As we just match on product by default, ignore three CVEs which are
for the "Puzzles" WordPress theme by ThemeREX (CPE themerex:puzzles).
(From OE-Core rev: 87326573c82ac1e8dc335319442236ef2341501e)
(From OE-Core rev: 48791ba2329ee930285e5ed8eff0f2535c70bec7)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adapted to different kirkstone CVE_STATUS format.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
CVE fixed:
- CVE-2024-40776 webkitgtk: Use after free may lead to Remote Code Execution
- CVE-2024-40780 webkitgtk: Out-of-bounds read was addressed with improved bounds checking
Upstream-Status: Backport from b951404ea7 and e83e4c7460
(From OE-Core rev: e4c82db8a7c3273fe30bc99880fcdcd7ab061924)
Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Without this change, TIC is the native tic in recipe-sysroot-native.
By default, native tic has set its default terminfo path to native path:
${datadir}/terminfo; $HOME/.terminfo
When sstate cache is used, the cached native tic's terminfo path could
be a path not exist on current host, then native tic will try to install
terminfo to HOME dir, cause host contamination.
Disable the terminfo installation by setting TIC to :
(From OE-Core rev: 33069a688930ccb98a66f02feac40382ecf6cf85)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fe35ead2c3135a18c346e7baa31d34b15c3e2d95)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Unless DEBUG_BUILD is enabled, pass -g1 to massively reduce the size of
the debug symbols (4.3GB to 700M at time of writing):
Level 1 produces minimal information, enough for making backtraces in
parts of the program that you don't plan to debug. This includes
descriptions of functions and external variables, and line number
tables, but no information about local variables.
This makes the sstate objects a lot more manageable, and packaging
faster. On my machine:
PKG TASK ABSDIFF RELDIFF WALLTIME1 -> WALLTIME2
webkitgtk do_compile -613.8s -21.7% 2823.3s -> 2209.5s
webkitgtk do_package -143.4s -53.6% 267.7s -> 124.3s
webkitgtk do_install -93.7s -60.1% 156.0s -> 62.3s
webkitgtk do_populate_sysroot -51.6s -86.4% 59.7s -> 8.1s
Cumulative walltime:
-892.9s -26.5% 56:06.3 (3366.3s) -> 41:13.4 (2473.4s)
(From OE-Core rev: 287584ee1068e36c7e758aa1d69ef71382c9adaa)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8361411ea0d67a2620680e2e86045799e072c80a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Currently, perl-native is missing from DEPENDS for webkitgtk even though
perlnative bbclass is inherited. This happens because the DEPENDS variable is
reassigned right after perlnative class is inherited:
inherit perlnative (DEPENDS += "perl-native")
...
DEPENDS = " \
..."
Adjust the DEPENDS line to use += in order to fix this.
(From OE-Core rev: 76cb08195f90b36395d7ad09ab8f2654eda0d204)
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: a207c8f42f809340e0794cd326cb5c45e32d7d56)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A type confusion issue was addressed with improved checks.
This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, Safari
16.5.1, macOS Ventura 13.4.1, iOS 15.7.7 and iPadOS 15.7.7.
Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that
this issue may have been actively exploited.
(From OE-Core rev: cdbc3c1548299eb78aeebb94909224eca8410158)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
The issue was addressed with improved bounds checks. This issue
is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6,
macOS Monterey 12.5, Safari 15.6. Processing web content may
lead to arbitrary code execution.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-48503https://support.apple.com/en-us/HT213340https://bugs.webkit.org/show_bug.cgi?id=241931
(From OE-Core rev: 8f956bc19963a02ee7b908bb49301a2ea5052066)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Backport and rebase patch to fix CVE-2023-23529.
CVE: CVE-2023-23529
(From OE-Core rev: f8bce477ad88da70c3a4196912ba72049b2aa765)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A memory corruption issue was addressed with improved input validation.
This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS
15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing
maliciously crafted web content may lead to arbitrary code execution.
References:
https://support.apple.com/en-us/HT213531https://bugs.webkit.org/show_bug.cgi?id=247562https://github.com/WebKit/WebKit/pull/6266
(From OE-Core rev: da1e7adf33b86cd818a39091043817e21ff8bbbd)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A use after free issue was addressed with improved memory management.
This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS
16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web
content may lead to arbitrary code execution.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-42867https://support.apple.com/en-us/HT213537
(From OE-Core rev: d4a872b6ac8c41d9c3f4d5f7255d4561684ef7d5)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A memory corruption issue was addressed with improved state management.
This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS
16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web
content may lead to arbitrary code execution.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-46699https://support.apple.com/en-us/HT213537
(From OE-Core rev: 8f71f60af366837399290a7fc9e0e38452f379cc)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A memory consumption issue was addressed with improved memory handling.
This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS
15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing
maliciously crafted web content may lead to arbitrary code execution.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-46691https://support.apple.com/en-us/HT213531
(From OE-Core rev: 15603261034610b6606df99996d065c254d8f8f9)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Changelog:
==========
- Reverted a change introduced in 1.14.1 which introduced crashes both
with WebKitGTK and WPE running under Wayland in some configurations.
