poky: subtree update:5951cbcabe..968fcf4989
Alejandro Hernandez (3):
baremetal-helloworld: Use do_image_complete instead of do_deploy
baremetal-image.bbclass: Create a class for baremetal applications or an RTOS
baremetal-helloworld: Use baremetal-image class to deploy the application
Alejandro del Castillo (2):
opkg-utils: upgrade to 0.4.3
opkg: upgrade to version 0.4.3
Alexander Kanavin (30):
dnf: upgrade 4.2.21 -> 4.2.23
meson: upgrade 0.54.2 -> 0.54.3
libdnf: update 0.47.0 -> 0.48.0
ffmpeg: disable altivec on ppc by default
dropbear: update 2019.78 -> 2020.79
elfutils: upgrade 0.179 -> 0.180
gnu-config: update to latest revision
libgpg-error: update 1.37 -> 1.38
perl: update 5.30.2 -> 5.32.0
gst-examples: upstream releases are even numbered
bison: upgrade 3.6.3 -> 3.6.4
python3-cython: upgrade 0.29.19 -> 0.29.20
stress-ng: upgrade 0.11.12 -> 0.11.14
piglit: upgrade to latest revision
linux-firmware: upgrade 20200519 -> 20200619
systemtap: upgrade 4.2 -> 4.3
alsa-lib: upgrade 1.2.2 -> 1.2.3.1
alsa-topology-conf: upgrade 1.2.2 -> 1.2.3
alsa-ucm-conf: upgrade 1.2.2 -> 1.2.3
alsa-utils: upgrade 1.2.2 -> 1.2.3
puzzles: upgrade to latest revision
diffoscope: upgrade 147 -> 148
libcheck: upgrade 0.14.0 -> 0.15.0
rsync: update 3.1.3 -> 3.2.1
sudo: upgrade 1.9.0 -> 1.9.1
python3-numpy: update 1.18.5 -> 1.19.0
mesa: update 20.0.7 -> 20.1.2
go-binary-native: fix upstream version check
Revert "python3-setuptools: patch entrypoints for faster initialization"
python3-setuptools: upgrade 47.1.1 -> 47.3.1
Alistair Francis (1):
opensbi: Update to OpenSBI v0.8 release
Andreas Müller (3):
nfs-utils: upgrade 2.4.3 -> 2.5.1
ccache: merge ccache.inc into recipe
ccache: upgrade 3.7.9 -> 3.7.10
Andrej Valek (2):
busybox: 1.31.1 -> 1.32.0
dropbear: update to 2020.80
Andrey Zhizhikin (1):
kernel/yocto: fix search for defconfig from src_uri
Armin Kuster (1):
wpa-supplicant: Security fix CVE-2020-12695
Bjarne Michelsen (1):
devtool: default to empty string, if LIC_FILES_CHKSUM is not available
Bruce Ashfield (10):
kernel/yocto: ensure that defconfigs are processed first
linux-yocto/5.4: update to v5.4.45
linux-yocto-rt/5.4: update to rt25
linux-yocto/5.4: update to v5.4.46
linux-yocto/5.4: update to v5.4.47
linux-yocto/5.4: update to v5.4.49 and -rt28
yocto-bsps: bump reference boards to v5.4.49
linux-yocto/5.4: update to v5.4.50
linux-yocto-dev: bump to 5.8-rc
lttng-modules: bump devupstream to v2.12.1+
Changqing Li (5):
xinit: add rxvt-unicode in RDEPENDS
modutils-initscripts: update postinst
initscripts: update postinst
gtk-icon-cache.bbclass: add runtime dependency
logrotate.py: fix testimage occasionally failure
Chen Qi (2):
oescripts.py: fix typo
oescripts: ignore whitespaces when comparing lines
Chris Laplante (2):
bitbake: contrib/vim: synchronize from kergoth/vim-bitbake rev 4225ee8b4818d7e4696520567216a3a031c26f7d
bitbake: ui/teamcity: don't use removed logging classes
Christian Eggers (1):
libnl: Extend for native/nativesdk
Damian Wrobel (1):
rootfs: do not let ldconfig to create symlinks
Daniel Klauer (2):
uboot-sign: Refactor do_deploy prefunc to do_deploy_prepend
deploy.bbclass: Clean DEPLOYDIR before do_deploy
David Khouya (2):
bitbake: lib/ui/taskexp: Validate gi import
bitbake: lib/ui/taskexp: Fix missing Gtk import
Hannu Lounento (1):
openssl: move ${libdir}/[...]/openssl.cnf to ${PN}-conf
Hongxu Jia (1):
iso-codes: switch upstream branch master -> main
Jason Wessel (1):
runqemu: If using a vmtype image do not add the -no-reboot flag
Joe Slater (1):
jquery: use ${S}
Joshua Watt (4):
bitbake: hashserv: Chunkify large messages
bitbake: siggen: Fix error when hash equivalence has an exception
classes/archiver: run do_unpack_and_patch after do_preconfigure
classes/archive: do_configure should not depend on do_ar_patched
Khem Raj (2):
musl: Update to tip of master
rxvt-unicode: Disable wtmp on musl
Konrad Weihmann (2):
systemd: remove kernel-install from base pkg
bitbake.conf: fix whitespace issues
Lee Chee Yang (3):
json-c: fix CVE-2020-12762
qemu: fix CVE-2020-10761
oeqa/core/loader: refine regex to find module
Lili Li (1):
kernel.bbclass: Fix Module.symvers support
Matt Madison (1):
kernel.bbclass: add gzip-native to do_deploy dependencies
Max Krummenacher (2):
cogl-1.0: : don't require eglmesaext.h
cogl-1.0: cope with missing x11 headers
Mingli Yu (2):
python3-libarchive-c: add the missing rdepends
python3: add ldconfig rdepends for python3-ctypes
Nicolas Dechesne (1):
checklayer: parse LAYERDEPENDS with bb.utils.explode_dep_versions2()
Pierre-Jean Texier (3):
libubootenv: bump to revision 86bd30a
curl: upgrade 7.71.0 -> 7.71.1
diffoscope: upgrade 148 -> 150
Rahul Kumar (1):
bzip2: Add test suite for bzip2
Rasmus Villemoes (1):
coreutils: don't split stdbuf to own package with single-binary
Richard Purdie (13):
pseudo: Switch to oe-core branch in git repo
pseudo: merge in fixes for setfacl issue
oeqa/selftest: Clean up separate builddir in success case when non-threaded
populate_sdk_ext: Fix to use python3, not python
bitbake: taskdata: Improve handling of regex in ASSUME_PROVIDED
bitbake: runqueue: Avoid unpickle errors in rare cases
bitbake: msg: Avoid issues where paths have relative components
oeqa/selftest: recipetool/devtool: Avoid load_plugin test race
oeqa/targetcontrol: Attempt to fix log closure warning message
rootfs-postcommands: Improve/fix rootfs_check_host_user_contaminated
spdx: Remove the class as its obsolete
adwaita-icon-theme: Add missing license files to LIC_FILES_CHKSUM
bitbake: server/process: Increase timeout for commands
Ross Burton (3):
ovmf: build natively everywhere
common-licenses: fix filename of BSD-2-Clause-Patent
gtk+3: fix reproducible build failure
Timon Ulrich (2):
kernel.bbclass: add lz4 dependency and fix the call to lz4
kernel.bbclass: make dependency on lzop-native conditional
Vacek, Patrick (1):
oeqa/core/loader: fix regex to include numbers
Wang Mingyu (1):
gtk+3: upgrade 3.24.20 -> 3.24.21
Yanfei Xu (1):
classes/kernel: Use a copy of image for kernel*.rpm if fs doesn't support symlinks
akuster (5):
libuv: update to the last version in meta-oe
bitbake: test/fetch: change to better svn source
overview-manual: add SPDX license header
mega-manual: Add SPDX license headers
ref-manual: Add SPDX license headers
hongxu (2):
qemu: switches from libcap to libcap-ng for PACAKGECONFIG virtfs
cpio: add nativesdk support
zangrc (1):
libjpeg-turbo:upgrade 2.0.4 -> 2.0.5
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I41e066e5957aa74c9a24e86a6c214bcf96e9c46b
diff --git a/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch b/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch
new file mode 100644
index 0000000..a45cfb6
--- /dev/null
+++ b/poky/meta/recipes-devtools/json-c/json-c/CVE-2020-12762.patch
@@ -0,0 +1,160 @@
+From 099016b7e8d70a6d5dd814e788bba08d33d48426 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:41:16 +0200
+Subject: [PATCH 1/3] Protect array_list_del_idx against size_t overflow.
+
+If the assignment of stop overflows due to idx and count being
+larger than SIZE_T_MAX in sum, out of boundary access could happen.
+
+It takes invalid usage of this function for this to happen, but
+I decided to add this check so array_list_del_idx is as safe against
+bad usage as the other arraylist functions.
+
+Upstream-Status: Backport [https://github.com/json-c/json-c/commit/31243e4d1204ef78be34b0fcae73221eee6b83be]
+CVE: CVE-2020-12762
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+
+---
+ arraylist.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arraylist.c b/arraylist.c
+index 12ad8af6d3..e5524aca75 100644
+--- a/arraylist.c
++++ b/arraylist.c
+@@ -136,6 +136,9 @@ int array_list_del_idx(struct array_list *arr, size_t idx, size_t count)
+ {
+ size_t i, stop;
+
++ /* Avoid overflow in calculation with large indices. */
++ if (idx > SIZE_T_MAX - count)
++ return -1;
+ stop = idx + count;
+ if (idx >= arr->length || stop > arr->length)
+ return -1;
+
+From 77d935b7ae7871a1940cd827e850e6063044ec45 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:46:45 +0200
+Subject: [PATCH 2/3] Prevent division by zero in linkhash.
+
+If a linkhash with a size of zero is created, then modulo operations
+are prone to division by zero operations.
+
+Purely protective measure against bad usage.
+---
+ linkhash.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/linkhash.c b/linkhash.c
+index 7ea58c0abf..f05cc38030 100644
+--- a/linkhash.c
++++ b/linkhash.c
+@@ -12,6 +12,7 @@
+
+ #include "config.h"
+
++#include <assert.h>
+ #include <limits.h>
+ #include <stdarg.h>
+ #include <stddef.h>
+@@ -499,6 +500,8 @@ struct lh_table *lh_table_new(int size, lh_entry_free_fn *free_fn, lh_hash_fn *h
+ int i;
+ struct lh_table *t;
+
++ /* Allocate space for elements to avoid divisions by zero. */
++ assert(size > 0);
+ t = (struct lh_table *)calloc(1, sizeof(struct lh_table));
+ if (!t)
+ return NULL;
+
+From d07b91014986900a3a75f306d302e13e005e9d67 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Mon, 4 May 2020 19:47:25 +0200
+Subject: [PATCH 3/3] Fix integer overflows.
+
+The data structures linkhash and printbuf are limited to 2 GB in size
+due to a signed integer being used to track their current size.
+
+If too much data is added, then size variable can overflow, which is
+an undefined behaviour in C programming language.
+
+Assuming that a signed int overflow just leads to a negative value,
+like it happens on many sytems (Linux i686/amd64 with gcc), then
+printbuf is vulnerable to an out of boundary write on 64 bit systems.
+---
+ linkhash.c | 7 +++++--
+ printbuf.c | 19 ++++++++++++++++---
+ 2 files changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/linkhash.c b/linkhash.c
+index f05cc38030..51e90b13a2 100644
+--- a/linkhash.c
++++ b/linkhash.c
+@@ -580,9 +580,12 @@ int lh_table_insert_w_hash(struct lh_table *t, const void *k, const void *v, con
+ {
+ unsigned long n;
+
+- if (t->count >= t->size * LH_LOAD_FACTOR)
+- if (lh_table_resize(t, t->size * 2) != 0)
++ if (t->count >= t->size * LH_LOAD_FACTOR) {
++ /* Avoid signed integer overflow with large tables. */
++ int new_size = INT_MAX / 2 < t->size ? t->size * 2 : INT_MAX;
++ if (t->size == INT_MAX || lh_table_resize(t, new_size) != 0)
+ return -1;
++ }
+
+ n = h % t->size;
+
+diff --git a/printbuf.c b/printbuf.c
+index 976c12dde5..00822fac4f 100644
+--- a/printbuf.c
++++ b/printbuf.c
+@@ -15,6 +15,7 @@
+
+ #include "config.h"
+
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -65,10 +66,16 @@ static int printbuf_extend(struct printbuf *p, int min_size)
+
+ if (p->size >= min_size)
+ return 0;
+-
+- new_size = p->size * 2;
+- if (new_size < min_size + 8)
++ /* Prevent signed integer overflows with large buffers. */
++ if (min_size > INT_MAX - 8)
++ return -1;
++ if (p->size > INT_MAX / 2)
+ new_size = min_size + 8;
++ else {
++ new_size = p->size * 2;
++ if (new_size < min_size + 8)
++ new_size = min_size + 8;
++ }
+ #ifdef PRINTBUF_DEBUG
+ MC_DEBUG("printbuf_memappend: realloc "
+ "bpos=%d min_size=%d old_size=%d new_size=%d\n",
+@@ -83,6 +90,9 @@ static int printbuf_extend(struct printbuf *p, int min_size)
+
+ int printbuf_memappend(struct printbuf *p, const char *buf, int size)
+ {
++ /* Prevent signed integer overflows with large buffers. */
++ if (size > INT_MAX - p->bpos - 1)
++ return -1;
+ if (p->size <= p->bpos + size + 1)
+ {
+ if (printbuf_extend(p, p->bpos + size + 1) < 0)
+@@ -100,6 +110,9 @@ int printbuf_memset(struct printbuf *pb, int offset, int charvalue, int len)
+
+ if (offset == -1)
+ offset = pb->bpos;
++ /* Prevent signed integer overflows with large buffers. */
++ if (len > INT_MAX - offset)
++ return -1;
+ size_needed = offset + len;
+ if (pb->size < size_needed)
+ {
diff --git a/poky/meta/recipes-devtools/json-c/json-c_0.14.bb b/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
index 99fde87..1d501d1 100644
--- a/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
+++ b/poky/meta/recipes-devtools/json-c/json-c_0.14.bb
@@ -4,7 +4,10 @@
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2"
-SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz"
+SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \
+ file://CVE-2020-12762.patch \
+"
+
SRC_URI[sha256sum] = "b377de08c9b23ca3b37d9a9828107dff1de5ce208ff4ebb35005a794f30c6870"
UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/releases"