Adds patch to backport fix for CVE-2025-5914.
(From OE-Core rev: ba5c5ca00d31d6440a1d810f7ef19720019845e8)
Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Backport patch for this CVE and also patch for its regression.
(From OE-Core rev: 0d880cdb51e47f78387b63063727fe6df1b009e6)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
https://github.com/libarchive/libarchive/releases/tag/v3.7.9
Libarchive 3.7.9 is a bugfix release
Important bugfixes:
* a regression in libarchive 3.7.8 regarding GNU sparse entries was fixed (#2558)
Also remove CVE_STATUS which was obsolete already before this upgrade.
(From OE-Core rev: 670f3fa028f3e873acf4c5265d3f5e4a3aa0ec89)
(From OE-Core rev: 5219998cde17542ae02622de29c5b4a1258772b2)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
CVE-2025-47268
ping in iputils through 20240905 allows a denial of service (application
error or incorrect data collection) via a crafted ICMP Echo Reply
packet, because of a signed 64-bit integer overflow in timestamp
multiplication.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47268
Patch from:
070cfacd73
(From OE-Core rev: 59f0d3befe0c828bdc16664af1f8b64b7f3911e7)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
When unzip-native is somehow introduced indirectly into the dependency
chain, then we get buildpath QA issue. Pass a similar value as the ZIP
to fix this issue.
(From OE-Core rev: 8d4987cf652c9844d93000fb012dc09eebcf9fcc)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
man utility calls col utility internally when formatting is asked for
therefore it expects col to be in rootfs otherwise silently errors with
retcode 3 meaning 'file not found' in this case its due to col not being
found, other distros eg. gets this via bsdextrautils dependency
Add it via packageconfig and keep is disabled by default since its
deprecated and col does not exist on musl
libssh2 ptest mansyntax.sh fails due to this error, which now works
(From OE-Core rev: bf5c8801b471fa13df9d55932375bfaedb623bd0)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
gperf needs to be ported to work with C23 standard
especially around getopt function signatures
(From OE-Core rev: 27c869a671632d4cfeb26585b23b37d3a06066be)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC 15 is coming with C23 as default and code is not ready for C23
(From OE-Core rev: 9b8b9ebc7583f82dfee532dc1998c005a0c254c2)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The code defines a custom 'bool' type (as an 'int'), which is incompatible
with C23 in which bool is a keyword, and trying to use <stdbool.h> fails
because 'int' and 'bool' are used interchangeably in the code.
Add the flag to CC variable, since CFLAGS is used by both c and c++ compilers
and clang++ is less forgiving when C compiler only option is used on its
cmdline so it complains about -std=gnu17 and bails out.
(From OE-Core rev: 49657089ef215824f8f79a81deb7baf4f27d0030)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
part of getopt.c is used in non-glibc libraries needs
attention when compiling with gcc-15
(From OE-Core rev: 01e7393565037119602a789ff02bf9f2e6b07b4d)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This upgrade includes fix for CVE-2024-57970, CVE-2025-25724 and
CVE-2025-1632
Changelog:
==========
Libarchive 3.7.8 is a bugfix and security release
Security fixes:
tar reader: Handle truncation in the middle of a GNU long linkname (#2422, CVE-2024-57970)
unzip: fix null pointer dereference (#2532, CVE-2025-1632)
tar reader: fix unchecked return value in list_item_verbose() (#2532, CVE-2025-25724)
Important bugfixes:
7zip reader: add SPARC (#2399) and POWERPC (#2459) filter support for non-LZMA compressors
tar reader: Ignore ustar size when pax size is present (#2405)
tar writer: Fix bug when -s/a/b/ used more than once with b flag (#2435)
cpio: Fix a Y2038 bug on Windows (#2471)
libarchive: Handle ARCHIVE_FILTER_LZOP in archive_read_append_filter (#2519)
libarchive: Adding missing seeker function to archive_read_open_FILE() (#2539)
(From OE-Core rev: 861d6a37e9457510e526c7cd5a63c82d9c48b591)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
_nl_msg_cat_cntr is not defined in libintl on musl systems
therefore add configure time check for it and use it to guard
the use of _nl_msg_cat_cntr
(From OE-Core rev: 0e9bc9620f992371b08ff1aef202d0d4737b9dd6)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix function prototypes for C23 to work
(From OE-Core rev: 2bdb276345b4b40be53d818116f71851e45cd1b1)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is in conflict with signature from system time.h
extern time_t mktime (struct tm *__tp) __THROW;
GCC-15 with C23 on, this is treated at error
posixtm.c:45:8: error: conflicting types for 'mktime'; have 'time_t(void)' {aka 'long int(void)'}
| 45 | time_t mktime ();
| | ^~~~~~
|
config.h is local include file to use quotes to include it
(From OE-Core rev: afc888d87fbf268c43bbcc81aa378eb9d58397a8)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes build with GCC-15 which is defaulting to C23
(From OE-Core rev: c4978268a4714466ecdec14d865a61adc47f3b3b)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC 15 has switched to C23 by default and tcp-wrappers is old code
pre-c99 and would need to be fixed all around to get to work in C23
(From OE-Core rev: 0a532f07eb54b7f66be25a0f9584581ab693b21c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC 15 defaults to C23 and bash is not yet ready for that
so keep using C17 like GCC 14 for now
(From OE-Core rev: aa9ac09aa7b8d4bd4427dbb26ae595b97b60da2f)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It removes the installation of ptest cases when upgrade libpam to 1.7.0.
Add them back to make ptest work. And 2 more cases in libpam 1.7.0.
(From OE-Core rev: ba8266267b4a89285bba0fceeaa1507957d318fb)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
mdadm doesn't use autotools at all:
- do_configure does nothing as it can't find configure.ac or configure
- do_compile is overridden to pass SYSROOT
- do_install is overridden but still calls autotools_do_install (which
is just 'make install DESTDIR=$D') and then appended.
Clean this up by passing SYSROOT and STRIP in EXTRA_OEMAKE, removing the
now-obsolete do_compile(), and merging the do_install()s.
(From OE-Core rev: a43888fda9aedaa5ac13d298644aedbf4134165d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: Upstream moved the GPLv3 text to the COPYING file as the main
license. Our LICENSE field remains correct though and the main license and
the library license remain unchanged.
61ee87ee22
(From OE-Core rev: 7f17e23a358bb0181e440a4ecf82e71bd938103b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Swap static link removal patch to a backport of upstream, remove autotools
usage (this is just a Makefile recipe), fix up metadata.
Changes:
Dimitry Andric (1):
Fix clang 15 -Wstrict-prototypes warnings
Drew DeVault (2):
README.md: mention system packages
Update version to 1.11.3
Eli Schwartz (2):
remove useless re-declarations of standard functions
get rid of some unused includes
Humm (3):
use .PP for paragraph breaks
scdoc(1), scdoc(5): follow conventions more closely
simplify list output
Max Schillinger (1):
fix formatting of escaped backticks
Simon Branch (2):
scdoc.5: fix capitalization of subsection headers
scdoc.5: fix formatting in the preamble
Simon Ser (1):
man: add section about SOURCE_DATE_EPOCH
jturtle (1):
Emit '\e' instead of '\\'
(From OE-Core rev: a57fa257b4e64a790ee649661c0a386803acf0a5)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
scdoc is a simple man page generator for POSIX systems written in C99.
(From OE-Core rev: 00c9683ae5ca5dd2d4490caa7a408a1a04a60f13)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update declarations to allow building with gcc-15 with C23 std
being default now.
Fixes:
error: conflicting types for 'xdr_opaque_auth
(From OE-Core rev: 567faa5515fc314e2c251c8ee14fe8e4186a3d97)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
============
- Build system:
- PDF book:
- Add support for UNIX V10 sources.
- Makefiles:
- Don't pass an escaped # to grep(1). Use a trick to work with
both new and old systems. This fixes a regressions in the
build system from man-pages-6.11, which was itself introduced
while fixing a regression introduced in man-pages-6.10.
[RP: Tweak version typo in commit message]
(From OE-Core rev: d19fcc6885521d5ec41a32938299b4cc016c0030)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
shadow-update-pam-conf.patch
refreshed for 4.17.3
[RP: One of the utilities, chage was dropped from pam]
(From OE-Core rev: f6fc7a8a786edc133e7be5a99d182f6adad02916)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The kernel/kvm test uses the host objcopy when building a payload, but
the host objcopy might not know how to deal with target binaries:
CC testcases/kernel/kvm/lib_host.o
objcopy: Unable to recognise the format of the input file `kvm_svm03-payload.elf'
make[3]: *** [ltp/testcases/kernel/kvm/Makefile:67: kvm_svm03-payload.o] Error 1
Solve this by using the host-prefixed objcopy binary.
(From OE-Core rev: 74818f79bd9a206f77ae3d26b19657116fd956cc)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Spamming the build host's syslog with useradd information during image creation
isn't great. Add a patch to disable that.
It may be possible to convince upstream to make it a configure option but for
now the patch is trivial and reduces host impact to the logs.
(From OE-Core rev: a52572886e60e4aff9d54b57bf45a301e1dec1ee)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Drop 0001-sched_attr-Do-not-define-for-glibc-2.41.patch as it has been
merged upstream.
* Skip statmount02 case which does not work on musl.
(From OE-Core rev: 5d72185e65aa0d9012913d9d095caceada7799d7)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bulk of these recipes used acpaths to work around argument list
limits as we passed the full path to every directory. As this behaviour
no longer happens we can remove these workarounds.
(From OE-Core rev: c4336f1b0da981b3ea396b17779b67898bceccef)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
