Upgrade urgency: SECURITY, contains fixes to security issues.
Security Fixes:
(CVE-2021-41099) Integer to heap buffer overflow handling certain string
commands and network payloads, when proto-max-bulk-len is manually configured
to a non-default, very large value [reported by yiyuaner].
(CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and
redis-sentinel parsing large multi-bulk replies on some older and less common
platforms [reported by Microsoft Vulnerability Research].
(CVE-2021-32687) Integer to heap buffer overflow with intsets, when
set-max-intset-entries is manually configured to a non-default, very large
value [reported by Pawel Wieczorkiewicz, AWS].
(CVE-2021-32675) Denial Of Service when processing RESP request payloads with
a large number of elements on many connections.
(CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by
Meir Shpilraien].
(CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded
data types, when configuring a large, non-default value for
hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries
or zset-max-ziplist-value [reported by sundb].
(CVE-2021-32627) Integer to heap buffer overflow issue with streams, when
configuring a non-default, large value for proto-max-bulk-len and
client-query-buffer-limit [reported by sundb].
(CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer
overflow [reported by Meir Shpilraien].
Bug fixes that involve behavior changes:
GEO* STORE with empty source key deletes the destination key and return 0 (#9271)
Previously it would have returned an empty array like the non-STORE variant.
PUBSUB NUMPAT replies with number of patterns rather than number of subscriptions (#9209)
This actually changed in 6.2.0 but was overlooked and omitted from the release notes.
Bug fixes that are only applicable to previous releases of Redis 6.2:
Fix CLIENT PAUSE, used an old timeout from previous PAUSE (#9477)
Fix CLIENT PAUSE in a replica would mess the replication offset (#9448)
Add some missing error statistics in INFO errorstats (#9328)
Other bug fixes:
Fix incorrect reply of COMMAND command key positions for MIGRATE command (#9455)
Fix appendfsync to always guarantee fsync before reply, on MacOS and FreeBSD (kqueue) (#9416)
Fix the wrong mis-detection of sync_file_range system call, affecting performance (#9371)
CLI tools:
When redis-cli received ASK response, it didn't handle it (#8930)
Improvements:
Add latency monitor sample when key is deleted via lazy expire (#9317)
Sanitize corrupt payload improvements (#9321, #9399)
Delete empty keys when loading RDB file or handling a RESTORE command (#9297, #9349)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This resolves openssl 3.x errors until upstream addresses them properly.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Sadly, the move to duktape has not yet happend, but it is on the
way, and meanwhile we can use modern mozjs at least.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fetch license.html rather than keep possibly stale
version in files/.
License-Update: Update copyright years; update lines used
Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Highlights of this upgrade:
* Fix 'undefined reference to __data_start' linker error on risc-v
* Fix data race in generic_malloc_many
* Fix handling of areas smaller than page size in GC_scratch_recycle
* Fix misaligned tlfs passed to AO_load on m68k
* Fix overflow of scratch_free_ptr value
* Limit number of unmapped regions (to avoid exceeding of vm.max_map_count)
See the following for detailed changes:
* https://github.com/ivmai/bdwgc/releases/tag/v8.0.6
The LIC_FILES_CHKSUM has changed because of update of copyright
year (in README.QUICK).
Signed-off-by: Ivan Maidanski <ivmai@mail.ru>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The default value for LIB_INSTALL_DIR is set to ${prefix}/lib in
CMakeLists.txt. However, in multilib builds, the package split picks up
the files from ${prefix}/lib64 or ${prefix}/lib32, which leads to QA
issues in do_package about left-over files in /usr/lib/pkgconfig and
/usr/lib/cmake.
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Backport a patch from grpc/master to be able to build c++ applications
when gRPC_BUILD_GRPC_CPP_PLUGIN=OFF. The patch should be dropped on the
recipe upgrade
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When we build an application that uses grpc for the target, following
error occurs
CMake Error at <application work dir>/recipe-sysroot/usr/lib/cmake/grpc/gRPCTargets.cmake:179 (message):
| The imported target "gRPC::grpc_cpp_plugin" references the file
|
| "<application work dir>/recipe-sysroot/usr/bin/grpc_cpp_plugin"
|
| but this file does not exist. Possible reasons include:
|
| * The file was deleted, renamed, or moved to another location.
|
| * An install or uninstall procedure did not complete successfully.
|
| * The installation package was faulty and contained
|
| "<application work dir>/recipe-sysroot/usr/lib/cmake/grpc/gRPCTargets.cmake"
|
| but not all the files it references.
|
| Call Stack (most recent call first):
| <application work dir>/recipe-sysroot/usr/lib/cmake/grpc/gRPCConfig.cmake:25 (include)
| CMakeLists.txt:4 (find_package)
That's because target grpc was built with CPP plugin support and
referenes it from CMake config file. This commit disables CPP plugin
build for the target, and sets dependency on compiler for native and SDK
builds
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fixes in OE-Core added some pkgconfig dependencies back and this flagged
that the .pc file was in ${PN}, not ${PN}-dev. Fix that.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The `avahi` dependency is needed only when network backend is used.
