summaryrefslogtreecommitdiff
path: root/meta/recipes-core/libxml
AgeCommit message (Collapse)AuthorFiles
2017-04-28libxml2: CVE-2016-9318Catalin Enache2
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 Upstream patch: https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-04-05libxml2: make dependencies on python conditionalDmitry Rozhkov1
The library libxml2 can provide its own bindings for python2 in addition to the third party python-lxml and python3-lxml packages if this functionality is enabled in PACKAGECONFIG. But in case the functionality is disabled there's no need to depend on python2. Make the dependency on python2 enabled only if the python feature is added to PACKAGECONFIG. Also add missing run-time dependency on make to libxml2-ptest. Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt1
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-28libxml2: Drop docs in native caseRichard Purdie1
With rss, moving these around was having an increasing overhead and we don't need them in the native case so remove them. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-12-16meta: remove True option to getVar callsJoshua Lock1
getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: Fix more NULL pointer derefsAndrej Valek2
The NULL pointer dereferencing could produced some security problems. This is a preventive security fix. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ↵Andrej Valek2
ranges Namespace nodes must be copied to avoid use-after-free errors. But they don't necessarily have a physical representation in a document, so simply disallow them in XPointer ranges. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: Necessary changes before fixing CVE-2016-5131Andrej Valek2
xpath: - Check for errors after evaluating first operand. - Add sanity check for empty stack. - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-11-30libxml2: Security fix CVE-2016-5131Yi Zhao2
CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131 Patch from: https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-10-15libxml2: Make tests non-executableJussi Kukkonen1
The XML W3C conformance test suite contains thousands of xml files all marked executable. We dutifully try to strip all these files of debug info in do_package. "chmod -x" improves build time by ~40 seconds. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-03libxml2: control ipv6 support based on DISTRO_FEATURESJackie Huang1
Add PACKAGECONFIG for ipv6 and control it based on DISTRO_FEATURES. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-01pythonnative.bbclass, python3native.bbclass: export STAGING_INCDIR, ↵Alexander Kanavin1
STAGING_LIBDIR, PYTHON variables We patch Python's distutils modules to access STAGING_INCDIR/LIBDIR, so when they are not set, scripts that utilize distutils (e.g. python-config) fail. Several recipes need to export those manually to prevent such failures, so let's do that in the class instead. PYTHON variable is exported because otherwise autotools' python.m4 macro will pick up its own internal default, which may not be the version that we want. glib recipe in particular was previously using Python 2.x during build due to python.m4 defaulting to it - now it's using Python 3.x, and so needs a small fix in deletion of *.pyc files. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-14libxml2: upgrade to 2.9.4Hongxu Jia2
- Drop configure.ac-fix-cross-compiling-warning.patch, libxml2 2.9.4 has fixed it Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-30python-native, python3-native: remove the use of exported HOST_SYS and ↵Alexander Kanavin1
BUILD_SYS variables The code that utilized them was superseded by the code (in the same patch!) that is utilizing STAGING_LIBDIR/STAGING_INCDIR, and wasn't correct in the first place as HOST_SYS is not necessarily the same as the sysroot directory name. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2016-05-06libxml2: fix dependencies and QA IssuesMaxin B. John1
Fix the following QA warnings: WARNING: libxml2-2.9.3-r0 do_package_qa: QA Issue: libxml2 rdepends on libiconv, but it isn't a build dependency, missing libiconv in DEPENDS or PACKAGECONFIG? [build-deps] WARNING: libxml2-2.9.3-r0 do_package_qa: QA Issue: libxml2-python rdepends on libiconv, but it isn't a build dependency, missing libiconv in DEPENDS or PACKAGECONFIG? [build-deps] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-04-09libxml2: fix AM_PATH_XML2Robert Yang1
The code: suppose $1 == 2.7: verdep=ifelse([$1], [], [], [>= $1]) results in: verdep=>= 2.7 This is wrong in shell: bash: 2.7: command not found Use quotation marks to fix the problem. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-16meta: more removals of redunant FILES_${PN}-dbgRoss Burton1
In some recipes overly-split -dbg packages were merged into PN-dbg. Unless there's a very good reason, recipes should have a single -dev and -dbg package. Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-01libxml2: upgrade to 2.9.3Ross Burton8
- Drop all the upstreamed patches - Rework the ansidecl removal so it's contained in a single patch Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-01libxml2: merge pointless bb/inc splitRoss Burton2
Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-01libxml2: remove legacy LDFLAGS += "-ldl" workaroundAndre McCurdy1
