openembedded-core.git/meta/recipes-extended/bash/bash-3.2.48, branch 2016-10

bash: fix string format errors when enabling security flags

2016-07-20T09:24:53+00:00

If security_flags.inc is included then bash 3.2.48 fails to build:

| ../bash-3.2.48/print_cmd.c:1152:3: error: format not a string literal and no format arguments [-Werror=format-security]
|    cprintf (indentation_string);

Backport a patch from upstream to solve this.

Signed-off-by: Ross Burton

bash: ensure LDFLAGS is passed when building ptest

2016-07-20T09:24:53+00:00

Signed-off-by: Ross Burton

bash_3.2.48: dont include target CFLAGS in host LDFLAGS

2015-08-09T22:14:31+00:00

Building the host tool 'mkbuiltins' will fail if the target CFLAGS
contains an option which isn't supported by the host's gcc. To prevent
the issue, define LDFLAGS_FOR_BUILD based on CFLAGS_FOR_BUILD instead
of CFLAGS.

Signed-off-by: Andre McCurdy 
Signed-off-by: Richard Purdie

bash: Upgrade bash to latest patch level to fix CVEs

2014-10-06T14:07:59+00:00

We upgrade bash_4.3 to patch revision 29, and bash_3.2.48 to 56.

There are numerous community bug fixes included with this set, but the key
items are:

bash32-052      CVE-2014-6271                           9/24/2014
bash32-053      CVE-2014-7169                           9/26/2014
bash32-054      exported function namespace change      9/27/2014
bash32-055      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash32-056      CVE-2014-6277                           10/2/2014

bash43-025      CVE-2014-6271                           9/24/2014
bash43-026      CVE-2014-7169                           9/26/2014
bash43-027      exported function namespace change      9/27/2014
bash43-028      CVE-2014-7186/CVE-2014-7187             10/1/2014
bash43-029      CVE-2014-6277                           10/2/2014

Signed-off-by: Mark Hatle 
Signed-off-by: Richard Purdie

bash: Fix CVE-2014-7169

2014-09-29T11:13:30+00:00

This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment

Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie

bash: fix CVE-2014-6271

2014-09-29T11:12:35+00:00

CVE-2014-6271 aka ShellShock.

"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."

Signed-off-by: Ross Burton

bash: Add ptest

2013-07-26T06:44:27+00:00

ptest support was already added for v4.2 but for the distros
using GPLv2 version of bash (3.2.48) this update is required.

Signed-off-by: Muhammad Shakeel 
Signed-off-by: Saul Wold

bash: fix mkbuiltins build failure

2013-01-09T12:36:22+00:00

Same patch for non-gplv3 version:

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=1fd9a16d2a4594a4e9179dc7353ac51ce32eb712

[YOCTO #3646]

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie