poky: subtree update:745e38ff0f..81f9e815d3
Adrian Bunk (6):
openssl: Upgrade 1.1.1c -> 1.1.1d
glib-2.0: Upgrade 2.60.6 -> 2.60.7
lttng-modules: Upgrade 2.10.10 -> 2.10.11
lttng-ust: Upgrade 2.10.4 -> 2.10.5
squashfs-tools: Remove UPSTREAM_CHECK_COMMITS
libmpc: Remove dead UPSTREAM_CHECK_URI
Alexander Kanavin (2):
runqemu: decouple gtk and gl options
strace: add a timeout for running ptests
Alistair Francis (1):
gdb: Mark gdbserver as ALLOW_EMPTY for riscv32
Andre McCurdy (9):
busybox: drop unused mount.busybox and umount.busybox wrappers
busybox: drop inittab from SRC_URI ( now moved to busybox-inittab )
busybox-inittab: minor formatting tweaks
base-files: drop legacy empty file /etc/default/usbd
busybox: rcS and rcK should not be writeable by everyone
ffmpeg: add PACKAGECONFIG controls for alsa and zlib (enable by default)
libwebp: apply ARM specific config options to big endian ARM
initscripts: enable alignment.sh init script for big endian ARM
libunwind: apply configure over-ride to both big and little endian ARM
Andrew F. Davis (4):
libepoxy: Disable x11 when not building for x11
cogl: Set depends to the virtual needed not explicitly on Mesa
gtk+3: Set depends to the virtual needed not explicitly on Mesa
weston: Set depends to the virtual needed not explicitly on Mesa
Armin Kuster (1):
gcc: Security fix for CVE-2019-15847
Changhyeok Bae (1):
iw: upgrade to 5.3
Changqing Li (2):
classextend.py: don't extend file for file dependency
report-error.bbclass: add local.conf/auto.conf into error report
Chen Qi (1):
python-numpy: fix build for libn32
Daniel Gomez (1):
lttng-modules: Add missing SRCREV_FORMAT
Diego Rondini (1):
initramfs-framework: support PARTLABEL option
Dmitry Eremin-Solenikov (7):
image-uefi.conf: add config file holding configuration for UEFI images
grub-bootconf: switch to image-uefi.conf
grub-efi: switch to image-uefi.conf
grub-efi.bbclass: switch to image-uefi.conf
systemd-boot: switch to image-uefi.conf
systemd-boot.bbclass: switch to image-uefi.conf
live-vm-common.bbclass: provide efi population functions for live images
Hector Palacios (1):
udev-extraconf: skip mounting partitions already mounted by systemd
Henning Schild (6):
oe-git-proxy: allow setting SOCAT from outside
oeqa: add case for oe-git-proxy
Revert "oe-git-proxy: Avoid resolving NO_PROXY against local files"
oe-git-proxy: disable shell pathname expansion for the whole script
oe-git-proxy: NO_PROXY suffix matching without wildcard for match_host
oe-git-proxy: fix dash "Bad substitution"
Hongxu Jia (1):
elfutils: 0.176 -> 0.177
Jack Mitchell (1):
iptables: add systemd helper unit to load/restore rules
Jaewon Lee (1):
populate_sdk_ext: Introduce mechanism to keep nativesdk* sstate in esdk
Jason Wessel (1):
gnupg: Extend -native wrapper to fix gpgme-native's gpgconf problems
Jiang Lu (2):
glib-networking:enable glib-networking build as native package
libsoup:enable libsoup build as native package
Joshua Watt (4):
sstatesig: Update server URI
Remove SSTATE_HASHEQUIV_SERVER
bitbake: bitbake: Rework hash equivalence
classes/archiver: Fix WORKDIR for shared source
Kai Kang (1):
systemd: provides ${base_sbindir}/udevadm
Khem Raj (10):
ptrace: Drop ptrace aid for musl/ppc
elfutils: Fix build on ppc/musl
cogl: Do not depend PN-dev on empty PN
musl: Update to latest master
glibc: Move DISTRO_FEATURE specific do_install code for target recipe only
populate_sdk_base.bbclass: nativesdk-glibc-locale is required on musl too
nativesdk.bbclass: Clear out LIBCEXTENSION and ABIEXTENSION
openssl: Enable os option for with-rand-seed as well
weston-init: Add possibility to run weston as non-root user
layer.conf: Remove weston-conf from SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS
Li Zhou (1):
qemu: Security Advisory - qemu - CVE-2019-15890
Limeng (1):
tune-cortexa57-cortexa53: add tunes for ARM Cortex-A53-Cortex-A57
Martin Jansa (2):
perf: fix build on kernels which don't have ${S}/tools/include/linux/bits.h
bitbake: Revert "bitbake: cooker: Ensure bbappends are found in stable order"
Maxime Roussin-Bélanger (1):
meta: add missing descriptions and homepage in bsp
Mikko Rapeli (2):
busybox.inc: handle empty DEBUG_PREFIX_MAP
bitbake: svn fetcher: allow "svn propget svn:externals" to fail
Nathan Rossi (7):
resulttool: Handle multiple series containing ptestresults
gcc-cross.inc: Process binaries in build dir to be relocatable
oeqa/core/case.py: Add OEPTestResultTestCase for ptestresult helpers
oeqa/selftest: Rework toolchain tests to use OEPTestResultTestCase
glibc-testsuite: SkipRecipe if libc is not glibc
cmake: 3.15.2 -> 3.15.3
meson.bbclass: Handle microblaze* mapping to cpu family
Oleksandr Kravchuk (5):
python3-pygobject: update to 3.34.0
font-util: update to 1.3.2
expat: update to 2.2.8
curl: update to 7.66.0
python3-dbus: update to 1.2.12
Otavio Salvador (1):
mesa: Upgrade 19.1.1 -> 19.1.6
Peter Kjellerstedt (3):
glibc: Make it build without ldconfig in DISTRO_FEATURES
package_rpm.bbclass: Remove a misleading bb.note()
tzdata: Correct the packaging of /etc/localtime and /etc/timezone
Quentin Schulz (1):
externalsrc: stop rebuilds of 2+ externalsrc recipes sharing the same git repo
Randy MacLeod (4):
valgrind: enable ~500 more ptests
valgrind: make a few more ptests pass
valgrind: ptest improvements to run-ptest and more
valgrind: disable 256 ptests for aarch64
Richard Purdie (8):
bitbake: runqueue/siggen: Optimise hash equiv queries
runqemu: Mention snapshot in the help output
initramfs-framework: support PARTLABEL option
systemd: Handle slow to boot mips hwdb update timeouts
meta-extsdk: Either an sstate task is a proper task or it isn't
oeqa/concurrenttest: Use ionice to delete build directories
bitbake: utils: Add ionice option to prunedir
build-appliance-image: Update to master head revision
Robert Yang (2):
conf/multilib.conf: Add ovmf to NON_MULTILIB_RECIPES
bitbake: runqueue: validate_hashes(): currentcount should be a number
Ross Burton (16):
libtasn1: fix build with api-documentation enabled
gstreamer1.0-libav: enable gtk-doc again
python3: handle STAGING_LIBDIR/INCDIR being unset
mesa: no need to depend on target python3
adwaita-icon-theme: fix rare install race
oeqa/selftest/wic: improve assert messages in test_fixed_size
oeqa/selftest/imagefeatures: dump the JSON if it can't be parsed
libical: upgrade to 3.0.6
acpica: upgrade 20190509 -> 20190816
gdk-pixbuf: upgrade 2.38.1 -> 2.38.2
piglit: upgrade to latest revision
libinput: upgrade 1.14.0 -> 1.14.1
rootfs-postcommands: check /etc/gconf exists before working on it
systemd-systemctl-native: don't care about line endings
opkg-utils: respect SOURCE_DATE_EPOCH when building ipkgs
bitbake: fetch2/git: add git-lfs toggle option
Scott Murray (1):
systemd: upgrade to 243
Stefan Ghinea (1):
ghostscript: CVE-2019-14811, CVE-2019-14817
Tim Blechmann (1):
icecc: blacklist pixman
Yeoh Ee Peng (3):
bitbake: bitbake-layers: show-recipes: Show recipes only
bitbake: bitbake-layers: show-recipes: Select recipes from selected layer
bitbake: bitbake-layers: show-recipes: Enable bare output
Yi Zhao (3):
screen: add /etc/screenrc as global config file
nfs-utils: fix nfs mount error on 32bit nfs server
grub: remove diffutils and freetype runtime dependencies
Zang Ruochen (2):
btrfs-tools:upgrade 5.2.1 -> 5.2.2
timezone:upgrade 2019b -> 2019c
Change-Id: I1ec24480a8964e474cd99d60a0cb0975e49b46b8
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
diff --git a/poky/meta/recipes-extended/acpica/acpica_20190509.bb b/poky/meta/recipes-extended/acpica/acpica_20190816.bb
similarity index 90%
rename from poky/meta/recipes-extended/acpica/acpica_20190509.bb
rename to poky/meta/recipes-extended/acpica/acpica_20190816.bb
index cf6db33..8f79974 100644
--- a/poky/meta/recipes-extended/acpica/acpica_20190509.bb
+++ b/poky/meta/recipes-extended/acpica/acpica_20190816.bb
@@ -17,8 +17,8 @@
DEPENDS = "bison flex bison-native"
SRC_URI = "https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz"
-SRC_URI[md5sum] = "dd1f8240f924b12b0a0de0c31ab26ab1"
-SRC_URI[sha256sum] = "860b5f94a0590b278592acf16a4556b05ff0309c08e8c48aa29827cfa02c8e9d"
+SRC_URI[md5sum] = "6a73b1e34715916fa31132dbe11008b0"
+SRC_URI[sha256sum] = "888e80f3bb77381620a5ead208e1a1be06f3ea66ddc8cfdfa62811cae5f03752"
UPSTREAM_CHECK_URI = "https://acpica.org/downloads"
S = "${WORKDIR}/acpica-unix2-${PV}"
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
new file mode 100644
index 0000000..3f28555
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
@@ -0,0 +1,68 @@
+From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Tue, 20 Aug 2019 10:10:28 +0100
+Subject: [PATCH] make .forceput inaccessible
+
+Bug #701343, #701344, #701345
+
+More defensive programming. We don't want people to access .forecput
+even though it is no longer sufficient to bypass SAFER. The exploit
+in #701343 didn't work anyway because of earlier work to stop the error
+handler being used, but nevertheless, prevent access to .forceput from
+.setuserparams2.
+
+CVE: CVE-2019-14811
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/gs_lev2.ps | 6 +++---
+ Resource/Init/gs_pdfwr.ps | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
+index 98d55fe..f1b771f 100644
+--- a/Resource/Init/gs_lev2.ps
++++ b/Resource/Init/gs_lev2.ps
+@@ -158,7 +158,7 @@ end
+ {
+ pop pop
+ } ifelse
+- } forall
++ } executeonly forall
+ % A context switch might have occurred during the above loop,
+ % causing the interpreter-level parameters to be reset.
+ % Set them again to the new values. From here on, we are safe,
+@@ -229,9 +229,9 @@ end
+ { pop pop
+ }
+ ifelse
+- }
++ } executeonly
+ forall pop
+-} .bind odef
++} .bind executeonly odef
+
+ % Initialize the passwords.
+ % NOTE: the names StartJobPassword and SystemParamsPassword are known to
+diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
+index 00c19fa..dfe504d 100644
+--- a/Resource/Init/gs_pdfwr.ps
++++ b/Resource/Init/gs_pdfwr.ps
+@@ -652,11 +652,11 @@ currentdict /.pdfmarkparams .undef
+ systemdict /.pdf_hooked_DSC_Creator //true .forceput
+ } executeonly if
+ pop
+- } if
++ } executeonly if
+ } {
+ pop
+ } ifelse
+- }
++ } executeonly
+ {
+ pop
+ } ifelse
+--
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch
new file mode 100644
index 0000000..c76e21c
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch
@@ -0,0 +1,270 @@
+From 0bafbd9c1273fab0dc79fd20db0ffc4443683f96 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Mon, 29 Apr 2019 11:14:06 +0100
+Subject: [PATCH 1/2] PDF interpreter - Decode ToUnicode entries of the form
+ /Identity-H/V
+
+Bug #701003 "Text searchability broken due to omission of /ToUnicode /Identity-H"
+
+The PDF references from 1.2 too 2.0 all state that the value associated
+with a ToUnicode key in a FontDescriptor must be a stream object. However
+this file (and one case seen previously, bug 687351) have FontDescriptor
+dictionaries where the value associated with a /ToUnicode key is a
+name object, in both cases /Identity-H.
+
+Although this is clearly not legal, Acrobat not only tolerates it, it
+actually uses it for search/copy/paste (see bug 701003 for details).
+Without the key Acrobat is unable to successfully search the output file.
+
+We can't simply preserve the name object as a ToUnicode value; when
+handling ToUnicode we actually decode the CMap and build a
+GlyphNames2Unicode map (an internal representation of the G2U data
+produced by the Microsoft PostScript printer driver). When writing the
+output file we use that information to get a Unicode value for each
+character we write, and build a new ToUnicode CMap using that.
+
+This commit tackles the problem by pre-scanning for a name object and
+then checking to see if its Identity-H or Identity-V (although we have
+not seen an Identity-V, there seems no reason why it wouldn't be
+equally valid). If we find either of these then we construct a
+GlyphNames2Unicode table for all possible values (0 - 65535) and store
+that with the font as normal. When we write the output file we only
+write the required entries for the subset font, so we write a now
+completely legal ToUnicode CMap, and Acrobat is equally happy with that
+as the original name.
+
+If the ToUnicode value isn't a name object, or isn't one of the
+identities then we proceed as before. This means we will print a
+warning for non conforming ToUnicode entries and ignore them.
+
+CVE: CVE-2019-14817
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/pdf_font.ps | 200 ++++++++++++++++++++++++--------------
+ 1 file changed, 129 insertions(+), 71 deletions(-)
+
+diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
+index 9fb85f6..2df3303 100644
+--- a/Resource/Init/pdf_font.ps
++++ b/Resource/Init/pdf_font.ps
+@@ -621,86 +621,144 @@ currentdict end readonly def
+ PDFDEBUG {
+ (.processToUnicode beg) =
+ } if
+- 2 index /ToUnicode knownoget {
+- dup type /dicttype eq { dup /File known not } { //true } ifelse {
+- % We undefine wrong /Length and define /File in stream dictionaries.
+- % Bug687351.pdf defines /ToUnicode /Identity-H, what is incorrect.
+- ( **** Warning: Ignoring bad ToUnicode CMap.\n) pdfformatwarning
+- pop
++
++ 2 index /ToUnicode knownoget
++ {
++ dup type /nametype eq {
++ % This is contrary to the specification but it seems that Acrobat at least will accept
++ % a ToUnicode with a value of Identity-H *and* will use that for search, copy/paste.
++ % We can't pass through a name, so the best we can do is build a GlyphNames2Unicode
++ % map matching that which would have been generated by a full 16-bit Identity CMap
++ %
++ % See bug numbers 701003 and 687351
++ %
++ dup /Identity-H eq 1 index /Identity-V eq or{
++ pop
++ 1 index /FontInfo .knownget not {
++ currentglobal 2 index dup gcheck setglobal
++ /FontInfo 5 dict dup 5 1 roll .forceput
++ setglobal
++ } if
++ dup /GlyphNames2Unicode .knownget not {
++ //true % No existing G2U, make one
++ } {
++ dup wcheck {
++ //false % Existing, writeable G2U, don't make new one
++ } {
++ pop //true % Existing read only G2U, make new one
++ } ifelse
++ } ifelse
++ {
++ currentglobal exch dup gcheck setglobal
++ dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
++ 3 2 roll setglobal
++ } if % font-res font-dict encoding|null font-info g2u
++
++ 0 1 65535{
++ % g2u index
++ dup dup 256 mod exch 256 idiv % g2u index lo-byte hi-byte
++ 2 string dup 0 4 -1 roll % g2u index lo-byte () () 0 hi-byte
++ put % g2u index lo-byte (x)
++ dup 1 % g2u index lo-byte (x) (x) 1
++ 4 -1 roll put % g2u index (x) (x) 1 lo-byte -> dict index (xx)
++ 2 index % g2u index (xx) dict
++ 3 1 roll % g2u g2u index (xx)
++ put % g2u
++ } for
++ pop % font-res font-dict encoding|null font-info
++ pop % font-res font-dict encoding|null
++ //false % We built a GlyphNames2Unicode table, don't need to process further
++ }{
++ //true % name is not Identity-V or H, fail by falling through
++ }ifelse
+ } {
+- /PDFScanRules .getuserparam dup //null eq {
+- pop //PDFScanRules_null
+- } {
+- 1 dict dup /PDFScanRules 4 -1 roll put
+- } ifelse
+- //PDFScanRules_true setuserparams
+- PDFfile fileposition
+- 3 -1 roll
+- count 1 sub
+- countdictstack
+- { //false resolvestream
+- % Following Acrobat we ignore everything outside
+- % begincodespacerange .. endcmap.
+- dup 0 (begincodespacerange) /SubFileDecode filter flushfile
+- /CIDInit /ProcSet findresource begin
+- //ToUnicodeCMapReader begin
+- 12 dict begin
+- /CMapType 2 def
+- mark exch % emulate 'begincodespacerange'
+- 0 (endcmap) /SubFileDecode filter cvx /begincmap cvx exch 2 .execn
+- endcmap
+- userdict /.lastToUnicode currentdict put
+- end end end
+- }
++ //true
++ } ifelse % not a name, try as a dictionary (as specified)
+
+- PDFSTOPONERROR {
+- { exec } 0 get
+- //false
+- 5 -2 roll
+- 5
++ % If the ToUnicode isn't a name, or the name isn't Identity-V or -H then follow the specification
++ % If its not a dictionary type throw an error, otherwise decode it and build a GlyphNames2Unicode
++ %
++ {
++ dup type /dicttype eq { dup /File known not } { //true } ifelse {
++ % We undefine wrong /Length and define /File in stream dictionaries.
++ % Bug687351.pdf defines /ToUnicode /Identity-H, what is incorrect.
++ ( **** Warning: Ignoring bad ToUnicode CMap.\n) pdfformatwarning
++ pop
+ } {
+- { stopped } 0 get
+- 4 2 roll
+- 4
+- } ifelse
+- array astore cvx exec
++ /PDFScanRules .getuserparam dup //null eq {
++ pop //PDFScanRules_null
++ } {
++ 1 dict dup /PDFScanRules 4 -1 roll put
++ } ifelse
++ //PDFScanRules_true setuserparams
++ PDFfile fileposition
++ 3 -1 roll
++ count 1 sub
++ countdictstack
++ { //false resolvestream
++ % Following Acrobat we ignore everything outside
++ % begincodespacerange .. endcmap.
++ dup 0 (begincodespacerange) /SubFileDecode filter flushfile
++ /CIDInit /ProcSet findresource begin
++ //ToUnicodeCMapReader begin
++ 12 dict begin
++ /CMapType 2 def
++ mark exch % emulate 'begincodespacerange'
++ 0 (endcmap) /SubFileDecode filter cvx /begincmap cvx exch 2 .execn
++ endcmap
++ userdict /.lastToUnicode currentdict put
++ end end end
++ }
+
+- countdictstack exch sub 0 .max { end } repeat
+- count exch sub 2 sub 0 .max { exch pop } repeat
+- 3 1 roll % Stach the stop flag.
+- PDFfile exch setfileposition
+- setuserparams
+- {
+- ( **** Warning: Failed to read ToUnicode CMap.\n) pdfformatwarning
+- } {
+- 1 index /FontInfo .knownget not {
+- currentglobal 2 index dup gcheck setglobal
+- /FontInfo 5 dict dup 5 1 roll .forceput
+- setglobal
+- } if
+- dup /GlyphNames2Unicode .knownget not {
+- //true % No existing G2U, make one
++ PDFSTOPONERROR {
++ { exec } 0 get
++ //false
++ 5 -2 roll
++ 5
++ } {
++ { stopped } 0 get
++ 4 2 roll
++ 4
++ } ifelse
++ array astore cvx exec
++
++ countdictstack exch sub 0 .max { end } repeat
++ count exch sub 2 sub 0 .max { exch pop } repeat
++ 3 1 roll % Stach the stop flag.
++ PDFfile exch setfileposition
++ setuserparams
++ {
++ ( **** Warning: Failed to read ToUnicode CMap.\n) pdfformatwarning
+ } {
+- dup wcheck {
+- //false % Existing, writeable G2U, don't make new one
++ 1 index /FontInfo .knownget not {
++ currentglobal 2 index dup gcheck setglobal
++ /FontInfo 5 dict dup 5 1 roll .forceput
++ setglobal
++ } if
++ dup /GlyphNames2Unicode .knownget not {
++ //true % No existing G2U, make one
+ } {
+- pop //true % Existing read only G2U, make new one
++ dup wcheck {
++ //false % Existing, writeable G2U, don't make new one
++ } {
++ pop //true % Existing read only G2U, make new one
++ } ifelse
+ } ifelse
++ {
++ currentglobal exch dup gcheck setglobal
++ dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
++ 3 2 roll setglobal
++ } if % font-res font-dict encoding|null font-info g2u
++ exch pop exch % font-res font-dict g2u encoding|null
++ userdict /.lastToUnicode get % font-res font-dict g2u Encoding|null CMap
++ .convert_ToUnicode-into-g2u % font-res font-dict
++ //null % font-res font-dict //null
+ } ifelse
+- {
+- currentglobal exch dup gcheck setglobal
+- dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
+- 3 2 roll setglobal
+- } if % font-res font-dict encoding|null font-info g2u
+- exch pop exch % font-res font-dict g2u encoding|null
+- userdict /.lastToUnicode get % font-res font-dict g2u Encoding|null CMap
+- .convert_ToUnicode-into-g2u % font-res font-dict
+- //null % font-res font-dict //null
+ } ifelse
+- } ifelse
+- } if
+- PDFDEBUG {
+- (.processToUnicode end) =
++ } if
++ PDFDEBUG {
++ (.processToUnicode end) =
++ } if
+ } if
+ } if
+ } stopped
+--
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch
new file mode 100644
index 0000000..6348fff
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch
@@ -0,0 +1,236 @@
+From cd1b1cacadac2479e291efe611979bdc1b3bdb19 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Wed, 21 Aug 2019 10:10:51 +0100
+Subject: [PATCH 2/2] PDF interpreter - review .forceput security
+
+Bug #701450 "Safer Mode Bypass by .forceput Exposure in .pdfexectoken"
+
+By abusing the error handler it was possible to get the PDFDEBUG portion
+of .pdfexectoken, which uses .forceput left readable.
+
+Add an executeonly appropriately to make sure that clause isn't readable
+no mstter what.
+
+Review all the uses of .forceput searching for similar cases, add
+executeonly as required to secure those. All cases in the PostScript
+support files seem to be covered already.
+
+CVE: CVE-2019-14817
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/pdf_base.ps | 2 +-
+ Resource/Init/pdf_draw.ps | 14 +++++++-------
+ Resource/Init/pdf_font.ps | 29 ++++++++++++++++-------------
+ Resource/Init/pdf_main.ps | 6 +++---
+ Resource/Init/pdf_ops.ps | 11 ++++++-----
+ 5 files changed, 33 insertions(+), 29 deletions(-)
+
+diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
+index 1a218f4..cffde5c 100644
+--- a/Resource/Init/pdf_base.ps
++++ b/Resource/Init/pdf_base.ps
+@@ -157,7 +157,7 @@ currentdict /num-chars-dict .undef
+ {
+ dup ==only () = flush
+ } ifelse % PDFSTEP
+- } if % PDFDEBUG
++ } executeonly if % PDFDEBUG
+ 2 copy .knownget {
+ exch pop exch pop exch pop exec
+ } {
+diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps
+index e18a7c2..0a3924c 100644
+--- a/Resource/Init/pdf_draw.ps
++++ b/Resource/Init/pdf_draw.ps
+@@ -501,8 +501,8 @@ end
+ ( Output may be incorrect.\n) pdfformaterror
+ //pdfdict /.gs_warning_issued //true .forceput
+ PDFSTOPONERROR { /gs /undefined signalerror } if
+- } if
+- }
++ } executeonly if
++ } executeonly
+ ifelse
+ } bind executeonly def
+
+@@ -1142,7 +1142,7 @@ currentdict end readonly def
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- }
++ } executeonly
+ {
+ currentglobal //pdfdict gcheck .setglobal
+ //pdfdict /.Qqwarning_issued //true .forceput
+@@ -1150,8 +1150,8 @@ currentdict end readonly def
+ pdfformaterror
+ } executeonly ifelse
+ end
+- } ifelse
+- } loop
++ } executeonly ifelse
++ } executeonly loop
+ {
+ (\n **** Error: File has unbalanced q/Q operators \(too many q's\)\n Output may be incorrect.\n)
+ //pdfdict /.Qqwarning_issued .knownget
+@@ -1165,14 +1165,14 @@ currentdict end readonly def
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- }
++ } executeonly
+ {
+ currentglobal //pdfdict gcheck .setglobal
+ //pdfdict /.Qqwarning_issued //true .forceput
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- } if
++ } executeonly if
+ pop
+
+ % restore pdfemptycount
+diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
+index 2df3303..6a6a5fe 100644
+--- a/Resource/Init/pdf_font.ps
++++ b/Resource/Init/pdf_font.ps
+@@ -638,7 +638,7 @@ currentdict end readonly def
+ currentglobal 2 index dup gcheck setglobal
+ /FontInfo 5 dict dup 5 1 roll .forceput
+ setglobal
+- } if
++ } executeonly if
+ dup /GlyphNames2Unicode .knownget not {
+ //true % No existing G2U, make one
+ } {
+@@ -668,10 +668,12 @@ currentdict end readonly def
+ pop % font-res font-dict encoding|null font-info
+ pop % font-res font-dict encoding|null
+ //false % We built a GlyphNames2Unicode table, don't need to process further
+- }{
++ } executeonly
++ {
+ //true % name is not Identity-V or H, fail by falling through
+ }ifelse
+- } {
++ } executeonly
++ {
+ //true
+ } ifelse % not a name, try as a dictionary (as specified)
+
+@@ -759,9 +761,9 @@ currentdict end readonly def
+ PDFDEBUG {
+ (.processToUnicode end) =
+ } if
+- } if
+- } if
+- } stopped
++ } executeonly if
++ } executeonly if
++ } executeonly stopped
+ {
+ .dstackdepth 1 countdictstack 1 sub
+ {pop end} for
+@@ -1291,19 +1293,20 @@ currentdict /eexec_pdf_param_dict .undef
+ //pdfdict /.Qqwarning_issued //true .forceput
+ } executeonly if
+ Q
+- } repeat
++ } executeonly repeat
+ Q
+- } PDFfile fileposition 2 .execn % Keep pdfcount valid.
++ } executeonly PDFfile fileposition 2 .execn % Keep pdfcount valid.
+ PDFfile exch setfileposition
+- } ifelse
+- } {
++ } executeonly ifelse
++ } executeonly
++ {
+ % PDF Type 3 fonts don't use .notdef
+ % d1 implementation adjusts the width as needed
+ 0 0 0 0 0 0
+ pdfopdict /d1 get exec
+ } ifelse
+ end end
+- } bdef
++ } executeonly bdef
+ dup currentdict Encoding .processToUnicode
+ currentdict end .completefont exch pop
+ } bind executeonly odef
+@@ -2103,9 +2106,9 @@ currentdict /CMap_read_dict undef
+ (Will continue, but content may be missing.) = flush
+ } ifelse
+ } if
+- } if
++ } executeonly if
+ /findresource cvx /undefined signalerror
+- } loop
++ } executeonly loop
+ } bind executeonly odef
+
+ /buildCIDType0 { % <CIDFontType0-font-resource> buildCIDType0 <font>
+diff --git a/Resource/Init/pdf_main.ps b/Resource/Init/pdf_main.ps
+index 5305ea6..a59e63c 100644
+--- a/Resource/Init/pdf_main.ps
++++ b/Resource/Init/pdf_main.ps
+@@ -2749,15 +2749,15 @@ currentdict /PDF2PS_matrix_key undef
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- }
++ } executeonly
+ {
+ currentglobal //pdfdict gcheck .setglobal
+ //pdfdict /.Qqwarning_issued //true .forceput
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- } if
+- } if
++ } executeonly if
++ } executeonly if
+ pop
+ count PDFexecstackcount sub { pop } repeat
+ (after exec) VMDEBUG
+diff --git a/Resource/Init/pdf_ops.ps b/Resource/Init/pdf_ops.ps
+index 285e582..6c1f100 100644
+--- a/Resource/Init/pdf_ops.ps
++++ b/Resource/Init/pdf_ops.ps
+@@ -186,14 +186,14 @@ currentdict /gput_always_allow .undef
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- }
++ } executeonly
+ {
+ currentglobal //pdfdict gcheck .setglobal
+ //pdfdict /.Qqwarning_issued //true .forceput
+ .setglobal
+ pdfformaterror
+ } executeonly ifelse
+- } if
++ } executeonly if
+ } bind executeonly odef
+
+ % Save PDF gstate
+@@ -440,11 +440,12 @@ currentdict /gput_always_allow .undef
+ dup type /booleantype eq {
+ .currentSMask type /dicttype eq {
+ .currentSMask /Processed 2 index .forceput
++ } executeonly
++ {
++ .setSMask
++ }ifelse
+ } executeonly
+ {
+- .setSMask
+- }ifelse
+- }{
+ .setSMask
+ }ifelse
+
+--
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb b/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
index fcc9e00..349c0c2 100644
--- a/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
@@ -25,6 +25,9 @@
file://do-not-check-local-libpng-source.patch \
file://avoid-host-contamination.patch \
file://mkdir-p.patch \
+ file://CVE-2019-14811-0001.patch \
+ file://CVE-2019-14817-0001.patch \
+ file://CVE-2019-14817-0002.patch \
"
SRC_URI = "${SRC_URI_BASE} \
diff --git a/poky/meta/recipes-extended/iptables/iptables/iptables.rules b/poky/meta/recipes-extended/iptables/iptables/iptables.rules
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/poky/meta/recipes-extended/iptables/iptables/iptables.rules
diff --git a/poky/meta/recipes-extended/iptables/iptables/iptables.service b/poky/meta/recipes-extended/iptables/iptables/iptables.service
new file mode 100644
index 0000000..041316e
--- /dev/null
+++ b/poky/meta/recipes-extended/iptables/iptables/iptables.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Packet Filtering Framework
+Before=network-pre.target
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=@SBINDIR@/iptables-restore /etc/iptables/iptables.rules
+ExecReload=@SBINDIR@/iptables-restore /etc/iptables/iptables.rules
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb b/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
index 6ac3fc6..ff9fcb1 100644
--- a/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
+++ b/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
@@ -10,12 +10,14 @@
SRC_URI = "http://netfilter.org/projects/iptables/files/iptables-${PV}.tar.bz2 \
file://0001-configure-Add-option-to-enable-disable-libnfnetlink.patch \