- Fix a crash caused by wrong assertion, which was typically triggered in
debug builds when using the NVidia drivers.
- Fix WebKit no longer repainting after provisional navigation with
PSON enabled.
- Fix graphics buffer leaks by always freeing them in buffer destroy
listener callbacks.
(From OE-Core rev: 7991fb7aa30cf56105ebbe060195f16aa1c9b6da)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit aa37e18a51714af3281b4127dceb40b38aa8ac3c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Backport patches to fix CVE-2022-32888 and CVE-2022-32923 for webkitgtk
2.36.8. The bugzilla IDs of the CVEs are from https://support.apple.com
which have been listed in patch headers.
(From OE-Core rev: e24e16974e81a0f62dd6f5862a465fc74ad751d3)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
webkitgtk 2.36.8 is a bug fix release in the stable 2.36 series.
What’s new in the WebKitGTK 2.36.8 release?
* Fix jumpy elements when scrolling GitLab and other web sites.
* Fix WebKitWebView:web-process-terminated signal not being emitted for
the first web view when sandboxing is enabled.
* Fix hang when opening HTML <select> elements in GTK4 builds.
* Fix kinetic scrolling with elements that use overflow scrolling.
* Fix several crashes and rendering issues.
It fixes CVES:
CVE: CVE-2022-32886
CVE: CVE-2022-32891
CVE: CVE-2022-32912
Refs:
* https://webkitgtk.org/2022/09/16/webkitgtk2.36.8-released.html
* https://webkitgtk.org/security/WSA-2022-0009.html
(From OE-Core rev: 94c4dc8d233a35270dfedd9739f36c7aca0a559f)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
==========
Fixed a crash caused by trying to deallocate already freed graphics buffers in certain situations.
(From OE-Core rev: d5269e53d936570c875ef743f4ac198bb3658b6e)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 0db4627fe8c6f8a0080248052dc06419774cba4f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
Fix the build when using Clang's libc++ or the Musl libc.
0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
removed since it's included in 1.12.3
(From OE-Core rev: f10345e445dd2b7bee1cc3dda6a80e8ab1a5e5f9)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f8d8cc58c9b9c221158414be186bc12aa5d80e91)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the first bug fix release in the stable 1.12 series.
Fixed a crash caused by trying to deallocate already freed graphics
buffers in certain situations.
(From OE-Core rev: 1c7eab82f45ecabe21de3759f1ab97897250fc50)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a614bb96fab31049614d8cb24062fe77c76c8e30)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a bug fix release in the stable 2.36 series.
What’s new in the WebKitGTK 2.36.5 release?
- Add support for PAC proxy in the WebDriver implementation.
- Fix video playback when loaded through custom URIs, this fixes video playback in the Yelp documentation browser.
- Fix WebKitWebView::context-menu when using GTK4.
- Fix LTO builds with GCC.
- Fix several crashes and rendering issues.
(From OE-Core rev: c13a40b162fba43f167e5841f6cd15c2c1ed1ab6)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 31e57deaed0fd46396d22dd6fcb75e955c1aa2f6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
What’s new in libwpe 1.12.1?
- Fix pasteboard to use the generic interface by default.
- Fix memory allocation to always abort execution on failure.
What’s new in libwpe 1.12.1?
- Fix pasteboard to use the generic interface by default.
- Fix memory allocation to always abort execution on failure.
(From OE-Core rev: 89feb5d2c39bf6b01f996bba522948ebb99863c7)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 03b7bfb0f011ba812808fa353611178cd5618e81)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes:
Fix the new ATSPI accessibility implementation to add the missing Collection interface for the loaded document.
Fix the MediaSession implementation to make the MPRIS object names more sandbox friendly, which plays better with Flatpak and WebKit’s own Bubblwrap-based sandboxing.
Fix leaked Web Processes in some particular situations.
Fix the build with media capture support enabled.
Fix cross-compilation when targeting 64-bit ARM.
Fix several crashes and rendering issues.
(From OE-Core rev: fde20b5b6bb030b6c5538938ac9a6e178576d9dd)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2396f8de9b6b9690dd70961084514da7d237f2ad)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a bug fix release in the stable 2.36 series.
Support capturing already encoded video streams, which takes advantage of encoding done in hardware by devices which support this feature.
Avoid using experimental GStreamer elements for video demuxing.
Avoid using the legacy GStreamer VA-API decoding plug-ins, which often cause rendering issues and are not much maintained. Their usage can be re-enabled setting WEBKIT_GST_ENABLE_LEGACY_VAAPI=1 in the environment.
Fix playback of YouTube streams which use dynamic ad insertion.
Fix display capture with Pipewire.
Fix the build without the X11 target when X11 headers are not present.
Fix several crashes and rendering issues.
(From OE-Core rev: 4e5437696e422631a1ae042f18412461242ef62e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 69e1c72417a4ea5594c17ead7bff2f9a0298e6c5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the first bug fix release in the stable 2.36 series.
What’s new in the WebKitGTK 2.36.1 release?
- Fix the build with accessibility disabled.
- Fix several crashes and rendering issues.
- Translation updates: Croatian.
(From OE-Core rev: cf336712afc3899ef45c7f2ef5f6b081223a1269)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4ed608d33fe5f38bc172e0cc6d938ffab184a47a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The renaming left a broken desktop file behind (the others are overwritten).
Fix this by removing it.
(From OE-Core rev: 60925ef384f8c9966499b0d7e67927f1906be495)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There was no icon being displayed for this, fix the name so that
is corrected.
(From OE-Core rev: 3bf3d123e1c62d1811039328f1f557ae35dec3fd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes build issues seen on mips, but problem is generic
(From OE-Core rev: 08c06980648d3f72cddbf62a96d6915f5d54b94e)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop patches:
0001-Fix-racy-parallel-build-of-WebKit2-4.0.gir.patch
0001-When-building-introspection-files-add-CMAKE_C_FLAGS-.patch
(both merged upstream)
reduce-memory-overheads.patch
(rejected by upstream, there's no use case - see the discussion)
Rebase to version submitted upstream:
0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch
Add:
0001-When-building-introspection-files-do-not-quote-CFLAG.patch
angle is no longer needed for x11-less setups.
(From OE-Core rev: 05582e9e6583126879977b0bbb88b691d625056b)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This ensures that platforms not implementing GL ( perhaps only providing
GLES ) are able to build webkit
(From OE-Core rev: 1117a5521e18dd6f7c18c22c87fe00e867f906d7)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ANGLE's copy of khrplatform.h is not uptodate with mesa/khronos khrplatform.h
which uses MESA_EGL_NO_X11_HEADERS which is now renamed in newer headers to
EGL_NO_X11 from mesa/khronos headers, however this define is
relatively new and 3D stacks do not have this adopted but apps
like qemu and bunch of others depend on it, I guess they assume mesa.
One can argue that its better to fix the 3D stacks to behave
like mesa but this means every BSP using these stacks will need to
carry such a fix.
https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/include/EGL/eglplatform.h
This patch helps with that
(From OE-Core rev: 4f6b987705a624da3304cb559b885c4352f9b517)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In commit ceda3238 (meta/meta-selftest/meta-skeleton: Update LICENSE
variable to use SPDX license identifiers) all LICENSE variables were
updated to only use SPDX license identifiers.
This does the same for comments and other variables where it is
appropriate to use the official SPDX license identifiers. There are
still references to, e.g., "GPLv3", but they are then typically in
descriptive text where they refer to the license in a generic sense.
(From OE-Core rev: 165759dced7fbe73b1db2ede67047896071dc6d0)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has first accepted, then reverted this change,
so this needs to be re-submitted, after verifying that it is
still relevant.
(From OE-Core rev: 389ac5f324d231525776456a64c5aaf32a6a4858)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Portions of it were then further refactored upstream, leading
to some bits of the patch dropped and some re-applied on a
automated version upgrade.
(From OE-Core rev: d9de00cd5228d42f628af455ad42c06a0883f6d0)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update webkitgtk from 2.34.4 to 2.34.5. It fixes CVE-2022-22589,
CVE-2022-22590 and CVE-2022-22592 in 2.34.5 according to
https://webkitgtk.org/security/WSA-2022-0002.html
And fix indentation as well.
CVE: CVE-2022-22589
CVE: CVE-2022-22590
CVE: CVE-2022-22592
(From OE-Core rev: 775e3e4ca357bd11ec77cd01ca072c6adca89173)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Compiling code is memory-intensive, especially kernel modules like the
SystemTap probes, so give the VM 768MB of RAM. Using 1GB appears to
cause PCI error, interestingly.
Hopefully this solves the intermittent failures caused by OOMs during
the SystemTap test.
[ YOCTO #14673 ]
(From OE-Core rev: 50ff1f018a670c963e1979dee76ebd696153b4c1)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When the date rolled from one year to another this highlighted a reproducibility
issue. This could be better fixed by using SOURCE_DATE_EPOCH from the environment
but I'm not sure how you do that in ruby. Help from someone with that knowledge
to submit that upstream very welcome.
(From OE-Core rev: 4d561c98f4d2e68d595aae4b03df1420cb01c3f7)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It is a dependency of new rxvt-unicode.
(From OE-Core rev: 57e257922c6da75376723b0088c677b13856d42f)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This upgrades to the latest upstream version where our fixes have equivalent
fixes merged upstream so our patches are no longer needed.
(From OE-Core rev: 987077008c89a9086247d5bcdf35aef7413fb954)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adds a PACKAGECONFIG option to use libsoup2 instead of libsoup3.
Including libsoup2 and libsoup3 in the same process can cause strange
runtime failures, and the latest release of each major version will
cause the process to exit if both are detected on startup.
The default is changed from libsoup3 back to libsoup2. Most GNOME
packages are still using libsoup2, and a large number of these pull in
webkitgtk either directly or indirectly. If webkitgtk uses libsoup3,
this causes all of these packages to fail at startup. It appears that
most GNOME packages will have to switch to libsoup3 when they transition
to GTK4.
(From OE-Core rev: deedca6bee5c90e35a7814b04bc5de03de9f9b1d)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>