meta/recipes-devtools/dpkg/dpkg_1.17.25.bb

subversion: Fix subversion-native on Fedora22

2015-07-26T08:08:47+00:00

Similarly to:
http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=9b19d6548a345009a6de79a6820c07a72054d961

we also need to fix the subversion-native case with gcc5 by using
the same fix to the BUILD_CPPFLAGS.

(From OE-Core rev: a5e7a1e597e7bbe3bbc547f43a89d00a8a9a9924)

(From OE-Core rev: 7d445547df528aa9e5bfb85568a7270e27f633ef)

Signed-off-by: Richard Purdie

subversion: Add -P to CPPFLAGS

2015-07-26T08:08:46+00:00

see https://gcc.gnu.org/gcc-5/porting_to.html

we need to stop the preprocessor from generating the #line directives
or we run into issues like

| checking for apr_int64_t Python/C API format string...
| configure: error: failed to recognize APR_INT64_T_FMT on this platform
| Configure failed. The contents of all config.log files follows to aid
debugging
| ERROR: oe_runconf failed

Rightly subversion should be fixed but lets leave that to subversion
folks

Change-Id: I02a89798ff949f79967ab0a73adcddaa4218662d
(From OE-Core rev: 7793b1c425077ed6ed11a9bc2a8b1b96612b1c96)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie

binutils: fix native builds when host has gcc5

2015-07-26T08:08:42+00:00

Cherry pick upstream commit to fix -Werror=logical-not-parentheses error
when building with native gcc5.

(From OE-Core rev: b3bd0dba3139a3e79bfcebe137248c7bdcadf04d)

Signed-off-by: George McCollister 
Signed-off-by: Richard Purdie

rpm: Fix CVE-2013-6435

2015-07-20T19:53:09+00:00

Backport to fix CVE-2013-6435. Description on [1] and original
patch taken from [2].

[1] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6435
[2] https://bugzilla.redhat.com/attachment.cgi?id=956207

[YOCTO #7181]

(From OE-Core rev: 6bf846ed5ccd1a4d01b36630708b2b9aa9e69ed5)

Signed-off-by: Leonardo Sandoval 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster