Commit Graph

1226 Commits

Author SHA1 Message Date
Jeroen Hofstee
d6795ab0ee php: move to version v7.4.28
CVE: CVE-2021-21703 CVE-2021-21706 CVE-2021-21707 CVE-2021-21708

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
[Didn't apply cleanly, corrected.]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Martin Jansa
245a1ab46b grpc: switch from master branch to main for upb
* hardknott and newer branches don't need this as upb repo was removed in:
  commit 15cff67fd6
  Author: Anatol Belski <anbelski@linux.microsoft.com>
  Date:   Fri Feb 19 12:39:55 2021 +0000

    grpc: Upgrade 1.24.3 -> 1.35.0

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Steve Sakoman
abd7cf838d lua: fix CVE-2022-28805
singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup
call, leading to a heap-based buffer over-read that might affect a system that
compiles untrusted Lua code.

https://nvd.nist.gov/vuln/detail/CVE-2022-28805

(From OE-Core rev: d2ba3b8850d461bc7b773240cdf15b22b31a3f9e)

Signed-off-by: Sana Kazi <sana.kazi@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 91e14d3a8e6e67267047473f5c449f266b44f354)
Signed-off-by: Omkar Patil <omkar.patil@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00
Nisha Parrakat
89d2876e2e nodejs: upgrade to 12.22.2
upgrading to next maintainence LTS version

Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Armin Kuster
bd08205d94 breakpad: Update SRC_URI for protobuf and lss
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Thomas Perrot
ac85c97636 breakpad: fix branch for gtest in SRC_URI
The commit 4fe018038f87 is in the main branch, so the do_fetch task failed.

Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b8bb7dc157)
[Fix up for Dunfell context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Ross Burton
a14eb5e288 protobuf: fix patch fuzz
Applying patch CVE-2021-22570.patch
patching file src/google/protobuf/descriptor.cc
Hunk #1 succeeded at 2603 with fuzz 1 (offset -23 lines).
Hunk #2 succeeded at 2817 with fuzz 1 (offset -14 lines).
Hunk #3 succeeded at 4006 (offset -17 lines).
Hunk #4 succeeded at 4050 (offset -18 lines).
Hunk #5 succeeded at 4368 (offset -18 lines).

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27 08:18:20 -07:00
Sana Kazi
0722ff6f02 protobuf: Fix CVE-2021-22570
Fix CVE-2021-22570.
Link: https://koji.fedoraproject.org/koji/buildinfo?buildID=1916865
Link: 394beeacb5/f/CVE-2021-22570.patch

Remove first and second hunk because the second argument in
InsertIfNotPresent() function is of type const char* const& but the
first and second hunk makes the type of second argument as const string
which is not compatible with the type of second argument in
InsertIfNotPresent().

Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-23 15:48:18 -08:00
Virendra Thakur
ec97823273 nodejs: Fix for CVE-2021-44532
Add patch to fix CVE-2021-44532

Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-06 11:01:44 -08:00
Armin Kuster
59bff77ad0 recipes: Update SRC_URI branch and protocols
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-17 12:26:21 -08:00
Andreas Weger
46eb172b64 grpc: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Andreas Weger <weger@hs-mittweida.de>

Change-Id: Ib24fce16b3986a465f1c5854166b8f28446b5186
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:47:24 -07:00
Khem Raj
9298852a91 android-tools: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:47:24 -07:00
Joe Slater
e4a74a0f0f php: move to version 7.4.21
Lots of bug fixes.

CVE: CVE-2021-21704 CVE-2021-21705

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93045c3db7)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 69dcf5bac8)
[Stable bug fix only updates]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 13:54:01 -07:00
Kai Kang
c1a9fe8517 libdbi-perl: fix CVE-2014-10402
Backport patch to fix CVE-2014-10402.

CVE: CVE-2014-10402

Ref:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972180#12

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c80b3757ff)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 13:44:12 -07:00
Mingli Yu
85f8047c71 php: Upgrade to 7.4.16
License-Update: License updated (year updated)

Fix some security issues such as CVE-2021-21702 and remove two
cve patches which already included in the new version.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e418ee4657)
[Bug fix only updates plus: CVE-2020-7071 ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:05:08 -07:00
Changqing Li
11c1cd6bf5 php: allow php as empty
Since commit c4ffcaa2[php: split out phpdbg into a separate package],
package php is empty, we might met error:
nothing provides php needed by php-cli-7.4.9-r0.corei7_64

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9be6b4f5a2)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:04:47 -07:00
Diego Santa Cruz
9982d7f277 php: split out phpdbg into a separate package
Since PHP 7.0 the phpdbg debugger is built by default and gets shipped
in the main php package, increasing its size by several MB; split it
out into a php-phpdbg package, following Debian naming.

Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c4ffcaa2ab)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:04:24 -07:00
Nicolas Dechesne
d34d040fda python3-{pyyaml,cython,pyparsing}: move from meta-python to meta-oe
This specific statement in ostree recipe breaks the YP compatible
status (yocto-check-layer):

RDEPENDS_${PN}-ptest += " \
    ...
    ${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-python',    'python3-pyyaml', '', d)} \
    ...
"

Recently python3-pyyaml was moved to OE-core (0a8600f9cec0), and the
ostree recipe was fixed with:
b9ede0cb18 (python3-pyyaml: Do not check for meta-python)

In dunfell, moving python3-pyyaml to OE-core is not a great idea, but
moving it from meta-python to meta-oe allows us to fix ostree YP
compatible issue. Since meta-python depends on meta-oe, it should not
be a change with any visible effect.

python3-cython and python3-pyparsing are collateral damages since they are
dependency for python3-pyyaml, so needed to be moved too.

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-25 13:36:16 -07:00
Clément Péron
d460525cd5 nodejs: 12.20.2 -> 12.21.0
Fixes :
 - CVE-2021-22883
 - CVE-2021-22884
 - CVE-2021-23840

Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 02feb1d932)
[12.x LTS version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14 10:03:51 -07:00
Sean Nyekjaer
1ea5c51d98 nodejs: 12.20.1 -> 12.20.2
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6322c63987)
[12.x is LTS version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14 10:03:51 -07:00
Peace Lee
997c27d55e Update commit for version 3.9.7
commit hash for version 3.9.7 is invalid
because previous commit hashes
chagned by git filter-branch command are restored

Signed-off-by: Peace Lee <iipeace5@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fdbfb6ce99)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-07 08:55:15 -07:00
Peace Lee
1fe81b38af guider: Upgrade to 3.9.7
Signed-off-by: Peace Lee <iipeace5@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93c9a20bf3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-07 08:55:15 -07:00
Mikko Rapeli
80c0a5fff6 giflib: apply patch for CVE-2019-15133 and set CVE_PRODUCT
Backport upstream patch for CVE-2019-15133.
Set CVE_PRODUCT to "giflib_project:giflib" which is used
in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:18:02 -08:00
Leon Anavi
52967af423 sip3: Upgrade 4.19.19 -> 4.19.23
Upgrade to release 4.19.23:

- Added some missing quotes to configure.py
- Fixed a race condition when calling the PyQt5-specific meta-call
  helper.
- Fixed the wrapping of methods that return a Py_Ssize_t.
- The code generator now distinguishes between the copy/assignment
  helper and the array helper when determining which helpers can
  be generated.
- Fixed the code generation when making a copy of C++ object on
  the stack to the heap when the class has no suitable ctor.
- Check there is a public copy ctor when we can't using an
  assigment operator as a workaround.
- Preserve any current exception in the implementation of the
  wrapper dealloc functions.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 358b398258)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:00:42 -08:00
Leon Anavi
112b03d7a4 sip3: Consolidate in a single file
Consolidate inc and bb files into a single bb file.
Fix the broken link for HOMEPAGE.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2bc281393a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:00:27 -08:00
Harpritkaur Bhandari
e5499dc4bc rapidjson: Upgrade SRCREV to latest
Upgrade SRCREV to latest as it fixes the below issue:
Running UndefinedBehaviorSanitizer on projects that use
rapidjson triggers 'applying non-zero offset <NN> to null
pointer' findings in 'internal/stack.h' which are hard
to suppress by library users.
Removed "0001-CMake-remove-hardcoded-CMAKECONFIG_INSTALL_DIR-path.patch"
as the changes are already incorporated in the latest
codebase.
As per abi-compliance-checker report the source compatibility
and binary compatibility between previous SRCREV
6a905f9311f82d306da77bd963ec5aa5da07da9c and current
SRCREV 0ccdbf364c577803e2a751f5aededce935314313
is 100% and this patch is already tested on 64bit
ARM (aarch64) in a product with on target CI tests.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 04d9ea0ba7)
Signed-off-by: Harpritkaur Bhandari <Harpritkaur.Bhandari@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 16:58:53 -08:00
Mikko Rapeli
4964a5a463 flatbuffers: whitelist CVE-2020-35864
CVE-2020-35864 is for the rust crate for flatbuffers, not
flatbuffers itself.

https://security-tracker.debian.org/tracker/CVE-2020-35864

"NOT-FOR-US: flatbuffers rust crate"

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 16:58:44 -08:00
Sean Nyekjaer
65d71ece83 nodejs: 12.19.1 -> 12.20.1
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cde1019804)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit ac6bc96e7d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:11:30 -08:00
Stacy Gaikovaia
42cb28ecd7 nodejs: 12.19.0 -> 12.19.1
Uprev nodejs in order to fix CVE-2020-8277.
This CVE allows an attacker to trigger a DNS request for a host
of their choice, which could trigger a Denial of Service in
nodejs versions < 12.19.1.

See https://nvd.nist.gov/vuln/detail/CVE-2020-8277 for details.

CVE: CVE-2020-8277
Signed-off-by: Stacy Gaikovaia <Stacy.Gaikovaia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a440154082)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 387f40ce80)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:11:18 -08:00
Khem Raj
1927ae1843 nodejs: Update to 12.19.0
This perhaps is last release in 12.x LTS

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a10f894a8e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:11:05 -08:00
Khem Raj
00cf8917dc nodejs: Fix arm32/thumb builds with clang
Backport a patch from upstream to take care of build failure e.g.

| ../deps/v8/src/codegen/arm/cpu-arm.cc:38:16: error: write to reserved register 'R7'
|   asm volatile("svc 0\n"
|                ^
| 1 error generated.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 45a2dfdd0f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:10:53 -08:00
Khem Raj
3fdb654e51 nodejs: Upgrade to 12.18.3
Drop already upstreamed patches
use builtin uv, it does not build without it

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit bda3ee6276)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:10:20 -08:00
Khem Raj
85f254c744 nodejs: Fix build with icu 67.1
Remove soon-to-be removed getAllFieldPositions

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Andrej Valek <andrej.valek@siemens.com>
(cherry picked from commit 7910f2b645)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:10:09 -08:00
Armin Kuster
0d76683416 lua: update to 5.3.6
LIC_FILES_CHKSUM changed to do year updates

This is the last 5.3.x update. This will give us the best
starting point for doing Maintence moving forward.

Its a bug fix only update. See http://www.lua.org/work/diffs-lua-5.3.5-lua-5.3.6.html

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12 15:48:22 -08:00
Wenlin Kang
e43ecf3297 lua: fix CVE-2020-24371
Source: openembedded.org
MR: 105165
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/meta-openembedded gatesgarth
ChangeID: 7471618778
Description:

Fix CVE-2020-24371

Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12 15:06:01 -08:00
Wenlin Kang
61922b26e0 lua: fix CVE-2020-15945
Source: openembedded.org
MR: 104897
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/meta-openembedded gatesgarth
ChangeID: 6c43941d11
Description:

Fixes CVE-2020-15945

Backport with modifications to apply successfully.

Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12 15:06:01 -08:00
Zheng Ruoqin
28a08b88ef php: CVE-2020-7069
Security Advisory

References
https://nvd.nist.gov/vuln/detail/CVE-2020-7069
https://bugs.php.net/patch-display.php?bug_id=79601&patch=openssl_aes_ccm_iv_fix&revision=latest

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fa80193468)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 992e09f09a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10 19:43:27 -08:00
Zheng Ruoqin
8d4826f656 php: CVE-2020-7070
Security Advisory

References
https://nvd.nist.gov/vuln/detail/CVE-2020-7070
https://bugs.php.net/patch-display.php?bug=79699&patch=fix-urldecode&revision=1600650364
https://github.com/php/php-src/blob/master/main/php_variables.c

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit aff8a1fefb)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 09f5a2ac5a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10 19:43:09 -08:00
Max Kellermann
cf29a55578 php: remove the failing ${D}/${TMPDIR} code
Appending ${TMPDIR} to ${D} doesn't make any sense, because both are
absolute paths.  And additionally, the code fails:

 rmdir: failed to remove '/usr/src/oe/tmp-musl/work/core2-64-oe-linux-musl/php/7.1.9-r0/image//usr': Directory not empty

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit f6338892d9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10 19:42:48 -08:00
Leon Anavi
45224eeec9 php: Upgrade 7.4.4 -> 7.4.9
Upgrade to release 7.4.9:

- Fixed: Upgrade apache2handler's php_apache_sapi_get_request_time
  to return usec
- Fixed: BSTR to PHP string conversion not binary safe
- Fixed: DCOM does not work with Username, Password parameter
- Fixed: serialize() and unserialize() methods can not be called
  statically
- Fixed: Segfault in php_str_replace_common
- Fixed: Assertion failure if dumping closure with unresolved
  static variable
- Fixed: Assertion failure when assigning property of string
  offset by reference
- Fixed: HT iterators not removed if empty array is destroyed
- Fixed: Changing array during undef index RW error segfaults
- Fixed: Use after free if changing array during undef var during
  array write fetch
- Fixed: Use after free if string used in undefined index warning
  is changed
- Fixed: Public non-static property in child should take priority
  over private static
- Fixed: getimagesize function silently truncates after a null
  byte
- Fixed: finfo_file crash (FILEINFO_MIME)
- Fixed: ftp_size on large files
- Fixed: mb_strimwidth does not trim string
- Fixed: Use of freed hash key in the phar_parse_zipfile function
- Fixed: ::getStaticProperties() ignores property modifications
- Fixed: ::getStaticPropertyValue() throws on protected props
- Fixed: Use after free when type duplicated into
  ReflectionProperty gets resolved
- Fixed: Can't copy() large 'data://' with open_basedir
- Fixed: dns_check_record() always return true on Alpine
- Fixed: array_walk() does not respect property types

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f46931abf0)
[Bug fix on update. lts version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10 19:41:39 -08:00
Zang Ruochen
aaaf03ada1 mcpp: Normalize the patch format of CVE
Because CVE-2019-14274.patch is included in ice-mcpp.patch, the cve-check-tool fails to correctly judge the CVE of the OSS. CVE-2019-14274.patch is separated from ice-mcpp.patch to fix the problem.

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9301b77e32)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 81874b2392)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10 19:24:24 -08:00
Yue Tao
fae2b90261 lua: Security Advisory - lua - CVE-2020-15888
Backport fix from https://github.com/lua/lua.git.

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 698748c153)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-30 21:29:08 -07:00
Armin Kuster
654ad8bea4 jsoncpp: add PE do to revert to older PV
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18 07:24:39 -07:00
Armin Kuster
0e0b4892f5 Revert "jsoncpp: upgrade 1.9.2 -> 1.9.3"
This reverts commit 2b384c5973.

It appears that there was a change in soname not noted in the changelog.

8b7ea09b80

ABI change appears to have occured.
https://abi-laboratory.pro/index.php?view=timeline&l=jsoncpp

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-13 20:45:23 -07:00
Paul Eggleton
28941dde0b protobuf-c: disable parallelism to avoid race condition
Unfortunately 489d3b4b93 did not completely
fix the problem - if you try cleaning and rebuilding protobuf-c-native it
doesn't take long to reproduce the issue on a 32-core machine. I spent
some time trying to debug this but failed, there is still a race between
generating t.test-full.pb.h and compiling cxx_generate_packed_data.c
despite BUILT_SOURCES and explicit dependencies. I even tried converting
the multiple target rules to use grouped targets (&:), that didn't fix it
either. Disabling parallelism as a workaround only costs ~20s and it
turns out that upstream is switching to Meson soon anyway:

  https://github.com/protobuf-c/protobuf-c/pull/340

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3251fe210a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-01 08:01:41 -07:00
Pierre-Jean Texier
2b384c5973 jsoncpp: upgrade 1.9.2 -> 1.9.3
See full changelog https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.3

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 65e124eef3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-01 08:00:22 -07:00
Andrew Geissler
3575cb4e60 nlohmann-json: backport gcc10 fix
The following issue and PR describe an issue with nlohmann-json and
GCC10.

https://github.com/nlohmann/json/issues/1920
https://github.com/nlohmann/json/pull/2034

Confirmed that this fixed the issue seen in OpenBMC when pulling in the
latest upstream meta-openembedded.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 12b707c52d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-28 21:23:56 -07:00
Claude Bing
a6c9ad397b php: update fix for opcache link issue in 7.4.4
The source of the issue is the update for PHP 7.4 support in
0001-opcache-config.m4-enable-opcache.patch (commit 7cc7a9ec).  Instead
of working around the issue in the recipe file, update the patch to
restore the call to PHP_ADD_LIBRARY().

Signed-off-by: Claude Bing <cbing@cybernetics.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3cfd16be4e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17 14:38:21 -07:00
Claude Bing
a009197ef4 php: fix opcache link error in 7.4
Explicitly specifying -lrt is required for opcache to be linked against
the proper dependencies.  Additionally, PHP disables libdl when it
detects a cross-compilation environment for some reason.  In order to
load any type of extension, re-enabling libdl is required.

Signed-off-by: Claude Bing <cbing@cybernetics.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0145cb4645)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17 14:36:56 -07:00
Claude Bing
ecce4fe695 php: fix PACKAGECONFIG for soap
PHP 7.4 enables libxml by default and removed it as a configurable
option.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7aeef522ff)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17 14:32:08 -07:00