openembedded-core.git/meta/recipes-extended, branch pyro

ghostscript : CVE-2016-10219, CVE-2016-10220, CVE-2017-5951

2017-04-28T10:26:07+00:00

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript
9.20 allows remote attackers to cause a denial of service (divide-by-zero
error and application crash) via a crafted file.

The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc.
Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted file that is
mishandled in the PDF Transparency module.

The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc.
Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10219
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10220
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5951

Upstream patches:
http://git.ghostscript.com/?p=ghostpdl.git;h=4bef1a1d32e29b68855616020dbff574b9cda08f
http://git.ghostscript.com/?p=ghostpdl.git;h=daf85701dab05f17e924a48a81edc9195b4a04e8
http://git.ghostscript.com/?p=ghostpdl.git;h=bfa6b2ecbe48edc69a7d9d22a12419aed25960b8

Signed-off-by: Catalin Enache 
Signed-off-by: Ross Burton

acpica: fix upstream version check

2017-04-28T10:26:06+00:00

Signed-off-by: Alexander Kanavin 
Signed-off-by: Ross Burton

lsbtest: add option --ignoreos to rpm install command

2017-04-28T10:26:06+00:00

After change to the rpm4, the rpm packages in lsbtest, such as:

    lsb-setup-4.1.0-1.noarch.rpm
    lsb-dist-checker-5.0.0.1-1.x86_64.rpm
    ......
    lsb-cmdchk-5.0.3-1.x86_64.rpm

When install above rpm packages, the error log appears:

    package lsb-setup-4.1.0-1.noarch is intended for a different operating system
    ......

So we should add option "--ignoreos" to the rpm install command in LSB_Test.sh
in ./meta/recipes-extended/lsb/lsbtest directory. In this way we can make sure
the correct installation of those rpm packages.

The YOCTO bug #11224 didn't create logs, this is because the above test rpm
packages didn't install.

[YOCTO #11224]

Signed-off-by: Dengke Du 
Signed-off-by: Ross Burton

Revert "logrotate: set downloadfilename"

2017-04-21T07:22:02+00:00

Sadly this breaks previous OE releases as it means the source mirror contains a
tarball with the same name but different checksums as was previously available.

This reverts commit 99c6e89db193d572e845f95eabbd9ec89c3508c7.

Signed-off-by: Ross Burton

ltp: fix an incorrect macro checking

2017-04-19T09:16:24+00:00

The previous patch added a check but incorrectly
change the elif to if, then it always return 0
for cpuid if the machine is not __i386__

getcpu01    1  TFAIL  :  getcpu01.c:140: getcpu() returned wrong value expected cpuid:7, returned value cpuid: 0

After this fix:
getcpu01    1  TPASS  :  getcpu() returned proper cpuid:7, node id:0

Signed-off-by: Jackie Huang 
Signed-off-by: Ross Burton

logrotate: set downloadfilename

2017-04-19T09:16:23+00:00

Otherwise, the filename is r3-9-1.tar.gz which isn't straightforward.

Signed-off-by: Robert Yang 
Signed-off-by: Ross Burton

unzip: add missing CVE headers to patches

2017-04-13T22:58:17+00:00

Signed-off-by: Ross Burton

grep: do_configure: fix "Argument list too long"

2017-04-13T22:57:38+00:00

Fixed when len(TMPDIR) = 410:
aclocal: error: cannot open echo 'm4_define [snip]' configure.ac |: Argument list too long'

This is becuase it has a lot of m4 files, use relative path for them
can fix the problem.

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

ed: update SRC_URI to yoctoproject mirror

2017-04-12T14:02:13+00:00

Upstream has removed the 1.14.1 release from ftp.gnu.org and
moved to the latest 1.14.2. Since we don't want to upgrade at
this point of time, temporarily move the SRC_URI to yoctoproject
mirror.

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

libsolv: correctly attribute musl fixing patches

2017-04-11T17:09:20+00:00

Also, they were previously squashed into a single patch; restore
the original two-patch arrangement.

As requested here:
http://lists.openembedded.org/pipermail/openembedded-core/2017-April/135460.html

Signed-off-by: Alexander Kanavin 
Signed-off-by: Richard Purdie