The current dependency configuration will add the `avahi` dependency
regardless if network backend is used or not.
Move the `avahi` dependency to be part of `PACKAGECONFIG` configuration
which will insert the dependency only when needed.
Signed-off-by: Nandor Han <nandor.han@vaisala.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* depends on MACHINE_ARCH libbpf causing:
oe-core$ openembedded-core/scripts/sstate-diff-machines.sh --tmpdir=tmp-glibc --machines="qemux86 qemux86copy qemuarm" --targets=pahole --analyze
=== Comparing signatures for task do_configure.sigdata between qemux86 and qemux86copy ===
ERROR: pahole different signature for task do_configure.sigdata between qemux86 and qemux86copy
NOTE: Reconnecting to bitbake server...
Hash for dependent task pahole/pahole_1.22.bb:do_prepare_recipe_sysroot changed from bfa7a0e0c59d99b0133ab295ebf7025a430242d4b8874d436d47cf8157192999 to e45ada248cd757d742872183d9fe426a7ce3b44a652b0900709ad3d0f3f64aa8
Unable to find matching sigdata for /OE/build/oe-core/meta-openembedded/meta-oe/recipes-devtools/pahole/pahole_1.22.bb:do_prepare_recipe_sysroot with hashes bfa7a0e0c59d99b0133ab295ebf7025a430242d4b8874d436d47cf8157192999 or e45ada248cd757d742872183d9fe426a7ce3b44a652b0900709ad3d0f3f64aa8
ERROR: 1 errors found in /OE/build/oe-core/tmp-glibc/sstate-diff/1633081392/signatures.qemux86copy.do_configure.sigdata.log
oe-core$ bitbake-diffsigs tmp-glibc/sstate-diff/1633081392/qemux86*/core2-32-oe-linux/pahole/*prepare_recipe_sysroot*
NOTE: Starting bitbake server...
NOTE: Started PRServer with DBfile: /OE/build/oe-core/cache/prserv.sqlite3, Address: 127.0.0.1:38435, PID: 21321
Hash for dependent task libbpf/libbpf_0.5.bb:do_populate_sysroot changed from 95bfd90e188d9ee6b4797736b07339d616655173a58a3f4f4f2ab4a5fa0bf3d8 to 9556bc318991640bba0eacc8f2102167bc7c389c13dadf08d69a9b864feae5c9
Unable to find matching sigdata for /OE/build/oe-core/meta-openembedded/meta-oe/recipes-kernel/libbpf/libbpf_0.5.bb:do_populate_sysroot with hashes 95bfd90e188d9ee6b4797736b07339d616655173a58a3f4f4f2ab4a5fa0bf3d8 or 9556bc318991640bba0eacc8f2102167bc7c389c13dadf08d69a9b864feae5c9
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* for host* parts you need to install linux-libc-dev:i386 on ubuntu-21.10
(not pulled by gcc-multilib already mentioned in meta-oe/README), otherwise
build for 32bit target will fail like this:
cortexa7t2hf-neon-vfpv4-oe-linux-gnueabi/luajit/2.1.0~beta3-210112-r0/git/src$ gcc -m32 -Wall -I. -DLUAJIT_TARGET=LUAJIT_ARCH_arm -DLJ_ARCH_HASFPU=1 -DLJ_ABI_SOFTFP=0 -isystem/OE/build/oe-core/tmp-glibc/work/cortexa7t2hf-neon-vfpv4-oe-linux-gnueabi/luajit/2.1.0~beta3-210112-r0/recipe-sysroot-native/usr/include -O2 -pipe -c -o host/minilua.o host/minilua.c
In file included from /usr/include/bits/errno.h:26,
from /usr/include/errno.h:28,
from host/minilua.c:40:
/usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such file or directory
1 | #include <asm/errno.h>
| ^~~~~~~~~~~~~
compilation terminated.
while for 64bit taget it would build without -m32 and work fine without linux-libc-dev:i386:
cortexa7t2hf-neon-vfpv4-oe-linux-gnueabi/luajit/2.1.0~beta3-210112-r0/git/src$ gcc -Wall -I. -DLUAJIT_TARGET=LUAJIT_ARCH_arm -DLJ_ARCH_HASFPU=1 -DLJ_ABI_SOFTFP=0 -isystem/OE/build/oe-core/tmp-glibc/work/cortexa7t2hf-neon-vfpv4-oe-linux-gnueabi/luajit/2.1.0~beta3-210112-r0/recipe-sysroot-native/usr/include -O2 -pipe -c -o host/minilua.o host/minilua.c
<OK>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
3.23.1: 2021-09-21
Improve ubx cycle detection.
Add quirks for Jackson Labs nonstandard NMEA
Change STATUS_NO_FIX to STATUS_UNK to avoid confusion with fix mode.
Change STATUS_FIX to STATUS_GPS to avoid confusion with fix mode.
Change STATUS_DGPS_FIX to STATUS_DGPS to avoid confusion with fix mode.
Split SOURCE_ACM from SOURCE_USB. ACM has no speeds.
Add speeds 1 mbps, 1.152 mbps, 1.5 mbps, and higher. When libc supports them.
Improve autobaud.
Add new u-blox M10 messages.
Fix u-blox M6, M7 initialization issues.
Various ubxtool and gpxlogger updates.
Add mtk3301_speed_switcher()
No API, ABI changes.
Fallback to "python3" if "python" not found.
0001-SConscript-Correct-the-installation-of-gpsd.hotplug.patch
removed since it is included in 3.23.1
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fix parsing of emphasis before links (#424, Nick Wellnhofer).
Fixes a regression introduced with commit ed0a4bf.
Update to Unicode 14.0 (data-man).
Add ~ to safe href character set (#394, frogtile).
Update CMakeLists.txt (Saleem Abdulrasool). Bump the minimum required
CMake to 3.7. Imperatively define output name for static library.
Fix install paths in libcmark.pc (Sebastián Mancilla).
CMAKE_INSTALL_<dir> can be relative or absolute path, so it is wrong to
prefix CMAKE_INSTALL_PREFIX because if CMAKE_INSTALL_<dir> is set to an
absolute path it will result in a malformed path with two absolute paths
joined together. Instead, use CMAKE_INSTALL_FULL_<dir> from
GNUInstallDirs.
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Remove one backported patch and add libxml2 to DEPNEDS to fix below
configure error:
| configure: error: Package requirements (libxml-2.0) were not met:
|
| No package 'libxml-2.0' found
Remove NOSECTION_FALLBACK as the configure option enable-nosection-fallback
is removed in the new version [1].
[1] 633f2624a7
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add chipsec, tools to dump and analyzing hardware, system firmware
components, like PCH register, ioport or iomem configuration space.
Signed-off-by: Liwei Song <liwei.song@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This release includes several new contributions,
such as support for URN document references (thanks to @rayvincent2)
and a new Boost.JSON adapter (thanks @matty0ung).
Loading sub-schemas from other files is also now supported.
This release also includes some minor bug fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog
Fix extend edge case going endlessly (@mgreter #3081)
Fix source-maps and how we count unicode characters (@mgreter #3096)
Fix seed generator if std::random_device fails (@benbucksch #3151)
Fix url() containing exclamation mark causing an error (#2880)
Fix Offset initialization when end was not given (@ihsinme #3131)
Fix obvious backporting error in pseudo extend (@mgreter #3136)
Fix obvious identical subexpressions in op_color_number (@ariccio #3148)
Fix edge case regarding unit-less number equality as object keys (@mgreter #3095)
Revert compound re-ordering for non extended selectors (@mgreter #3100)
Prevent compiler warning about unnecessary copy (@acocuzzo #3129)
Replace Travis CI with GitHub Actions (@mgreter #3150)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The main repo is sourced from git://git.openembedded.org not github.
Don't think oe-core.git exists.
Lets be constent across all sub layers.
Drop Revisions and Prioriiy from repo references as they are not used.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The bump of the reference / default kernels and libc-headers to 5.14
in oe-core broke the build of the vbox guest drivers.
The upstream SVN already has 5.14 fixes for the issues, so these are
SVN exports of the changes. When a new release is available, we can
drop the changes.
Also in this patch, is a fixup for the source directory for patching.
It was broken in the overrides conversion, and since there weren't
any active patches at the time, we didn't notice that source wasn't
set to a directory where quilt could actually find the files.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