libxml2 is able to find libdl.so on its own. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-25libxml2: fix CVE-2015-7942 and CVE-2015-8035Armin Kuster3
CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections() CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [YOCTO #8641] Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-06-18libxml2: Security Advisory - libxml2 - CVE-2015-1819Yue Tao2
for CVE-2015-1819 Enforce the reader to run in constant memory Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-14libxml2: fix python path and add libxml2-pythonRobert Yang1
We have libxml2-python for native and nativesdk, but don't have it for target, and can't find the reason from the git log, libxml2-python is widely used, after looked into it's configure.in, we can add it by PACKAGECONFIG. The previous --with-python=${STAGING_BINDIR}/python is incorrect, it acted as work becase it's conigure can check automatically, python is in ${STAGING_BINDIR_NATIVE}/${PYTHON_PN}-native/${PYTHON_PN}, as known as ${PYTHON}. Add python to PACKAGECONFIG, since createrepo rdepends on libxml2-python, otherwise the target createrepo can't work. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-04-30libxml2: remove libxml2-CVE-2014-3660.patchRobert Yang1
It is a backport patch, and verified that the patch is in the source. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-08libxml2: Contain glibc-extentions under __GLIBC__Khem Raj2
Makes it more portable Change-Id: I7bbc4cc0ebc26d54248b8433dab94db207615445 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-15libxml2: Backport fix for CVE introduced entity issuesRichard Purdie2
The CVE fix introduced problems with entity issues, we observed this when building the Yocto Docs in particular. Backport the fix from upstream so we can build our docs correctly. [YOCTO #7134] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-12-24libxml2: upgrade to 2.9.2Hongxu Jia4
- Rebase python-sitepackages-dir.patch to 2.9.2 - Drop libxml2-CVE-2014-3660.patch which has been merged to 2.9.2. - Add configure.ac-fix-cross-compiling-warning.patch to fix cross compilation failure. - Tweak do_configure_prepend, use configure.ac to instead of configure.in - Add cmake files to ${PN}-dev Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-10-24libxml2: fix CVE-2014-3660Joe MacDonald2
It was discovered that the patch for CVE-2014-0191 for libxml2 is incomplete. It is still possible to have libxml2 incorrectly perform entity substituton even when the application using libxml2 explicitly disables the feature. This can allow a remote denial-of-service attack on systems with libxml2 prior to 2.9.2. References: http://www.openwall.com/lists/oss-security/2014/10/17/7 https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-09-01recipes: Remove references to eglibcKhem Raj1
change use of eglibc related variabled to glibc equivalents Signed-off-by: Khem Raj <raj.khem@gmail.com>
2014-08-28meta: fix RDEPNEDS for the test related pkgsRobert Yang1
Add bash, python or perl to the ptest pkgs to fix the RDEPENDS issues. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-25libxml2: Explicitly enable zlib supportOtavio Salvador1
The zlib support is a must if you are using RPM backend. So this explicitly enable it and adds a comment in the recipe to avoid its removal by mistake. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-15libxml2: port AM_PATH_XML2 to use pkg-configRoss Burton2
Upstream AM_PATH_XML2 uses xml2-config which we disable, so port this macro to use pkg-config. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-16libxml2: enable catalog supportHongxu Jia1
It let the environment variable XML_CATALOG_FILES could work which was required by xmlto. [YOCTO #2416] Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-16binconfig-disabled: Add class and useRichard Purdie1
This adds a binconfig-disabled class which can be used by recipes where a -config file is installed but we wish to disable it and just rely on the .pc files instead. Rather than simply deleting it, we make the script "exit 1" so that it can be found in PATH and raise a build error rather than something silently falling back to the build system for example. Rather than randomly finding -config files, this adds in the specification of a list of binconfig scripts which is more deterministic and maintainable moving forward. This patch converts various users in OE-Core to use this, a world build of OE-Core tests out ok with this change. There will likely be issues in other layers however, hence this being a RFT. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-06libxml2: fix python packaging for nativesdkPaul Eggleton2
We enable the python module in nativesdk-libxml2, but the python binary used is in the native sysroot and thus you get the module installed in the wrong path. Even with that fixed the python files are still unpackaged, so create an ${PN}-python package and add them to it. (This does not affect the libxml target build at all since python is disabled for that.) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-08libxml2: fix CVE-2014-0191Maxin B. John2
It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors. Reference: https://access.redhat.com/security/cve/CVE-2014-0191 Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-09-17libxml2: remove patch for CVE-2012-2871Ross Burton2
This CVE patch is actually against Chromium as they ship an internal fork of libxml2 and breaks ABI. The real issue has been resolved in libxslt 1.1.27, and we're shipping 1.1.28. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-18Upstream-Status: Correct capitalizationSaul Wold1
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-07-09libxml2: Add ptestMihaela Sendrea4
Install libxml2 test suite and run it as ptest. Signed-off-by: Mihaela Sendrea <mihaela.sendrea@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-06-10libxml2: added python dependency to nativesdkFelipe F. Tonello1
This is necessary since libxml2 has python dependency. This patch will fix this error: ... /path/to/build/system/4.7.2/ld: cannot find -lpython2.7 ... ERROR: Task 4152 (virtual:nativesdk:meta/recipes-core/libxml/libxml2_2.9.0.bb, do_compile) failed with exit code '1' Signed-off-by: Felipe F. Tonello <eu@felipetonello.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-05-12libxml2: Update to 2.9.1Saul Wold3
Copyright date and generalize authors clause Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-12-14libxml2 CVE-2012-2871Li Wang2
the patch come from: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src \ /include/libxml/tree.h?r1=56276&r2=149930 libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2871 [YOCTO #3580] [ CQID: WIND00376779 ] Upstream-Status: Pending Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-12-04libxml2: update PR to contain INC_PR to reflect the update of inc fileZhenhua Luo1
Signed-off-by: Zhenhua Luo <b19537@freescale.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-12-03libxml2: add --with-fexceptions in configure flags to support exception ↵Zhenhua Luo1
handling in C++ programs Without this flag, the library has a problem with C++ programs using exception handling. Signed-off-by: Zhenhua Luo <b19537@freescale.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-11-21libxml2: Update to 2.9.0Saul Wold2
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-11-02recipes-core: replace virtclass-native(sdk) with class-native(sdk)Robert Yang1
The overrides virtclass-native and virtclass-nativesdk are deprecated, which should be replaced by class-native and class-nativesdk. [YOCTO #3297] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-07-22libxml2: Update for python-native changesMorgan Little1
Add pythonnative to the inherits list Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-19Convert tab indentation in python functions into four-spaceRichard Purdie1
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-10libxml2: Fix libzypp ansidecl related build failuresRichard Purdie3
cmake looks at all include statements, even if they're not used. To make builds deterministic and avoid needing to add binutils as a dependency for libzypp, completely remove the include from the header file, even if it is never used. This avoids issues where you'd build binutils, then libzypp, then remove binutils (and hence ansidecl.h) and then recompile libzypp which would still have the dependency and hence fail. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-06-28libxml: disable lzmaMarcin Juszkiewicz2
On my system libxml-native got linked with host copy of liblzma and as a result libxslt-native was not linkable: | x86_64-linux-libtool: link: gcc -isystem/home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/include -O2 -pipe -Wall -Wl,-rpath-link -Wl,/home/hrw /HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib -Wl,-rpath-link -Wl,/home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64- linux/lib -Wl,-rpath -Wl,/home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib -Wl,-rpath -Wl,/home/hrw/HDD/devel/canonical/ci-linaro/oecore/buil d/tmp-eglibc/sysroots/x86_64-linux/lib -Wl,-O1 -o .libs/xsltproc xsltproc.o -L/home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib -L/home/hrw/ HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/lib ../libxslt/.libs/libxslt.so ../libexslt/.libs/libexslt.so /home/hrw/HDD/devel/canonical/ci-linaro/oecore/ build/tmp-eglibc/work/x86_64-linux/libxslt-native-1.1.26-r8/libxslt-1.1.26/libxslt/.libs/libxslt.so /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux /usr/lib/libxml2.so -ldl /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib/liblzma.so -lrt -lz -lm -pthread -Wl,-rpath -Wl,/home/hrw/HDD/deve l/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib | /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib/libxml2.so: undefined reference to `lzma_code@XZ_5.0' | /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib/libxml2.so: undefined reference to `lzma_auto_decoder@XZ_5.0' | /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib/libxml2.so: undefined reference to `lzma_end@XZ_5.0' | /home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/sysroots/x86_64-linux/usr/lib/libxml2.so: undefined reference to `lzma_properties_decode@XZ_5.0' | collect2: error: ld returned 1 exit status | make[2]: *** [xsltproc] Error 1 | make[2]: Leaving directory `/home/hrw/HDD/devel/canonical/ci-linaro/oecore/build/tmp-eglibc/work/x86_64-linux/libxslt-native-1.1.26-r8/libxslt-1.1.26/xsltproc' Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-09 12:32:48 +0000