file://0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch \
+ file://iptables.service \
+ file://iptables.rules \
"
SRC_URI[md5sum] = "29de711d15c040c402cf3038c69ff513"
SRC_URI[sha256sum] = "a23cac034181206b4545f4e7e730e76e08b5f3dd78771ba9645a6756de9cdd80"
-inherit autotools pkgconfig
+inherit autotools pkgconfig systemd
EXTRA_OECONF = "--with-kernel=${STAGING_INCDIR}"
@@ -56,6 +58,19 @@
ALLOW_EMPTY_${PN}-modules = "1"
+do_install_append() {
+
+ install -d ${D}${sysconfdir}/iptables
+ install -m 0644 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/iptables
+
+ install -d ${D}${systemd_system_unitdir}
+ install -m 0644 ${WORKDIR}/iptables.service ${D}${systemd_system_unitdir}
+
+ sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_system_unitdir}/iptables.service
+}
+
+SYSTEMD_SERVICE_${PN} = "iptables.service"
+
RDEPENDS_${PN} = "${PN}-module-xt-standard"
RRECOMMENDS_${PN} = " \
${PN}-modules \
diff --git a/poky/meta/recipes-extended/screen/screen_4.6.2.bb b/poky/meta/recipes-extended/screen/screen_4.6.2.bb
index 24ec751..21b476d 100644
--- a/poky/meta/recipes-extended/screen/screen_4.6.2.bb
+++ b/poky/meta/recipes-extended/screen/screen_4.6.2.bb
@@ -35,10 +35,11 @@
PACKAGECONFIG ??= ""
PACKAGECONFIG[utempter] = "ac_cv_header_utempter_h=yes,ac_cv_header_utempter_h=no,libutempter,"
-EXTRA_OECONF = "--with-pty-mode=0620 --with-pty-group=5 \
+EXTRA_OECONF = "--with-pty-mode=0620 --with-pty-group=5 --with-sys-screenrc=${sysconfdir}/screenrc \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
do_install_append () {
+ install -D -m 644 ${S}/etc/etcscreenrc ${D}/${sysconfdir}/screenrc
if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then
install -D -m 644 ${WORKDIR}/screen.pam ${D}/${sysconfdir}/pam.d/screen
fi
diff --git a/poky/meta/recipes-extended/timezone/timezone.inc b/poky/meta/recipes-extended/timezone/timezone.inc
index ce16524..f6bab1a 100644
--- a/poky/meta/recipes-extended/timezone/timezone.inc
+++ b/poky/meta/recipes-extended/timezone/timezone.inc
@@ -4,7 +4,7 @@
LICENSE = "PD & BSD & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
-PV = "2019b"
+PV = "2019c"
SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \
http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \
@@ -12,7 +12,7 @@
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
-SRC_URI[tzcode.md5sum] = "91e0978d947496fd6aaf46d351f9c41d"
-SRC_URI[tzcode.sha256sum] = "2e479d409337da41408629ce6c3b4d8410b10ba6d4431d862e22d2b137d7756d"
-SRC_URI[tzdata.md5sum] = "b26b5d7d844cb96c73ed2fb6d588daaf"
-SRC_URI[tzdata.sha256sum] = "05d9092c90dcf9ec4f3ccfdea80c7dcea5e882b3b105c3422da172aaa9a50c64"
+SRC_URI[tzcode.md5sum] = "195a17454c5db05cab96595380650391"
+SRC_URI[tzcode.sha256sum] = "f6ebd3668e02d5ed223d3b7b1947561bf2d2da2f4bd1db61efefd9e06c167ed4"
+SRC_URI[tzdata.md5sum] = "f6987e6dfdb2eb83a1b5076a50b80894"
+SRC_URI[tzdata.sha256sum] = "79c7806dab09072308da0e3d22c37d3b245015a591891ea147d3b133b60ffc7c"
diff --git a/poky/meta/recipes-extended/timezone/tzdata.bb b/poky/meta/recipes-extended/timezone/tzdata.bb
index 82fe369..1e2d9bd 100644
--- a/poky/meta/recipes-extended/timezone/tzdata.bb
+++ b/poky/meta/recipes-extended/timezone/tzdata.bb
@@ -147,6 +147,8 @@
RPROVIDES_tzdata-misc = "tzdata-misc"
FILES_tzdata-core += " \
+ ${sysconfdir}/localtime \
+ ${sysconfdir}/timezone \
${datadir}/zoneinfo/Pacific/Honolulu \
${datadir}/zoneinfo/America/Anchorage \
${datadir}/zoneinfo/America/Los_Angeles \
@@ -202,8 +204,7 @@
${datadir}/zoneinfo/iso3166.tab \
${datadir}/zoneinfo/Etc/*"
-CONFFILES_tzdata-core += "${@ "${sysconfdir}/timezone" if bb.utils.to_boolean(d.getVar('INSTALL_TIMEZONE_FILE')) else "" }"
-CONFFILES_tzdata-core += "${sysconfdir}/localtime"
+CONFFILES_tzdata-core = "${sysconfdir}/localtime ${sysconfdir}/timezone"
ALLOW_EMPTY_${PN} = "1"
RDEPENDS_${PN} = "${TZ_PACKAGES}"